JP6261933B2 - Broadcast communication cooperative receiver and broadcast communication cooperative system - Google Patents

Description

  The invention of the present application is a broadcast communication cooperation system using broadcast and a communication network such as the Internet, a dedicated IP (Internet Protocol) line, etc., for each application, application activation control in consideration of the activation range and link range, The present invention relates to a technology for performing resource access control.

  In recent years, various services that link broadcasting and communication (hereinafter referred to as “broadcast communication cooperation service”) have been studied along with digitization of broadcasting and high-speed / broadband communication (for example, see Non-Patent Documents 1 and 2). ). In this broadcasting / communication cooperation service, it is assumed that various information related to broadcasting programs are acquired via a communication network and presented in combination with broadcasting. In addition, in order to enjoy the broadcasting / communication cooperation service, the receiver is assumed to use an application adapted to the broadcasting / communication cooperation service.

  The broadcasting / communication cooperation system provides a new service by taking advantage of the characteristics of broadcasting and communication, and various web applications such as HTML (HyperText Markup Language) 5 are executed by the receiver in conjunction with broadcasting. Realize service. In this system, in order to provide attractive services to viewers, not only applications created by broadcasters but also applications created by service providers other than broadcasters based on certain rules are given to viewers. An environment that can be provided is desired. On the other hand, as with data broadcasting in the current digital broadcasting, a mechanism for controlling the link range of the application is necessary from the viewpoint of broadcasting safety and publicity, such as preventing viewers from being guided to harmful sites. In particular, since an application created by a service provider other than a broadcaster may not necessarily be understood by the broadcaster, it is indispensable to set restrictions on the link range.

  Here, Non-Patent Document 3 proposes a linked application created by a broadcaster as a kind of application. This linked application is automatically activated and terminated in conjunction with the program broadcast on the viewing channel. In the technology described in Non-Patent Document 3, in order to perform start control, an application name, an application ID, a control command such as automatic start and forced end, and location information (URI: Uniform Resource) of an application distribution server. Identifier) is required. Therefore, the broadcaster uses broadcast waves to distribute application control information (AIT: Application Information Table) including these pieces of information in association with the organization channel. Furthermore, the broadcaster can control the link range of the application by including the “Simple application boundary descriptor” proposed in Non-Patent Document 4 in the AIT, as in the data broadcast in the current digital broadcast. .

  Non-Patent Document 5 proposes a resource access control technique when an application calls an API (Application Program Interface) for using broadcast resources and receiver resources. The technology described in Non-Patent Document 5 is a valid application created by a broadcaster, a valid application created by a service provider other than the broadcaster, or any other application depending on the application authentication result. The attribute is determined by the receiver. The technique described in Non-Patent Document 5 controls whether or not resource access is possible based on the attribute determination result. In other words, in the technique described in Non-Patent Document 5, the resource access permission list for each application attribute provided in the receiver is referred to in advance, and for example, resource access control of legitimate applications created by the service provider is collectively managed. can do.

“Overview of R & D on Broadcast and Communication Collaboration Technologies”, NHK STRL R & D, No. 133, 2012.5, P4-P9 “Hybridcast (R) basic system overview”, NHK R & D, No. 133, 2012.5, P10-P19 “Technology supporting Hybridcast (R)”, NHK R & D, No. 133, 2012.5, P20-P27 “Digital Video Broadcasting (DVB); Signaling and carriage of interactive applications and services in Hybrid broadcast / broadband environments”, ETSI TS 102 809 V1.1.1 (2010-01) "A Study on Access Control Method for Hybridcast Application", IEICE General Conference, B-7-34, 2012

  In data broadcasting in the current digital broadcasting, BML (Broadcast Markup Language) content can be arranged on an interactive web server. Therefore, the receiver can refer to and present the BML document (communication content) on the interactive web server. There are two types of communication content: a link state in which broadcast content can be referred to and a non-link state in which no broadcast content can be referenced. Here, when the broadcast content transits to the communication content below the specified URI (base URI directory), the link state is maintained. On the other hand, when any other URI is designated, the state transits to the unlinked state. Linked communication content behaves as one of the contents constituting a content group including broadcast content. On the other hand, communication content in an unlinked state behaves as an independent content group and cannot refer to broadcast resources such as video, audio, subtitles, data carousels, and event messages.

  Non-Patent Document 3 proposes a non-linked application that is also produced by a service provider other than the broadcaster. This unlinked application is activated and terminated by the user at an arbitrary timing. For example, the receiver acquires the application list from the server, and starts the non-linked application by selecting the non-linked application from a plurality of applications described in the application list. This application list includes location information (URI) of an application distribution server, and may be the application control information described above.

In other words, the non-linked application is not directly activated by the broadcast content, but acquires the location information of the distribution server via communication, so that the security level is lowered compared to the distribution by broadcast waves. Therefore, it is necessary to control activation by each application in consideration of the link range regardless of the type of application such as a linked application and a non-linked application.
Note that the link range refers to a range of URIs that can be referred to by the application when the application starts or transitions to a Web page.

  Further, with the technique described in Non-Patent Document 5, resource access control can only be performed for each application attribute. That is, in the technique described in Non-Patent Document 5, whether or not broadcast resources such as video, audio, subtitles, data carousels, and event messages, and communication resources such as video content and metadata can be used for each application. It is not possible to control resource access by granting finely.

Further, in the broadcasting / communication cooperation service, information and services by an application are presented in combination with a broadcast program. Therefore, from the viewpoint of broadcast safety and publicity, it is not preferable that the application can be activated regardless of the program channel of the broadcast program, and it is necessary to control activation by each application in consideration of the activation range. is there.
The activation range refers to the range of composition channels that can be activated when the application is activated.

  Accordingly, an object of the present invention is to provide a broadcasting / communication cooperation receiving apparatus and a broadcasting / communication cooperation system capable of solving the above-described problems and enabling access control to individual applications.

  In view of the above-described problems, the broadcasting / communication cooperation receiving apparatus according to the first invention of the present application is a certificate issuing apparatus that issues an application certificate to which one or more of activation range information or link range information is added. An application registration apparatus for adding or associating an application certificate with an application, an application server for storing an application to which an application certificate is added or associated, and a broadcast transmitting apparatus for transmitting a broadcast program via a broadcast wave , A broadcasting / communication cooperation receiving apparatus that receives a broadcast program, and includes an application acquisition unit, an extraction unit, an activation determination unit, and an activation control unit. To do.

  According to such a configuration, the broadcasting / communication cooperation receiving apparatus acquires the application to which the application certificate is added or associated from the application server via the network by the application acquisition unit.

The application for the certificate, the application is started range information indicating a possible organize ACTIVATE CHANNEL, or, one has only to be added in the link-scope information application indicates linkable U RI. Further, both the activation range information and the link range information may be added to the application certificate.

  In addition, the broadcasting / communication cooperation receiving apparatus extracts one or more of activation range information and link range information necessary for activation control of the application from the application certificate added to or associated with the application by the extraction unit.

  In the broadcast communication cooperative reception apparatus, the activation determination unit determines whether the acquired application can be activated based on one or more of the activation range information and the link range information extracted by the extraction unit. The broadcast communication cooperative receiving apparatus controls the activation of the application by the activation control unit based on the determination result of the activation determination unit.

  Moreover, in view of the above-mentioned subject, the broadcasting / communication cooperation receiving device according to the second invention of the present application provides access control file management for signing an access control file in which one or more of activation range information and link range information are stored. A device, an application registration device for adding or associating an access control file with an application, an application server for storing an application to which an access control file is added or associated, and a broadcast transmitting device for transmitting a broadcast program via broadcast waves A broadcasting / communication cooperation receiving apparatus that receives a broadcast program, and includes an application acquisition unit, an application authentication unit, an extraction unit, an activation determination unit, and an activation control unit. It is characterized by providing.

  According to such a configuration, the broadcasting / communication cooperation receiving apparatus acquires an application to which the access control file is added or associated from the application server via the network by the application acquisition unit. Also, the broadcasting / communication cooperation receiving apparatus verifies whether the signature of the access control file added to or associated with the application is valid by the application authentication unit.

  Also, the broadcasting / communication cooperation receiving apparatus extracts one or more of activation range information or link range information necessary for application activation control from the access control file whose signature is verified by the application authentication unit by the extraction unit. To do.

  In the broadcast communication cooperative reception apparatus, the activation determination unit determines whether the acquired application can be activated based on one or more of the activation range information and the link range information extracted by the extraction unit. The broadcast communication cooperative receiving apparatus controls the activation of the application by the activation control unit based on the determination result of the activation determination unit.

In the broadcast communication cooperative receiving device according to the third and fourth inventions of the present application, the extraction unit extracts at least the link range information from the application certificate or the access control file, and the activation determination unit becomes an application acquisition source. Link range determination means for determining whether or not the acquired application can be activated depending on whether or not the URI of the application server is included in the link range information.
According to such a configuration, the broadcasting / communication cooperation receiving apparatus can prevent activation of an application acquired from an application server outside the link range.

In the broadcast communication cooperative receiving device according to the fifth and sixth inventions of the present application, the extraction means extracts at least the activation range information from the application certificate or the access control file, and the activation determination means is the selected broadcast. It is characterized by comprising activation range determination means for determining whether or not the acquired application can be activated depending on whether or not the program channel is included in the activation range information.
According to such a configuration, the broadcasting / communication cooperation receiving apparatus can prevent the application from being activated when the viewer is viewing a channel outside the activation range.

When the broadcasting / communication cooperation receiving apparatus includes both the link range determination unit and the activation range determination unit, the activation control unit preferably determines the activation of the application as follows.
That is, the activation control unit activates the application when it is determined by both the activation range determination unit and the link range determination unit that the acquired application can be activated, and at least one of the activation range determination unit and the link range determination unit If it is determined that the acquired application cannot be started, the application is not started.

In the broadcast communication cooperative receiving apparatus according to the reference invention, an application certificate or an access control file is further added or stored with resource use range information indicating one or more resources that can be used by the application, and the extraction unit includes: Resource access control means for extracting resource usage range information from the application certificate or access control file and performing resource access control for prohibiting access to the resource for the acquired application based on the resource usage range information; Is further provided.
According to such a configuration, the broadcasting / communication cooperation receiving apparatus can prevent an application from accessing a resource outside the use range.

The broadcast communication cooperative receiving apparatus according to the seventh invention of the present application includes, as applications, application execution means for executing a Web application that transitions from a Web page to another Web page, and Web applications that are executed by the application execution means. Transition control means for inquiring to the link range determination means whether or not it is possible to make a transition to the Web page, and the link range determination means determines whether the link range information includes the URI of another Web page. If it is further determined whether or not the application can transition to another web page, and the transition control means determines that the web application cannot transition to another web page by the link range determination means, the end of the web application, or , To other web pages Characterized by instructing the transitions stop the application execution unit.
According to such a configuration, the broadcasting / communication cooperation receiving apparatus can prevent a running application from changing to a Web page outside the link range.

Further, in view of the above-described problems, the broadcast communication cooperative receiving apparatus according to the eighth invention of the present application includes a certificate issuing apparatus that issues an application certificate to which resource usage range information is added, and an application certificate as an application. A broadcast communication cooperation system including an application registration device to be added or associated, an application server that stores an application to which an application certificate is added or associated, and a broadcast transmission device that transmits a broadcast program via a broadcast wave A broadcasting / communication cooperation receiving device that is used and receives a broadcast program, and includes an application acquisition unit, an extraction unit, and a resource access control unit.

According to such a configuration, the broadcasting / communication cooperation receiving apparatus acquires the application to which the application certificate is added or associated from the application server via the network by the application acquisition unit.
This application for the certificate, the application resource usage range information indicating a resource is added available.

  In addition, the broadcasting / communication cooperation receiving apparatus extracts resource usage range information necessary for resource access control from the application certificate added to or associated with the application by the extracting unit. Then, the broadcasting / communication cooperation receiving device performs resource access control for prohibiting access to the resource for the acquired application based on the resource use range information by the resource access control means.

In view of the above-described problems, the broadcasting / communication cooperation system according to the ninth invention of the present application issues a certificate issuance for issuing an application certificate to which start range information, link range information, and resource use range information are added. Broadcast transmission for transmitting a broadcast program via broadcast waves, an application registration device for adding or associating an application certificate with an application, an application server for storing an application to which an application certificate is added or associated, and a broadcast wave A broadcasting / communication cooperation receiving system including an apparatus and a broadcasting / communication cooperation receiving device that receives a broadcasting program, wherein the broadcasting / communication cooperation receiving device includes an application acquisition unit, an extraction unit, an activation range determination unit, and a link range determination. Means, activation control means, and resource access control means It is characterized in.

  According to such a configuration, the broadcasting / communication cooperation receiving apparatus acquires the application to which the application certificate is added or associated from the application server via the network by the application acquisition unit.

The certificate for this application, launch range information and an application and link range information indicating a linkable U RI is resource use range information indicating application resources available to application shows a possible organize ACTIVATE CHANNEL And are added.

  In addition, the broadcasting / communication cooperation receiving apparatus uses the extraction unit to add the activation range information and link range information necessary for the activation control of the application and the resources necessary for the resource access control from the application certificate added to or associated with the application. Extract usage range information.

