WO2007108114A1

WO2007108114A1 - Domain participation method, attribute certificate selection method, communication terminal, ic card, ce device, attribute certificate issuing station, and content server

Info

Publication number: WO2007108114A1
Application number: PCT/JP2006/305729
Authority: WO
Inventors: Satoshi Ohta
Original assignee: Matsushita Electric Industrial Co., Ltd.
Priority date: 2006-03-22
Filing date: 2006-03-22
Publication date: 2007-09-27

Abstract

Provided is a domain participation method capable of acquiring a content by a secure method by using one CE device in a plurality of user environments. The domain participation method includes: a domain participation report step for reporting a domain participation to an attribute certificate issuing station (500) which issues a domain participation permission certificate according to a public key certificate of a CE device (400) as a domain representative, an IC card (300) containing the attribute certificate, and an attribute certificate of a communication terminal (200) as a domain participant; and a domain participation permission attribute certificate issuing step in which the attribute certificate issuing station (500) receives the domain participation report from the communication terminal (200), correlates the public key certificate of the CE device (400) with the attribute certificate of the communication terminal (200), and issues a domain participation permission attribute certificate in which the public key certificate of the CE device (400) is correlated with the attribute certificate of the communication terminal (200), to the communication terminal (200).

Description

Specification

Domain participation method, attribute certificate selection method, communication terminal, IC card, CE device Attribute certificate issuing authority and content server

Technical field

The present invention relates to a domain participation method, an attribute certificate selection method, a communication terminal, an IC card, a CE device, and an attribute certificate, in which content is acquired by a secure method using one CE device in a plurality of user environments. It relates to an issuing authority and a content server.

Background art

In recent years, the distribution of content such as music and video has often been performed via the Internet, and it has become possible for users to easily acquire favorite content.

However, since the Internet is an open environment for all users, unauthorized acquisition of content by malicious users becomes a problem.

As a method of preventing such unauthorized acquisition of content, there is a system that performs authentication when a user accesses a content server that holds content. In such systems, many use Public Key Infrastructure (PKI) for authentication.

[0005] PKI is an infrastructure that provides security services such as confidentiality, authentication, integrity, and non-repudiation by providing encryption and digital signature functions. In this PKI, a certificate authority issues a public key certificate as proof of the user's identity.

[0006] The following describes authentication when a user's client device connects to a server device that holds content.

When an access request to a client device server device is generated, the client device and the server device obtain each other's public key certificate. Methods of obtaining a public key certificate include obtaining the other party's public key certificate and obtaining it from the repository.

[0008] When each device of the client device and the server device acquires the public key certificate of the communication partner, it verifies the validity 'validity by the signature of the acquired public key certificate, expiration date, etc. Prove.

[0009] In this verification, if it is found that the public key certificate is valid and valid, it is verified whether the communication partner is the valid owner of the public key certificate. For this verification, a signature with a private key paired with the public key contained in the public key certificate is used.

[0010] Each device signs the value shared with the other party with the private key owned by itself and transmits it to the other party, thereby making it possible for each other to obtain the public key certificate acquired earlier. We can verify that we are the rightful owner.

[0011] Examples of applications that provide authentication and encryption communication using a public key certificate as described above include SSL, IPsec, and the like.

[0012] As described above, in PKI, the user can authenticate the user by possessing the public key / private key pair.

[0013] However, authentication in PKI can not confirm what authority the user has. Therefore, in order to perform access control, it is necessary to have a mechanism to confirm the rights owned by the user. The method is access control by attribute certificate.

Conventionally, “a data communication system including attribute confirmation processing and a data communication method including attribute confirmation processing” are known as a system using such authentication by public key certificate and access control by attribute certificate. Teach (see Patent Document 1).

[0015] In Patent Document 1, the shop server and the user device are expressed as an entity. The shop server and the user device own the public key certificate and the attribute certificate.

[0016] In Patent Document 1, an attribute code is added to each function of an entity that executes data communication, for example, each function such as a device that executes content purchase and a server that receives a content purchase request. There is.

