HK1116313A - Terminal device, provision server, electronic information utilization method, electronic information provision method, terminal device program, provision server program, intermediate program and recording medium - Google Patents

Description

Terminal device, providing server, electronic information utilization method, and electronic information providing method

This application is a divisional application of the invention patent application having an application number of 200480000610.6, an application date of 2004-4/13, and an invention title of "terminal device, providing server, electronic information utilization method, electronic information providing method, terminal device computer program, providing server computer program, intermediary computer program, and storage medium".

Technical Field

The present invention relates to a device authentication system and the like, and particularly relates to a system for efficiently performing device authentication by incorporating an extended function for device authentication in a browser.

Background

Next, description will be made of (1) a method of using content using a CE device and (2) an extension of a browser function using a plug-in the related art.

(prior art 1)

In recent years, CE (Consumer Electronics) devices have become widespread.

The CE device is an electronic device that has a built-in computer and can use a network service, and various services provided by a service server can be used by accessing the service server.

Here, a case where content is downloaded from a service server and used is considered.

The contents provided by the service server include contents that can be freely used in a browser, dedicated contents used by a dedicated application, and contents that require user authentication at the time of downloading.

Fig. 11 is a diagram for explaining an example of a configuration of a conventional CE device.

The CE device 103 has an application a for authenticating a user with the content provided by the service server a and authentication information a required for the service server a to authenticate the user.

When the CE device 103 requests the service server a to transmit the content, the service server a requests user authentication, and accordingly, the CE device 103 transmits authentication information a to the service server a.

The service server a authenticates the user by the authentication information a, and then transmits the content to the CE device 103. CE device 103 may use these contents in application a.

Similarly, the CE device 103 includes an application B and authentication information B for the service server B and an application C and authentication information C for the service server C.

In this way, the conventional CE device 103 needs to prepare authentication information for each application.

In addition, when authenticating an application, for example, an authentication screen is displayed on a display or the like, and it is necessary for a user to input necessary items on the authentication screen and then send the screen to a service server or the like.

Therefore, when a user searches for a content using a browser or the like and then wants to use a desired content, the user must temporarily switch from the browser screen to an authentication screen to perform authentication processing, and a seamless transition from the search to the use of the content cannot be achieved.

Fig. 12 is a flowchart for explaining an example of a procedure when content is downloaded by means of an existing CE apparatus.

These contents are dedicated contents used by a predetermined application or contents that require user authentication when downloaded.

A service server is accessed from a browser of the CE device requesting the downloading of content (step 202).

Accordingly, the service server makes a user authentication request to the browser (step 212).

In this regard, user authentication is performed between the CE device and the service server in a prescribed order.

After the authentication is completed, the service server downloads an application required for using the content to the CE device (step 214).

The CE device then installs the downloaded application (step 204).

In addition, when the application is already installed, step 214 and step 204 are omitted.

The installed application then issues a content download request to the service server (step 222).

Then, mutual authentication is performed between the application and the service server (step 224, step 216), and the service server transmits the content to the application (step 218).

The application receives and uses the content (step 226).

(prior art 2)

The extension of the browser function by the plug-in is explained below.

The browser has basic functions such as a display function of interpreting an HTML (Hypertext Markup Language) text and displaying a screen on a display, a communication function of accessing the URL site by setting a URL to download or transmit data to the site, and a jump function of jumping to a URL (Uniform Resource locator) that develops a link in the HTML text.

In addition to such basic functions, the browser can add an application called plug-in to extend its functions.

For example, although a browser does not generally have a function of playing back moving pictures or music, moving pictures and music can be played back in the browser by adding a moving picture playback plug-in and a music playback plug-in.

These plug-ins are typically dynamically launched, and the browser launches the corresponding plug-in to issue a content request according to the content type (type).

To launch a plug-in this manner, tag information called an EMBED tag is prepared in HTML. In the EMBED tag, a parameter called MIME type is set, whereby a plug-in to be started can be specified.

The URL of the download address of the content used by the plug-in is specified by the SRC parameter set in the EMBED tag.

After finding the EMBED tag in the received HTML text, the browser analyzes the MIME type to start a plug-in adaptive to the data format of the content, and meanwhile, downloads the content from the URL determined by the SRC parameters.

The user can use the downloaded content by means of the launched plug-in.

Japanese patent application No. 2001 and 527668 disclose a technology using the EMBED tag.

In a system for selecting various types of image data from a distribution site in a distributed environment to restore, the technology configures a Smart Mirror (Smart Mirror) to store format data sets of different files, and directs a user's request to the most appropriate Mirror site.

When downloading a video clip or a sound clip, this technique analyzes an EMBED tag in an HTML text, starts downloading a designated file, and analyzes a file format.

As described above, the conventional CE device needs to prepare authentication information for each application, and thus cannot use the memory efficiently.

Further, when using dedicated content, there is an authentication operation or application startup, and the like, and thus the user cannot achieve a seamless transition from selecting the content of the browser to using the content.

Disclosure of Invention

Therefore, an object of the present invention is to provide a device authentication system and the like capable of efficiently performing authentication when using a network service.