  Also, the broadcast communication cooperative receiving apparatus determines whether or not the acquired application can be activated by the activation range determining means, based on whether or not the broadcast channel organization channel of the selected broadcast program is included in the activation range information. Then, the broadcast communication cooperative receiving apparatus determines whether or not the acquired application can be activated by the link range determination unit based on whether or not the URI of the application server that is the acquisition source of the application is included in the link range information.

  In the broadcast communication cooperative reception apparatus, the activation control unit controls the activation of the application based on the determination results of the activation range determination unit and the link range determination unit. Then, the broadcasting / communication cooperation receiving device performs resource access control for prohibiting access to the resource for the acquired application based on the resource use range information by the resource access control means.

In view of the above-described problems, the broadcast communication cooperative receiving apparatus according to the reference invention adds or associates an access control file management apparatus for signing an access control file in which resource usage range information is stored and an access control file to an application. Broadcast and communication use system including an application registration apparatus, an application server that stores an application to which an access control file is added or associated, and a broadcast transmission apparatus that transmits a broadcast program via a broadcast wave. A broadcasting / communication cooperation receiving apparatus for receiving a program, comprising: an application acquisition unit, an application authentication unit, an extraction unit, and a resource access control unit.

  According to such a configuration, the broadcasting / communication cooperation receiving apparatus acquires an application to which the access control file is added or associated from the application server via the network by the application acquisition unit. Also, the broadcasting / communication cooperation receiving apparatus verifies whether the signature of the access control file added to or associated with the application is valid by the application authentication unit.

  Also, the broadcasting / communication cooperation receiving apparatus extracts the resource use range information necessary for resource access control from the access control file whose signature is verified by the application authenticating means by the extracting means. Then, the broadcasting / communication cooperation receiving device performs resource access control for prohibiting access to the resource for the acquired application based on the resource use range information by the resource access control means.

  Moreover, in view of the above-described problem, the broadcasting / communication cooperation system according to the tenth invention of the present application is an access control file management for signing an access control file in which start range information, link range information, and resource use range information are stored. A device, an application registration device for adding or associating an access control file with an application, an application server for storing an application to which an access control file is added or associated, and a broadcast transmitting device for transmitting a broadcast program via broadcast waves A broadcasting / communication cooperation receiving system that receives a broadcasting program, wherein the broadcasting / communication cooperation receiving device includes an application acquisition unit, an application authentication unit, an extraction unit, an activation range determination unit, A link range determination means, an activation control means, Characterized in that it comprises a chromatography scan access control means.

  According to such a configuration, the broadcasting / communication cooperation receiving apparatus acquires an application to which the access control file is added or associated from the application server via the network by the application acquisition unit. Also, the broadcasting / communication cooperation receiving apparatus verifies whether the signature of the access control file added to or associated with the application is valid by the application authentication unit.

  In addition, the broadcasting / communication cooperation receiving apparatus is necessary for starting access range information and link range information necessary for starting control of an application and for resource access control from an access control file whose signature is verified by the application authenticating means by the extracting means. Resource usage range information is extracted.

  Also, the broadcast communication cooperative receiving apparatus determines whether or not the acquired application can be activated by the activation range determination unit based on whether or not the channel range of the selected broadcast program is included in the activation range information. . Then, the broadcast communication cooperative receiving apparatus determines whether or not the acquired application can be activated by the link range determination unit based on whether or not the URI of the application server that is the acquisition source of the application is included in the link range information.

  In the broadcast communication cooperative reception apparatus, the activation control unit controls the activation of the application based on the determination results of the activation range determination unit and the link range determination unit. Then, the broadcasting / communication cooperation receiving device performs resource access control for prohibiting access to the resource for the acquired application based on the resource use range information by the resource access control means.

According to the present invention, the following excellent effects can be obtained.
According to the first invention of this application, the broadcasting / communication cooperation receiving apparatus can extract one or more of activation range information and link range information necessary for application activation control from the application certificate. Access control (application activation control considering at least one of the activation range and the link range) can be performed.

  According to the second invention of the present application, the broadcasting / communication cooperation receiving apparatus can extract one or more of activation range information and link range information necessary for activation control of the application from the access control file. Access control (application activation control in consideration of at least one of the activation range and the link range) can be performed.

According to the third and fourth aspects of the present invention, the broadcasting / communication cooperation receiving apparatus can prevent the application acquired from the application server outside the link range from being activated.
According to the fifth and sixth aspects of the present invention, the broadcasting / communication cooperation receiving apparatus can prevent the application from being activated when the viewer is viewing a channel outside the activation range.
According to the reference invention, the broadcasting / communication cooperation receiving apparatus can prevent an application from accessing a resource outside the use range.
According to the seventh aspect of the present invention, the broadcast-communication cooperative receiving apparatus can prevent the running application from changing to a Web page outside the link range.

According to the eighth invention of the present application, the broadcasting / communication cooperation receiving apparatus can extract the resource use range information necessary for resource access control from the application certificate, and therefore, access control for each application (resource access control). It can be performed.

According to the ninth aspect of the present invention, the broadcasting / communication cooperation system can extract the activation range information and link range information necessary for application activation control and the resource usage range information necessary for resource access control from the application certificate. . Therefore, according to the ninth aspect of the present invention, the broadcasting / communication cooperation system can perform access control (application start control and resource access control in consideration of the start range and link range) for each application.

According to the reference invention, the broadcasting / communication cooperation receiving apparatus can extract resource use range information necessary for resource access control from the access control file, and therefore performs access control (resource access control) for each application. Can do.

  According to the tenth aspect of the present invention, the broadcasting / communication cooperation system can extract activation range information and link range information necessary for application activation control and resource usage range information necessary for resource access control from the access control file. Therefore, according to the tenth aspect of the present invention, the broadcasting / communication cooperation system can perform access control (application start control and resource access control in consideration of the start range and link range) for each application.

It is the schematic which shows the whole structure of the broadcast communication cooperation system which concerns on 1st Embodiment of this invention. FIG. 2 is a block diagram showing a configuration of an ID / signature key / certificate issuing device in FIG. 1. FIG. 3 is a diagram showing a data structure of a certificate issued by the ID / signature key / certificate issuing device of FIG. 2. It is a figure explaining the description format of the starting range information of FIG. It is a figure explaining the description format of the link range information of FIG. It is a figure explaining the description format of the resource utilization range information of FIG. It is a figure which shows the data structure of the resource access restriction information of FIG. It is a block diagram which shows the structure of the application registration apparatus of FIG. It is a block diagram which shows the structure of the receiver of FIG. It is a figure which shows the data structure of the starting range information table which the receiver of FIG. 9 memorize | stores. FIG. 10 is a diagram illustrating a data structure of a link range information table stored in the receiver of FIG. 9. FIG. 10 is a diagram illustrating a data structure of a resource access control table stored in the receiver of FIG. 9. It is a sequence diagram which shows operation | movement of the broadcast communication cooperation system of FIG. It is the schematic which shows the whole structure of the broadcast communication cooperation system which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the structure of the access control file management apparatus of FIG. It is a block diagram which shows the structure of the application registration apparatus of FIG. It is a block diagram which shows the structure of the receiver of FIG. It is a sequence diagram which shows operation | movement of the broadcast communication cooperation system of FIG. It is a sequence diagram which shows operation | movement of the broadcast communication cooperation system of FIG. It is the schematic which shows the whole structure of the broadcast communication cooperation system which concerns on the modification 3 of this invention.

(First embodiment)
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings as appropriate. In each embodiment, means having the same function and the same step (process) are denoted by the same reference numerals, and the description thereof is omitted.

[Overall configuration of broadcasting / communication cooperation system]
With reference to FIG. 1, the structure of the broadcast communication cooperation system 1 which concerns on 1st Embodiment of this invention is demonstrated.
The broadcasting / communication cooperation system 1 links broadcasting and communication, and provides various services to users (viewers) together with broadcasting programs. Specifically, the broadcasting / communication cooperation system 1 transmits a broadcast program to a broadcasting / communication cooperation receiver (receiver) 80 via a broadcast wave, and receives applications adapted to various services via a network. To the machine 80. Then, the broadcasting / communication cooperation system 1 provides various services related to the broadcast program to the user by the application in the receiver 80. At this time, the broadcasting / communication cooperation system 1 performs safe access control for each application in the receiver 80.

  The access control means that the receiver 80 performs one or more of application activation control in consideration of the activation range, application activation control in consideration of the link range, and resource access control. In the present embodiment, the receiver 80 will be described as performing all these three controls.

The “application” is software that can be used by the receiver 80, including software that operates on a browser of HTML (HyperText Markup Language) 5. In the present embodiment, it is assumed that the application is a Web application that makes a transition from the displayed Web page to another Web page.
The application may be abbreviated as “application”.

A “broadcast station” is a program that sends a program with composition, and distributes a broadcast program to users (viewers) by broadcast waves or a network.
A “service provider” provides a service, and creates and distributes content and an application for providing the service.
A “license institution” issues a license (certificate) of an application to a service provider.

  As shown in FIG. 1, the broadcasting / communication cooperation system 1 includes a CA station 10, a broadcast transmitting device 20, an ID / signature key / certificate issuing device (certificate issuing device) 30, an application registration device 40, an application A production apparatus 50, a content distribution server 60, an application server 70, and a receiver 80 are provided.

In response to the certificate issuance application from the license authority, the CA station 10 obtains a root certificate C _CA (hereinafter “certificate C _CA ”) and an intermediate certificate C _L (hereinafter “certificate C _L ”). And a license authority signature key S _L (hereinafter referred to as “signature key S _L ”).

Here, the CA station 10 performs a root signature key S _CA (hereinafter “signature key S _CA ”) and a root verification key P _CA (hereinafter “signature key S _CA ”) by a general public key cryptosystem such as DSA, RSA, and elliptic curve. A key pair with “verification key P _CA ”) is generated. For example, the CA station 10 generates only one pair of the signature key S _CA and the verification key P _CA. Then, the CA station 10 stores the verification key P _CA in the certificate C _CA and issues it to the broadcast station (broadcast transmitter 20). On the other hand, the signature key S _CA is stored and managed by the CA station 10.

Further, the CA station 10 generates a key pair of the signature key S _L and the license authority verification key P _L (hereinafter “signature key P _L ”) by the public key cryptosystem described above. For example, the CA station 10 generates a signature key S _L and a verification key P _L for each license authority (in this embodiment, a pair of the signature key S _L and the verification key P _L is generated). Then, the CA station 10 stores the verification key P _L in the certificate C _L , generates a signature of the certificate C _L using the signature key S _CA, and adds the signature to the certificate C _L. Further, the CA station 10 issues a certificate _CL to the broadcasting station (broadcast transmission apparatus 20) and issues a signature key _SL to the license institution (ID / signature key / certificate issuing apparatus 30).
Since the CA station 10 has a general configuration, a detailed description thereof is omitted.

The broadcast transmission apparatus 20 is managed by a broadcast station and transmits a broadcast program to the receiver 80 via a broadcast wave. The broadcast transmitting apparatus 20, the DSM-CC (Digital storage media command and control) data carousel like transmission means, certificates issued _C CA at the CA 10, and transmits the _{C L} to a receiver 80.

In addition, although the broadcast transmission apparatus 20 demonstrates in the form which transmits a broadcast program as a broadcast wave, you may transmit via a cable (not shown) or a network.
Moreover, since the broadcast transmission apparatus 20 is a broadcasting facility for digital broadcasting comprised of a general program organization facility, a program transmission facility, a transmission facility, etc., detailed description thereof is omitted.

The ID / signature key / certificate issuing device 30 is managed by a license institution, and in response to an application ID application from a service provider, an application ID and an application signature key S _B (hereinafter, “signature key S _B ”). ) And an application certificate C _B (hereinafter, “certificate C _B ”) are issued to the service provider (application registration apparatus 40).
The configuration of the ID / signature key / certificate issuing device 30 will be described later.

Application registration device 40 is managed by the service provider, from the Licensing Authority (ID · signature key and a certificate issuing device 30), in which the application ID, the signature key S _B, and a certificate C _B is issued is there. The application registration unit 40 generates a signature by the signature key S _B. Furthermore, the application registration unit 40, the input from the application producing unit 50 to be described later application, is intended to add an application ID, a signature by the signature key S _B, and a certificate C _B.
The configuration of the application registration device 40 will be described later.

The application production device 50 is a development environment for producing an application. Here, the application creation apparatus 50 can create an application by installing an SDK (Software Development Kit) provided by a broadcasting station or a license institution.
The application production apparatus 50 has a general configuration, and thus detailed description thereof is omitted.

The content distribution server 60 is managed by a service provider, and provides content to the receiver 80 via a network in response to a request from an application of the receiver 80. Examples of the content distribution server 60 include a VOD (video on demand) distribution server, a caption distribution server, and a multi-view distribution server.
Since the content distribution server 60 has a general configuration, detailed description thereof is omitted.
In FIG. 1, the solid line indicating content distribution from the content distribution server 60 to the receiver 80 is omitted for easy viewing of the drawing.

The application server 70 is a server that stores and manages applications created by service providers. In response to a request from the receiver 80, the application server 70 transmits the application to the receiver 80 via the network.
Since the application server 70 has a general configuration, detailed description is omitted.