That is, the functions that the entity can execute are determined by the attribute code of the attribute certificate. Each entity performs mutual authentication between entities when attempting to perform a certain function in data communication with another entity. If this mutual authentication is successful, attribute authentication is performed to confirm what function the communication partner can execute. An entity uses an attribute certificate when performing attribute authentication of the entity with which it is communicating, and the method of obtaining this attribute certificate may be sent by the other party, obtained from a repository, etc. There is a way.

An entity that has acquired the attribute certificate of the other party of communication verifies the attribute certificate. As a result of verification, if it is determined that the attribute certificate is correct, the attribute described in the attribute certificate is confirmed. If the confirmed attribute matches the one assumed, the entity permits the other party to perform the function given by the attribute.

[0020] Also, if the attribute certificate or the attribute information described in the attribute certificate is invalid as a result of verification of the acquired certificate, the entity rejects the communication partner from executing the function.

[0021] This prevents execution of processing spoofing as another entity, and enables data communication such as secure content transaction.

Patent Document 1: Japanese Patent Application Laid-Open No. 2002-139998

Disclosure of the invention

Problem that invention tries to solve

In the conventional “data communication system including attribute confirmation processing and data communication method including attribute confirmation processing”, a family or a plurality of users use one CE (Consumer Electronics) device. In the case where the CE device has to be limited to one user, there is a problem if the user who performs content acquisition with the CE device is limited.

An object of the present invention is to provide a domain participation method, an attribute certificate selection method, a communication terminal, and an IC card, in which one CE device can be used in a plurality of user environments and content can be acquired in a secure manner. , CE equipment, attribute certificate issuing authority, and content server.

Means to solve the problem

The domain participation method of the present invention is a domain participation method for acquiring content in a secure manner using one CE device in a plurality of user environments, and the public key of the CE device as a domain representative. Based on the certificate, the memory with the IC card function where the attribute certificate is stored, and the attribute certificate of the communication terminal who is the domain participant, domain participation permission is permitted. The domain participation notification step of notifying domain participation to the attribute certificate issuing authority that issues the attribute certificate, and the attribute certificate issuing office receiving the domain participation notification from the communication terminal enables the CE device to be published. Domain participation which issues a domain participation permission attribute certificate in which a key certificate is associated with an attribute certificate of the communication terminal, and a public key certificate of the CE device is associated with an attribute certificate of the communication terminal to the communication terminal And a step of issuing a permission attribute certificate.

Effect of the invention

According to the present invention, since one public key certificate and multiple attribute certificates can be stored in association with one domain using an IC card, domain management can be facilitated. Become. In addition, since user identification is possible by associating a public key certificate with an attribute certificate, multiple users can use one CE device, and it is possible to use one CE device according to the user who accesses it. Content can be provided.

Brief description of the drawings

FIG. 1 is a block diagram showing an example of a communication system for realizing a domain joining method according to an embodiment of the present invention.

[FIG. 2] A block diagram showing a configuration of a communication terminal in a communication system for realizing a domain joining method according to an embodiment of the present invention.

[FIG. 3] A block diagram showing a configuration of an IC card in a communication system for realizing a domain participation method according to an embodiment of the present invention.

[FIG. 4] A block diagram showing a configuration of a CE device in a communication system for realizing a domain participation method according to an embodiment of the present invention.

[FIG. 5] A block diagram showing a configuration of an attribute certificate issuing station in a communication system for realizing a domain participation method according to an embodiment of the present invention.

[FIG. 6] A sequence diagram showing an example of a communication procedure of a system for realizing a domain joining method according to an embodiment of the present invention.

[FIG. 7] A block diagram for explaining the operation at the time of domain participation application of a communication terminal in the communication system for realizing the domain participation method according to one embodiment of the present invention.

[FIG. 8] In a communication system for realizing a domain participation method according to an embodiment of the present invention Block diagram for explaining the operation at the time of content acquisition of the communication terminal

[FIG. 9] A block diagram for explaining the operation at the time of applying for a domain participant in an IC card in a communication system for realizing a domain participation method according to an embodiment of the present invention.

[FIG. 10] A block diagram for explaining an operation at the time of content acquisition of an IC card in a communication system realizing a domain participation method according to an embodiment of the present invention

[FIG. 11] A block diagram for explaining a method of issuing a domain participation permission attribute certificate of an attribute certificate issuing authority in a communication system for realizing a domain participation method according to an embodiment of the present invention.