In order to achieve the above object, the present invention provides a terminal device including a display device, an intermediary device, and an authentication information transmitting device, wherein the display device includes: a display function of displaying electronic information provided on a network as viewable; a designation information receiving function of receiving designation information designating the intermediary apparatus; a designation function of designating the intermediary apparatus using the received designation information; the mediation device is designated by the designation function and activates the authentication information transmission device, and the authentication information transmission device is activated by the mediation device and transmits device authentication information to an authentication server (configuration 1).

Here, the 1 st configuration may include: an authentication result receiving means for receiving an authentication result from the authentication server; an authentication result transmitting device for transmitting the received authentication result to a providing server for providing electronic information; and an electronic information receiving device for receiving the electronic information transmitted from the providing server based on the transmitted authentication result (configuration 2).

Here, the mediation device according to claim 2 may be configured to include: the utilization function utilizes the electronic information received from the providing server.

Further, the structure 2 may be configured as follows: a request device for requesting the providing server to provide electronic information; the designation information receiving function receives designation information transmitted from the providing server based on the requested request.

In addition, the 1 st configuration may be configured such that: the designation information receiving function receives designation information including connection information for connecting to the authentication server, and the authentication information transmitting apparatus connects to the authentication server using the received connection information (configuration No. 3).

The structure 3 may be configured such that: the authentication server may include a plurality of authentication servers, and the designation information receiving function may receive designation information including connection information of each of the authentication servers sorted according to a priority order of connection.

The 2 nd structure may be configured such that: the designation information receiving function receives designation information including connection information for connecting to the providing server, and the authentication result transmitting device connects to the providing server using the received connection information.

A providing server for providing electronic information to a terminal device according to claim 2, comprising: a designation information transmitting means for transmitting designation information for designating the mediation means for activating the authentication information transmitting means by the display means of the terminal device; an authentication result receiving means for receiving an authentication result from the terminal device; and an electronic information transmitting device for transmitting the electronic information based on the received authentication result (configuration 4).

The providing server according to the 4 th configuration may be configured as follows: a request receiving device for receiving a request for providing electronic information from the terminal device; the specification information transmitting device transmits the specification information based on the received request.

The providing server according to claim 4 may be configured as follows: an authentication information receiving device for receiving authentication information from the terminal device, and an authentication device for authenticating the terminal device using the received authentication information; the electronic information transmitting device transmits electronic information to the terminal device based on the authentication result of the authentication device.

In order to achieve the above object, the present invention provides an electronic information using method for use in a computer including a display device, an intermediary device, and an authentication information transmitting device, the method including the steps of: a display step, realized by means of the display device: a display function of displaying electronic information provided on a network as viewable; a designation information receiving function of receiving designation information designating the intermediary apparatus; a designation function of designating the intermediary apparatus using the received designation information; an intermediating step of designating the intermediating apparatus by the designation function of the displaying step, and causing the intermediating apparatus to activate the authentication information transmitting apparatus; an authentication information transmission step of activating the authentication information transmission device through the mediation step and transmitting device authentication information to an authentication server (configuration 5).

In the 5 th configuration, the structure may be such that: the computer further comprises an authentication result receiving device, an authentication result transmitting device, and an electronic information receiving device; comprises the following steps: an authentication result receiving step of receiving an authentication result from the authentication server by the authentication result receiving means; an authentication result transmitting step of transmitting the received authentication result to a providing server that provides electronic information by the authentication result transmitting means; an electronic information receiving step of receiving, by the electronic information receiving apparatus, electronic information transmitted from the providing server based on the transmitted authentication result (configuration 6).

The structure 6 may be configured such that: the intermediary device has a utilization function for utilizing the electronic information received from the providing server, and includes a utilization step for utilizing the electronic information received from the providing server in the intermediary device.

The structure 6 may be configured such that: the device also comprises a request device for requesting the providing server to provide the electronic information; the designation information receiving step receives designation information transmitted from the providing server based on the requested request.

The 5 th structure may be configured such that: the designation information receiving function receives designation information including connection information for connecting to the authentication server, and the authentication information transmitting step connects to the authentication server using the received connection information (configuration 7).

The 7 th structure may be configured such that: the authentication server may include a plurality of authentication servers, and the designation information receiving function may receive designation information including connection information of each of the authentication servers sorted according to a priority order of connection.

The structure 6 may be configured such that: the designation information receiving function receives designation information including connection information for connecting to the providing server, and the authentication result transmitting step connects to the providing server using the received connection information.

In order to achieve the above object, the present invention provides an electronic information providing method for use in a providing server for providing electronic information to a terminal device having the configuration of claim 2, wherein the providing server includes a designation information transmitting means, an authentication result receiving means, and an electronic information transmitting means; the electronic information providing method is characterized by comprising the following steps: a designation information transmission step of transmitting, by the designation information transmission device, designation information for designating an intermediary device that activates an authentication information transmission device by a display device of the terminal apparatus; an authentication result receiving step of receiving an authentication result from the terminal device by the authentication result receiving means; and an electronic information transmission step of transmitting electronic information by the electronic information transmission device based on the received authentication result (configuration 8).

The 8 th structure may be configured as follows: the providing server further includes a request accepting unit that accepts an electronic information providing request from the terminal device, and the specifying information transmitting unit transmits the specifying information based on the request accepted in the request accepting unit.

