JP6756656B2 - Terminal device, registration method and registration program - Google Patents

Description

The present invention, an end terminal device, to the registration process and registration program.

In recent years, communication networks have become widespread, and services via networks are being actively provided. For example, the user uses a terminal device to register user information for a service provided via a network. Then, when the user uses the service, he / she tries to log in to the service based on the registered user information, and after the user authentication by the service, uses the service.

Here, as an authentication technology in a network, a technology is known in which authentication is performed not by a user terminal for using a service but by an authentication terminal that performs authentication, and the service is used by the user terminal based on such authentication information. (For example, Patent Document 1).

JP-A-2009-118110

However, with the above-mentioned conventional technique, it is difficult to perform a highly convenient registration process. For example, with the spread of communication networks, one user may use a plurality of different terminals to use a service or acquire various information. In this case, in the above-mentioned prior art, if the user desires to use a plurality of terminals as authentication terminals, the user needs to register each of the plurality of terminals on the service side. In addition, since the user needs to register for each service to be used, the registration process at the time of use becomes a burden, and there is a possibility that the spread of the service will not progress.

This application was made in view of the above, an end terminal device capable of performing excellent registration processing convenience, and to provide a registration method and a registration program.

The terminal device according to the present application is a terminal device that can use a service provided by a predetermined external device, and is detected by a detection unit that detects another terminal device and the detection unit based on a predetermined rule. A determination unit that determines the reliability of the other terminal device and a terminal device that can use the service provided by the external device are registered when the determination unit determines that the other terminal device is reliable. The predetermined database is provided with a registration unit for registering the other terminal device.

According to one aspect of the embodiment, there is an effect that the registration process having excellent convenience can be performed.

FIG. 1 is a diagram showing an example of registration processing according to the embodiment. FIG. 2 is a diagram showing a configuration example of a registration system according to an embodiment. FIG. 3 is a diagram showing a configuration example of the registration device according to the embodiment. FIG. 4 is a diagram showing an example of the trust policy storage unit according to the embodiment. FIG. 5 is a diagram showing an example of a registered device storage unit according to the embodiment. FIG. 6 is a diagram showing a configuration example of a user terminal according to the embodiment. FIG. 7 is a diagram showing an example of the trust policy storage unit according to the embodiment. FIG. 8 is a diagram showing an example of the registration information storage unit according to the embodiment. FIG. 9 is a sequence diagram (1) showing a processing procedure according to the embodiment. FIG. 10 is a sequence diagram (2) showing a processing procedure according to the embodiment. FIG. 11 is a diagram (1) for explaining an example of the registration process according to the modified example. FIG. 12 is a diagram (2) for explaining an example of the registration process according to the modified example. FIG. 13 is a diagram (3) for explaining an example of the registration process according to the modified example. FIG. 14 is a hardware configuration diagram showing an example of a computer that realizes the function of the registration device.

Hereinafter, an end terminal device according to the present application, embodiments of the registration method and a registration program (hereinafter, referred to as "embodiment") will be described in detail with reference to the drawings. The end terminal device according to the present This embodiment does not registration method and a registration program is limited. In addition, each embodiment can be appropriately combined as long as the processing contents do not contradict each other. Further, in each of the following embodiments, the same parts are designated by the same reference numerals, and duplicate description is omitted.

[1. Example of registration process]
First, an example of the registration process according to the embodiment will be described with reference to FIG. FIG. 1 is a diagram showing an example of registration processing according to the embodiment. In FIG. 1, a plurality of devices possessed by a user (when it is not necessary to distinguish each device, these are collectively referred to as “user terminal 10”” by the registration device 100 which is a server device corresponding to the registration device according to the present application. An example of the process in which) is registered is shown.

In the embodiment, registration means storing device information in the server in order to enjoy a predetermined service provided by the server. For example, a user who uses the user terminal 10 registers the user terminal 10 in order to use the registration device 100 and the service provided by the registration device connected to the registration device 100. When the service is used after the user terminal 10 is registered, the user terminal 10 accesses the registration device 100 and transmits the credential information (Credential Information) issued at the time of registration to the registration device 100. An example of credential information is a pass code. The registration device 100 authenticates the user terminal 10 when it is confirmed that the credential information transmitted from the user terminal 10 and the credential information issued at the time of registration of the user terminal 10 are not different. That is, the user terminal 10 obtains the authority to use the predetermined service by receiving the authentication from the registration device 100.

As described above, in order to use the service on the network, the user first needs to perform the registration process on the server (or the device that manages registration and authentication) that provides the service. However, one user often has a plurality of devices, and it is troublesome to register all of these devices.

Therefore, the registration device 100 and the user terminal 10 according to the present application perform the registration process having excellent convenience by performing the process described below. Hereinafter, the flow of the registration process performed by the registration device 100 and the user terminal 10 will be described with reference to FIG.

In FIG. 1, a smartphone 20 and a tablet 30 will be illustrated as an example of the user terminal 10. That is, it is assumed that the smartphone 20 and the tablet 30 are devices owned by the same user. In the following description, a device that transmits a registration request for another device, such as the smartphone 20, may be referred to as a "first terminal device". Further, a device such as the tablet 30 that transmits a registration request for its own device via another device may be referred to as a "second terminal device".

First, the smartphone 20 transmits a registration request to the registration device 100 (step S01). The registration device 100 determines the trust (reliability) of the smartphone 20 according to a predetermined trust policy (step S02). In the embodiment, the trust policy is a rule for determining the trust of the device registered in the registration device 100. That is, the registration device 100 determines whether or not the smartphone 20 that has transmitted the registration request is a device that conforms to the trust policy stored in the trust policy storage unit 121. In this case, the registration device 100 may acquire the information used for determining whether or not the trust policy is met from the smartphone 20 that has transmitted the registration request.

Then, when the registration device 100 conforms to the trust policy, the registration device 100 verifies the trust of the smartphone 20 that has sent the registration request and registers the smartphone 20 (step S03). Although the details will be described later, the trust policy in the embodiment corresponds to, for example, which manufacturer the device was manufactured by and which function the device has (for example, what protocol is supported). Is it a rule that indicates, etc.

The registration device 100 stores the registered device in the registration device storage unit 122. At the time of step S03, the registration device 100 registers the smartphone 20. When the smartphone 20 is registered, the registration device 100 responds with information regarding registration (step S04). For example, the registration device 100 transmits the unique identification information (ID) used in the future authentication process and the credential information paired with the ID to the smartphone 20. For example, the registration device 100 transmits a passcode or the like composed of a predetermined number of characters as credential information to the smartphone 20.

Here, it is assumed that the user who uses the smartphone 20 and the tablet 30 desires to use the service provided by the registration device 100 not only on the smartphone 20 but also on the tablet 30. In this case, the user operates the smartphone 20 to perform a predetermined detection process. Alternatively, the smartphone 20 performs a process of detecting a predetermined device without accepting the user's operation.

For example, the smartphone 20 performs a process of detecting a device in the vicinity of the smartphone 20 (step S05). For example, the smartphone 20 detects nearby devices by detecting radio waves such as Wifi (registered trademark) and Bluetooth (registered trademark), and by detecting devices using the same access point. By such processing, the smartphone 20 detects the tablet 30.

Then, the smartphone 20 transmits a registration request to the tablet 30 (step S06). The registration request in this case is a request transmitted from the smartphone 20 to the tablet 30, and includes a request for the smartphone 20 to transmit the terminal information of the tablet 30. That is, the registration request in this case means that the smartphone 20 requests the tablet 30 to transmit the terminal information in order to register the tablet 30 in some device.

The tablet 30 responds to the registration request from the smartphone 20 (step S07). Specifically, the tablet 30 transmits the terminal information of the tablet 30. For example, the tablet 30 responds to the smartphone 20 with information such as what kind of manufacturer the tablet 30 is manufactured by, or what kind of functions the tablet 30 has.

Then, the smartphone 20 makes a trust determination of the tablet 30 based on the information transmitted from the tablet 30 (step S08). For example, the smartphone 20 determines the trust of the tablet 30 according to the trust policy held by the smartphone 20.

For example, the smartphone 20 determines whether or not the tablet 30 is a terminal device that satisfies the standard according to the standard of the trust policy held by the smartphone 20. That is, the smartphone 20 determines whether or not the trust of the tablet 30 can be verified. In the example of FIG. 1, it is assumed that the smartphone 20 determines that the tablet 30 is a reliable device. In this case, the smartphone 20 transmits the registration request of the tablet 30 to the registration device 100 (step S09). At this time, the smartphone 20 includes information (for example, a signature) proving that the tablet 30 is trusted in the registration request based on the trust policy held by the smartphone 20. The trust policy held by the smartphone 20 may have, for example, the same standard as the trust policy held by the registration device 100.

When the registration device 100 receives the registration request of the tablet 30 from the smartphone 20, the registration device 100 analyzes the proof that the tablet 30 is trusted by the smartphone 20. For example, the registration device 100 verifies the signature given to the registration request by the smartphone 20. Then, when the registration device 100 determines that the signature by the smartphone 20 is reliable, the tablet 30 is additionally registered (step S10).