The receiver 80 is, for example, a receiving device that is installed in each user's home, can watch broadcast programs such as terrestrial digital broadcasting, BS digital broadcasting, and data broadcasting, and can receive applications via a network. . The receiver 80 includes a boot range information from the certificate C _B that is added to the application, and link range information, extracts the resource usage range information, and the startup control of the application in consideration of the start range and link range, Perform resource access control.

Since the receiver 80 controls the acquisition, activation, termination, and the like of the application based on the application activation information, an outline of the application activation information will be described.
The “application activation information” is information for identifying an application such as an application identifier (ID), an application location, and additional information for controlling the application (application information table: AIT ( Information corresponding to Application Information Table). In other words, the application activation information includes location information (URI) of the application server 70 from which the application is acquired.

[Configuration of ID / signature key / certificate issuing device]
The configuration of the ID / signature key / certificate issuing device 30 will be described with reference to FIG. 2 (see FIG. 1 as appropriate).
As shown in FIG. 2, the ID / signature key / certificate issuing device 30 includes a signature key input unit 301, an application ID generation unit 302, a signature key / verification key generation unit 303, a certificate generation unit 304, Certificate management means 305 and signature key management means 306 are provided.

Signature key input unit 301 is for signature key _{S L} is input from the CA 10. Then, the signature key input unit 301 outputs the input signature key _SL to the certificate generation unit 304.

  The application ID generation unit 302 generates an application ID added to the application. For example, the application ID generation unit 302 generates an application ID according to a preset naming convention. In this naming convention, for example, the service ID of the service provider and a number that uniquely identifies the application within the service provider are used as the application ID. Then, the application ID generation unit 302 outputs the generated application ID to the certificate generation unit 304.

Signing key and verification key generation unit 303, signature key S _B and, verification key P _{B (hereinafter,} "verification key P _B") applications and generates a. Here, the signature key / verification key generation unit 303 generates a key pair of the signature key S _B and the verification key P _B by the public key encryption method similar to that of the CA station 10. Then, the signature key / verification key generation unit 303 outputs the generated verification key P _B to the certificate generation unit 304. Furthermore, the signature key and verification key generation unit 303 outputs the generated signature key S _B to the signature key managing unit 306.

Certificate generation means 304, and generates a certificate C _B to be added to the application. For example, as shown in FIG. Generating a certificate _{C B} conforming to 509.
Specifically, the certificate generation unit 304 adds the verification key P _B inputted from the signature key and verification key generation unit 303 in the certificate C _B. Furthermore, certificate generating means 304, the application ID input from the application ID generation unit 302 is added to the certificate _{C B.} Then, the certificate generation unit 304, for example, application creators, in accordance with the contents of the application, adds information identifying an application certificate C _B. Furthermore, certificate generating means 304, the startup range information, the link range information and resource utilization range information is added to the certificate C _B.
Incidentally, the license authorities, for example, for each Apu application, activation range information added to the certificate C _B, is set in advance the link range information and resource utilization range information.

Furthermore, the certificate generating unit 304, by using the signature key S _L that is input from the signature key input unit 301, the corresponding data as a signature based message to certificate C _B of the pre-signature certificate (FIG. 3), the signature Is generated. At this time, the certificate generation unit 304 can use a signature algorithm similar to the signature generation unit 403 (FIG. 8) described later. Then, the certificate generation unit 304 adds the application ID, the signature with the signature key S _L , and the name of the signature algorithm used to generate the signature with the signature key S _L to the certificate C _B to obtain a certificate. The data is output to the management unit 305.

<Specific example of certificate>
Referring to FIG. 3, the certificate generation unit 304 for example of generated certificate C _B, it will be described.
As shown in FIG. 3, among the data items of the pre-signature certificate, the version, serial number, and validity period (start, end) are ITU X. Detailed description will be omitted because the description is based on 509.
In the public key information of the pre-signature certificate, verification key P _B is stored, the name of the algorithm that generated the verification key P _B is described.
In the pre-signature certificate, the name of the license institution is described as the issuer, and the business ID (unique ID) of the license institution is described as the identifier of the issuer.
In the pre-signature certificate, the name of the service provider is described as the subject, and the service provider ID (unique ID) of the service provider is described as the identifier of the subject.
In the extension items of the pre-signature certificate, an application ID, application identification, start range information (start range), link range information (link range), and resource use range information (resource use range) are described. The
Then, the certificate C _B, in addition to each data item of the pre-signature certificate, a signature by the signature key S _L (license organization signing), the name of the signature algorithm used to generate the signature of the license authority Is stored.

<Description format of boot range information>
With reference to FIG. 4, the description format of starting range information is demonstrated.
As illustrated in FIG. 4, the activation range information includes descriptor_tag, descriptor_length, and boundary_extension_count as data items. In addition, the activation range information includes one or more sets of original_network_id, transport_stream_id, and service_id as data items.

In the descriptor_tag, a value indicating the activation range information (for example, “0x01”) is described in 8 bits.
In descriptor_length, the entire byte length of the data portion of the descriptor immediately following this data item is described in 8 bits.
In boundary_extension_count, the number of knitting channels stored in the activation range information is described in 8 bits.

In original_network_id, the original network identification corresponding to the organization channel is described in 16 bits.
In transport_stream_id, the transport stream identification corresponding to the composition channel is described in 16 bits.
In service_id, service identification corresponding to the organization channel is described in 16 bits.
That is, a set of original_network_id, transport_stream_id, and service_id represents one organized channel.

  Note that original_network_id, transport_stream_id, and service_id are defined in, for example, ARIB (Association of Radio Industries and Businesses) STD-B10.

<Description format of link range information>
With reference to FIG. 5, the description format of link range information is demonstrated.
As illustrated in FIG. 5, the link range information includes descriptor_tag, descriptor_length, and boundary_extension_count as data items. Further, the link range information includes one or more boundary_extension_lengths and one or more boundary_extension_bytes whose number is specified by boundary_extension_count as data items.

In descriptor_tag, a value indicating link range information (for example, “0x02”) is described in 8 bits.
In boundary_extension_byte, one or more URI character codes that can be linked to an application are described in binary format.

Since each data item of the link range information is the same as the “Simple application boundary descriptor” described in the following reference, detailed description is omitted.
Reference: “Digital Video Broadcasting (DVB); Signaling and carriage of interactive applications and services in Hybrid broadcast / broadband environments”, ETSI TS 102 809 V1.1.1 (2010-01)

<Description format of resource usage range information>
The description format of the resource usage range information will be described with reference to FIGS.
As illustrated in FIG. 6, the resource usage range information includes descriptor_tag, descriptor_length, and resource_access_control_data as data items.

In the descriptor_tag, a value indicating the resource usage range information (for example, “0x03”) is described in 8 bits.
In descriptor_length, the entire byte length of the data portion of the descriptor immediately following this data item is described in 8 bits.
In resource_access_control_data, as shown in FIG. 7, resource access restriction information is described in an 8-bit binary format.

  In this resource access restriction information, each bit is associated with a resource type, and the availability is determined for each resource type. In the example of FIG. 7, in the resource access restriction information, the first bit corresponds to the resource “video”, the second bit corresponds to the resource “audio”, and the third bit corresponds to the resource “caption”. The fourth bit corresponds to the resource “data: BML”. In the resource access restriction information, the fifth bit corresponds to the resource “program arrangement information: SI”, the sixth bit corresponds to the resource “VOD”, and the seventh bit corresponds to the resource “streaming”. The eighth bit corresponds to the resource “metadata”.

  When the bit corresponding to the resource type is “1”, the resource access restriction information indicates that the application can access the resource and use the resource. On the other hand, when the bit corresponding to the resource type is “0”, the resource access restriction information indicates that the application cannot access the resource and cannot use the resource.

Here, the resources are content elements and receiver resources necessary for the operation of the application, and examples thereof include broadcast resources, communication resources, and receiver resources.
This broadcast resource is a resource handled by a broadcast wave, and can include, for example, video, audio, caption, data: BML, program arrangement information: SI (Service Information).
Communication resources are resources handled in the network, and can include, for example, VOD, streaming, and metadata.
Furthermore, the receiver resource is a resource related to software and hardware of the receiver 80, and examples thereof include video / audio output processing, channel selection processing, memory, and storage.

In FIG. 7, whether each resource is classified as a broadcast resource or a communication resource is shown in parentheses (the same applies to FIG. 12).
In addition, although the resource access control information is in an 8-bit binary format, the resource access control information is not limited to this, and is defined according to the number of access control target resources.
Further, in the present embodiment, the certificate C _B, including extended field, for example, "CCITT Recommendation X.208: Specification of Abstract Syntax Notation One (ASN.1), 1988 (ASN.1: Abstract Syntax Notation One, The description language defined in ITU-T X.680-689) is used.

Returning to FIG. 2, the description of the configuration of the ID / signature key / certificate issuing device 30 will be continued.
Certificate management unit 305, stores the input from certificate generation unit 304 certificate C _B, and manages. The certificate management unit 305, depending on the application for the application ID from the service provider, the stored certificate C _B, and outputs to the application registration unit 40.

Signature key management unit 306, the signature key and a verification key stores the input signature key S _B from the generation unit 303 is configured to manage. The signature key managing unit 306, depending on the application for the application ID from the service provider, the stored signature key S _B, and outputs to the application registration unit 40.

[Configuration of application registration device]
The configuration of the application registration apparatus 40 will be described with reference to FIG. 8 (see FIG. 1 as appropriate).
As shown in FIG. 8, the application registration apparatus 40 includes an application input unit 401, a signature key input unit 402, a signature generation unit 403, a signature addition unit 404, a certificate addition unit 405, and an application output unit 406. Is provided.

  The application input unit 401 is used to input an application from the application creation apparatus 50. Then, the application input unit 401 outputs the input application to the signature generation unit 403 and the signature addition unit 404.

Signature key input unit 402 is for certificate and C _B from the license agency, and the signature key S _B is inputted. The signature key input unit 402 outputs the input signature key S _B to the signature generation unit 403. Furthermore, the signing key input unit 402 outputs the inputted certificate C _B in the certificate adding means 405.

Signature generating means 403, the signature key from the input means 402 is a signature key S _B is inputted, using the signature key S _B, and generates an application signature. For example, the signature generation unit 403 uses the binary code of the application input from the application input unit 401 as the signature source message that is the source of the application signature. Then, the signature generation unit 403 generates a signature for application by applying a signature algorithm (for example, DSA signature) to the signature source message, and outputs it to the signature addition unit 404.
Note that the signature generation unit 403 preferably applies the signature algorithm after converting the signature source message into data with a small capacity by using a hash function (for example, SHA-1 algorithm) for the signature source message.

That is, the signature generation unit 403 generates an application signature represented by the following equation (1). In this equation (1), Sig is an application signature, Signature_Ks is signature generation with a signature key S _B (private key), and Mes is a signature source message.
Sig = Signature_Ks (Mes) (1)

  The signature adding unit 404 adds the application signature input from the signature generation unit 403 to the application input from the application input unit 401. Then, the signature adding unit 404 outputs the application to which the application signature is added to the certificate adding unit 405.

Certificate adding means 405, the application entered from the signature adding unit 404 is for adding a certificate C _B input from the signature key input unit 402. The certificate adding means 405, an application certificate C _B is added, and outputs to the application output unit 406.

The application output unit 406 outputs (registers) the application input from the certificate addition unit 405 to the application server 70. In other words, application application output unit 406 is output a full application, the application ID, signature and application by signature key S _B, in which certificates and C _B are packaged.

[Receiver configuration]
The configuration of the receiver 80 will be described with reference to FIG. 9 (see FIG. 1 as appropriate).
As shown in FIG. 9, a receiver (broadcast communication cooperative receiver) 80 includes a broadcast receiving unit 801, a broadcast signal analyzing unit 802, a video / audio decoding unit 803, a data broadcast decoding unit 804, and a communication transmitting / receiving unit. 805, application activation information acquisition unit 806, application activation information storage unit 807, list control unit 808, application management / execution control unit 809, activation application identification information storage unit 810, application acquisition unit 811, application A storage unit 812, an application execution unit 813, an operation control unit 814, a composite display unit 815, a security management unit 816, and a resource management unit 821 are provided.

The broadcast receiving unit 801 receives broadcast data transmitted as a broadcast wave via the antenna A. This broadcast receiving means 801 receives and demodulates broadcast data, performs error correction and TMCC (Transmission and Multiplexing Configuration Control) decoding, etc., and outputs it to the broadcast signal analysis means 802 as an MPEG2 transport stream (TS). To do.
The broadcast receiving means 801 is not limited to receiving a broadcast signal by radio waves via the antenna A, and may be a means for receiving a broadcast signal via a cable.

  The broadcast signal analyzing unit 802 analyzes PSI / SI (Program Specific Information / Program Information) in the stream data (transport stream) demodulated by the broadcast receiving unit 801, Data such as video, audio, data broadcast, etc. corresponding to the selected channel being selected is extracted. The channel selection is performed based on a channel switching instruction notified from the operation control means 814 described later.

  This broadcast signal analyzing means 802 outputs the extracted video, audio and other data in the PES (Packetized Elementary Stream) format to the video / audio decoding means 803 and extracts the section such as the extracted data broadcast data. The format data is output to the data broadcast decoding means 804.