The 8 th structure may be configured as follows: the providing server further includes an authentication information receiving device and an authentication device, and the electronic information providing method includes an authentication information receiving step of receiving authentication information from the terminal device by the authentication information receiving device; an authentication step of authenticating the terminal device by the authentication device using the received authentication information; in the electronic information transmission step, electronic information is transmitted to the terminal device based on the authentication result in the authentication step.

In order to achieve the above object, the present invention provides a terminal device computer program for implementing a display function, an intermediary function, and an authentication information transmission function by a computer, the terminal device computer program comprising: the display function includes a display function for displaying electronic information provided on a network to be viewable; a designation information receiving function of receiving designation information designating the mediation function; a specifying function of specifying the mediation function using the received specifying information; the intermediary function is designated by the designation function, and the authentication information transmission function is activated; the authentication information transmission function is activated by the mediation function and transmits device authentication information to an authentication server (structure 9).

The 9 th structure may be configured such that: implementing with a computer: an authentication result receiving function for receiving an authentication result from the authentication server; an authentication result transmitting function for transmitting the received authentication result to a providing server for providing electronic information; and an electronic information receiving function for receiving the electronic information transmitted from the providing server based on the transmitted authentication result (configuration 10).

The 10 th structure may be configured such that: the intermediation function includes a utilization function for utilizing the electronic information received from the providing server.

The 10 th structure may be configured such that: the terminal device computer program further implements a request function for requesting the providing server to provide electronic information; the designation information reception function receives the designation information transmitted from the providing server based on the requested request.

The 9 th structure may be configured such that: the designation information receiving function receives designation information including connection information for connecting to the authentication server, and the authentication information transmitting function connects to the authentication server using the received connection information (structure 11).

The 11 th structure may be configured such that: the authentication server may include a plurality of authentication servers, and the designation information receiving function may receive designation information including connection information of each of the authentication servers sorted according to a priority order of connection.

The 10 th structure may be configured such that: the designation information receiving function receives designation information including connection information for connecting to the providing server, and the authentication result transmitting function connects to the providing server using the received connection information.

In order to achieve the above object, the present invention provides a server computer program that runs on a computer for providing electronic information to a terminal device having the configuration 2, and that realizes by the computer: a designation information transmission function of transmitting designation information for designating an intermediary function for starting the authentication information transmission function by a display function of the terminal device; an authentication result receiving function for receiving an authentication result from the terminal device; and an electronic information transmission function for transmitting the electronic information based on the received authentication result (configuration 12).

The providing server computer program according to claim 12 may be configured to: implementing a request accepting function in the computer, and accepting an electronic information provision request from the terminal device; the designation information transmission function transmits the designation information based on the received request.

The providing server computer program according to claim 12 may be configured to: implementing, in the computer, an authentication information reception function of receiving authentication information from the terminal device and an authentication function of authenticating the terminal device using the received authentication information; the electronic information transmission function transmits electronic information to the terminal device based on the authentication result of the authentication function.

Further, the present invention provides a storage medium readable by a computer storing a computer program for a terminal device that realizes a display function, an intermediary function, and an authentication information transmission function by the computer, the storage medium comprising: the display function includes: a display function of displaying electronic information provided on a network as viewable; a designation information receiving function of receiving designation information designating the mediation function; a designation function of designating the intermediary apparatus using the received designation information; the intermediary function is designated by the designation function, and the authentication information transmission function is activated; the authentication information sending function sends the device authentication information to the authentication server after being activated by the mediation function.

Further, the present invention is a storage medium readable by a computer, storing a providing server computer program running in a computer for providing electronic information to a terminal device of the configuration 2, the providing server computer program being implemented by the computer: a designation information transmission function of transmitting designation information for designating an intermediary function for starting the authentication information transmission function by a display function of the terminal device; an authentication result receiving function for receiving an authentication result from the terminal device; and an electronic information transmitting function for transmitting the electronic information based on the received authentication result.

Further, the present invention provides an intermediating computer program for implementing the intermediating apparatus of the 1 st configuration by a computer, implementing the intermediating function by a computer, and activating an authentication information transmitting device of a terminal device when receiving a designation from a display device of the terminal device which has received designation information.

Further, the present invention provides a computer-readable storage medium storing a mediation computer program for realizing with a computer a mediation apparatus of the 1 st configuration, the mediation computer program realizing with a computer: and an intermediary function that activates the authentication information transmitting device of the terminal device when receiving the designation from the display device of the terminal device that received the designation information.

Drawings

Fig. 1 is a diagram for explaining an outline of the device authentication system according to the present embodiment.

Fig. 2 is a diagram for explaining the configuration of the device authentication system according to the present embodiment.

Fig. 3 is an exemplary diagram of a modular structure of the CE apparatus 3.

Fig. 4 is an exemplary diagram of the hardware configuration of the CE apparatus 3.

Fig. 5 is a diagram of an example of an EMBED tag included in an authentication trigger.

Fig. 6 is a flowchart for explaining a procedure when the CE apparatus downloads content from the service server.

Fig. 7 is a flowchart for explaining a procedure when the CE apparatus of modification 1 downloads content from the service server.

Fig. 8 is a diagram for explaining a module configuration in the CE device according to modification 2.