In this case, the registration device 100 may perform a process of registering the smartphone 20 and the tablet 30 in the same trust network by using a concept such as a trust network which is a network between trusted devices. That is, the registration device 100 additionally registers the tablet 30 with respect to the trust network formed by the smartphone 20. For example, the registration device 100 may perform processing such as providing a similar service for devices belonging to the same trusted network. For example, the registration device 100 may perform processing such as providing a common login screen when a device belonging to the same trusted network logs in to the service.

When the tablet 30 is registered, the registration device 100 responds to the smartphone 20 to that effect (step S11). In this case, the registration device 100 issues the ID and the credential information as in the case of registration of the smartphone 20. Then, the registration device 100 transmits the issued ID and the credential information to the smartphone 20.

When the smartphone 20 acquires the ID and the credential information, the smartphone 20 transmits the acquired ID and the credential information to the tablet 30 (step S12). In the future, the tablet 30 will be able to use the service provided by the registration device 100 by authenticating the registration device 100 using the ID and the credential information received from the smartphone 20.

As described above, the registration device 100 according to the embodiment is a registration request transmitted from the first terminal device whose reliability has been verified based on the trust policy which is a predetermined rule, and the first terminal device is Based on the rules it holds, it receives a registration request, which is a request that includes proof that the second terminal device (tablet 30) has been trusted by the first terminal device. Then, the registration device 100 registers the second terminal device when the registration request is received.

As described above, the registration device 100 according to the embodiment does not need to perform all the registration processing on the registration device 100 (server) side when registering the device, and the second terminal device is trusted by the first terminal device. If there is a terminal device, such a second terminal device can be registered. That is, the registration device 100 can determine the trust of the first terminal device and accept the registration of the second terminal device to which the trust has been propagated from the first terminal device. According to such a process, the user can save the trouble of accessing all the devices possessed by the user to perform the registration process, so that the registration process can be easily performed. Further, if the first terminal device is set to automatically detect a nearby device, the user can autonomously and automatically perform the registration process by each device, and thus the registration device 100. You can automatically increase the number of devices that can use the service. Further, the first terminal device itself holds the trust policy, and makes a trust determination of the second terminal device according to the policy. That is, the first terminal device determines the trust of the second terminal device according to the same criteria as when the registration device 100 determines the trust of the first terminal device. Therefore, according to the registration process according to the embodiment, it is possible to perform registration in which safety is ensured. As described above, the registration device 100 according to the embodiment can perform the registration process that is convenient for the user.

[2. Registration system configuration]
Next, the configuration of the registration system 1 including the registration device 100 according to the embodiment will be described with reference to FIG. FIG. 2 is a diagram showing a configuration example of the registration system 1 according to the embodiment. As illustrated in FIG. 2, the registration system 1 according to the embodiment includes a user terminal 10 and a registration device 100. Further, the user terminal 10 includes a smartphone 20, a tablet 30, and the like. These various devices are communicably connected by wire or wirelessly via the network N.

The user terminal 10 is, for example, an information processing terminal (device) such as a desktop PC (Personal Computer), a notebook PC, a tablet terminal, a mobile phone including a smartphone, or a PDA (Personal Digital Assistant). Further, the user terminal 10 also includes a wearable device such as a watch-type terminal and a spectacle-type terminal. Further, the user terminal 10 may include various smart devices having an information processing function. For example, the user terminal 10 may include a smart home appliance such as a TV (Television), a smart vehicle such as an automobile, a drone, a domestic robot, and the like.

The registration device 100 is a server device that registers the user terminal 10 based on a predetermined trust policy. Further, when the registration device 100 receives a registration request including the fact that a different device is trusted from the already registered user terminal 10, the registration device 100 registers the device. That is, the registration device 100 can register a new device by adding it to the already registered user terminal 10 based on the propagated trust.

The registration device 100 may also function as a web server that provides various services. Further, the registration device 100 serves as an authentication management device that allows the user terminal 10 to access (use the service) the web server that provides various services through the authentication process for the user terminal 10. It may work.

[3. Registration device configuration]
Next, the configuration of the registration device 100 according to the embodiment will be described with reference to FIG. FIG. 3 is a diagram showing a configuration example of the registration device 100 according to the embodiment. As shown in FIG. 3, the registration device 100 includes a communication unit 110, a storage unit 120, and a control unit 130. The registration device 100 includes an input unit (for example, a keyboard, a mouse, etc.) that receives various operations from an administrator or the like who uses the registration device 100, and a display unit (for example, a liquid crystal display, etc.) for displaying various information. You may have.

(About communication unit 110)
The communication unit 110 is realized by, for example, a NIC (Network Interface Card) or the like. The communication unit 110 is connected to the network N by wire or wirelessly, and transmits / receives information to / from the user terminal 10 via the network N.

(About storage unit 120)
The storage unit 120 is realized by, for example, a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory (Flash Memory), or a storage device such as a hard disk or an optical disk. The storage unit 120 has a trust policy storage unit 121 and a registration device storage unit 122.

(About trust policy storage unit 121)
The trust policy storage unit 121 stores the trust policy for determining the reliability of the user terminal 10 when registering the user terminal 10. Here, FIG. 4 shows an example of the trust policy storage unit 121 according to the embodiment. FIG. 4 is a diagram showing an example of the trust policy storage unit 121 according to the embodiment. In the example shown in FIG. 4, the trust policy storage unit 121 has items such as "determination element", "type", and "content".

The "determination element" indicates an element for determining the reliability of the user terminal 10. For example, the determination element can take information such as "manufacturing information" and "implementation function". The manufacturing information indicates information regarding the manufacturing of the user terminal 10. The implementation function indicates information about the function included in the user terminal 10.

"Type" indicates the type of the determination element. For example, when the determination element is manufacturing information, the type includes "manufacturer name" and the like. This indicates whether or not the user terminal 10 is trusted depending on which manufacturer the user terminal 10 is manufactured by. When the determination element is an implementation function, the type includes "trust proof" and the like. This indicates information such as which function is provided as a function of the user terminal 10 as a function of proving the trust of the user terminal 10 itself.

"Content" indicates the content related to each determination element. For example, when the type of the determination element is "manufacturer name" and the content is "manufacturer M01", the user terminal 10 manufactured by the manufacturer M01 is recognized to have a certain degree of reliability in the trust policy. Shown.

Further, when the type of the determination element is "trust proof" and the content is "safety compliant F01", the user terminal 10 satisfying the safety compliant F01 has a certain degree of reliability in the trust policy. It shows that it is accepted. Note that FIG. 4 shows an example in which conceptual information such as "safety-compliant F01" is stored for the content of the trust certificate, but in reality, the device is specified for safety in the content of the trust certificate. Information such as support for protocols that meet the standards and the ability to generate encrypted information standardized by a specific association is stored.

That is, FIG. 4 shows that the trust policy held by the registration device 100 includes determination elements such as "manufacturing information" and "implementation function" as determination elements. In addition, there is a type of manufacturing information called "manufacturer name", which indicates that devices manufactured by manufacturers such as "manufacturer M01", "manufacturer M02", and "manufacturer M03" are given a certain degree of trust. In addition, there is a type of "trust certification" in the mounting function, for example, when the device has functions such as "safety compliant F01", "safety compliant F02", and "safety compliant F03" (in the relevant function). If the device supports it), it indicates that the device has a certain degree of trust. The trust policy storage unit 121 may store a determination element having a predetermined signature. That is, the trust policy storage unit 121 is a determination element with a signature certifying that the device is manufactured by "Manufacturer M01" and a signature for certification information that "Safety Compliant F02" is certified. Remember. Then, the registration device 100 may perform a process of verifying the trust of the user terminal 10 by verifying these signatures.

(Regarding the registered device storage unit 122)
The registration device storage unit 122 stores information about the device registered in the registration device 100. Here, FIG. 5 shows an example of the registered device storage unit 122 according to the embodiment. FIG. 5 is a diagram showing an example of the registered device storage unit 122 according to the embodiment. In the example shown in FIG. 5, the registered device storage unit 122 has items such as “device ID”, “type”, “issue ID”, and “credential”. In addition, the credential item has sub-items such as "type" and "verification data".

The “device ID” indicates identification information of the device registered in the registration device 100. In the embodiment, the device ID is assumed to match the reference code. For example, a device having a device ID of "20" indicates a smartphone 20. Similarly, a device having a device ID of "30" indicates a tablet 30.

"Type" indicates the type of device. The "issue ID" indicates the identification information issued to the device when the registration device 100 registers the device.

"Credentials" indicate information used to authenticate a registered device. “Type” indicates the type of information used as the credential. For example, types include passcodes, biometric information, hardware tokens, and the like. "Verification data" indicates data for verifying the authentication of the registered device. For example, the verification data is a character string such as "XXXXXX" in the case of a passcode, and fingerprint data of a user who uses the device in the case of biometric information.