[FIG. 12] A block diagram for explaining a processing method at the time of content acquisition of a CE device in a communication system for realizing a domain participation method according to an embodiment of the present invention. Best Mode for Carrying Out the Invention

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. It is to be noted that components and corresponding parts having the same configuration or function in the respective drawings are denoted by the same reference numerals, and the description thereof will not be repeated.

As shown in FIG. 1, the communication system 100 for realizing the domain participation method of this example is a communication terminal 200, an IC card 300, a CE device 400, an attribute certificate issuing station 500, and a content server 60.

It consists of 0 etc.

In the system shown in FIG. 1, communication terminal 200 and CE device 400 are connected to network 800 via access point (AP) 700, and communication in this communication system 100 is performed. The network may be in the form of direct communication between devices as long as data transfer is possible.

FIG. 2 is a block diagram showing a configuration of a communication terminal in a communication system for realizing a domain participation method according to an embodiment of the present invention.

As shown in FIG. 2, the communication terminal 200 used in the communication system 100 includes a network input / output unit 201, an external device access request unit 202, an external device operation unit 203, a device information storage unit 204, and a public key certificate. Storage unit 205, domain participation permission attribute certificate issuance request unit 206, An attribute certificate storage unit 207, a domain participation permission attribute certificate reception unit 208, a domain participation permission attribute certificate output unit 209, and a card slot input / output unit 210 are provided.

In FIG. 2, the network input / output unit 201 transmits and receives information to and from the attribute certificate issuing authority 500 and the content server 600 connected to the CE device 400 and the network 800.

The external device access request unit 202 requests the CE device 400, which is an external device, to access including user information.

The external device operation unit 203 selects content from the communication terminal 200 and determines content acquisition.

The device information storage unit 204 stores device information of an external device input via the network input / output unit 201, user information of the communication terminal 200, and the like.

Public key certificate storage unit 205 stores the public key certificate of the user of communication terminal 200.

Domain participation permission attribute certificate issuance request unit 206 sends attribute certificate issuance authority 500 via network I / O unit 201 and network 800 in order to join CE device 400 as a domain representative. Apply for domain advisors.

The attribute certificate storage unit 207 stores the attribute certificate of the communication terminal 200.

The domain participation permission attribute certificate reception unit 208 receives the domain participation permission attribute certificate issued from the attribute certificate issuing station 500 via the network input / output unit 201 and the network 800.

The domain participation permission attribute certificate output unit 209 sends the domain participation permission attribute certificate received by the domain participation permission attribute certificate receiving unit 220 from the attribute certificate issuing station 500 to the card slot input / output unit 210. .

The card slot input / output unit 210 receives the domain participation permission attribute certificate received from the domain participation permission attribute certificate output unit 209 and the user of the communication terminal 200 stored in the public key certificate storage unit 205. The public key certificate or the like is transmitted to the IC card 300 connected to the card slot input / output unit 210.

In addition, the card slot input / output unit 210 is stored in the IC card 300 connected thereto. Receive card information.

FIG. 3 is a block diagram showing a configuration of an IC card in a communication system for realizing a domain participation method according to an embodiment of the present invention.

As shown in FIG. 3, the IC card 300 used in the communication system 100 includes an input / output unit 301, a certificate transmission unit 302, a public key certificate storage unit 303, an attribute certificate storage unit 304, and device information reading. Part 305, certificate verification and notification part 306, certificate comparison and verification part 307, domain management part 3

It has 08.

In FIG. 3, the input / output unit 301 transmits / receives information to / from the communication terminal 200, the CE device 400, and the like.

The certificate transmission unit 302 receives the public key certificate and the attribute certificate read out from the public key certificate storage unit 303 and the attribute certificate storage unit 304 when applying for domain participation of the communication terminal 200, and outputs the certificate to the input / output unit 301. Send to an external device via

The public key certificate storage unit 303 stores the public key certificate of the device to which the IC card 300 is connected.

The attribute certificate storage unit 304 stores the attribute certificate of the device to which the IC card 300 is connected.