Fig. 9 is a diagram for explaining an example of the EMBED tag according to modification 3.

Fig. 10 is a diagram for explaining an example of the EMBED tag according to modification 4.

Fig. 11 is a diagram for explaining an example of a configuration of a conventional CE device.

Fig. 12 is a flowchart for explaining an example of a procedure when content is downloaded by means of an existing CE apparatus.

Detailed Description

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[ summary of embodiments ]

In this embodiment, a plug-in mechanism is used to implement an authentication request for content that needs to be authenticated. An authentication trigger is generated by embedding authentication related information in the information of the initiating plug-in. The device terminal (CE device) that receives the authentication trigger issues a content request after performing necessary authentication.

Furthermore, in the present embodiment, since a plurality of applications share one common module and common authentication information as necessary authentication functions, a plurality of authentication mechanisms are not required to serve each application.

Fig. 1 is a diagram for explaining an outline of the device authentication system according to the present embodiment.

The CE device 3 includes a browser 9 necessary for accessing the service server 4 and an authentication module 7 for performing device authentication by the authentication server 5.

The device authentication plug-in 8 is a plug-in having a function of starting the authentication module 7.

The device authentication plug-in 8 may be determined by a specified MIME type, and the browser 9 starts the device authentication plug-in 8 after receiving an EMBED tag with such MIME type.

In the device authentication system configured as described above, when the service server 4 attempts to authenticate the device by the CE device 3, it transmits an authentication trigger (trigger information for the CE device 3 to perform device authentication) including an EMBED tag for activating the device authentication plug-in 8.

The browser 9 determines the device authentication plug-in 8 to launch according to the MIME type of the EMBED tag.

Then, the device authentication plug-in 8 activates the authentication module 7 to transmit authentication information to the authentication server 5, and causes the authentication server 5 to perform device authentication.

Generally, the plug-in activated by the browser is mainly animation reproduction software for reproducing moving pictures, music reproduction software for reproducing music, or the like, and presents data to the user after reproduction, but the device authentication plug-in 8 adds a function of activating the authentication module 7 to the browser 9.

As described in the following embodiments, the device authentication plug-in 8 may have a configuration having a function of an application client (hereinafter, referred to as an application) that enables use of content in addition to a function of activating the authentication module 7.

[ detailed description of the embodiments ]

Fig. 2 is a diagram for explaining the configuration of the device authentication system 1 according to the present embodiment.

In the device authentication system 1, the CE device 3, the service server 4, and the authentication server 5 are connected to each other via a network such as the internet and can communicate with each other.

In addition, in fig. 1, 1 CE device 3 and 1 service server 4 are provided for simplicity, and these may be plural.

The CE device 3 is, for example, an audio device such as a video recorder, a stereo system, or a television, a home appliance such as an automatic rice cooker or a refrigerator, or other electronic devices, and is equipped with a computer therein, and can use services via a network.

The CE device 3 has authentication information necessary for device authentication such as a device ID and a passphrase, and when the service server 4 requests device authentication before providing a service, the device authentication can be performed by the authentication server 5.

In addition, a passphrase is a character string having a password function, and although a password longer than a password is referred to as a passphrase, both the passphrase and the password may be used for device authentication in practice.

The service server 4 is a server that is configured by, for example, a Web server and provides a service to the CE device 3. The service server 4 opens a service site specified by a predetermined URL, and the CE device 3 can access the service server 4 by specifying the URL.

The traffic server 4 provides services to the CE devices 3 accessing the service site. The user can utilize the services provided by the service server 4 through the CE device 3.

The service provided by the service server 4 includes, for example, contents such as music contents, travel information contents, movie contents, and cooking recipe contents, personal information including interests and hobbies, equipment information of the CE equipment, information such as setting parameters required for connecting to the internet, and remote operations of the CE equipment such as maintenance of the CE equipment, software upgrade, bathroom operation, and air conditioning operation.

In addition, an online storage service, affinity service (matching service of the specification and service of a device with the specification and service of a demand from other devices) may also be provided.

Furthermore, if the CE apparatus 3 is a toilet, it is also possible to provide a health care service of checking health condition by detecting defecation of the user by a sensor.

The service server 4 constitutes a providing server that provides electronic information. Further, the apparatus includes a designated information transmitting device for transmitting the EMBED tag to the CE device 3, an authentication result receiving device for receiving the device authentication result from the CE device 3, and an electronic information transmitting device for transmitting the content based on the received authentication result.

Further, the CE device 3 includes a request accepting means for accepting a request for transmission of the content in the service server 4 when the content is requested to be transmitted after being viewed.

In the present embodiment, the content is used as an example of the electronic information; it is not limited thereto, and can provide a wide range of electronic information for other services. For example, remote operation of a bathroom, software upgrade, health diagnosis using health information such as blood pressure and blood glucose level transmitted from a user, and the like, the service server 4 can provide various electronic information.

The authentication server 5 is a server that performs device authentication on the CE device 3 instead of the service server 4.

The authentication server 5 receives authentication information such as a device ID or a passphrase from the CE device 3, and performs device authentication on the CE device 3.