That is, in FIG. 5, it is shown that the device registered by the registration device 100 is a device having identification information such as “20” or “30”, and each type is “smartphone” or “tablet”. There is. Further, it is shown that the ID issued for the registration of the smartphone 20 is "dev01". Further, the type of credential used when authenticating the smartphone 20 is "passcode", and the verification data of the passcode is "XXXXXX".

(About control unit 130)
The control unit 130 is, for example, a controller, and various programs (registration related to the embodiment) stored in the storage device inside the registration device 100 by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like. (Corresponding to an example of a program) is realized by executing RAM as a work area. Further, the control unit 130 is a controller, and is realized by, for example, an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

As shown in FIG. 3, the control unit 130 includes a reception unit 131, a determination unit 132, a registration unit 133, and a transmission unit 134, and realizes or executes an information processing function or action described below. .. The internal configuration of the control unit 130 is not limited to the configuration shown in FIG. 3, and may be another configuration as long as it is a configuration for performing information processing described later. Further, the connection relationship of each processing unit included in the control unit 130 is not limited to the connection relationship shown in FIG. 3, and may be another connection relationship.

(About receiver 131)
The receiving unit 131 receives various information. For example, the receiving unit 131 receives a request for registration to the registration device 100 from the smartphone 20, which is an example of the user terminal 10.

Further, the receiving unit 131 is a registration request transmitted from the smartphone 20 whose reliability has been authenticated based on a predetermined rule, and is a user different from the smartphone 20 depending on the smartphone 20 based on the rule held by the smartphone 20. The terminal 10 (eg, tablet 30) receives a registration request, which is a request including proof of trust. That is, the receiving unit 131 receives not only the direct registration request but also the indirect registration request related to the tablet 30 transmitted from the already registered smartphone 20.

When receiving the registration request, the receiving unit 131 receives information about the smartphone 20 that sent the registration request and the tablet 30 that newly requests the registration. For example, the receiving unit 131 receives information such as identification information of the smartphone 20, type as a device, manufacturing information, and a function to be implemented.

(About judgment unit 132)
The determination unit 132 determines the reliability of the registration request received by the reception unit 131. For example, the determination unit 132 determines the reliability of whether or not the smartphone 20 requesting registration is a reliable terminal device.

The determination unit 132 determines the reliability according to the trust policy, which is a predetermined rule. For example, the determination unit 132 determines whether or not the smartphone 20 that has transmitted the registration request has conditions that meet the elements for being recognized as a reliable terminal device in the trust policy. In this case, the determination unit 132 may determine the reliability by a single element, or may determine the reliability by scoring a plurality of elements.

Further, the determination unit 132 is a registration request transmitted from the smartphone 20, and for a registration request including the fact that the smartphone 20 has proved the reliability of the tablet 30, the registration request is truly transmitted from the smartphone 20. You may judge the reliability of the source such as whether or not.

For example, the determination unit 132 proves that the proof included in the registration request has trusted the tablet 30 by the smartphone 20 based on a rule having a standard equivalent to the trust policy held by the registration device 100. In some cases, the tablet 30 may be determined to be a reliable terminal device. That is, the determination unit 132 is a terminal device that makes the tablet 30 reliable when the smartphone 20 has a trust policy of the same standard as the registration device 100 and the tablet 30 is determined by the trust policy. Judge that there is. In other words, the determination unit 132 determines whether or not the reliability of the other terminal device is determined by the terminal device to which the trust policy in the registration device 100 is appropriately propagated.

The determination unit 132 may simplify the determination process by relying on the process performed by the already registered smartphone 20. For example, the determination unit 132 determines whether or not the proof included in the registration request is based on a predetermined communication established between the smartphone 20 and the tablet 30 without performing the determination of the trust policy as described above. It may be determined.

Then, when the proof included in the registration request is based on a predetermined communication, the determination unit 132 trusts the registration request transmitted from the smartphone 20 and determines that the tablet 30 is a reliable terminal device. May be good. The predetermined communication is, for example, short-range communication (for example, Bluetooth) by pairing established between the smartphone 20 and the tablet 30.

That is, when communication is established between the smartphone 20 and the tablet 30, the determination unit 132 presumes that the smartphone 20 is a terminal device having a close relationship such as being owned by the same user. Trust the registration request sent from the smartphone 20. In this case, since the determination unit 132 can simplify the determination process, the processing load can be reduced. Further, for example, the determination unit 132 uses the fact that communication between the first terminal device and the second terminal device is established as a determination element, so that the first terminal device can be determined by what kind of trust policy. Even if it is unclear whether the terminal device of 2 is determined, a certain degree of reliability can be ensured, so that a safe registration process can be performed.

(Registration section 133)
The registration unit 133 registers the user terminal 10 based on a predetermined rule. For example, the registration unit 133 registers the smartphone 20 (first terminal device) based on the trust policy stored in the trust policy storage unit 121. Specifically, the registration unit 133 registers the smartphone 20 when the reliability of the smartphone 20 is authenticated by the determination unit 132 based on a predetermined rule.

Then, the registration unit 133 receives a registration request including proof that the tablet 30 (second terminal device) is trusted by the smartphone 20 based on the rules held by the smartphone 20. To register.

In addition, the registration unit 133 makes a registration request by determining the reliability of the registration request by the determination unit 132 and the reliability of the proof that the second terminal device is trusted by the first terminal device. When it is determined that the user terminal 10 is a reliable terminal device, the user terminal 10 may be registered.

For example, the registration unit 133 trusts the second terminal device by the first terminal device based on a rule in which the proof contained in the registration request has the same criteria as the trust policy stored in the trust policy storage unit 121. A second terminal device may be registered if it proves that it has been done.

Further, when registering the user terminal 10, the registration unit 133 issues unique identification information and credential information for each user terminal 10. When the registration unit 133 is accessed from the user terminal 10 after registration, the registration unit 133 requests the user terminal 10 to present the unique identification information and the credential information issued at the time of registration. Then, the registration unit 133 authenticates the user terminal 10 that presents the correct unique identification information and the credential information. The authenticated user terminal 10 obtains the authority to use, for example, the service provided by the registration device 100.

Further, the registration unit 133 transfers the identification information issued at the time of registration, which is unique identification information used when the second terminal device accesses the registration device 100, via the first terminal device. It may be issued to the second terminal device. That is, the registration unit 133 passes the unique identification information and the credential information to the second terminal device via the first terminal device. As a result, the registration unit 133 may be in a situation where it is difficult for the second terminal device to directly communicate with the registration device 100, or may directly receive unique identification information or credential information. Even if it is not possible, the second terminal device can be registered without any trouble.

(About transmitter 134)
The transmission unit 134 transmits various information. For example, the transmission unit 134 transmits a response regarding registration to the user terminal 10 that has transmitted the registration request. As a response, the transmission unit 134 transmits to the user terminal 10 that the registration has been performed, and the unique identification information and credential information issued at the time of registration.

[4. User terminal configuration]
Next, the configuration of the user terminal 10 according to the embodiment will be described with reference to FIG. FIG. 6 is a diagram showing a configuration example of the user terminal 10 according to the embodiment. As shown in FIG. 6, the user terminal 10 has a communication unit 11, an input unit 12, a display unit 13, a detection unit 14, a storage unit 15, and a control unit 16.

(About communication unit 11)
The communication unit 11 is realized by, for example, a NIC or the like. The communication unit 11 is connected to the network N by wire or wirelessly, and transmits / receives information to / from the registration device 100, an arbitrary device, or the like via the network N.

(About the input unit 12 and the display unit 13)
The input unit 12 is an input device that receives various operations from the user. For example, the input unit 12 is realized by an operation key or the like provided on the user terminal 10. The display unit 13 is a display device for displaying various information. For example, the display unit 13 is realized by a liquid crystal display or the like. When a touch panel is adopted for the user terminal 10, a part of the input unit 12 and the display unit 13 are integrated.

(About detection unit 14)
The detection unit 14 detects various information about the user terminal 10. Specifically, the detection unit 14 detects the user's operation on the user terminal 10, the location information where the user terminal 10 is located, the information about the device connected to the user terminal 10, the environment in the user terminal 10, and the like. To do.

For example, the detection unit 14 detects the user's operation based on the information input to the input unit 12. That is, the detection unit 14 detects that the input unit 12 has been input for an operation of touching the screen, that there has been a voice input, and the like. Further, the detection unit 14 may detect that a predetermined application has been started by the user. When such an application is an application that operates an imaging function (for example, a camera) in the user terminal 10, the detection unit 14 detects that the imaging function is being used by the user. Further, the detection unit 14 may detect an operation such that the user terminal 10 itself is moved based on the data detected by the acceleration sensor, the gyro sensor, or the like provided in the user terminal 10.

Further, the detection unit 14 detects the current position of the user terminal 10. Specifically, the detection unit 14 receives radio waves transmitted from a GPS (Global Positioning System) satellite, and based on the received radio waves, provides position information (for example, latitude and longitude) indicating the current position of the user terminal 10. get.