The device information reading unit 305 reads the information of the public key certificate and the attribute certificate of the CE device 400 which is the domain representative, in order to establish a connection with the CE device 400.

The certificate verification notification unit 306 notifies the CE device 400 via the input / output unit 301 whether or not the user compared and verified by the certificate comparison verification unit 307 is an appropriate user.

The certificate comparison and verification unit 307 compares and verifies the user information acquired from the communication terminal 200 by the device information reading unit 305 and the attribute certificate stored in the attribute certificate storage unit 304.

The domain management unit 308 manages whether or not the domain participation permission attribute certificate associated with the public key certificate of the CE device 400 that is the domain representative is the correct domain.

FIG. 4 is a block diagram showing the configuration of a CE device in a communication system for realizing the domain participation method according to an embodiment of the present invention.

[0055] As shown in FIG. 4, CE device 400 used in communication system 100 is connected to the network. Force unit 401, user information transfer unit 402, card slot input / output unit 403, authentication result notification unit 4

04, a device information reading unit 405, an external device access request providing unit 406, and a screen display device connection unit 407.

In FIG. 4, network input / output unit 401 transmits / receives information to / from devices connected to network 800.

The user information transfer unit 402 transmits the user information acquired from the communication terminal 200 to the IC card 300.

The card slot input / output unit 403 transmits / receives information to / from the IC card 300 connected thereto.

The authentication result notification unit 404 receives a notification of a diagnosis result as to whether the user information of the communication terminal 200 is appropriate or not from the certificate verification notification unit 306 of the IC card 300.

The device information reading unit 405 reads the device information of the device connected to the network 800 via the network input / output unit 401.

The external device access request providing unit 406 transfers the content request of the communication terminal 200 to the content server 600.

The screen display device connection unit 407 transmits the content information acquired from the content server 600 to the screen display device 900 shown in FIG. 1 connected thereto.

FIG. 5 is a block diagram showing a configuration of an attribute certificate issuing station in a communication system for realizing a domain participation method according to an embodiment of the present invention.

As shown in FIG. 5, the attribute certificate issuing station 500 used in the communication system 100 includes a network input / output unit 501, a domain participation reception unit 502, a domain creation unit 503, and a domain storage unit 5.

04, the domain participation permission attribute certificate issuing unit 505 is provided.

In FIG. 5, network input / output unit 501 transmits / receives information to / from devices connected to network 800.

The domain participation reception unit 502 receives the CE device 40 received via the network input / output unit 501.

0 public key certificate and attribute certificate, domain certificate of attribute certificate of communication terminal 200

Send to 503.

A domain creation unit 503 is a CE that is a domain representative received by the domain participation reception unit 502. The public key certificate of the device 400 and the attribute certificate of the communication terminal 200 that participates in the domain are associated with the domain by the dull attribute, and the associated domain participation permission attribute certificate is sent to the domain storage unit 504.

The domain storage unit 504 stores the domain participation permission attribute certificate associated by the domain creation unit 503 for each domain.

The domain participation permission attribute certificate issuing unit 505 stores the domain participation permission attribute stored in the domain storage unit 504 with respect to the communication terminal 200 that performs domain participation via the network input / output unit 501. Read the certificate from time to time and issue it.

Next, the communication procedure of the communication system 100 for realizing the domain participation method of this example will be described. FIG. 6 is a sequence diagram showing an example of a communication procedure of a system for realizing the domain participation method according to an embodiment of the present invention.

In the system 100 for realizing the domain participation method of this example, first, in order to use the CE device 400, the communication terminal 200 needs to join the domain with the CE device 400 as the domain representative. .

Therefore, as shown in FIG. 6, CE device 400, which is a domain representative, stores its own public key certificate and attribute certificate in IC card 300 (step ST601), and this public key certificate is stored. The IC card 300 storing the document and the attribute certificate is delivered to the communication terminal 200 which is a domain participant (step ST602).

Communication terminal 200 which has acquired IC card 300 has an attribute certificate of its own attribute certificate and the public key certificate and attribute certificate of CE device 400 which is the domain representative stored in IC card 300. Book publishing agency 500 (step ST603).