  At this time, the broadcast signal analyzing unit 802 uses the application included in the AIT descriptor (application activation information descriptor) that is one of SI (program sequence information) from the stream data demodulated by the broadcast receiving unit 801. Activation information may be extracted. Then, the broadcast signal analysis unit 802 writes the extracted application activation information in the application activation information storage unit 807. Furthermore, when the application activation information is extracted, the broadcast signal analysis unit 802 indicates that the application activation information has been notified (activation information notification) together with information for identifying the application (application ID), and application management / execution control unit 809. Notify

  Further, the broadcast signal analyzing means 802 inquires about the selected channel from the activation range determining means 818 (tuned channel inquiry). In response to this channel selection inquiry, the broadcast signal analysis unit 802 outputs the channel selection channel inquiry result to the activation range determination unit 818 described later as information indicating the selected channel.

The channel selection channel inquiry result is a set of original_network_id, transport_stream_id, and service_id included in the analyzed program arrangement information.
Further, in FIG. 9, signal input / output between the broadcast signal analysis unit 802 and the activation range determination unit 818 is illustrated by a circle B in order to make the drawing easy to see.

  The video / audio decoding unit 803 decodes the video / audio (video stream and audio stream) extracted by the broadcast signal analysis unit 802. This video / audio decoding means 803, when the video / audio is encoded by, for example, the MPEG2 encoding method, is output to the composite display means 815 as video / audio data in an output format that can be decoded and displayed by MPEG2. Output.

  The data broadcast decoding unit 804 decodes the data broadcast data extracted by the broadcast signal analysis unit 802. This data broadcast decoding means 804 has a function of a BML browser that decodes the carousel, analyzes the BML, and converts the BML into an output format that can be displayed, and synthesizes the converted display data (data broadcast data). Output to means 815.

  Further, the data broadcast decoding unit 804 may extract the application activation information transmitted by the carousel. Then, the data broadcast decoding unit 804 writes the extracted application activation information in the application activation information storage unit 807.

Here, the data broadcast decryption unit 804 further includes a certificate extraction unit 804a.
Certificate extraction unit 804a are transmitted in the carousel certificate _C CA, it extracts a _{C L.} The certificate extraction unit 804a is extracted certificate _C CA, writes the _{C L} in the certificate management section 817a.
The communication transmitting / receiving means 805 receives data such as applications via the network.

The application activation information acquisition unit 806 acquires activation information corresponding to the application via the communication transmission / reception unit 805.
For example, the application activation information acquisition unit 806 acquires application activation information from a predetermined server (application activation information server) at the time of activation (when the power is turned on), and writes the acquired application activation information in the application activation information storage unit 807. . Alternatively, the application activation information acquisition unit 806 acquires application activation information when an instruction to display a list of applications (list display instruction) is notified by the user via an operation control unit 814 described later. Also good.

  The application activation information storage unit 807 stores application activation information, and is a storage medium such as a memory or a hard disk. Here, the application activation information storage unit 807 is written with the application activation information extracted by the broadcast signal analysis unit 802. The application activation information storage unit 807 is written with the application activation information acquired by the application activation information acquisition unit 806.

The list control unit 808 is a launcher that displays a list of applications that can be started and controls application selection.
The list control unit 808 displays a list of applications that can be activated. That is, the list control unit 808 generates a list of applications corresponding to the application activation information stored in the application activation information storage unit 807 when a list display is instructed by the user via the operation control unit 814. The display data is output to the composite display means 815.

  The list control unit 808 selects an application based on a list selection instruction from the user instructed via the operation control unit 814 in the displayed application list. Then, the list control unit 808 outputs a selected application notification including a number (application ID) for identifying the selected application to the application management / execution control unit 809.

The application management / execution control means 809 controls the life cycle of an application (the process from when an application is loaded and executed until it is terminated).
The application management / execution control unit 809 sets the activation range to the activation range determination unit 818 when the activation information notification is notified from the broadcast signal analysis unit 802 or when the selection application notification is notified from the list control unit 808. Inquire (Start range inquiry).
In response to the activation range inquiry, the application management / execution control unit 809 receives an activation range inquiry result (activation range inquiry result) from the activation range determination unit 818.
In FIG. 9, signal input / output between the application management / execution control unit 809 and the activation range determination unit 818 is indicated by a circled A to make the drawing easier to see.

  This start range inquiry result is information indicating whether or not the application can be started according to the start range, and is referred to by the start control means 809a described later. For example, the activation range query result is either “application activation is possible” in which the application can activate the application within the activation range, or “application activation impossible” in which the application cannot be activated outside the activation range.

Further, the application management / execution control unit 809 receives the link range determination unit 819 when the activation information notification is notified from the broadcast signal analysis unit 802 or when the selection application notification is notified from the list control unit 808. (Link range query).
At this time, the application management / execution control unit 809 obtains the location information (URI of the application server 70) described in the application activation information in the application activation information storage unit 807. Then, the application management / execution control means 809 describes the acquired location information as the acquisition source URI in the link range query.

In response to the link range inquiry, the application management / execution control unit 809 receives the link range inquiry result (link range inquiry result) from the link range determination unit 819.
This link range inquiry result is information indicating whether or not an application can be activated according to the link range, and is referred to by the activation control unit 809a and the transition control unit 809d. For example, the link range inquiry result is either “application startable” in which the application can start the application within the link range, or “application start disabled” in which the application cannot start the application outside the link range.

The application management / execution control unit 809 receives an authentication result from an application authentication unit 817 described later.
The authentication result is information indicating whether the application authentication has succeeded or failed, and is referred to by the activation control unit 809a. For example, the authentication result is either “authentication success” in which application authentication is successful or “authentication failure” in which application authentication has failed.

Further, when a resource allocation request is input from the application execution unit 813 described later, the application management / execution control unit 809 outputs (transfers) the resource allocation request to the resource management unit 821 described later.
In addition, when a resource allocation request response is input from the resource management unit 821, the application management / execution control unit 809 outputs (transfers) this resource allocation request response to the application execution unit 813.

Here, the application management / execution control unit 809 includes an activation control unit 809a, an end control unit 809b, an accumulation management unit 809c, and a transition control unit 809d.
The activation control unit 809a controls activation of the application acquired by the application acquisition unit 811 based on the input activation range inquiry result, link range inquiry result, and authentication result.

  When the activation range query result is “application launch is possible”, the link range query result is “application launch is possible”, and the authentication result is “authentication successful”, the activation control unit 809a applies the application execution unit 813 to the application execution unit 813. Notify that the application is to be executed (startup control instruction). As a result, the application is started.

On the other hand, if the activation range query result is “application launch disabled”, the link range query result is “application launch disabled”, or the authentication result is “authentication failure”, the startup control unit 809a does not execute the application, The application execution unit 813 is instructed. As a result, the activation of the application is prohibited.
The activation control unit 809a manages the activated application with identification information (application ID), and writes the activated application ID in the activated application identification information storage unit 810.

The termination control unit 809b performs termination control of the running application.
Specifically, the end control unit 809b corresponds to the application ID notified together with the activation information notification stored in the application activation information storage unit 807 when the activation information notification is notified from the broadcast signal analysis unit 802. The application is terminated according to the application control code (activation termination instruction) described in the application activation information.

The accumulation management unit 809c performs control to accumulate (install) the application in the receiver 80 (specifically, the application storage unit 812) in advance.
Specifically, the storage management unit 809c sends an application to the application storage unit 812 from the list control unit 808 together with information (application ID) for identifying the selected application selected by the user in the list of applications that can be started. When notified that the application is stored, the application acquisition unit 811 indicates that the application is acquired from the location (URI) of the application described in the application activation information and written to the application storage unit 812 (application acquisition instruction). Notice.
As a result, the application storage unit 812 stores the application selected by the user.

Further, when the application management unit 809c stores (installs) the application in the application storage unit 812, the storage management unit 809c writes and manages the state that the application is stored in the application activation information storage unit 807.
On the other hand, the accumulation management unit 809c deletes the accumulated application in accordance with a user instruction. That is, the applications stored in the application storage unit 812 are displayed in a list by a stored application list display unit (not shown) in the storage management unit 809c, and selected by the user by an application selection deletion unit (not shown). It is deleted from the application storage means 812. At this time, the application selection / deletion unit (not shown) sets the corresponding application accumulation state to “not accumulated” in the application activation information storage unit 807.

The transition control unit 809d controls the transition of the application being executed by the application execution unit 813.
Specifically, the transition control unit 809d is notified from the application execution unit 813 that the web page is transitioned (transition destination information notification) when the application being executed transits the web page. This transition destination information notification includes the ID of the application being executed and the URI of the transition destination Web page.

When the transition destination information notification is input, the transition control unit 809d inquires of the link range determination unit 819 whether or not the application being executed can transition to the transition destination Web page (transition availability inquiry). At this time, the transition control unit 809d describes the URI included in the transition destination information notification in the transition permission query as the acquisition source URI.
In response to this transition permission inquiry, the transition control means 809d receives a transition permission inquiry result from the link range determination means 819 (transition permission result).

  This transition permission / inquiry result is information indicating whether or not the application can transition to the transition destination Web page according to the link range. For example, the transition availability inquiry result is either “application transition allowed” in which the application can transit within the link range, or “application transition impossible” in which the application cannot transition outside the link range.

  If the result of whether the transition is possible is “application transition is possible”, the transition control unit 809d notifies the application execution unit 813 that web page transition is permitted (transition permission notification). As a result, the application transitions to the Web page.

  On the other hand, when the transition permission / inquiry result is “application transition not possible”, the transition control unit 809d notifies the application execution unit 813 that the web page transition cannot be permitted (transition non-permission notification). As a result, the application stops the transition of the Web page.

  The activated application identification information storage unit 810 stores identification information (application ID) of an activated application, and is a storage medium such as a semiconductor memory. The activation application identification information storage unit 810 is written with an application ID when the application is activated by the activation control unit 809a, and is deleted when the application is terminated by the termination control unit 809b.

The application acquisition unit 811 acquires an application stored in the application server 70 via the communication transmission / reception unit 805.
When the application acquisition instruction is notified from the accumulation management means 809c, the application acquisition unit 811 acquires the specified application from the location (address) of the application notified by the instruction, and stores the acquired application in the application storage. Write and accumulate in means 812.

In addition, the application acquisition unit 811 outputs an authentication instruction to the application authentication unit 817 when the application is acquired. This authentication instruction is for instructing whether or not the application is valid (application authentication).
Accordingly, the receiver 80 can reduce the number of times each time the application is activated, compared with the case where application authentication is performed, and can reduce the processing load on the receiver 80.
The authentication instruction output by the application acquisition unit 811 is illustrated as “authentication instruction 1” in FIG. The “authentication instruction 2” will be described later.

The application storage unit 812 stores the application acquired by the application acquisition unit 811 and is a storage medium such as a hard disk. The application stored in the application storage unit 812 is read and executed by the application execution unit 813.
Note that the applications stored in the application storing unit 812, the application ID linked digital terrestrial television broadcasting system 1 is assumed, signature, and a certificate C _B is added.

The application execution unit 813 starts and ends the application based on an instruction (startup control instruction) from the application management / execution control unit 809.
When the activation control unit 809a instructs the application execution unit 813 to execute the application, the application execution unit 813 determines the application and the application based on information (application ID, location, etc.) specifying the application included in the activation control instruction. Data required for execution (for example, metadata, icon data, etc.) is acquired from the acquisition source of the application.
Then, the application execution unit 813 develops (loads) the application in a memory (not shown) and executes the application (broadcast station application and general application).
Image and audio data accompanying execution of this application is output to the composite display means 815.

In addition, the application execution unit 813 may display a message indicating that the application cannot be executed via the composite display unit 815 when the activation control unit 809a is instructed not to execute the application. That is, when the activation range query result is “application launch disabled”, the link range query result is “application launch disabled”, or the authentication result is “authentication failure”, the startup control instruction is not input to the application execution unit 813. Application startup is prohibited.
In addition, when the application execution unit 813 is instructed to end the application from the end control unit 809b, the application execution unit 813 ends the instructed application.

Further, the application execution unit 813 notifies the application management / execution control unit 809 of a transition destination information notification when the application being executed transits from the displayed Web page to another Web page (transition destination Web page).
In response to this transition destination information notification, the application execution unit 813 receives “transition permission notification” or “transition non-permission notification” from the application management / execution control unit 809.

When “transition permission notification” is input, the application execution unit 813 transitions the Web page to the application being executed.
On the other hand, when “transition non-permission notice” is input, the application execution unit 813 stops the transition of the Web page by the application being executed. At this time, the application execution unit 813 may display a message indicating that the Web page cannot be changed via the composite display unit 815.

Here, the application execution unit 813 outputs a resource allocation request to the resource management unit 821 via the application management / execution control unit 809 when an application (API) that accesses the resource is called by the running application. To do.
This resource allocation request is for requesting resource allocation, and includes, for example, the ID of an application that is being activated and the API name that this application has called.

The application execution unit 813 receives a resource allocation request response from the application management / execution control unit 809.
The response to the resource allocation request indicates whether the resource allocation has succeeded or failed. For example, the response to the resource allocation request indicates either “resource allocation success” in which resource allocation is successful or “resource allocation failure” in which resource allocation is unsuccessful.