Further, the detection unit 14 may acquire the position information by various methods. For example, when the user terminal 10 has a function equivalent to that of a contactless IC card used at a station ticket gate or a store (or, the user terminal 10 has a function of reading the history of a contactless IC card. Case), the used position is recorded together with the information that the boarding fee is settled at the station by the user terminal 10. The detection unit 14 detects such information and acquires it as position information. Further, when the user terminal 10 communicates with a specific access point, the detection unit 14 may detect the position information that can be acquired from the access point. Further, the position information may be acquired by an optical sensor, an infrared sensor, a magnetic sensor, or the like provided in the user terminal 10.

Further, the detection unit 14 detects an external device connected to the user terminal 10. For example, the detection unit 14 detects the external device based on the exchange of communication packets with the external device, the signal emitted by the external device, and the like. Specifically, the detection unit 14 detects radio waves such as Wifi and Bluetooth used by an external device. Further, the detection unit 14 may detect the type of connection with the external device when communication with the external device is established. For example, the detection unit 14 detects whether it is connected to an external device by wire or by wireless communication. Further, the detection unit 14 may detect a communication method or the like used in wireless communication. Further, the detection unit 14 may detect the external device based on the information acquired by the radio wave sensor that detects the radio wave emitted by the external device, the electromagnetic wave sensor that detects the electromagnetic wave, and the like. An example of an external device is another device (another user terminal 10) used by a user who uses the user terminal 10, and is, for example, a smartphone 20 or a tablet 30.

Further, the detection unit 14 detects the environment in the user terminal 10. The detection unit 14 detects information about the environment by using various sensors and functions provided in the user terminal 10. For example, the detection unit 14 includes a microphone that collects sounds around the user terminal 10, an illuminance sensor that detects the illuminance around the user terminal 10, and an acceleration sensor (or an acceleration sensor) that detects the physical movement of the user terminal 10. A gyro sensor, etc.), a humidity sensor that detects the illuminance around the user terminal 10, a geomagnetic sensor that detects the magnetic field at the location of the user terminal 10, and the like are used. Then, the detection unit 14 detects various information by using various sensors. For example, the detection unit 14 detects the noise level around the user terminal 10, whether the surroundings of the user terminal 10 have an illuminance suitable for capturing the user's iris, and the like. Further, the detection unit 14 may detect surrounding environment information based on a photograph or video taken by the camera.

Further, the user terminal 10 may acquire context information indicating the context of the user terminal 10 based on the information detected by the detection unit 14. As described above, the user terminal 10 has various built-in sensors (detection unit 14) such as position, acceleration, temperature, gravity, rotation (angular velocity), illuminance, geomagnetism, pressure, proximity, humidity, and rotation vector. Get the physical quantity of as context information. Further, the user terminal 10 may acquire the connection status with various devices (for example, information on the establishment of communication and the communication standard used) as context information by using the built-in communication function. ..

(About storage unit 15)
The storage unit 15 stores various information. The storage unit 15 is realized by, for example, a semiconductor memory element such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 15 includes a trust policy storage unit 151 and a registration information storage unit 152.

(About trust policy storage 151)
The trust policy storage unit 151 stores the trust policy used by the user terminal 10 to determine the trust of other devices. Here, FIG. 7 shows an example of the trust policy storage unit 151 according to the embodiment. FIG. 7 is a diagram showing an example of the trust policy storage unit 151 according to the embodiment. In the example shown in FIG. 7, the trust policy storage unit 151 has items such as "determination element", "type", and "content". The same contents as those described with reference to FIG. 4 will be omitted.

“Pairing” in the mounting function indicates an example of the type of mounting function determined by the user terminal 10. In the example shown in FIG. 7, for a device for which pairing has been established with a reliable terminal (in the example of FIG. 7, the smartphone 20 is exemplified), the user terminal 10 is constant based on the trust policy. It shows that reliability is recognized.

The trust policy storage unit 151 may be set to receive communication from the registration device 100 and synchronize with the trust policy stored in the trust policy storage unit 121. In other words, the trust policy stored in the trust policy storage unit 151 may be the same as the trust policy stored in the trust policy storage unit 121.

(Registration information storage unit 152)
The registration information storage unit 152 stores the registration information registered in the registration device 100 with respect to the own device and the terminal (second terminal device) trusted by the own device. Here, FIG. 8 shows an example of the registration information storage unit 152 according to the embodiment. FIG. 8 is a diagram showing an example of the registration information storage unit 152 according to the embodiment. As shown in FIG. 8, the registration information storage unit 152 has items such as “registration server”, “device ID”, “type”, “issue ID”, and “credential”. In addition, the credential item has sub-items such as "type" and "verification data". The same contents as those described in FIG. 5 will be omitted.

The "registration server" indicates a server device registered by the user terminal 10. That is, in FIG. 8, the user terminal 10 is registered with the "registration device 100", and each device ID is a device having identification information such as "20" or "30", and each type is Indicates that it is a "smartphone" or "tablet". Further, it is shown that the ID issued for the registration of the smartphone 20 is "dev01". Further, the type of credential used when authenticating the smartphone 20 is "passcode", and the verification data of the passcode is "XXXXXX".

(About control unit 16)
The control unit 16 is a controller, and is realized by, for example, a CPU, an MPU, or the like executing various programs stored in a storage device inside the user terminal 10 using the RAM as a work area. Further, the control unit 16 is a controller, and is realized by, for example, an integrated circuit such as an ASIC or FPGA.

As shown in FIG. 6, the control unit 16 includes a reception unit 161, a detection unit 162, a determination unit 163, a generation unit 164, and a transmission unit 165, and functions and operations of information processing described below. To realize or execute. The internal configuration of the control unit 16 is not limited to the configuration shown in FIG. 6, and may be another configuration as long as it is a configuration for performing information processing described later.

(About receiver 161)
The receiving unit 161 receives various information. For example, the receiving unit 161 receives registration information such as the fact that registration has been performed from the registration device 100 and unique identification information and credential information issued when registration has been performed from the registration device 100.

(About detector 162)
The detection unit 162 detects the second terminal device based on the information detected by the detection unit 14. That is, the detection unit 162 detects a device that requests registration to the registration device 100 but has not yet been registered to the registration device 100. In addition, in detecting the second terminal device, the detection unit 162 may perform the detection based on the operation from the user, or may perform the detection in response to the request from the second terminal device. Further, the detection unit 162 may, for example, use an application that performs registration processing to perform processing for detecting a short-distance device that is activating the same application as a second terminal device.

(About judgment unit 163)
The determination unit 163 determines the reliability of the second terminal device detected by the detection unit 162 based on a predetermined rule. Specifically, the determination unit 163 determines the reliability of the second terminal device based on the trust policy stored in the trust policy storage unit 151.

In this case, the determination unit 163 may determine the reliability of the second terminal device by using a trust policy based on a standard equivalent to the trust policy held by the registration device 100. That is, since the second terminal device trusted by the first terminal device forms a trusted network which is a network trusted by each other, the first terminal device itself is registered in the registration device 100. It is desirable to determine the second terminal device based on the trust policy used at that time.

Therefore, the determination unit 163 determines the second terminal device after performing processing so that the trust policy held by the own device becomes the same standard as the trust policy held by the registration device 100. For example, the determination unit 163 may make a request to the registration device 100, cause the registration device 100 to transmit the trust policy, and perform a process of updating the trust policy of the own device. Further, the determination unit 163 may make a request to a predetermined external device and acquire a trust policy in accordance with the predetermined standard (for example, the standard to which the registration device 100 complies).

(About generator 164)
The generation unit 164 generates various information. For example, the generation unit 164 is a request including proof that the second terminal device is trusted when the determination unit 163 determines that the second terminal device is a reliable device, and is registered. Generate a registration request requesting that the second terminal device be registered in the device 100.

When generating the registration request, the generation unit 164 ensures reliability, for example, by adding a signature indicating that the registration request is definitely generated by the user terminal 10 (first terminal device). May be done.

(About transmitter 165)
The transmission unit 165 transmits various information. For example, the transmission unit 165 transmits a registration request generated by the generation unit 164, including proof that the second terminal device is trusted, to the registration device 100. Further, when the second terminal device is registered by the registration device 100, the transmission unit 165 transfers the unique identification information and the credential information issued from the registration device 100 to the second terminal device to the second terminal device. Send to the terminal device.

[5. Processing procedure]
Next, the procedure of processing by the registration system 1 according to the embodiment will be described with reference to FIGS. 9 and 10. First, the procedure in which the registration device 100 registers the smartphone 20, which is the first terminal device, will be described with reference to FIG. FIG. 9 is a sequence diagram (1) showing a processing procedure.

As shown in FIG. 9, the first terminal device (smartphone 20) requests the registration device 100 to register (step S101). That is, the first terminal device transmits a registration request to the registration device 100. The registration device 100 that has received the registration request determines the trust of the first terminal device based on the trust policy stored in the trust policy storage unit 121 (step S102).