Attribute certificate issuing authority 500 associates the public key certificate of CE device 400 that is the domain representative with the attribute certificate of communication terminal 200, and creates a domain participation permission attribute certificate (step ST 604). And issue the created domain participation permission attribute certificate to the communication terminal 200 (step ST605).

The communication terminal 200 having issued the domain participation permission attribute certificate from the attribute certificate issuing station 500 stores the received domain participation permission attribute certificate in the IC card 300 (step ST 606). Thus, communication terminal 200 can participate in a domain in which CE device 400 is the domain representative, and can use CE device 400.

Thus, the communication terminal 200 that is permitted to join the domain with the CE device 400 as the domain representative is the IC device 300 in which the domain participation permission attribute certificate is stored.

It returns to 400 (step ST607).

The CE device 400 having the IC card 300 returned from the communication terminal 200 inserts the IC card 300 returned from the communication terminal 200 into a card slot (not shown) (step ST 608). As a result, the input / output unit 301 of the IC card 300 is connected to the card slot input / output unit 210 of the CE device 400.

According to the above procedure, communication terminal 200 participates in a domain in which CE device 400 is the domain representative.

Next, an attribute certificate selection procedure in the domain participation method of this example will be described.

In FIG. 6, when there is access to content including user information from communication terminal 200 (step ST 609), CE device 400 compares the user information with the domain participation permission attribute certificate in IC card 300. (Step ST610).

Communication terminal 200 acquires access information at the time of authentication with CE device 400. Here, the authentication method at the time of access between the communication terminal 200 and the CE device 400 is not particularly limited. For example, mutual authentication using a public key certificate or an attribute using an attribute certificate It may be any of the certification.

When CE device 400 determines that the access information from communication terminal 200 is user information of a domain participant, content request and disclosure of the domain representative in IC card 300 inserted are made. The key certificate and the attribute certificate of the communication terminal 200 are transmitted (provided) to the content server 600 (step ST611).

Content server 600 identifies (authenticates) the public key certificate provided from CE device 400 with the device information and the attribute certificate (user information) (step ST 612), and reproduces the CE key according to the user. Send (provide) possible content to the CE device 400 (step ST613)

) o

Next, the operation of the communication terminal 200 at the time of domain participant application will be described. Figure 7 shows the present invention FIG. 21 is a block diagram for explaining an operation at the time of domain participation application for a communication terminal in the communication system in the communication system for realizing the domain participation method according to the embodiment of the present invention.

In FIG. 7, when communication terminal 200 applies for domain participation, first, domain participation permission attribute certificate issuance request section 206 performs network entry / output section 201 and domain input / output section 201 for domain participation. Apply to the attribute certificate issuing authority 500 via the network 800 for participation in the domain.

At this time, the communication terminal 200 provides the attribute certificate issuing station 500 with the attribute certificate stored in the attribute certificate storage unit 207 in order to indicate that the communication terminal 200 itself is a domain participant. Believe)

On the other hand, attribute certificate issuing authority 500 associates the public key certificate of CE device 400 that is the domain representative with the attribute certificate of communication terminal 200, creates a domain participation permission attribute certificate, and creates it. The domain participation permission attribute certificate is issued to the communication terminal 200.

Communication terminal 200 receives the domain participation request attribute certificate issued from attribute certificate issuing station 500 via domain 800 and network input / output unit 201, and domain certificate for packet participation permission attribute certificate receiving unit 208 Do.

Then, the domain participation permission attribute certificate receiving unit 208 sends the domain participation permission attribute certificate received from the attribute certificate issuing station 500 to the domain participation permission attribute certificate output unit 209. In addition, the domain participation permission attribute certificate output unit 209 stores the domain participation permission attribute certificate received from the domain participation permission attribute certificate reception unit 208 in the IC card 300 connected to the card slot output unit 210. .

By this means, communication terminal 200 can communicate with CE device 400 by participating in a domain in which CE device 400 is the domain representative.

Next, the operation of the communication terminal 200 at the time of content acquisition will be described. FIG. 8 is a block diagram for explaining the operation at the time of content acquisition of the communication terminal in the communication system for realizing the domain participation method according to the embodiment of the present invention.