Here, when the response to the resource allocation request is “resource allocation successful”, the application execution unit 813 calls the API and uses the resource allocated by the resource management unit 821.
On the other hand, if the response to the resource allocation request is “resource allocation failure”, the application execution unit 813 performs arbitrary processing for each application, such as security-related exception processing or application termination. In this case, the application execution unit 813 notifies the active application by an interrupt signal or the like, for example, from the termination control unit 809b, and terminates the application.

  The application execution unit 813 has been described as outputting a resource allocation request to the resource management unit 821 via the application management / execution control unit 809, but is not limited thereto. Specifically, the application execution unit 813 may directly output a resource allocation request to the resource management unit 821 (not shown).

The operation control unit 814 controls a user operation (for example, channel change or the like) on the receiver 80 via an input unit such as an external remote controller Ri.
This operation control means 814 notifies the broadcast signal analysis means 802 of a channel switching instruction including the channel number of the selected channel, when a change of channel is instructed by the user via the remote controller Ri. As a result, the channel currently being viewed is selected.

The composite display means 815 combines and displays video and audio. The composite display means 815 includes video data / audio data decoded by the video / audio decoding means 803, display data of the data broadcast decoded by the data broadcast decoding means 804, and display data of the list generated by the list control means 808. The application display data generated by the application execution unit 813 is combined and displayed.
Note that the synthesized display unit 815 outputs the synthesized audio as an audio signal to an audio output device Sp such as a speaker connected to the outside, and the synthesized video (image) is externally connected as a video signal. Output to a video display device Mo such as a liquid crystal display.

  The security management unit 816 manages the security of the receiver 80, and includes an application authentication unit 817, an activation range determination unit (activation determination unit) 818, a link range determination unit (activation determination unit) 819, and a resource access. And a control means 820.

  The application authentication unit 817 performs application authentication for the application acquired by the application acquisition unit 811 in response to the authentication instruction input from the application acquisition unit 811. Therefore, as shown in FIG. 9, the application authentication unit 817 includes a certificate management unit 817a, a certificate confirmation unit 817b, a signature verification unit 817c, and an access control information extraction unit (extraction unit) 817d.

Certificate management section 817a, the certificate extraction unit 804a with the extracted certificate _C CA, storing _{C L,} and manages.
Certificate checking unit 817b in response to an instruction from the application authentication means 817, a certificate C _B that is added to the application, whether the certificate managing means 817a in the storage certificate C _L is valid Is to confirm.

The signature verification unit 817c verifies whether the signature extracted from the application is valid.
Access control information extraction unit 817d, in response to an instruction from the signature verification unit 817c, the extended field of a valid certificate C _B, as access control information, the activation range information, and link range information, and resource usage range information Is extracted.

<Application authentication>
Hereinafter, application authentication by the application authentication unit 817 will be described.
Or application authentication means 817, the authentication instruction from the application acquisition section 811 is input, whether the application of the application storage unit 812 certificate C _B is added, that is, can be extracted certificate C _B from the application Confirm whether or not.

If the certificate C _B is added, the application authentication means 817, from the application storage unit 812, extracts an application main body, and an additional application ID to the application, signature and application, and a certificate C _B. Then, the application authentication unit 817 instructs the certificate checking unit 817b to check the validity of the certificate.
On the other hand, if the certificate C _B is not added, the application authentication means 817, the authentication result as the outputs "authentication failure" to the application management and execution control unit 809 to end the application authentication.
In FIG. 9, the application signature is simply indicated as “signature” (the same applies to FIG. 13).

Certificate checking unit 817b uses the verification key P _CA of the stored certificate C _CA in certificate management section 817a, is stored in the certificate management section 817a certificate C _L is whether it is valid Check.
Note that the certificate C _L to check whether it is valid, for example, by using the verification key P _CA, the certificate C _L to the added signature (signature generated by the signature key S _CA) decodes It is to verify whether or not the decrypted signature and the signature source message match.

If the certificate C _L is valid, the certificate verification unit 817b uses the verification key P _L of the certificate C _L, check whether the application authentication means 817 is extracted certificate C _B is effective To do.
The confirmation of whether or not the certificate C _B is valid is, for example, using the verification key P _L to decrypt the signature (signature with the signature key S _L ) added to the certificate C _B and decrypt it. It is to verify whether or not the signed signature matches the signature source message.

If the certificate _{C B} is valid, the certificate verification unit 817b instructs the signature verification of the signature verification unit 817c (signature verification instruction).
On the other hand, if the certificate C _L is not valid, or if the certificate C _B is not valid, the certificate verification unit 817b outputs "authentication failure" to the application management and execution control unit 809 as the authentication result, the application authentication Exit.

Signature verification unit 817c, when signature verification instruction from the certificate confirmation unit 817b is input, using the verification key P _B of the certificate C _B, application signature verifies whether valid. Specifically, the signature verification unit 817c verifies the application signature by applying a signature verification algorithm to the signature source message (see Expression (2)). In this formula (2), the signature verification Verify_Kp has used the verification key (public key) _{P B.}
Verify_Kp (Mes, Sig) <=> 1 Equation (2)

  Here, if the result of Verify is “1”, it can be said that the application signature is valid. In this case, the signature verification unit 817c instructs the access control information extraction unit 817d to extract access control information (access control information extraction instruction).

  On the other hand, if the result of Verify is not “1”, the application signature is not valid. In this case, the signature verification unit 817c outputs “authentication failure” to the application management / execution control unit 809 as an authentication result together with the ID of the application that has verified the application signature, and ends application authentication.

Access control information extraction unit 817d, when the access control information extraction instruction is input from the signature verification unit 817c, extracts boot range information from the extended fields of the certificate C _B, with application ID, the activation range determining means 818 Output. The access control information extraction unit 817d from the extended fields of the certificate C _B extracts the link range information, together with the application ID, and outputs the link range judging means 819. Further, the access control information extraction unit 817d extracts a resource utilization range information from the extended fields of the certificate C _B, together with the application ID, and outputs the resource access control unit 820. Thereafter, the access control information extraction unit 817d outputs “authentication success” as an authentication result to the application management / execution control unit 809 together with the ID of the application whose application signature has been verified, and ends application authentication.

The description of the configuration of the receiver 80 will be continued.
The activation range determination means 818 determines whether or not the acquired application can be activated depending on whether or not the broadcast channel organization channel of the selected broadcast program is included in the activation range information.

<Startup range judgment>
Hereinafter, the activation range determination by the activation range determination means 818 will be described with reference to FIG. 10 (see FIG. 9 as appropriate).
First, the activation range determination unit 818 writes the activation range information input from the access control information extraction unit 817d in the activation range information table stored in a memory or the like as shown in FIG.

This activation range information table has an application ID and one or more organization channels as data items.
As the application ID, the application ID input from the access control information extraction unit 817d is written.
In the activation range, original_network_id, transport_stream_id, and service_id included in the activation range information input from the access control information extraction unit 817d are written.

For example, in the activation range information table of FIG. 10, for the application identified by application ID = “1”, the organization channel identified by original_network_id = “0x7FE0”, transport_stream_id = “0x7FE0” and service_id = “0x0400” is activated. Indicates that it is a range.
In the activation range information table of FIG. 10, only one activation range is illustrated for two applications, but it is needless to say that the present invention is not limited to this.

Next, when the activation range query is input from the application management / execution control unit 809, the activation range determination unit 818 outputs the channel selection channel query to the broadcast signal analysis unit 802.
In response to the channel inquiry during channel selection, the activation range determination unit 818 receives the channel selection channel inquiry result from the broadcast signal analysis unit 802. Then, for the acquired application ID, the activation range determination unit 818 matches the selected channel that is included in the channel selection channel inquiry result with one of the activation ranges included in the activation range information table. It is determined whether or not.

When the selected knitting channel matches any of the activation ranges, the activation range determination unit 818 outputs “app activation possible” as the activation range inquiry result to the application management / execution control unit 809.
On the other hand, if the selected knitting channel does not match any of the activation ranges, the activation range determination means 818 outputs “application activation impossible” to the application management / execution control means 809 as the activation range inquiry result. .

Returning to FIG. 9, the description of the configuration of the receiver 80 will be continued.
The link range determination unit 819 determines whether or not the acquired application can be activated based on whether or not the URI of the application server 70 is included in the link range information.
Further, the link range determination unit 819 determines whether or not the application can transition to the transition destination Web page based on whether or not the URI of the transition destination Web page is included in the link range information.

<Link range judgment>
Hereinafter, link range determination by the link range determination unit 819 will be described with reference to FIG. 11 (see FIG. 9 as appropriate).
First, as shown in FIG. 11, the link range determination unit 819 writes the link range information input from the access control information extraction unit 817d in a link range information table stored in a memory or the like.

This link range information table has an application ID and one or more link ranges as data items.
As the application ID, the application ID input from the access control information extraction unit 817d is written.
The link range is written by restoring the boundary_extension_byte of the link range information input from the access control information extracting unit 817d to a text format.

For example, in the link range information table of FIG. 11, the application identified by application ID = “1” is identified by “http://hoobar.co.jp” and “http://xyzzy.co.jp”. This URI indicates that it is a link range.
In FIG. 11, only two link ranges are shown for two applications, but it is needless to say that the present invention is not limited to this.

Next, for the acquired application, the link range determination unit 819 matches the acquisition source URI included in the link range query from the application management / execution control unit 809 with any of the link ranges included in the link range information table. It is determined whether or not to do.
As described above, in the link range query, the URI of the application server 70 is described as the acquisition source URI.

If the acquisition source URI matches one of the link ranges, the link range determination unit 819 outputs “app startable” to the application management / execution control unit 809 as the link range query result.
On the other hand, when the acquisition source URI does not match any of the link ranges, the link range determination unit 819 outputs “application start impossible” to the application management / execution control unit 809 as the link range inquiry result.

Further, the link range determination unit 819 determines whether the acquisition source URI included in the transition availability inquiry from the transition control unit 809d matches any of the link ranges included in the link range information table for the application being executed. Determine whether.
Note that, as described above, in the transition availability inquiry, the URI of the transition destination Web page is described as the acquisition source URI.

If the acquisition source URI matches any of the link ranges, the link range determination unit 819 outputs “application transition allowed” to the transition control unit 809d as the transition availability inquiry result.
On the other hand, when the acquisition source URI does not match any of the link ranges, the link range determination unit 819 outputs “application transition impossible” to the transition control unit 809d as the transition availability inquiry result.

Returning to FIG. 9, the description of the configuration of the receiver 80 will be continued.
The resource access control unit 820 prepares a resource access control table and performs resource access control on the application acquired by the application acquisition unit 811.

<Resource access control>
Hereinafter, resource access control by the resource access control means 820 will be described with reference to FIG. 12 (see FIG. 9 as appropriate).
First, as shown in FIG. 12, the resource access control means 820 writes the resource usage range information input from the access control information extraction means 817d into a resource access control table stored in a memory or the like.

This resource access control table has, as data items, an API identifier, a resource type, an API name, and availability for each application.
The API identifier is an identifier that uniquely identifies an API that accesses a resource, and is set in advance.
The API name is a name of an API that accesses the resource, and is set in advance.
The resource type is information indicating a resource that can be accessed by the API, and is set in advance corresponding to the resource access restriction information of FIG.
The availability indicates whether or not each application can access the resource.

  Consider a case where the bit string of the resource access restriction information included in the resource usage range information is “11111111” for the application identified by the application ID = “1”. That is, the resource access restriction information is “1” indicating that the resource can be accessed from the first bit to the eighth bit.

  In this case, the resource access control means 820 corresponds to the resource “video” corresponding to the first bit, the resource “sound” corresponding to the second bit, and the third bit regarding whether or not the application ID = 1 can be used. Write “◯” indicating that access is possible to the resource “caption” and the resource “data” corresponding to the fourth bit.

  Further, the resource access control means 820 corresponds to the availability of the application ID = 1, the resource “program arrangement information” corresponding to the fifth bit, the resource “VOD” corresponding to the sixth bit, and the seventh bit. “O” is written in the resource “streaming” to be performed and the resource “metadata” corresponding to the eighth bit.

  Consider a case where the bit string of the resource access restriction information is “00011111” for the application identified by application ID = “2”. That is, the resource access restriction information is “0” indicating that the resource cannot be accessed from the first bit to the third bit. The resource access restriction information is “1” from the fourth bit to the eighth bit.

  In this case, the resource access control unit 820 writes “x” indicating that access is not possible in the resource “video”, the resource “sound”, and the resource “caption” regarding the availability of the application ID = 2.

  Further, the resource access control means 820 sets “O” to the resource “data”, the resource “program arrangement information”, the resource “VOD”, “streaming”, and the resource “metadata” regarding the availability of the application ID = 2. Write.

  Consider a case where the bit string of the resource access restriction information is “00000000” for the application identified by application ID = “3”. That is, the resource access restriction information is “0” from the first bit to the eighth bit.

In this case, the resource access control means 820 determines whether or not the application ID = 3 can be used, the resource “video”, the resource “audio”, the resource “caption”, the resource “data”, the resource “program arrangement information”, and the resource “VOD”. , “×” is written in the resource “streaming” and the resource “metadata”.
In FIG. 12, although three examples of applications are illustrated, it is needless to say that the application is not limited to this.