Then, when the registration device 100 determines that the first terminal device is a reliable device, the registration device 100 registers the first terminal device. In this case, the registration device 100 issues unique identification information (ID) corresponding to the first terminal device (step S103).

The registration device 100 transmits the issued ID to the first terminal device (step S104). The first terminal device stores the ID as registration information (step S105).

Next, the procedure in which the registration device 100 registers the tablet 30, which is the second terminal device, will be described with reference to FIG. FIG. 10 is a sequence diagram (2) showing a processing procedure.

As shown in FIG. 10, the first terminal device (smartphone 20) detects the second terminal device (tablet 30) (step S201). The second terminal device transmits information in response to the detection (step S202). The information that responds to the detection is, for example, that the first terminal device that has performed the detection trusts the communication from the first terminal device and that the information transmitted from the first terminal device is received. Information that indicates that the preparation is complete.

Subsequently, the first terminal device transmits information regarding the registration request (step S203). The information regarding the registration request includes, for example, information for confirming whether or not the registration device 100 is permitted to make the registration request, and information regarding the second terminal device used when generating the registration request. Information or the like for confirming whether or not transmission to the terminal device of 1 is permitted.

The second terminal device transmits information in response to the registration request to the first terminal device (step S204). The information that responds to the registration request is, for example, information that permits the registration device 100 to make a registration request, information about the second terminal device (manufacturing information, information including a function to be implemented), and the like. ..

The first terminal device determines the trust of the second terminal device based on the information stored in the trust policy storage unit 151 by using the information returned from the second terminal device (step S205). Further, the first terminal device generates a registration request including proof that the second terminal device has been trusted (step S206).

Then, the first terminal device transmits the generated registration request to the registration device 100 (step S207). The registration device 100 determines the registration request transmitted from the first terminal device (step S208). Then, the registration device 100 registers the second terminal device when the proof that the first terminal device has trusted the second terminal device is reliable. In addition, the registration device 100 indicates whether or not the proof that the first terminal device has trusted the second terminal device is reliable, for example, in the signature attached from the first terminal device. Judge based on.

Then, the registration device 100 issues unique identification information (ID) corresponding to the second terminal device (step S209). The registration device 100 transmits the issued ID to the first terminal device (step S210).

The first terminal device transmits the ID transmitted from the registration device 100 to the second terminal device (step S211). The second terminal device stores the ID transmitted from the first terminal device as registration information (step S212). After that, the second terminal device can use the service or the like provided by the registration device 100 by using the ID and the credential information transmitted from the first terminal device.

[6. Modification example]
The processing by the registration system 1 described above may be carried out in various different forms other than the above-described embodiment. Therefore, another embodiment of the registration system 1 will be described below.

[6-1. Registration using the key method]
The user terminal 10 side may perform a more secure registration process when registering with the registration device 100. This point will be described with reference to FIG. FIG. 11 is a diagram (1) for explaining an example of the registration process according to the modified example. In the example of FIG. 11, it is assumed that the registration device 100 has already registered the smartphone 20 as the first terminal device.

The smartphone 20 detects the tablet 30 as a nearby device (step S21). Then, the smartphone 20 transmits information regarding the registration request to the tablet 30 (step S22). The tablet 30 responds to the request from the smartphone 20 (step S23). Then, the smartphone 20 makes a trust determination of the tablet 30 based on the information transmitted from the tablet 30 (step S24). For example, the smartphone 20 determines the trust of the tablet 30 according to the trust policy held by the smartphone 20. As described above, the processes of steps S21 to S24 correspond to steps S05 to S08 shown in FIG.

Subsequently, the smartphone 20 requests the tablet 30 for registration information (step S25). Here, the registration information requested by the smartphone 20 indicates the information to be registered in the registration device 100 from the tablet 30 side. On the other hand, the tablet 30 performs a process of issuing a private key and a public key related to registration as registration information (step S26).

Here, the private key and the public key issued by the tablet 30 are paired and serve as a key for performing the authentication process of the tablet 30. For example, the tablet 30 adopts a key system in which the private key is held by the own device and the public key is held on the server side. In this case, if the tablet 30 transmits the information signed using the private key to the server side and the server side cannot decrypt the information signed using the private key using the public key, the registration device 100 will perform the registration device 100. Does not authenticate the tablet 30.

For example, the tablet 30 holds the issued private key in a storage area that cannot be accessed unless a specific authentication process is performed. The specific authentication process is, for example, an authentication process using biometric information of a user who owns the tablet 30. In this case, the tablet 30 cannot access the private key unless it accepts the biometric information of the user, and the information of the private key cannot be used. That is, the tablet 30 cannot be authenticated by the registration device 100 until it receives the biometric information of the user set as its own user. By adopting such an authentication method, the tablet 30 does not transmit credential information such as a passcode to the registration device 100 to perform authentication, so that the security of authentication can be enhanced.

The tablet 30 transmits the issued public key to the smartphone 20 (step S27). The tablet 30 may attach a signature indicating that it has been issued to the public key.

Then, the smartphone 20 transmits the public key to the registration device 100 together with the registration request of the tablet 30 (step S28). At this time, the smartphone 20 includes information proving that the tablet 30 is trusted in the registration request based on the trust policy held by the smartphone 20.

When the registration device 100 receives the registration request and the public key of the tablet 30 from the smartphone 20, the registration device 100 analyzes the proof that the tablet 30 is trusted by the smartphone 20. Further, the registration device 100 determines the signature of the public key issued by the tablet 30 (step S29). For example, in the registration device 100, the tablet 30 that issued the public key is determined to be a reliable device based on the trust policy held by the smartphone 20, and the public key attached by the tablet 30 is determined. Determine that the signature is credible.

Then, the registration device 100 registers the public key in association with the tablet 30 (step S30). That is, the registration device 100 additionally registers the tablet 30 together with the public key (step S31).

The registration device 100 transmits a response indicating that the tablet 30 has been registered to the smartphone 20 (step S32). The smartphone 20 transmits the issued ID to the tablet 30 (step S33).

After that, when the tablet 30 authenticates to the registration device 100, the tablet 30 does not transmit the credential information such as the passcode, but authenticates using a predetermined authentication means (step S34). That is, the tablet 30 requires the user to input biometric information in the authentication process. Then, when the user inputs the biometric information and the input information is collated, the tablet 30 accesses the private key. Then, the tablet 30 generates the encrypted information by adding a signature using the private key. The tablet 30 transmits the generated information to the registration device 100. The registration device 100 decrypts the transmitted information with the public key. If the combined processing is performed, the registration device 100 determines that the tablet 30 is being used by a true user, and authenticates the tablet 30 with such processing. That is, the tablet 30 can transmit information proving that it is being used by a true user to the registration device 100 without directly transmitting information such as a passcode, so that highly secure authentication is performed. be able to.

As described above, the registration device 100 is a public key issued by the tablet 30 (second terminal device) together with the registration request transmitted from the smartphone 20 (first terminal device), and is an authentication process of the tablet 30. Receive the public key used for. Then, the registration device 100 registers the public key in association with the tablet 30. By such a process, the registration device 100 can perform a highly convenient and highly secure registration process.

[6-2. Trust Propagation]
The user terminal 10 side may determine another device by a plurality of user terminals 10 when generating a registration request to the registration device 100. This point will be described with reference to FIG. FIG. 12 is a diagram (2) for explaining an example of the registration process according to the modified example. In the example of FIG. 12, it is assumed that the registration device 100 has already registered the smartphone 20 as the first terminal device and the tablet 30 as the second terminal device.

The smartphone 20 or tablet 30 detects the watch-type terminal 40 as a nearby device (step S41). Then, the smartphone 20 or the tablet 30 transmits information regarding the registration request to the watch-type terminal 40 (step S42). The watch-type terminal 40 responds to a request from the smartphone 20 or the tablet 30 (step S43). As described above, the processes of steps S41 to S43 correspond to steps S05 to S07 shown in FIG.

Then, the smartphone 20 or the tablet 30 makes a trust determination of the watch-type terminal 40 based on the information transmitted from the watch-type terminal 40. That is, the smartphone 20 or the tablet 30 makes a trust determination of the watch-type terminal 40 with a plurality of devices (step S44). In this case, the smartphone 20 or the tablet 30 may perform the trust determination of the watch-type terminal 40 on behalf of any one device, or the two devices may perform the trust determination of the watch-type terminal 40 together, and both of them. The watch-type terminal 40 may be determined to be a reliable device only when it is determined that is a trust. Further, the smartphone 20 or the tablet 30 may have the same trust policy or may have different trust policies.

Then, the smartphone 20 or the tablet 30 transmits the registration request of the watch-type terminal 40 to the registration device 100 (step S45). The registration device 100 trusts the registration request transmitted from the smartphone 20 or the tablet 30 because, for example, the source smartphone 20 or the tablet 30 has already been registered. Alternatively, the registration device 100 may determine the reliability of the registration request based on the various determinations described above (step S46).