Since any individual or group can install the service server 4, the present embodiment is configured to separately install the authentication server 5 and transmit important security authentication information to the authentication server 5. International application number PCT/JP03/06180, which was filed on 5/19/2003 and is required to be entitled to the priority of patent application 2002-144896 originally filed on 5/20/2002 in japan, describes a technique for performing device authentication using such an authentication server.

Further, the service server 4 may perform device authentication as in the related art.

In this case, the service server 4 includes an authentication information receiving device that receives authentication information from the CE device 3 and an authentication device that authenticates the CE device 3 using the received authentication information. Further, after the CE device 3 is device-authenticated, the content is transmitted.

In the device authentication system 1 configured as described above, when the service server 4 provides a service requiring device authentication, a series of processes are executed by the steps indicated by the numbers in the figure.

Step 1: the CE device 3 requests the service server 4 to provide a service requiring device authentication.

Step 2: the service server 4 sends an authentication trigger to the CE device 3 requesting device authentication.

And step 3: the CE device 3 receives the authentication trigger from the service server 4, and then transmits authentication information to the authentication server 5 to request device authentication.

And 4, step 4: the authentication server 5 receives the authentication information from the CE device 3 and performs device authentication. Then, the authentication result is transmitted to the CE device 3.

And 5: the CE device 3 receives the authentication result from the authentication server 5, and transmits the authentication result to the service server 4.

Step 6: the service server 4 confirms to the authentication server 5 whether or not the authentication result is indeed the device authentication by the authentication server 5. For example, the validation process may be accomplished as follows: the authentication server 5 issues a one-time ID to be included in the authentication result when performing device authentication, and the service server 4 makes an inquiry to the authentication server 5 using the one-time ID.

And 7: the service server 4 confirms the authentication result by the authentication server 5, and then starts providing the service to the CE device 3.

Fig. 3 is an exemplary diagram of a modular structure of the CE apparatus 3.

Fig. 2 shows only 1 service server 4, but fig. 3 shows service servers 4a to 4c as an example. The service servers 4a to 4c can provide various services, but only the content service will be described below.

The CE device 3 includes various functional portions such as a browser 9, applications 8a to 8c, an authentication module 7, an authentication information storage unit 10, a protocol adjustment module 11, and an encryption module 12.

When the CE device 3 is connected to the service site specified by the input URL to download the content, and the content is described in a markup language such as HTML text, the browser 9 can interpret the content and display the content on the screen, or transmit the data to the service site specified by the URL.

When the HTML text includes the EMBED tag, the browser 9 starts an application for MIME type determination from among the applications 8a to 8 c.

The label of the EMBED will be described in detail later.

The browser 9 constitutes a display device having a display function of displaying contents (electronic information) on the network as viewable.

As described later, the EMBED tag constitutes specification information for specifying the applications 8a to 8 c.

The browser 9 also has a receiving function of receiving the specification information from the service servers 4a to 4c and a specifying function of receiving the applications 8a to 8c specified using the specification information.

The browser 9 further includes a requesting device that requests the applications 8a to 8c to transmit the content.

The applications 8a to 8c are plug-ins that extend the functions of the browser 9, and allow users to use the contents transmitted by the service servers 4a to 4c, respectively.

That is, application 8a is a plug-in for using content provided by the service server 4a, and so on for other applications.

Further, the applications 8a to 8c are configured to start the authentication module 7 after being started by the browser 9. That is, the applications 8a to 8c also have a function as the device authentication plug-in 8 of fig. 1.

In this way, the applications 8a to 8c constitute mediation means for mediating between the browser 9 and the authentication module 7, and activate the authentication module 7 after being specified and activated by the browser 9.

The applications 8a to 8c also have a function of using content.

The applications 8a to 8c also function as electronic information receiving devices that receive the contents transmitted from the service servers 4a to 4c, respectively.

The authentication information storage unit 10 is a functional part that supplies information necessary for device authentication of the CE device 3, such as a device ID or a passphrase, to the authentication module 7.

The authentication module 7 is a functional part for causing the authentication server 5 to execute device authentication of the CE device 3, and when activated by the applications (device authentication plug-ins) 8a to 8c, communicates with the authentication server 5 to execute a series of device authentication sequences.

More specifically, for example, reading the device ID and the passphrase from the authentication information storage section 10 transmits authentication information to the authentication server 5, and receives a device authentication result and the like transmitted from the authentication server 5.

The authentication module 7 constitutes authentication information transmission means that communicates with the authentication server 5 and transmits authentication information to the authentication server 5.

Further, the authentication server 7 constitutes an authentication result receiving means when receiving the authentication result transmitted from the authentication server 5.

Further, in the unpublished patent document (patent application 2003-115755), a device authentication method is proposed in which a set of a random number and a passphrase generated in the authentication server 5 is subjected to hash processing to generate a digest, and the digest is used by the authentication server 5 to perform device authentication, but the authentication module 7 may be configured to use this authentication method.

In this case, the authentication module 7 receives the random number from the authentication server 5, generates a digest together with the passphrase, and transmits the digest to the authentication server 5.

On the other hand, the authentication server 5 stores the random number transmitted to the authentication server 5, generates a digest from the password phrase and the random number stored in advance, and determines whether or not the digest matches the digest received from the authentication server 7.