In FIG. 8, when the communication terminal 200 acquires the content, the external device access request unit 202 accesses the CE device 400 that is the external device via the network input / output unit 201 including user information. To request. The device authentication at the time of access between the communication terminal 200 and the CE device 400 at this time is mutual authentication using the public key certificate of the user stored in the public key certificate storage unit 205, or the attribute certificate It is possible to use any of the attribute authentication methods using the attribute certificate stored in the storage unit 207, and is not particularly limited.

In the communication terminal 200, after device authentication is established with the CE device 400, the external device operation unit 203 performs content selection from the communication terminal 200 and content acquisition determination.

Next, the operation at the time of domain participant application for the IC card 300 will be described. FIG. 9 is a block diagram for explaining an operation at the time of applying for a domain participant in an IC card in a communication system for realizing a domain participation method according to an embodiment of the present invention.

At the time of domain participation application, the IC card 300 is first inserted into the CE device 400 as shown in FIG.

In the IC card 300 inserted into the CE device 400, the device information reading unit 305 is a CE device.

Reads the public key certificate and attribute certificate information of CE device 400 that is the domain representative to establish a connection with 400.

The public key certificate and the attribute certificate of the CE device 400 read by the device information reading unit 305 are stored in the public key certificate storage unit 303 and the attribute certificate storage unit 304.

The IC card 300 storing the public key certificate and the attribute certificate of the CE device 400 which is the domain representative is connected to the card slot input / output unit 210 of the communication terminal 200 as shown in FIG. .

By this means, certificate sending unit 302 of IC card 300 receives CE device 400 which is a domain representative from public key certificate storage unit 303 and attribute certificate storage unit 304 when domain participation application for communication terminal 200 is applied. Read out the public key certificate and attribute certificate of and send the public key certificate and attribute certificate of this CE device 400 to the attribute certificate issuing authority 500.

The attribute certificate issuing authority 500 having received this receives the domain participation permission attribute certificate which is created by associating the public key certificate of the CE device 400 which is the domain representative with the attribute certificate of the communication terminal 200 as a communication terminal. Issue to 200

The IC card 300 inserted in the communication terminal 200 has the domain participation permission attribute certificate issued from the attribute certificate issuing station 500 to the communication terminal 200, and the attribute certificate storage unit 304 performs communication end. Received from the end 200.

Then, IC card 300 having received the domain participation permission attribute certificate from communication terminal 200 has domain participation permission attribute associated with the public key certificate of CE device 400 which is the domain representative in domain management unit 308. Manage whether the certificate is in the correct domain.

Next, an operation at the time of content acquisition of the IC card 300 will be described. FIG. 10 is a block diagram for explaining an operation at the time of content acquisition of an IC card in a communication system for realizing a domain participation method according to an embodiment of the present invention.

First, the IC card 300 at the time of content acquisition compares the user information acquired from the communication terminal 200 by the device information reading unit 305 with the attribute certificate stored in the attribute certificate storage unit 304 by certificate comparison and verification. The part 307 compares and verifies.

Then, after the IC card 300 completes the comparison and verification of the user information and the attribute certificate in the certificate comparison and verification unit 307, the user compared and verified in the certificate comparison and verification unit 307 is an appropriate user. The certificate verification and notification unit 306 notifies the CE device 400 via the input / output unit 301 whether or not the certificate verification notification unit 306 has received the certificate.

Further, the certificate transmission unit 302 of the IC card 300 determines that the user compared and verified by the certificate comparison / verification unit 307 is an appropriate user from the certificate verification notification unit 306 to the CE device 400. After being notified, the content server of the CE device 400 who is the domain representative and the attribute certificate of the user of the communication terminal 200 who is the domain participant from the CE device 400 via the network 800 via the content server Send to 600

Next, the method of issuing the domain participation permission attribute certificate of the attribute certificate issuing station 500 will be described. FIG. 11 is a block diagram for explaining a method of issuing a domain participation permission attribute certificate of an attribute certificate issuing authority in a communication system for realizing a domain participation method according to an embodiment of the present invention.