Then, the registration device 100 additionally registers the clock-type terminal 40 when the registration request is trusted (step S47). In other words, the registration device 100 additionally registers the watch-type terminal 40 in the trust network already constructed by the smartphone 20 and the tablet 30.

Then, the registration device 100 transmits a response indicating that the watch-type terminal 40 has been registered to the smartphone 20 or the tablet 30 (step S48). The smartphone 20 or tablet 30 transmits the issued ID to the watch-type terminal 40 (step S49).

As described above, the registration device 100 is a registration request transmitted from the smartphone 20 (first terminal device) or the already registered tablet 30 (second terminal device), and is held by the smartphone 20 or the tablet 30. Includes proof that the smartphone 20 or tablet 30 has trusted a third terminal device (clock-type terminal 40 in the example of FIG. 12), which is a device different from the smartphone 20 or tablet 30, based on the trust policy. Receive the registration request, which is a request. Then, the registration device 100 registers the third terminal device when the registration request is received. In this way, the registration device 100 may accept registration of a different device based on the trust determination by any of the plurality of devices already registered. As a result, the registration device 100 can perform the registration process that is highly convenient for the user.

The registration device 100 is a registration request transmitted from any device whose reliability has been authenticated, and at least two of any devices are based on a rule held by at least one of the devices. As described above, the registration request, which is a request including proof that the fourth terminal device (arbitrary user terminal 10), which is a device different from any of the already registered devices, is trusted, is received, and the registration request is made. When it is received, the fourth terminal device may be registered.

That is, the registration device 100 may trust the registration request when the fourth terminal device is trusted by at least two or more devices instead of any one device. In other words, the registration device 100 estimates that reliability cannot be ensured by the determination process by any one device, and trusts only the fourth terminal device in which the determination process by the plurality of devices is performed. As a result, the registration device 100 can further improve the safety of the registration process.

[6-3. Cooperative processing between devices]
The user terminal 10 side may perform a process of constructing a trust network by a plurality of devices or a process of additionally registering a new device without going through the registration device 100. This point will be described with reference to FIG. FIG. 13 is a diagram (3) for explaining an example of the registration process according to the modified example. In the example of FIG. 13, it is assumed that the smartphone 20 and the tablet 30 have already constructed a predetermined trust network without going through the registration device 100. In the example shown in FIG. 13, the smartphone 20 or the tablet 30 (that is, the user terminal 10) has a registration unit 166 in addition to the configuration shown in FIG.

The smartphone 20 or tablet 30 detects the watch-type terminal 40 as a nearby device (step S61). Then, the smartphone 20 or the tablet 30 transmits information regarding the registration request to the watch-type terminal 40 (step S62). The watch-type terminal 40 responds to a request from the smartphone 20 or the tablet 30 (step S63).

Then, the smartphone 20 or the tablet 30 makes a trust determination of the watch-type terminal 40 based on the information transmitted from the watch-type terminal 40. That is, the smartphone 20 or the tablet 30 makes a trust determination of the watch-type terminal 40 with a plurality of devices (step S64). In this case, the smartphone 20 or the tablet 30 may perform the trust determination of the watch-type terminal 40 on behalf of any one device, or the two devices may perform the trust determination of the watch-type terminal 40 together, and both of them. The watch-type terminal 40 may be determined to be a reliable device only when it is determined that is a trust. Further, the smartphone 20 or the tablet 30 may have the same trust policy or may have different trust policies.

Then, when the smartphone 20 or the tablet 30 determines that the watch-type terminal 40 is a reliable device, the watch-type terminal 40 is additionally registered in the trust network constructed by the smartphone 20 and the tablet 30. Specifically, the registration unit 166 related to the smartphone 20 or the tablet 30 additionally registers the information of the watch-type terminal 40 in the registration information storage unit 152. The registration unit 166 is a processing unit that performs processing corresponding to the registration unit 133 related to the registration device 100.

Then, the smartphone 20 or the tablet 30 issues an ID to the watch-type terminal 40 (step S65). Subsequently, the smartphone 20 or the tablet 30 transmits the issued ID to the watch-type terminal 40 (step S66).

After that, in addition to the smartphone 20 and the tablet 30, the watch-type terminal 40 can also execute the same processing as the smartphone 20 and the tablet 30 on a predetermined server. For example, when the smartphone 20 and the tablet 30 have the authority to access the server 200 that provides a predetermined service, the watch-type terminal 40 can also use the server 200 (step S67). ).

In this way, the smartphone 20 or tablet 30 belonging to the trusted network, which is a network between trusted devices, detects the clock-type terminal 40, which is a predetermined device that does not belong to the trusted network. Then, the smartphone 20 or the tablet 30 is clock-shaped by at least one of the smartphone 20 or the tablet 30 based on the rules held by each of the smartphone 20 or the tablet 30 with respect to the detected clock-type terminal 40. Determine the reliability of the terminal 40. Then, when the smartphone 20 or the tablet 30 determines that the watch-type terminal 40 is a reliable device, the watch-type terminal 40 is registered as a device belonging to the trust network.

As described above, each of the user terminals 10 according to the embodiment has a function as a registration device, and can perform a process of additionally registering a predetermined device in the trust network. By such processing, the user can efficiently construct a network for a plurality of possessed devices. The trust policy storage unit 151 and the registration information storage unit 152 shown in FIG. 13 may be possessed by any of the smartphone 20, the tablet 30, and the watch-type terminal 40, and may be possessed by all the devices. May be good.

[6-4. Processing variations]
In each process of the above embodiment, there may be various variations in each process performed by the user terminal 10 and the registration device 100.

For example, when registering the second terminal device, the registration device 100 adjusts the process of registering the second terminal device based on the information about the first terminal device that relied on the second terminal device. It may be. Specifically, the registration device 100 includes the registration time when the first terminal device is registered in the registration device 100, the frequency of access to the registration device 100 and the service server associated with the registration device 100, and the first in the trusted network. Rarity of one terminal device (for example, among a plurality of terminals registered in a trusted network, the model of the terminal, the OS (Operating System) of the terminal, etc. are rare compared to other terminals. ), The safety of the credential in the registration of the first terminal device, the conditions of the trust policy in the registration of the first terminal device, and the like are acquired as information about the first terminal device. Then, the registration device 100 has, for example, an earlier registration time, a higher frequency of access, a higher rarity, a higher credential security, and a trust policy condition. Judge the strictness and the combination. Then, for example, the registration device 100 may register the second terminal device by giving priority to the registration request applied from the first terminal device whose registration time is earlier. Alternatively, for example, the registration device 100 determines that the registration request applied from the first terminal device whose registration time is earlier is highly reliable, and performs the registration process of the second terminal device. May be good.

Further, the user terminals 10 may mutually determine the trust of the terminals, and when constructing the trust network, the user terminal 10 may perform the propagation processing of the access authority to the service.

For example, it is assumed that there are a smartphone 20 and a tablet 30 that are permitted to access the service server 200 that provides the service in a predetermined trust network. Further, in addition to the service server 200, it is assumed that there are a fifth terminal device and a sixth terminal device in which access to the service server 300 that provides a service different from that of the service server 200 is permitted. In this case, it is assumed that the fifth terminal device and the sixth terminal device are terminals whose reliability has been proved by the smartphone 20 or the tablet 30 and registered in the trust network.

Here, any user terminal 10 (smartphone 20 or tablet 30) belonging to the trusted network can access the service server 300 when newly registering the seventh terminal device. The terminal device may be registered. That is, the user terminal 10 has a trust network consisting of a plurality of terminals that can access at least one service, and when a new terminal is added to the trust network, it is involved in registration processing such as determining a trust policy. You may also perform processing such as granting access authority to services that are not available and can be accessed by other terminals belonging to the same trusted network.

In the above example, even if the smartphone 20 does not access the service server 300, the newly added seventh terminal device is a fifth terminal device or a sixth terminal. Similar to the device, processing may be performed to grant the authority to access the service server 300. Alternatively, the smartphone 20 does not allow access to the newly added seventh terminal device (does not grant access authority) even to the service server to which other terminals are allowed to access. Conditions and selections may be made. As described above, the user terminal 10 and the registration device 100 are not necessarily limited to the processing described in the above embodiment, and various conditions may be changed or the processing may be adjusted.

Further, the user terminal 10 may perform processing such as granting authority such as arbitrarily exchanging data or the like between terminals in the trusted network without going through a server such as the registration device 100. Good.

Further, the registration device 100 may perform a process of soliciting user terminals 10 who desire registration. For example, the registration device 100 solicits registration by broadcast, and discovers (detects) a communicable terminal or a nearby terminal on the network. In other words, the registration device 100 sends a solicitation for registration to the registration device 100 to various user terminals 10.

Among the user terminals 10 that have received the solicitation for registration from the registration device 100, the user terminal 10 that desires registration transmits a registration request to the registration device 100. In this case, the registration device 100 inquires of the registered user terminal 10 about the trust of the user terminal 10 that has transmitted the registration request.