In this way, the authentication module 7 outputs the passphrase as a different digest at a time, instead of the plain text, thereby making it possible to obtain an improvement in security.

The protocol adjustment module 11 is a functional part that converts the protocol of data transmitted from the authentication module 7 to the authentication server 5 into the protocol used by the authentication server 5 or vice versa.

The encryption module 12 is a functional part that encrypts the communication path of the CE device 3 and the authentication server 5.

The encryption technique may use, for example, SSL (Secure Sockets Layer).

Fig. 4 is an exemplary diagram of the hardware configuration of the CE apparatus 3.

The CPU (Central Processing Unit) 21 is a Central Processing Unit that executes various processes in accordance with a computer program stored in a ROM (read only Memory) 22 or a computer program downloaded from a storage Unit 28 into a RAM (Random Access Memory) 23.

The ROM22 stores basic computer programs and parameters and the like necessary for operating the CE apparatus 3.

The RAM23 provides a work area necessary for the CPU21 to execute various processes.

The storage unit 28 stores various computer programs and data necessary for operating the CE device 3, and is configured by a storage device such as a hard disk or a semiconductor memory.

The computer programs stored in the storage unit 28 include an OS (Operating System) for realizing basic functions such as file input/output and control of each part of the CE device 3, and various computer programs ranging from a browser computer program to an encryption computer program that constitute each component from the browser 9 to the encryption module 12 shown in fig. 3 in a software manner.

The CPU21 executes these programs to configure the browser 9 to the encryption module 12 in software.

The CPU21, ROM22, and RAM23 are connected to each other via the bus 24. An input/output interface 25 is also connected to the bus 24.

The input/output interface 25 is connected with: an input unit 26 constituted by a keyboard, a mouse, and the like; a display device including a CRT (Cathode ray Tube), an LCD (Liquid crystal display), and the like; an output unit 27 including a sound box; a storage unit 28 formed of a hard disk or the like; a communication unit 29 including a modem and a terminal adapter. The communication unit 29 performs communication processing via a network.

The input unit 26 inputs a URL set to the browser 9, information for operating the applications 8a to 8c, and the like, and can input various information and commands.

The output unit 27 can output a screen displayed by the browser 9, screens displayed by the applications 8a to 8c, and moving images, still images, and sounds reproduced by the applications 8a to 8 c.

The drive 30 is connected to the input/output interface 25 as necessary, and a magnetic disk 41, an optical disk 42, a magneto-optical disk 43, a memory card 44, and the like are mounted as appropriate, and a computer program read therefrom is installed in the storage unit 28 as necessary.

The authentication server 5 and the service server 4 have basically the same configuration as the CE device 3, and therefore, description thereof is omitted.

Fig. 5 is a diagram of an example of an EMBED tag included in an authentication trigger.

Line 51 states that the tag is an EMBED tag from which the browser 9 can identify the EMBED tag.

Line 52 defines the MIME type to specify which of the applications 8 a-8 c is to be launched.

Line 53 is a dummy line set and is not specifically related to device authentication. It is originally used in the EMBED tag to specify the download location of the content by the SRC parameter, but in the present embodiment, the applications 8a to 8c activate the authentication module 7, and therefore, the entry is made dummy.

Line 54 describes device authentication-related information including a URL (URL of an authentication site) for connecting to the authentication server 5, information for specifying an authentication service started in the authentication server 5, and the like.

Line 55 describes information for specifying the query location after authentication, including the URL of a connected site after successful device authentication and the URL of a connected site when failed device authentication.

Line 56 specifies the version of the device authentication. The legend shows the contents corresponding to the device authentication of version 1.00 and version 2.00.

The device authentication has a plurality of versions, and a structure of receiving different services according to different versions of the device authentication may be employed.

The version of the device authentication required by the service servers 4a to 4c can be specified by line 56.

The CE device 3 connects to the authentication server 5 using the URL (connection information necessary for connecting to the authentication server) of the 54 th row contained in the EMBED tag, and transmits the authentication result to the service server using the URL (connection information necessary for connecting to the providing server) of the 55 th row.

Fig. 6 is a flowchart for explaining a procedure when the CE device 3 downloads, from the service server 4, content requiring device authentication in the device authentication system 1.

The following processes are performed by the CPUs of the CE device 3, the service server 4, and the authentication server 5 according to predetermined computer programs.

First, the browser 9 in the CE device 3 accesses the service site of the service server 4 and requests transmission of content requiring device authentication (step 42).

In this regard, the service server 4 sends an authentication trigger to the browser 9 (step 52). The authentication trigger includes an EMBED tag for starting an application (one of the applications 8a to 8c, hereinafter simply referred to as an application) required to use the content requested by the CE device 3.

The browser 9 receives the authentication trigger from the service server 4 and determines the MIME type contained in the EMBED tag (step 44).

The browser 9 then launches the application determined by the MIME type (step 46).

After the application is started by the browser 9, the authentication module 7 is started to request the authentication module 7 to perform device authentication (step 32).

When the application is started, the authentication module 7 acquires the device ID or the passphrase generation authentication information from the authentication information storage unit 10 (fig. 3), and transmits the device ID or the passphrase generation authentication information to the authentication server 5 (step 22). In addition, since the URL of the authentication site of the authentication server 5 is described in the EMBED tag, the authentication server 5 is accessed using the URL.