In FIG. 11, the attribute certificate issuing station 500 in the case of issuing a domain participation permission attribute certificate has a domain participation reception unit 502 that is a public key certificate of CE device 400 whose domain representative is And an attribute certificate, and an attribute certificate of the communication terminal 200 which is a domain participant, through the network input / output unit 501. Then, the domain participation reception unit 502 sends the public key certificate and attribute certificate of the CE device 400 received via the network input / output unit 501 and the attribute certificate of the communication terminal 200 to the domain creation unit 503.

Domain creation section 503 has the public key certificate of CE device 400 that is the domain representative received by domain participation reception section 502 and the attribute certificate of communication terminal 200 that participates in domain with the domain attribute. Associating of, and sending the associated domain participation permission attribute certificate to the domain storage unit 504.

The domain storage unit 504 stores the domain participation permission attribute certificate associated in the domain creation unit 503 for each domain.

Then, domain participation permission attribute certificate issuing unit 505 transmits the domain participation stored in domain storage unit 504 to communication terminal 200 performing domain participation via network input / output unit 501. Read out and issue permission attribute certificates as appropriate.

Next, a processing method at the time of content acquisition of the CE device 400 will be described. FIG. 12 is a block diagram for explaining a processing method at the time of content acquisition of a CE device in a communication system for realizing a domain participation method according to an embodiment of the present invention.

As shown in FIG. 1, the CE device 400 at the time of content acquisition is connected in advance to the content server 600 via the network 800, and a screen display device 900 for displaying content information is connected, Shall be

In FIG. 12, the user information transfer unit 402 of the CE device 400 transfers, to the IC card 300, the user information for which the communication terminal 200 has also been obtained in advance.

Further, the authentication result notification unit 404 of the CE device 400 receives, from the certificate verification notification unit 306 of the IC card 300, a notification of a diagnosis result as to whether the user information of the communication terminal 200 is appropriate.

Then, the external device access request providing unit 406 of the CE device 400 transfers the content request of the communication terminal 200 to the content server 600.

By the way, according to the domain participation method of this example, even if a user is participating in the domain without using the communication terminal 200 such as a mobile phone, the domain participation in the IC card 300 can be used. Content from CE device 400 with password for using authorization attribute certificate Acquisition is possible.

In addition, in the domain participation method of this example, the power of storing one public key certificate and a plurality of attribute certificates in one domain using an IC card 300 is disclosed. The storage medium for storing the document may be, for example, a flash memory having an IC card function, as long as it is removable and retains the security function equivalent to that of the IC card 300.

Industrial applicability

According to the domain participation method of the present invention, one public key certificate and a plurality of attribute certificates can be stored in association with one domain using an IC card, and domain management can be facilitated. Therefore, domain participation method, attribute certificate selection method, communication terminal, IC card, CE device, attribute certificate that acquires content in a secure way using one CE device in multiple user environments Useful as an issuing authority and content server.

Claims

The scope of the claims

[1] A domain participation method for acquiring content in a secure manner using one CE device in multiple user environments,

Based on the public key certificate of the CE device that is the domain representative, the memory with the IC card function that stores the attribute certificate, and the attribute certificate of the communication terminal that is the domain participant, domain participation permission A domain participation notification step of notifying the attribute certificate issuing authority which issues the attribute certificate of domain participation;

The attribute certificate issuing authority associates the public key certificate of the CE device with the attribute certificate of the communication terminal by receiving domain participation notification from the communication terminal, and the public key certificate of the CE device and the communication. A domain participation permission attribute certificate issuing step of issuing a domain participation permission associated with an attribute certificate of a terminal to the communication terminal.

[2] After the CE device includes the public key certificate and the attribute certificate of the memory, and the communication terminal acquires the memory storing the domain participation permission attribute certificate, the domain participation permission attribute certificate is obtained. When there is an access from the communication terminal power which has acquired a document, an attribute for searching for an attribute certificate corresponding to the communication terminal from among the attribute certificates in the memory based on the user information in the access information Certificate search step,

In the attribute certificate search step, if there is an attribute certificate that matches the user information included in the access of the CE device to the communication terminal, the public key certificate of the CE device and the communication terminal The attribute certificate transmission step of transmitting to the content server an attribute certificate that matches the user information included in the access of the attribute certificate selection method in the domain participation method according to claim 1.