  Next, the resource access control means 820 searches the resource access control table using the application ID and API name included in the resource assignment availability inquiry as a search key in the resource access control table to determine whether the resource can be assigned.

  For example, consider a case where an application identified by application ID = “1” calls “API_A ()”. In this case, the resource access control means 820 determines that the resource can be allocated because the application ID = 1 in the resource access control table and the availability of the resource “video” is “◯”. Then, the resource access control unit 820 outputs “resource allocatable” indicating that the resource can be accessed to the resource management unit 821.

  For example, consider a case where an application identified by application ID = “2” calls “API_B ()”. In this case, the resource access control means 820 determines that the resource cannot be allocated because the application ID = 1 in the resource access control table and the availability of the resource “voice” is “x”. Then, the resource access control unit 820 outputs “resource allocation impossible” indicating that the resource cannot be accessed to the resource management unit 821.

Returning to FIG. 9, the description of the configuration of the receiver 80 will be continued.
The resource management unit 821 manages various resources. Here, when a resource allocation request is input from the application execution unit 813, the resource management unit 821 outputs a resource allocation enable / disable inquiry to the resource access control unit 820 in response to the resource allocation request.
This resource allocation availability inquiry is an inquiry to the resource access control means 820 for resource allocation availability, and includes, for example, the application ID and API name stored in the resource allocation request.

Further, the resource management unit 821 receives a resource allocation availability response from the resource access control unit 820.
Here, the resource management unit 821 allocates a resource to the running application when the response to the resource allocation availability inquiry is “resource allocation is possible”. Then, the resource management unit 821 outputs “resource allocation success” to the application management / execution control unit 809.
On the other hand, the resource management unit 821 outputs “resource allocation failure” to the application management / execution control unit 809 when the response to the resource allocation availability inquiry is “resource allocation impossible”.

[Broadcast communication system operation]
With reference to FIG. 13, the operation of the broadcasting / communication cooperation system 1 will be described (see FIG. 1 as appropriate).
In the description of FIG. 13, it is assumed that the certificates C _CA , C _L , and C _B are valid and the signature of the application is valid.

  As shown in FIG. 13, the CA station 10 is requested to issue a certificate from the license institution. The certificate issuance application is performed online such as a network or offline such as mail (step S1).

The CA station 10 generates a key pair of the signature key S _CA and the verification key P _CA and also generates a key pair of the signature key S _L and the verification key P _L.
The CA station 10 issues a signature key _SL to the ID / signature key / certificate issuing device 30 (step S2).
CA station 10 stores the verification key _{P CA} certificate _{C CA,} stores the signature and the verification key _{P L} by signature key _{S CA} certificate _{C L,} certificate _C CA, broadcast transmitting apparatus _{C L} 20 To issue. The broadcast transmitting apparatus 20 via a broadcast wave, and transmits the CA station 10 certificate issued _C CA, the _{C L} in the receiver 80 (step S3).

  The license institution (ID / signature key / certificate issuing device 30) applies for an application ID from the service provider. The application ID is applied online or offline (step S4).

The ID / signature key / certificate issuing device 30 generates an application ID, generates a key pair of a signature key S _B and a verification key P _B, and a certificate C _B in which the application ID and the verification key P _B are stored. Is generated (step S5).
ID-signing key-certificate issuing unit 30 issues a certificate _{C B} application ID and the verification key _{P B} is stored, and a signature key _{S B} to the application registration unit 40 (step S6).

Application registration unit 40 uses the signature key S _B input from the ID-signing key-certificate issuing unit 30 generates the application signature (step S7).
Application registration unit 40, signature and application by signature key S _B, is added (package) and a certificate C _B to the application, registers the Apu application to the application server 70 (step S8, S9).

The receiver 80 requests an application from the application server 70 (step S10).
The receiver 80 acquires the requested application from the application server 70 (step S11).
The receiver 80, the application extracts the signature by the signature key _{S B,} and a certificate _{C B} (step S12).

The receiver 80 confirms whether or not the certificate _CL is valid using the verification key P _CA of the certificate C _CA (step S13).
The receiver 80 uses the verification key P _L of the valid certificate C _L to check whether or not the certificate C _B extracted from the application is valid (step S14).
The receiver 80 is a valid certificate _{C B,} and extracts the application ID (step S15).
The receiver 80 uses the verification key P _B of a valid certificate C _B, extracted from the application, application signature to verify whether the validity by the signature key S _B (step S16).

The receiver 80 is, from the certificate C _B, the access control information (start range information, link range information and resource utilization range information) is extracted and a startup range information table, and link range information table, and a resource access control table Prepare (step S17).

The receiver 80 determines whether or not the channel of the selected broadcast program is included in the activation range information table (step S18).
The receiver 80 determines whether the URI of the application server is included in the link range information table (step S19).
The receiver 80 controls the activation of the application based on the activation range information table and the link range information table (step S20).
The receiver 80 controls resource access for the application based on the source access control table (step S21).

  As described above, the broadcasting / communication cooperation system 1 according to the first embodiment of the present invention can safely provide applications created by various service providers, and applications created by service providers other than the broadcasters. As for an application for which the broadcaster does not necessarily know all the operation contents, it is possible to finely control activation, link range and access to resources.

That is, the network-linked digital terrestrial television broadcasting system 1, since the include resource use range information in the certificate C _B, for each application, video, audio, subtitles, data carousel, broadcast resources such as event messages, video content, meta Access to communication resources such as data can be finely controlled.
Furthermore, network-linked digital terrestrial television broadcasting system 1, because it contains activated range information in the certificate C _B, may be taking into account the activation range, controls the activation of the individual application.
Furthermore, network-linked digital terrestrial television broadcasting system 1, since the include link range information in the certificate C _B, you may be taking into account the link range, to control the transition of the activation and Web pages for individual applications.

  Furthermore, the broadcasting / communication cooperation system 1 can correctly confirm the authenticity (no falsification) of the application and the application ID and the provider of the application and the reliability of the application by using the signature and the certificate. It can be secured.

  In addition, the broadcasting / communication cooperation system 1 can flexibly operate a signature key (secret key) in various units such as a service provider unit or an individual application unit according to required security. Furthermore, in the broadcasting / communication cooperation system 1, the number of verification keys (public keys included in the certificate) stored in the receiver 80 in advance may be about 1 to several, so that the security of the receiver 80 can be ensured. It is possible to achieve both reduction in mounting load.

(Second Embodiment)
[Overall configuration of broadcasting / communication cooperation system]
With reference to FIG. 14, the difference of the configuration of the broadcast communication cooperative system 1 </ b> A according to the second embodiment of the present invention from the first embodiment will be described.
The network-linked digital terrestrial television broadcasting system 1A, starting range information, the link range information and resource utilization range information, that was stored in the certificate C _B rather than the access control file is different from the first embodiment.
In FIG. 14, the access control file is abbreviated as “file”.

  As shown in FIG. 14, the broadcasting / communication cooperation system 1A includes a CA station 10, a broadcast transmission device 20, an access control file management device 30A, an application registration device 40A, an application production device 50A, and a content distribution server 60. , An application server 70A, a receiver 80A, and an access control file server 90.

CA station 10, except that issues the signature key S _L to the Licensing Authority (access control file management apparatus 30A), the same as in FIG. 1, and detailed description thereof will be omitted.
The broadcast transmitting apparatus 20 is the same as that in FIG.

The access control file management device 30A is managed by a license institution, and generates an application ID and an access control file in response to an application ID application from a service provider. Specifically, the access control file management device 30A stores the activation range information, link range information, and resource usage range information in the access control file. The access control file management device 30A, by using the signature key S _L that is input from the CA 10, and generates a signature for the access control file. Then, the access control file management apparatus 30A adds the application ID and the access control file signature to the access control file, and outputs (registers) them to the access control file server 90 described later. Further, the access control file management unit 30A outputs the application ID, and a signature key _{S L} to the application registration unit 40A.
The configuration of the access control file management device 30A will be described later.

Application registration device 40A is managed by the license agency, the access control file management unit 30A, in which the application ID, and a signature key S _L is input. The application registration unit 40A uses a signature key S _L, to generate the application signature. Furthermore, the application registration apparatus 40A adds an application ID and an application signature to the application input from the service provider (application production apparatus 50A), and outputs (registers) the application ID to the application server 70A.
The configuration of the application registration apparatus 40A will be described later.

  The application creation apparatus 50A is the same as that shown in FIG. 1 except that it is managed by the service provider and outputs the application to the license organization (application registration apparatus 40A).

The content distribution server 60 is the same as that shown in FIG.
The application server 70A is the same as FIG. 1 except that the application is input from the license authority (application registration apparatus 40A), and thus detailed description thereof is omitted.

The receiver 80A is the same as that shown in FIG. 1 except that the activation range information, link range information, and resource usage range information are extracted from the access control file registered in the access control file server 90.
The configuration of the receiver 80A will be described later.

The access control file server 90 is a server that stores and manages an access control file registered by the license authority (access control file management apparatus 30A). Then, the access control file server 90 transmits the access control file to the receiver 80A via the network.
Since the access control file server 90 has a general configuration, detailed description thereof is omitted.

[Configuration of access control file management device]
The configuration of the access control file management device 30A will be described with reference to FIG. 15 (see FIG. 14 as appropriate).
As shown in FIG. 15, the access control file management device 30A includes a signature key input unit 311, an application ID generation unit 312, an access control file generation unit 313, an access control file management unit 314, and a signature key management unit 315. With.

Signature key input unit 311 is for signature key _{S L} is input from the CA 10. Then, the signature key input unit 311 outputs the input signature key _SL to the access control file generation unit 313 and the signature key management unit 315.

  The application ID generation unit 312 generates an application ID, similar to the application ID generation unit 302 in FIG. Then, the application ID generation unit 312 outputs the generated application ID to the access control file generation unit 313.

The access control file generation unit 313 generates an access control file in which access control information is stored. Specifically, the access control file generation unit 313 stores activation range information, link range information, and resource usage range information in the access control file. Then, the access control file generation unit 313 adds the application ID input from the application ID generation unit 312 to the access control file.
The activation range information, link range information, and resource usage range information are the same information as in the first embodiment.

The access control file generating unit 313, by using the signature key S _L that is input from the signature key input unit 311, the binary data of the access control file as a signature based message, generates a signature for the access control file. Here, the access control file generation unit 313 uses a signature algorithm similar to the certificate generation unit 304 of FIG. Then, the access control file generation unit 313 adds the generated access control file signature to the access control file and outputs the access control file management unit 314 with the access control file signature.

  The access control file management unit 314 stores and manages the access control file input from the access control file generation unit 313. Then, the access control file management means 314 outputs the stored access control file to the access control file server 90 in response to the application ID application from the service provider. At this time, the access control file management unit 314 extracts the application ID from the access control file, and outputs the extracted application ID to the application registration apparatus 40A.

Signature key managing unit 315, stores the signature key S _L that is input from the signature key input unit 311 is configured to manage. Then, the signature key management unit 315 outputs the stored signature key _SL to the application registration apparatus 40A.

[Configuration of application registration device]
The configuration of the application registration apparatus 40A will be described with reference to FIG. 16 (see FIG. 14 as appropriate).
As illustrated in FIG. 16, the application registration apparatus 40A includes an application input unit 411, a signature key input unit 412, a signature generation unit 413, a signature addition unit 414, and an application output unit 415.

  The application input unit 411 receives an application from the application creation device 50A. The application input unit 411 receives an application ID corresponding to this application from the access control file management apparatus 30A. Then, the application input unit 411 adds an application ID to the input application and outputs it to the signature generation unit 413 and the signature addition unit 414.

Signature key input unit 412 is for signature from the access control file management unit 30A key S _L is input. Then, the signature key input unit 402 outputs the input signature key _SL to the signature generation unit 413.

Signature generating means 413, the signature key signing key S _L from the input means 412 is input, using the signature key S _L, and generates an application signature. For example, the signature generation unit 413 uses the binary code of the application input from the application input unit 411 as the signature source message that is the source of the application signature. Then, the signature generation unit 413 generates an application signature by the same method as the signature generation unit 403 in FIG. 8 and outputs it to the signature addition unit 414.

  The signature adding unit 414 adds the application signature input from the signature generation unit 413 to the application input from the application input unit 411. Then, the signature adding unit 414 outputs the application to which the application signature is added to the application output unit 415.

The application output unit 415 outputs (registers) the application input from the signature adding unit 414 to the application server 70A. In other words, application application output unit 415 outputs differs from that of the application main body, and application ID, signature application by signature key S _L and is packaged.

[Receiver configuration]
The configuration of the receiver 80A will be described with reference to FIG. 17 (see FIG. 14 as appropriate).
As shown in FIG. 17, the receiver 80A includes a broadcast receiving unit 801, a broadcast signal analyzing unit 802, a video / audio decoding unit 803, a data broadcast decoding unit 804, a communication transmitting / receiving unit 805, and an application activation information acquisition. Means 806, application activation information storage means 807, list control means 808, application management / execution control means 809, activated application identification information storage means 810, application acquisition means 811A, application storage means 812A, and application execution Means 813, operation control means 814, composite display means 815, security management means 816A, and resource management means 821 are provided.
The units from the broadcast receiving unit 801 to the activated application identification information storage unit 810 are the same as the units in FIG.