For example, suppose that the smartphone 20 is a terminal registered in the registration device 100, and the tablet 30 is a terminal that newly requests registration in the registration device 100. In this case, the registration device 100 requests the smartphone 20 to determine the trust of the tablet 30. The smartphone 20 verifies the trust of the tablet 30 according to the trust policy it holds. Then, when the smartphone 20 verifies that the tablet 30 is a reliable terminal, the smartphone 20 transmits a message to that effect to the registration device 100. The registration device 100 registers the tablet 30 based on the information transmitted from the smartphone 20.

In this way, the registration device 100 may perform a process of soliciting registration from, for example, an unspecified number of terminals, and causing the already registered terminals to determine the trustability of the terminals that have responded to the solicitation. .. As a result, the registration device 100 can efficiently expand the trust network while ensuring safety.

[6-5. Judgment by user]
In each process of the above embodiment, the determination by the user of the user terminal 10 may be added. For example, the user may simultaneously activate a predetermined application (for example, an application realized by a registration program) on the smartphone 20 and the tablet 30 to perform detection processing with each other. Further, when the user terminal 10 has an item such as "judgment by the user" as a trust policy, the user may intervene his / her own judgment as a judgment factor that the user terminal 10 trusts a different device. it can.

[6-6. User terminal]
In the above embodiment, the configuration example of the user terminal 10 is shown with reference to FIG. 6, but the user terminal 10 does not necessarily have all the configurations shown in FIG. As described above, the user terminal 10 includes not only smart devices such as smartphones 20 and tablets 30, but also watch-type terminals 40 and eyeglass-type terminals having communication functions, heart rate measuring devices that store the user's heartbeat, and the like. , Various devices are included. In this case, the user terminal 10 does not necessarily accept input from the user, but may have a function of automatically acquiring the user's information and transmitting such information to the communication network. That is, the user terminal 10 does not necessarily have the configuration shown in FIG. 6 as long as it is a device having a predetermined communication function that realizes so-called IoT (Internet of Things).

The registration device 100 and the user terminal 10 may be set to differ depending on, for example, the function of the device with respect to the device to be newly registered. That is, the registration device 100 and the user terminal 10 flexibly adjust the trust policy according to the function of the device to be registered, such as not allowing registration if the device does not accept input from the user in the trust policy. You may do so.

[6-7. Communication with registration device]
In the above embodiment, for example, in FIG. 1, regarding the second terminal device (tablet 30) trusted by the first terminal device (smartphone 20), the registration device is registered via the first terminal device in relation to the registration process. An example of receiving an ID or the like from 100 is shown. However, the embodiment is not limited to this, and communication after the registration request is transmitted from the first terminal device may be established between the second terminal device and the registration device 100.

[6-8. Registration of the first terminal device]
In the above embodiment, an example is shown in which the first terminal device is registered from the registration device 100. However, the embodiment is not limited to this, and the first terminal device may not be registered in the registration device 100. In this case, the first terminal device is, for example, a device that holds a trust policy of the same standard as the registration device 100, and the first terminal device performs a process of determining the trust of the second terminal device. Then, the first terminal device can transmit a registration request with proof that the second terminal device is a reliable device to the registration device 100, and request the registration of the second terminal device. That is, in the registration system 1, the first terminal device itself is not registered in the registration device 100, and the first terminal device may function as a terminal for determining the trust of the second terminal device.

[7. Hardware configuration]
The registration device 100 according to the above-described embodiment is realized by, for example, a computer 1000 having a configuration as shown in FIG. Hereinafter, the registration device 100 will be described as an example. FIG. 14 is a hardware configuration diagram showing an example of a computer 1000 that realizes the functions of the registration device 100. The computer 1000 has a CPU 1100, a RAM 1200, a ROM 1300, an HDD 1400, a communication interface (I / F) 1500, an input / output interface (I / F) 1600, and a media interface (I / F) 1700.

The CPU 1100 operates based on a program stored in the ROM 1300 or the HDD 1400, and controls each part. The ROM 1300 stores a boot program executed by the CPU 1100 when the computer 1000 is started, a program that depends on the hardware of the computer 1000, and the like.

The HDD 1400 stores a program executed by the CPU 1100, data used by such a program, and the like. The communication interface 1500 receives data from another device via the communication network 500 (corresponding to the network N shown in FIG. 2) and sends the data to the CPU 1100, and the data generated by the CPU 1100 is transmitted to the other device via the communication network 500. Send to the device.

The CPU 1100 controls an output device such as a display or a printer, and an input device such as a keyboard or a mouse via the input / output interface 1600. The CPU 1100 acquires data from the input device via the input / output interface 1600. Further, the CPU 1100 outputs the data generated via the input / output interface 1600 to the output device.

The media interface 1700 reads a program or data stored in the recording medium 1800 and provides the program or data to the CPU 1100 via the RAM 1200. The CPU 1100 loads the program from the recording medium 1800 onto the RAM 1200 via the media interface 1700, and executes the loaded program. The recording medium 1800 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or PD (Phase change rewritable Disk), a magneto-optical recording medium such as MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory. And so on.

For example, when the computer 1000 functions as the registration device 100 according to the embodiment, the CPU 1100 of the computer 1000 realizes the function of the control unit 130 by executing the program loaded on the RAM 1200. Further, the data in the storage unit 120 is stored in the HDD 1400. The CPU 1100 of the computer 1000 reads these programs from the recording medium 1800 and executes them, but as another example, these programs may be acquired from another device via the communication network 500.

[8. Others]
Further, among the processes described in the above-described embodiment, all or a part of the processes described as being automatically performed can be manually performed, or the processes described as being manually performed can be performed. All or part of it can be done automatically by a known method. In addition, the processing procedure, specific name, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified. For example, the various information shown in each figure is not limited to the illustrated information.

Further, each component of each of the illustrated devices is a functional concept, and does not necessarily have to be physically configured as shown in the figure. That is, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or part of the device is functionally or physically distributed / physically in arbitrary units according to various loads and usage conditions. It can be integrated and configured. For example, the determination unit 132 shown in FIG. 3 and the registration unit 133 may be integrated. Further, for example, the information stored in the storage unit 120 may be stored in an external storage device via the network N.

Further, for example, in the above embodiment, an example is shown in which the registration device 100 performs a reception process for receiving a registration request and a registration process for registering the user terminal 10. However, the registration device 100 described above may be separated into a reception device that performs reception processing and a registration device that performs registration processing. That is, the registration device 100 may be separated into a front-end server that transmits / receives information to / from the user terminal 10 and a back-end server that performs processing based on the received information. In this case, the processing by the registration device 100 according to the embodiment is realized by the registration system 1 having a device that realizes the function of the front-end server and a device that realizes the function of the back-end server.

In addition, the above-described embodiments and modifications can be appropriately combined as long as the processing contents do not contradict each other.

[9. effect〕
As described above, the registration device 100 according to the embodiment includes a reception unit 131 and a registration unit 133. The receiving unit 131 is a registration request transmitted from the first terminal device (in the embodiment, the smartphone 20) whose reliability (trust) has been verified based on a predetermined rule, and is held by the first terminal device. The registration request, which is a request including proof that the second terminal device (tablet 30 in the embodiment) is trusted by the first terminal device, is received based on the rules. Then, the registration unit 133 registers the second terminal device when the registration request is received by the reception unit 131.

In this way, the registration device 100 according to the embodiment registers the second terminal device trusted by the first terminal device whose reliability is ensured. According to such a process, the user can save the trouble of accessing all the devices possessed by the user to perform the registration process, so that the registration process can be easily performed. That is, the registration device 100 can perform the registration process that is convenient for the user.

Further, the registration unit 133 proves that the proof included in the registration request is trusted by the first terminal device based on the rule having the same standard as the predetermined rule. In the case, the second terminal device is registered.

In this way, the registration device 100 according to the embodiment registers the second terminal device trusted by the same standard as the standard (trust policy) when the first terminal device is trusted by itself. As a result, the registration device 100 can also perform the registration process for the second terminal device while ensuring the safety that it guarantees.

Further, the registration unit 133 transfers the identification information issued at the time of registration, which is unique identification information used when the second terminal device accesses the registration device, via the first terminal device. Issued to 2 terminal devices.

In this way, the registration device 100 according to the embodiment can pass the information or the like issued at the time of registration to the second terminal device via the first terminal device. As a result, for example, even if the device has difficulty in direct communication with the registration device 100, the registration process can be performed without any trouble through the first terminal device. That is, the registration device 100 can realize a flexible registration process.

Further, the receiving unit 131 receives the registration request transmitted from the first terminal device and the public key issued by the second terminal device and used for the authentication process for the second terminal device. To do. The registration unit 133 registers the public key in association with the second terminal device.

As described above, in order to adopt the authentication by the predetermined key method, the registration device 100 according to the embodiment receives the public key from the second terminal device and registers it in association with the second terminal device. You may. As a result, the registration device 100 can perform a more secure registration process.