[3] The public key certificate identifies device information and the attribute certificate identifies a user by combining the domain participation method according to claim 1 and the attribute certificate selection method in the domain participation method. A service method for providing a service according to an apparatus and a user using the public key certificate and the attribute certificate.

[4] holds an attribute certificate that certifies the identity of the user, and notifies the attribute certificate issuing station of user information of the communication terminal and an attribute certificate of the communication terminal. Domain participation permission attribute certificate issuance request unit,

Stored in the memory! The public key certificate and attribute certificate of the CE device are notified to the attribute certificate issuing authority via the network input / output unit of the communication terminal, and the attribute certificate issuing authority issues the attribute certificate. A domain participation permission attribute certificate receiving unit for receiving a domain participation permission attribute certificate;

A communication terminal for making domain participation request in the domain participation method according to claim 1, comprising: a domain participation permission attribute certificate output unit for storing the domain participation permission attribute certificate in the memory.

[5] A communication terminal for acquiring content that is displayed on a screen display device connected to the CE device.

A device information storage unit that stores device information including user information;

An external device access request unit for accessing the CE device using the user information of the device information storage unit;

The communication terminal according to claim 4, further comprising: an external device operation unit that performs content selection and content acquisition on the screen display device via the CE device when authentication with the CE device is established.

[6] A public key certificate storage unit for storing the public key certificate of the CE device;

An attribute certificate storage unit for storing the attribute certificate of the CE device in advance; and after the communication terminal accesses the attribute certificate issuing authority by the domain participation permission attribute certificate issuance request unit, the domain representative is represented Certificate transmitting unit for transmitting certificate information of the person to the attribute certificate issuing authority via the network input / output unit of the communication terminal; and the domain participant associated with the public key certificate of the domain representative An IC card as the memory connected to the communication terminal in the domain joining method according to claim 1, further comprising: a domain management unit that manages an attribute certificate.

[7] An IC card connected to the CE device for receiving content acquisition access of the communication terminal by the CE device and determining whether the user participates in a domain, the user using the communication terminal A certificate for acquiring the CE device power user information that has received information, and comparing and verifying the user information with the attribute certificate in the attribute certificate storage unit. Book comparison and verification department,

A certificate verification notification unit for notifying the CE device whether or not the user information is appropriate according to the verification result of the comparison verification unit;

The public key certificate of the CE device and the attribute certificate of the communication terminal are transmitted to the content server via the network of the CE device when the user information is appropriate according to the verification result in the comparison and verification unit. The IC card according to claim 6, comprising: a certificate transmission unit.

[8] An attribute certificate issuing authority that issues the domain participation permit certificate, and

A domain participant reception unit for receiving a domain participation notification of the communication terminal, which is a domain participant, and

The communication terminal and certificate information is received from the memory connected to the communication terminal and the public key certificate of the CE device as the domain representative and the communication terminal as the domain participant A domain creation unit that associates a domain with the attribute certificate of

A domain storage unit that stores, for each domain, the attribute certificate associated by the domain creation unit;

The domain participation permission attribute certificate issuing unit according to claim 1, further comprising: a domain participation permission attribute certificate issuing unit that issues the attribute certificate associated by the domain creation unit to the communication terminal that is the domain participant. Station.

[9] At the time of content request of the communication terminal, the content is certified by the user based on the user information included in the access of the user who has issued the domain participation permission attribute certificate from the attribute certificate issuing authority. It is a CE device that is connected to a content server in advance and connected to a network and that has a screen display device that displays content information.

A user information transfer unit which receives an access including user information of the communication terminal power and which is connected to the user information and transferred to the memory;

An authentication result notification unit that returns the result received from the certificate verification notification unit of the memory to the communication terminal that has accessed the information; The CE device according to the domain participation method according to claim 1, further comprising: an access request providing unit that notifies the content server of a content request of the communication terminal.

An attribute certificate of the communication terminal that makes the content request and a public key certificate of the CE device that is the domain representative are acquired, the public key certificate is device information, and the attribute certificate is a user. The content server according to the attribute certificate selection method according to claim 2, wherein the content that can be reproduced by the CE device according to the user is provided by identifying the content certificate.