The authentication server 5 receives the authentication information from the authentication module 7 and performs device authentication of the CE device 3 (step 12).

Then, the authentication server 5 transmits the device authentication result to the authentication module 7 (step 14).

The authentication module 7 receives the device authentication result from the authentication server 5 and provides it to the application (step 24).

The application receives the device authentication result from the authentication module 7 and sends it to the service server 4 (step 34).

In this way, after the application is started, it is possible to establish an independent connection with the service server 4 and receive necessary data.

Further, since the URL accessed when the device authentication is successful and the URL accessed when the device authentication is failed are described in the EMBED tag, the application accesses a site corresponding to the result of the device authentication (both provided in the service server 4).

The service server 4 receives the device authentication result from the application and, if the authentication is successful, transmits the content to the application (step 54).

The application receives and uses the content (step 36).

On the other hand, when the device authentication result is that the device authentication of the CE device 3 fails, the content is not transmitted.

Further, the authentication server 5 may issue the one-time ID to be included in the device authentication result when performing device authentication, or the service server 4 may confirm whether or not the authentication server 5 has actually performed device authentication using the one-time ID after receiving the device authentication result.

Further, in the present embodiment, the authentication server 5 performs the device authentication of the CE device 3, and when the service server 4 performs the device authentication, the authentication module 7 transmits the authentication information to the service server 4, and if the authentication information is authenticated by the service server 4, the service server 4 transmits the content to the CE device 3.

The present embodiment described above can obtain the following effects:

(1) it is not necessary for any application to prepare authentication information for each application in order to utilize the authentication information stored in the authentication information storage section 10. That is, the authentication information can be unified.

(2) The respective applications utilize a common authentication module 7, thereby eliminating the need for each application to have an authentication function.

(3) A plug-in mechanism installed in an existing browser (existing technologies that utilize different applications through different module launches) may be used as a trigger for device authentication.

(4) When downloading content requiring device authentication, the applications 8a to 8c start the authentication module 7 to automatically perform device authentication, and thus seamless transition can be made from viewing and retrieving of content by the browser to the use of content by the applications.

(5) Since the plug-in is dynamically added to the browser 9, the application 8d and other applications can be added later.

The above embodiment has been described with respect to the case where the applications 8a to 8c are installed in advance in the CE device 3; however, the present invention is not limited to this, and another application may be newly added and installed or deleted.

In the present embodiment, the authentication module 7 is mounted in advance; a structure that is later installed may also be employed.

(modification 1)

This modification requires device authentication when the service server 4 provides a service used on a browser.

In the example of fig. 6, the applications 8a to 8c have a content use function of making the content available and a start function (mediation function) of starting the authentication module 7, but in the present embodiment, the content is used by the browser 9, and therefore, the corresponding functional parts of the applications 8a to 8c are the device authentication plug-in 8 having the function of starting the authentication module 7.

Next, a content download process according to modification 1 will be described with reference to the flowchart of fig. 7. In the steps up to step 24, the browser 9 starts the device authentication plug-in 8 specified by the MIME type (step 46), the device authentication plug-in 8 is started by the browser 9, the authentication module 7 is started, and the authentication module 7 is requested to perform device authentication (step 32), and the processes up to this point are the same as those in fig. 6, and therefore, the description thereof is omitted.

In the CE device 3, after the authentication module 7 provides the device authentication result to the device authentication plug-in 8 (step 24), the device authentication plug-in 8 provides it to the browser 9 (step 134).

The browser 9 transmits the device authentication result received from the device authentication plug-in 8 to the service server 4 (step 148).

The URL accessed after the authentication is successful and the URL accessed when the authentication is failed are described in the EMBED tag.

The service server 4 receives the device authentication result from the browser 9, and if the authentication is successful, transmits the content to the browser 9 (step 154).

The browser 9 then receives the content from the service server 4 and makes it available (step 149).

If the authentication result of the device is authentication failure, the service server 4 does not transmit the content.

In this modification, a configuration may be adopted in which device authentication is also required for the content used in the browser 9.

In addition, the device authentication plug-in 8 may be shared at each service site that provides content. That is, if the device authentication plug-in 8 is determined by the MIME type of the EMBED tag, the device authentication plug-in 8 can be used in any service site that needs to set device authentication for the content used in the browser 9.

In the present modification, the browser 9 uses the content after the device authentication; however, the present invention is not limited to this, and the content may be used in another application after the device authentication plug-in 8 is activated to perform device authentication.

(modification 2)

Fig. 8 is a diagram for explaining a modification of the modules in the CE device 3.

In fig. 3, the authentication information storage section 10 supplies the authentication information to the authentication module 7; while variant 2 is provided for applications 8 a-8 c.

In this case, by statically linking the applications 8a to 8c and the authentication module 7, the risk of missing authentication information can be reduced.

Further, when the applications 8a to 8c and the authentication module 7 are statically linked, the authentication module 7 cannot be shared with other applications, and therefore, in this case, the authentication module 7 needs to be prepared for each of the applications 8a to 8 c.

(modification 3)

In modification 3, 2 authentication servers 5 are prepared in the device authentication system 1.