The application acquisition unit 811A acquires an application, and writes and stores the acquired application in the application storage unit 812A, similarly to the application acquisition unit 811 of FIG.
Similarly to the application acquisition unit 811 of FIG. 9, the application acquisition unit 811A outputs an authentication instruction to the application authentication unit 817A when an application is acquired.

  Further, when the application acquisition unit 811A acquires an application, the application acquisition unit 811A acquires an access control file associated with the application from the access control file server 90. Specifically, the application acquisition unit 811A extracts an application ID from the acquired application, and acquires an access control file to which the same application ID is added from the access control file server 90. Then, the application acquisition unit 811A writes and stores the acquired access control file in the application storage unit 812A.

The application storage unit 812A stores the application acquired by the application acquisition unit 811A and the access control file associated with the application.
For example, the application stored in the application storage unit 812 is added with the same application ID as the access control file corresponding to this application. That is, the application and the access control file can be associated with each other by the application ID.

  The application execution unit 813, the operation control unit 814, and the composite display unit 815 are the same as the respective units in FIG.

The security management unit 816A manages the security of the receiver 80A, and includes an application authentication unit 817A, an activation range determination unit 818, a link range determination unit 819, and a resource access control unit 820.
The activation range determination unit 818, the link range determination unit 819, and the resource access control unit 820 are the same as the respective units in FIG.

  The application authentication unit 817A performs application authentication for the application acquired by the application acquisition unit 811A in response to the authentication instruction input from the application acquisition unit 811A.

  As shown in FIG. 17, the application authentication unit 817A includes a certificate management unit 817Aa, an access control file confirmation unit 817Ab, a signature verification unit 817Ac, and an access control information extraction unit 817Ad.

Certificate management unit 817Aa the certificate extraction unit 804a with the extracted certificate _C CA, storing _{C L,} and manages.
Access control file confirmation section 817Ab in response to an instruction from the application authentication means 817A, certificate management unit 817Aa in the storage certificate C _L confirms whether a valid signature is legitimate for the access control file It is verified whether or not.

The signature verification unit 817Ac verifies whether the signature extracted from the application (application signature) is valid.
In response to an instruction from the signature verification unit 817Ac, the access control information extraction unit 817Ad obtains, as access control information, start range information, link range information, and resource usage range from an access control file with a valid access control file signature. Information is extracted.

<Application authentication>
Hereinafter, application authentication by the application authentication unit 817A will be described.
When the authentication instruction is input from the application acquisition unit 811A, the application authentication unit 817A checks whether an access control file corresponding to the application in the application storage unit 812A exists.

  If there is a corresponding access control file, the application authentication unit 817A receives from the application storage unit 812A an application body, an application ID added to the application, an application signature, and an access control file associated with the application. To extract. Then, the application authentication unit 817A instructs the access control file confirmation unit 817Ab to verify the validity of the access control file signature.

  On the other hand, if the corresponding access control file does not exist, the application authentication unit 817A outputs “authentication failure” to the application management / execution control unit 809 as the authentication result, and ends the application authentication.

Access control file confirmation section 817Ab, using the verification key _{P CA} of stored in the certificate managing part 817Aa certificate _{C CA,} whether stored in a certificate management unit 817Aa certificate _{C L} is valid Confirm.

If the certificate C _L is enabled, the access control file confirmation section 817Ab, using the verification key P _L of the certificate C _L, for access control file signatures to verify whether or not justified.
Note that the verification access control file signature of whether valid, for example, by using the verification key P _L, decodes the signature for the access control file, and decrypted signature access control file and signature element message Is to verify whether or not.

When the access control file signature is valid, the access control file confirmation unit 817Ab instructs the signature verification unit 817Ac to verify the signature (signature verification instruction).
On the other hand, if the certificate C _L is not valid, or, if for access control file signature is not valid, access control file confirmation means 817Ab outputs "authentication failure" to the application management and execution control means 809 as the authentication result, End application authentication.

Signature verifying means 817Ac, when signature verification instruction from the access control file confirmation section 817Ab is input, using the verification key P _L certificate C _L, application signature verifies whether valid. Here, the signature verification unit 817Ac verifies the application signature by the same method as the signature verification unit 817c of FIG.

If the application signature is valid, the signature verification unit 817Ac instructs the access control information extraction unit 817Ad to extract access control information (access control information extraction instruction).
If the application signature is not valid, the signature verification unit 817Ac outputs “authentication failure” to the application management / execution control unit 809 as an authentication result together with the ID of the application that has verified the application signature, and ends application authentication.

  When the access control information extraction instruction is input from the signature verification unit 817Ac, the access control information extraction unit 817Ad extracts the activation range information from the access control file and outputs it to the activation range determination unit 818 together with the application ID. Further, the access control information extraction unit 817Ad extracts link range information from the access control file, and outputs it to the link range determination unit 819 together with the application ID. Further, the access control information extraction unit 817Ad extracts the resource usage range information from the access control file and outputs it to the resource access control unit 820 together with the application ID. Thereafter, the access control information extraction unit 817Ad outputs “authentication success” to the application management / execution control unit 809 as the authentication result together with the ID of the application whose application signature has been verified, and ends the application authentication.

The resource management unit 821 is the same as that shown in FIG.
Since the activation range determination, link range determination, and resource access control are the same as those in the first embodiment, description thereof is omitted.

[Broadcast communication system operation]
The operation of the broadcasting / communication cooperation system 1A will be described with reference to FIGS. 18 and 19 (see FIG. 14 as appropriate).
In the description of FIGS. 18 and 19, it is assumed that the certificates C _CA and _CL are valid and the access control file signature and the application signature are valid.
Step S31 in FIG. 18 is the same as step S1 in FIG.

The CA station 10 generates a key pair of the signature key S _CA and the verification key P _CA and also generates a key pair of the signature key S _L and the verification key P _L.
The CA station 10 issues a signature key _SL to the access control file management apparatus 30A (step S32).

Step S33 is the same as step S3 in FIG.
The license institution (access control file management apparatus 30A) applies for an application ID from the service provider. The application ID is applied online or offline (step S34).

The access control file management device 30A generates an application ID and an access control file signature (step S35).
The access control file management device 30A stores the activation range information, link range information, and resource usage range information in the access control file. Then, the access control file management apparatus 30A adds the application ID and the access control file signature to the access control file (step S36).

The access control file management apparatus 30A registers the access control file to which the application ID and the access control file signature are added in the access control file server 90 (step S37).
Access control file management apparatus 30A issues an application ID, and verification key _{S L} to the application registration unit 40A (step S38).

Application registration device 40A, using the signature key S _L that is input from the access control file management unit 30A, and generates an application signature (step S39).
The application registration apparatus 40A adds (packages) the application ID and the application signature to the application, and registers the application in the application server 70A (steps S40 and S41).

The receiver 80A requests an application from the application server 70A (step S42).
The receiver 80A acquires the requested application from the application server 70A (step S43).

The receiver 80A uses the verification key P _CA of the certificate C _CA to check whether the certificate _CL is valid (step S44).
The receiver 80A extracts the application ID and the application signature from the application (step S45).

The receiver 80A requests the access control file server 90 for an access control file corresponding to the acquired application (step S46).
The receiver 80A acquires the requested access control file from the access control file server 90 (step S47).

Receiver 80A using the verification key P _L valid certificate C _L, for the access control file extracted from the access control file signatures to verify whether or not valid (step S48).
Receiver 80A using the verification key P _L valid certificate C _L, application extracted from the application signature verifies whether valid (step S49).

The receiver 80A extracts access control information (activation range information, link range information, and resource use range information) from the access control file, and prepares an activation range information table, a link range information table, and a resource access control table. (Step S50).
Steps S51 to S54 in FIG. 19 are the same as steps S18 to S21 in FIG.

  As described above, the broadcasting / communication cooperation system 1A according to the second embodiment of the present invention has the same effects as those of the first embodiment.

  The present invention is not limited to the above-described embodiment, and various modifications can be made without departing from the spirit of the present invention. Hereinafter, the modification of this invention is demonstrated concretely.

(Modification 1)
With reference to FIG. 1, FIG. 14, the broadcast communication cooperation system 1, 1A which concerns on the modification 1 is demonstrated.
In each of the embodiments described above, transmits the certificate issued by the CA station 10 to the Licensing Authority _C CA, the _{C L,} via a broadcast wave, the transmission means, such as DSM-CC data carousel, a receiver 80,80A However, the present invention is not limited to this.
That is, the network-linked digital terrestrial television broadcasting system 1,1A are certificates issued by the CA 10 _C CA, the _{C L,} not through the broadcast wave, and mounted on previously receiver 80, 80A, it may be shipped. Furthermore, network-linked digital terrestrial television broadcasting system 1,1A, the certificate _C CA, the _{C L,} via a network, may be transmitted to the receiver 80, 80A.

(Modification 2)
In the first embodiment described above, the ID / signature key / certificate issuing device 30 is managed by the license authority, but the present invention is not limited to this.
For example, it is assumed that the service provider application creation apparatus 50 includes all the means of the ID / signature key / certificate issuing apparatus 30.
Further, the application production apparatus 50 may include all means other than the application ID generation means 302 (FIG. 2) in the ID / signature key / certificate issuing apparatus 30. In this case, the service operators, and to apply for the application ID to the license agency, receives only the application ID from the license institutions, will produce its own signature and certificate C _B.

(Modification 3)
In the first embodiment described above, the application registration apparatus 40 is managed by the service provider, but the present invention is not limited to this.
For example, as shown in FIG. 20, the license institution may manage the application registration apparatus 40.
In this case, the application to which the certificate is added by the certificate adding unit 405 may be registered in the application server 70 via the service provider.

(Modification 4)
In the first embodiment described above, has been described that includes an application ID to the certificate C _B, the present invention may not include the application ID in the certificate C _B. Thus, the network-linked digital terrestrial television broadcasting system 1 is not required to issue a certificate C _B for each application, it is possible to reduce the processing load. On the other hand, the broadcasting / communication cooperation system 1 cannot prevent falsification of the application ID by the service provider B, and the safety may be lowered.

(Modification 5)
In the first embodiment described above, the application output from the application output unit 406, an application main body, and application ID, signature and application by signature key S _B, the certificate and C _B is one that was packaged However, the present invention is not limited to this.
For example, signature and application by signature key S _B, and certificate C _B, by separating the application body is not limited to the application server 70, and placed on any server such as the application starting information server (not shown) Also good.
In this case, the signature and for separate application, certificates and C _B, adds the application ID to the application main body, it is necessary to map them.

(Modification 6)
In each of the above-described embodiments, the broadcasting station, the license institution, and the service provider are described as one, but the present invention is not limited to this.
For example, the broadcasting / communication cooperation systems 1 and 1A may include a plurality of broadcasting stations.
The broadcasting / communication cooperation systems 1 and 1A may include a plurality of license organizations.
In addition, the broadcasting / communication cooperation systems 1 and 1A may include a plurality of service providers.
In the broadcasting / communication cooperation system 1, 1A, a broadcasting station may produce an application as a service provider.
In addition, the broadcasting / communication cooperation systems 1 and 1A may be integrated with a broadcasting station and a license institution.

(Modification 7)
A receiver 80 according to Modification 7 will be described with reference to FIG.
The application management / execution control means 809 may store and manage a security information table (not shown).
For example, the application management / execution control unit 809 writes the activation range query result input from the activation range determination unit 818 in the security information table stored in the memory or the like in association with the activated application ID.

  The application management / execution control unit 809 writes the link range query result input from the link range determination unit 819 in the security information table in association with the active application ID.

  Further, the application management / execution control unit 809 writes the response to the resource allocation request input from the resource management unit 821 in the security information table in association with the active application ID.

  Further, the application management / execution control unit 809 writes the authentication result input from the application authentication unit 817 in the security information table in association with the activated application ID.

  As a result, the application management / execution control unit 809 can store and manage the success / failure of resource allocation to the active application, the activation range, the link range, and the authentication result.

(Modification 8)
In each of the above-described embodiments, it has been described that the application execution unit 813 stops the transition of the Web page when a transition stop notification is input. However, the present invention is not limited to this.
For example, when a transition stop notification is input, the application execution unit 813 may end the running application.

(Modification 9)
In each of the above-described embodiments, application authentication is performed when an application is acquired. However, the present invention can also perform application authentication when an application is activated. In this case, each time the activation control unit 809a activates the application, an authentication instruction is output to the application authentication unit 817 (“authentication instruction 2” in FIG. 9), and application authentication is performed, thereby improving safety. To do.
In this way, since it is only necessary to verify the signature at any timing when the application is acquired or when the application is activated, the design flexibility of the receiver 80 can be improved.

(Modification 10)
In the first embodiment described above, the certificate C _B, a starting range information, and link range information has been described as being added and resource usage range information, the present invention is not limited thereto.
That is, the certificate C _B, a starting range information, and link range information only needs to be added any one or more of the resource utilization range information.

Hereinafter, as a modification 10, the case where activation range information and resource utilization range information in the certificate C _B is added, referring to differences from the above embodiments.
The application management / execution control unit 809 does not output the link range query to the link range determination unit 819 even when the activation information notification is notified or the selected application notification is notified.