Further, the registration device 100 according to the embodiment further includes a determination unit 132 for determining reliability in the registration request. The registration unit 133 registers the second terminal device when the determination unit 132 determines that the registration request is reliable.

As described above, the registration device 100 according to the embodiment may perform a predetermined determination process with respect to the registration request received from the first terminal device. As a result, the registration device 100 can improve the safety of the registration process.

The determination unit 132 determines whether or not the proof included in the registration request is based on a predetermined communication established between the first terminal device and the second terminal device. When the determination unit 132 determines by the determination unit 132 that the proof included in the registration request is based on a predetermined communication established between the first terminal device and the second terminal device, the registration unit 133 uses a second terminal device. Register the terminal device.

As described above, the registration device 100 according to the embodiment determines whether or not the second terminal device is a reliable device by determining the communication state between the first terminal device and the second terminal device. It may be determined. As a result, the registration device 100 can secure a certain degree of reliability with respect to the second terminal device, so that a safe registration process can be performed.

Further, the receiving unit 131 is a registration request transmitted from the first terminal device or the second terminal device registered by the registration unit 133, and is a rule held by the first terminal device or the second terminal device. A third terminal device (in the embodiment, a clock-type terminal 40), which is a terminal device different from the first terminal device or the second terminal device depending on the first terminal device or the second terminal device. Receives a registration request, which is a request containing proof that is trusted. The registration unit 133 registers the third terminal device when the registration request is received by the reception unit 131.

As described above, the registration device 100 according to the embodiment may accept registration of a further different device based on the trust determination by any of the plurality of already registered devices. According to such a process, the user can efficiently register a plurality of possessed devices. That is, the registration device 100 can provide a registration process that is highly convenient for the user.

Further, the receiving unit 131 is a registration request transmitted from either the first terminal device or the terminal device registered by the registration unit 133, and is based on a rule held by at least one of the terminal devices. Includes proof that a fourth terminal device (arbitrary user terminal 10), which is a terminal device different from any of the already registered terminal devices, has been trusted by at least two or more of any of the terminal devices. Receive the registration request, which is a request. The registration unit 133 registers the fourth terminal device when the registration request is received by the reception unit 131.

As described above, the registration device 100 according to the embodiment is not a terminal device of any one of the registered terminal devices, but a fourth terminal device (new registration is desired) by at least two or more terminal devices. The registration request may be trusted when the terminal device) is trusted. As a result, the registration device 100 can further improve the safety of the registration process.

Further, the registration unit 133 registers the first terminal device as a predetermined rule (trust policy) based on the rule regarding the function implemented by the first terminal device or the rule regarding the manufacture of the first terminal device. To do.

In this way, the registration device 100 according to the embodiment can determine the reliability of the terminal device based on the functions and manufacturing information implemented by the terminal device. As a result, the registration device 100 can secure a certain degree of reliability in registration.

Further, the user terminal 10 according to the embodiment is a terminal device whose reliability has been verified based on a predetermined rule held by the registration device 100, and has a detection unit 162, a determination unit 163, and a transmission unit 165. .. The detection unit 162 detects the second terminal device. The determination unit 163 determines the reliability of the second terminal device detected by the detection unit 162 based on a rule having the same criteria as a predetermined rule. The transmission unit 165 is a request including proof that the second terminal device is trusted when the determination unit 132 determines that the second terminal device is a reliable terminal device, and is a registration device. A registration request requesting that the second terminal device be registered in 100 is transmitted to the registration device 100.

As described above, the user terminal 10 according to the embodiment is a registration device by determining the reliability of the second terminal device by using the trust policy corresponding to the trust policy used when the user terminal 10 is registered. It is possible to determine whether or not the second terminal device is suitable as the target to be registered in 100. Then, the user terminal 10 transmits a registration request to the registration device 100 together with a proof that the second terminal device is suitable. That is, according to the user terminal 10, the registration request of the second terminal device can be made to the registration device 100 without the second terminal device directly communicating with the registration device 100. As a result, the user terminal 10 can improve the convenience of the user regarding the registration process.

Further, an example of the registration method according to the embodiment, the registration method executed by any of a plurality of terminal devices belonging to the trusted network, which is a network between trusted devices, includes a detection step and Includes a determination step and a registration step. The detection step detects a predetermined terminal device that does not belong to the trusted network. In the determination step, the reliability of the predetermined terminal device is determined by at least one of the plurality of terminal devices based on the rules held by each of the plurality of terminal devices with respect to the predetermined terminal device detected by the detection step. Judge the sex. In the registration step, when it is determined by the determination step that the predetermined terminal device is a reliable terminal device, the predetermined terminal device is registered as a terminal device belonging to the trust network.

As described above, in the registration method according to the embodiment, the plurality of terminal devices cooperate to determine the terminal device to be registered in the trust network between the terminal devices, and perform the registration process of the terminal device. According to such processing, for example, even when the user possesses a plurality of terminal devices and newly adds a terminal device, the user has conventionally used the terminal device without requiring any special processing. A network environment similar to that of a terminal device can be used with a new terminal device. As described above, according to the registration method according to the embodiment, the convenience of the registration process can be improved.

The configuration as described above may be realized by the registration system 1. That is, in the registration system 1 including the registration device 100, the first terminal device, and the second terminal device, the reliability of the first terminal device is verified based on a predetermined rule held by the registration device 100. Is based on a rule having a standard equivalent to a predetermined rule for the detection unit 162 that detects the second terminal device and the second terminal device detected by the detection unit 162. When the determination unit 163 for determining the reliability of the second terminal device and the determination unit 163 determine that the second terminal device is a reliable terminal device, a request including proof that the second terminal device is trusted. It is provided with a transmission unit 165 that transmits a registration request requesting the registration of the second terminal device to the registration device 100 to the registration device 100. Then, the registration device 100 includes a reception unit 131 that receives the registration request transmitted by the transmission unit 165, and a registration unit 133 that registers the second terminal device when the registration request is received by the reception unit 131. To be equipped. With such a configuration, the registration system 1 has an effect that the registration process having excellent convenience can be performed.

Although some of the embodiments of the present application have been described in detail with reference to the drawings, these are examples, and various modifications are made based on the knowledge of those skilled in the art, including the embodiments described in the disclosure column of the invention. It is possible to carry out the present invention in other improved forms.

Further, the above-mentioned "section, module, unit" can be read as "means" or "circuit". For example, the receiving unit can be read as a receiving means or a receiving circuit.

1 Registration system 10 User terminal 20 Smartphone 30 Tablet 40 Clock type terminal 100 Registration device 110 Communication unit 120 Storage unit 121 Trust policy storage unit 122 Registration device storage unit 130 Control unit 131 Reception unit 132 Judgment unit 133 Registration unit 134 Transmission unit 151 Trust Policy storage unit 152 Registration information storage unit 16 Control unit 161 Reception unit 162 Detection unit 163 Judgment unit 164 Generation unit 165 Transmission unit 166 Registration unit

Claims (8)

A terminal device that can use services provided by a predetermined external device .
A detector that detects other terminal devices and
A determination unit that determines the reliability of another terminal device detected by the detection unit based on a predetermined rule, and a determination unit.
Wherein when it is determined that the determination unit is reliable in the other terminal device, to the predetermined database external device available terminal device service provided is registered, it registers the another terminal device A terminal device including a registration unit . The terminal device according to claim 1, wherein the service provided by the external device is registered in the predetermined database as a terminal device that can be used. The terminal device according to claim 1 or 2, wherein the reliability has been verified based on the predetermined rule. The terminal device according to claim 3, wherein the reliability has been verified based on the predetermined rule held by the external device. The registration unit
A identification information to be issued at the time of registration, and wherein the unique identification information used when the other terminal device to access to the external device, to issue to those said other terminal devices The terminal device according to any one of claims 1 to 4 . The registration unit registers a public key provided by the external device as a public key used for authentication processing for the other terminal device in association with the other terminal device.
The terminal device according to any one of claims 1 to 5 , characterized in that. It is a registration method executed by a terminal device that can use a service provided by a predetermined external device.
A detection process that detects other terminal devices,
A determination step of determining the reliability of another terminal device detected by the detection step based on a predetermined rule, and a determination step of determining the reliability of the other terminal device.
When it is determined by the determination step that the other terminal device is reliable, the other terminal device is registered in a predetermined database in which the terminal device that can use the service provided by the external device is registered. With the registration process
A registration method characterized by including. To a computer owned by a terminal device that can use services provided by a predetermined external device
Detection procedure to detect other terminal devices and
A determination procedure for determining the reliability of another terminal device detected by the detection procedure based on a predetermined rule, and a determination procedure for determining the reliability of the other terminal device.
When it is determined by the determination procedure that the other terminal device is reliable, the other terminal device is registered in a predetermined database in which the terminal device that can use the service provided by the external device is registered. Registration procedure and
Registration program to execute.

Images