The activation control unit 809a notifies the application execution unit 813 of an activation control instruction when the activation range query result is “application activation enabled” and the authentication result is “authentication successful”.
On the other hand, the activation control unit 809a instructs the application execution unit 813 not to execute the application when the activation range query result is “application activation not possible” or the authentication result is “authentication failure”.

  The application execution unit 813 changes the application being executed from the displayed Web page to another Web page without notifying the application management / execution control unit 809 of the transition destination information notification.

Access control information extraction unit 817d, in response to an instruction from the signature verification unit 817c, the extended field of a valid certificate C _B, extracts the start range information, and resource utilization range information.

Incidentally, only the start range information in the certificate C _B is added, and, if the resource usage range information is not added, the access control information extraction unit 817d does not extract the resource utilization range information, the resource access control means 820 What is necessary is to always output “resource allocatable” to the resource management means 821.
Similarly to the tenth modification, the access control file may store one or more of activation range information, link range information, and resource usage range information.

(Modification 11)
Hereinafter, as a modification 11, the case where the link range information and resource utilization range information in the certificate C _B is added, referring to differences from the first embodiment described above.
The application management / execution control unit 809 does not output the activation range query to the activation range determination unit 818 even when the activation information notification is notified or the selected application notification is notified.

The activation control unit 809a notifies the application execution unit 813 of an activation control instruction when the link range inquiry result is “app activation allowed” and the authentication result is “authentication successful”.
On the other hand, the activation control unit 809a instructs the application execution unit 813 not to execute the application when the link range query result is “application activation not possible” or the authentication result is “authentication failure”.

Access control information extraction unit 817d, in response to an instruction from the signature verification unit 817c, the extended field of a valid certificate C _B, extracts the resource range information, and resource utilization range information.

Incidentally, only the link range information in the certificate C _B is added, and, if the resource usage range information is not added, the access control information extraction unit 817d does not extract the resource utilization range information, the resource access control means 820 What is necessary is to always output “resource allocatable” to the resource management means 821.
Further, as in the tenth modification, link range information and resource use range information may be stored in the access control file.

(Modification 12)
Hereinafter, a modified example 12, the case where activation range information and link range information in the certificate C _B is added, referring to differences from the above embodiments.
In this case, the access control information extraction unit 817d does not extract the resource usage range information.
The resource access control means 820 does not perform resource access control even when a resource assignment availability inquiry is input, and always outputs “resource assignable” to the resource management means 821.
Similar to the twelfth modification, the access control file may store start range information and link range information.

(Modification 13)
Hereinafter, a modified example 13, the case where only the resource utilization range information in the certificate C _B is added, referring to differences from the above embodiments.
The application management / execution control unit 809 does not output the activation range query to the activation range determination unit 818 even when the activation information notification is notified or when the selection application notification is notified, and the link range determination unit 819 Do not output the link range query.

If the authentication result is “authentication successful”, the activation control unit 809a notifies the application execution unit 813 of an activation control instruction.
On the other hand, the activation control unit 809a instructs the application execution unit 813 not to execute the application when the authentication result is “authentication failure”.

Access control information extraction unit 817d, in response to an instruction from the signature verification unit 817c, the extended field of a valid certificate C _B, to extract the resource utilization range information.

The application execution unit 813 changes the application being executed from the displayed Web page to another Web page without notifying the application management / execution control unit 809 of the transition destination information notification.
Note that, as in Modification 13, only the resource usage range information may be stored in the access control file.

(Modification 14)
In the second embodiment described above, the broadcasting / communication cooperation system 1A has described the access control file as an independent file, but the present invention is not limited to this.
That is, the broadcasting / communication cooperation system 1A may use the access control file as an application activation information file and store the activation range information, link range information, and resource usage range information in the extension items of the application activation information file. In this case, the access control file server in FIG. 14 is an application activation information server that stores and manages this application activation information file.

In addition, the broadcasting / communication cooperation system 1A may use an access control file in an XML (eXtensible Markup Language) format.
Further, the broadcasting / communication cooperation system 1A may divide the activation range information, link range information, and resource usage range information into separate files and arrange them. In this case, it is necessary to add an application ID to each file and associate the file with the application body.

(Modification 15)
In the second embodiment described above, the license institution is described as registering the application, but the present invention is not limited to this.
In the broadcasting / communication cooperation system 1A, the license organization may output the application with the application signature added to the service provider, and the service provider may register the application in the application server 70A.
Further, the license authority may output only the application signature to the service provider. In this case, the service provider adds an application signature to the application and registers it in the application server 70A.

(Modification 16)
In the second embodiment described above, the application and the access control file are described as being associated with each other by the application ID. However, the present invention is not limited to this.
That is, the broadcasting / communication cooperation system 1A may add an access control file to the application.

1,1A Broadcasting and Communication Cooperation System 10 CA Station 20 Broadcasting Transmitter 30 ID / Signature Key / Certificate Issuing Device (Certificate Issuing Device)
30A Access control file management device 40, 40A Application registration device 50, 50A Application production device 60 Content distribution server 70, 70A Application server 80, 80A Receiver 90 Access control file server 301, 311 Signature key input means 302, 312 Application ID generation Means 303 Signature key / verification key generation means 304 Certificate generation means 305 Certificate management means 306, 315 Signature key management means 313 Access control file generation means 314 Access control file management means 401, 411 Application input means 402, 412 Signature key input Means 403, 413 Signature generation means 404, 414 Signature addition means 405 Certificate addition means 406, 415 Application output means 801 Broadcast reception means 802 Broadcast signal analysis means 803 Video / audio recovery Means 804 Data broadcast decryption means 804a Certificate extraction means 805 Communication transmission / reception means 806 Application activation information acquisition means 807 Application activation information storage means 808 List control means 809 Application management / execution control means 809a Activation control means 809b Termination control means 809c Storage management means 809d Transition control means 810 Start application identification information storage means 811 and 811A Application acquisition means 812 and 812A Application storage means 813 Application execution means 814 Operation control means 815 Composite display means 816 and 816A Security management means 817 and 817A Application authentication means 817a and 817Aa Certificate management means 817b Certificate confirmation means 817Ab Access control file confirmation means 817c, 817Ac Signature verification means 817d, 817Ad Access control information extractor (Extraction means)
818 Activation range determination means (activation determination means)
819 Link range determination means (startup determination means)
820 Resource access control means 821 Resource management means

Claims (10)

Application launch range information indicating a possible organize ACTIVATE CHANNEL, or, a certificate issuing apparatus that issues an application certificate or the one or more is added in the link range information indicating the application can reference U RI ,
An application registration device for adding or associating the application certificate to the application;
An application server for storing an application to which the application certificate is added or associated;
A broadcast transmission device for transmitting a broadcast program via a broadcast wave;
A broadcasting / communication cooperation receiving apparatus for receiving the broadcasting program, which is used in a broadcasting / communication cooperation system including:
Application acquisition means for acquiring the application from the application server via a network;
Extraction means for extracting one or more of the activation range information or the link range information from an application certificate added to or associated with the application;
An activation determination unit that determines whether the acquired application can be activated based on any one or more of the activation range information or link range information extracted by the extraction unit;
An activation control means for controlling the activation of the application based on the determination result of the activation determination means;
A broadcasting / communication cooperative receiving apparatus comprising: Application launch range information indicating a possible organize ACTIVATE CHANNEL, or, the access control file management apparatus the application to sign the access control file any of 1 or more is stored in the link-scope information indicating referable U RI ,
An application registration device for adding or associating the access control file to the application;
An application server for storing an application to which the access control file is added or associated;
A broadcast transmission device for transmitting a broadcast program via a broadcast wave;
A broadcasting / communication cooperation receiving apparatus for receiving the broadcasting program, which is used in a broadcasting / communication cooperation system including:
Application acquisition means for acquiring the application from the application server via a network;
Application authentication means for verifying whether the signature of the access control file added or associated with the application is valid;
Extraction means for extracting one or more of the activation range information or the link range information from an access control file whose signature is verified by the application authentication means;
An activation determination unit that determines whether the acquired application can be activated based on any one or more of the activation range information or link range information extracted by the extraction unit;
An activation control means for controlling the activation of the application based on the determination result of the activation determination means;
A broadcasting / communication cooperative receiving apparatus comprising: It said extraction means, certificate or al for the application, extracting at least said link range information,
The activation determination means includes
A link range determination unit that determines whether the acquired application can be activated based on whether the URI of the application server that is the acquisition source of the application is included in the link range information;
The broadcasting / communication cooperation receiving apparatus according to claim 1, further comprising: The extraction means extracts at least the link range information from the access control file;
The activation determination means includes
A link range determination unit that determines whether the acquired application can be activated based on whether the URI of the application server that is the acquisition source of the application is included in the link range information;
The broadcast communication cooperative reception device according to claim 2, comprising: Said extraction means, certificate or al for the application, extracting at least the activation range information,
The activation determination means includes
Activation range determination means for determining whether or not the acquired application can be activated depending on whether or not the channel of the selected broadcast program is included in the activation range information;
Linked digital terrestrial television broadcasting receiving device according to claim 1 or claim 3, characterized in that it comprises a. The extraction means extracts at least the activation range information from the access control file;
The activation determination means includes
Activation range determination means for determining whether or not the acquired application can be activated depending on whether or not the channel of the selected broadcast program is included in the activation range information;
The broadcasting / communication cooperation receiving apparatus according to claim 2, further comprising: Application execution means for executing a Web application that transitions from a Web page to another Web page as the application;
Transition control means for inquiring of the link range determination means whether or not the web application being executed by the application execution means can transition to the other web page;
The link range determination means includes
Further determining whether or not the web application can transition to the other web page according to whether or not the URI of the other web page is included in the link range information;
The transition control means includes
When the link range determination unit determines that the Web application cannot transition to the other Web page, it instructs the application execution unit to end the Web application or stop transition to the other Web page. The broadcasting / communication cooperation receiving apparatus according to claim 3 or 4, characterized by the above. A certificate issuing apparatus that application issues an application certificate that resource utilization range information is added indicating the resources available,
An application registration device for adding or associating the application certificate to the application;
An application server for storing an application to which the application certificate is added or associated;
A broadcast transmission device for transmitting a broadcast program via a broadcast wave;
A broadcasting / communication cooperation receiving apparatus for receiving the broadcasting program, which is used in a broadcasting / communication cooperation system including:
Application acquisition means for acquiring the application from the application server via a network;
Extraction means for extracting the resource usage range information from an application certificate added to or associated with the application;
Resource access control means for performing resource access control for prohibiting access to the resource for the acquired application based on the resource usage range information;
A broadcasting / communication cooperative receiving apparatus comprising: A starting range information application shows a possible organize ACTIVATE CHANNEL, applications and link range information the application shows a possible reference U RI, and the resource use range information the application shows the available resources have been added A certificate issuing device for issuing a certificate for use;
An application registration device for adding or associating the application certificate to the application;
An application server for storing an application to which the application certificate is added or associated;
A broadcast transmission device for transmitting a broadcast program via a broadcast wave;
A broadcast communication cooperative receiving device that receives the broadcast program, and a broadcast communication cooperative system comprising:
The broadcast communication cooperative receiving device is
Application acquisition means for acquiring the application from the application server via a network;
Extraction means for extracting the activation range information, the link range information, and the resource use range information from an application certificate added to or associated with the application;
Activation range determination means for determining whether or not the acquired application can be activated depending on whether or not the channel of the broadcast program that has been selected is included in the activation range information;
Link range determination means for determining whether or not the acquired application can be activated depending on whether or not the URI of the application server that is the acquisition source of the application is included in the link range information;
An activation control unit that controls activation of the application based on the determination results of the activation range determination unit and the link range determination unit;
Resource access control means for performing resource access control for prohibiting access to the resource for the acquired application based on the resource usage range information;
A broadcasting / communication cooperation system comprising: A starting range information application shows a possible organize ACTIVATE CHANNEL, and link range information the application shows a possible reference U RI, and resource usage range information the application shows the available resources are stored Access An access control file management device for signing the control file;
An application registration device for adding or associating the access control file to the application;
An application server for storing an application to which the access control file is added or associated;
A broadcast transmission device for transmitting a broadcast program via a broadcast wave;
A broadcast communication cooperative receiving device that receives the broadcast program, and a broadcast communication cooperative system comprising:
The broadcast communication cooperative receiving device is
Application acquisition means for acquiring the application from the application server via a network;
Application authentication means for verifying whether the signature of the access control file added or associated with the application is valid;
Extraction means for extracting the activation range information, the link range information, and the resource use range information from an access control file whose signature is verified by the application authentication unit;
Activation range determination means for determining whether or not the acquired application can be activated depending on whether or not the channel of the broadcast program that has been selected is included in the activation range information;
Link range determination means for determining whether or not the acquired application can be activated depending on whether or not the URI of the application server that is the acquisition source of the application is included in the link range information;
An activation control unit that controls activation of the application based on the determination results of the activation range determination unit and the link range determination unit;
Resource access control means for performing resource access control for prohibiting access to the resource for the acquired application based on the resource usage range information;
A broadcasting / communication cooperation system comprising:

Images