Fig. 9 is a diagram for explaining an example of the label for label according to the embodiment.

The EMBED tag is suitable for the case where there are 2 authentication servers 5.

If 2 authentication servers 5 are prepared, when any one authentication server 5 fails, device authentication can be performed by the other authentication server 5. In addition, when communication with the authentication server 5 which is initially accessed is difficult due to excessively concentrated access or the like, device authentication may be performed by another authentication server 5.

Line 61 in fig. 9 declares an EMBED tag.

Line 62 is a MIME type that identifies the application 8 to be launched.

Line 63 is information used for device authentication by the 1 st (master) authentication server 5, and line 64 is information used for device authentication by the 2 nd (slave) authentication server 5.

Line 65 describes the URL of the authentication site or information for identifying the authentication service provided by the authentication site.

Line 66 describes the URL of the connection point after the device authentication succeeds and the URL of the connection point when the device authentication fails.

The version of the device authentication is described in line 67.

The structure of the 64 th row is the same as that of the 63 rd row, and therefore, the description thereof is omitted.

As described above, the EMBED tag of fig. 9 includes connection information in which the order of connection priority is given by the master, the slave, and the like.

In modification 3 described above, 2 authentication servers 5 can be provided in the device authentication system 1, and device authentication can be performed quickly.

Further, when a plurality of authentication servers 5 are prepared, the label of the EMBED may be generated and the corresponding operation may be performed in the same manner.

(modification 4)

In modification 4, there are 2 types of authentication modules 7 mounted on the CE device 3.

Since each vendor uses various types of CE devices as the CE device 3, there may be various types of ways of authenticating the module 7.

Fig. 10 is a diagram for explaining an example of the label for label according to the embodiment.

Line 71 declares an EMBED tag.

In addition, line 72 sets the MIME type.

Line 73 is information corresponding to mode 1, and line 74 is information corresponding to the other modes.

The CE device 3 that received the EMBED tag selects information suitable for its own mode from the information and uses the information.

Line 75 describes the URL identifying the authentication site of the authentication server 5 and information identifying the authentication service used at that site.

Line 76 describes the URL of the connection point after the device authentication is successful and the URL of the connection point when the device authentication fails.

Line 77 describes the version of the device authentication.

The structure of line 74 is the same as line 73, and therefore, the description thereof is omitted.

In the modification 4 described above, the device authentication system 1 can cope with the case where CE devices 3 having different types of authentication modules 7 are present in a mixed manner.

In addition, modification 4 describes a case where there are 2 types of authentication modules 7; however, the same can be applied to cases where there are a plurality of systems.

According to the present invention, it is possible to efficiently perform authentication when using a service via a network.

Claims (38)

1. A terminal device comprising a display device, an intermediary device, and an authentication information transmission device,

the display device includes: a display function of displaying electronic information provided on a network as viewable; a designation information receiving function of receiving designation information designating the intermediary apparatus; a designation function of designating the mediation apparatus using the received designation information,

the intermediary device is designated by the designation function and activates the authentication information transmission device,

the authentication information transmitting means is activated by the intermediary means and transmits the device authentication information to the authentication server.

2. The terminal device according to claim 1, comprising:

an authentication result receiving means for receiving an authentication result from the authentication server;

an authentication result transmitting device for transmitting the received authentication result to a providing server for providing electronic information;

and an electronic information receiving device for receiving the electronic information transmitted from the providing server based on the transmitted authentication result.

3. The terminal device of claim 2,

the mediation device includes: the function is used to utilize the electronic information received from the providing server.

4. The terminal device of claim 2,

a request device for requesting the providing server to provide electronic information,

the designation information receiving function receives designation information transmitted from the providing server based on the requested request.

5. The terminal device of claim 1,

the designation information reception function receives designation information containing connection information for connecting to the authentication server,

the authentication information transmitting apparatus connects to the authentication server using the received connection information.

6. The terminal device of claim 5,

the authentication server receiving function receives designation information including connection information of each of the authentication servers sorted according to a priority order of connection.

7. The terminal device of claim 2,

the designation information reception function receives designation information containing connection information for connecting to the providing server,

the authentication result transmitting device connects to the providing server using the received connection information.

8. A providing server that provides electronic information to the terminal device according to claim 2, comprising:

a designation information transmitting means for transmitting designation information for designating the mediation means for activating the authentication information transmitting means by the display means of the terminal device;

an authentication result receiving means for receiving an authentication result from the terminal device;

and an electronic information transmitting device for transmitting the electronic information based on the received authentication result.

9. An electronic information utilization method used in a computer having a display device, an intermediary device, and an authentication information transmission device, comprising the steps of:

a display step, realized by the display device: a display function of displaying electronic information provided on a network as viewable; a designation information receiving function of receiving designation information designating the intermediary apparatus; a designation function of designating the intermediary apparatus using the received designation information;

an intermediating step of designating the intermediating apparatus by the designation function of the displaying step, and causing the intermediating apparatus to activate the authentication information transmitting apparatus;

an authentication information transmission step of activating the authentication information transmission device through the mediation step and transmitting the device authentication information to an authentication server.

10. An electronic information providing method used in a providing server that provides electronic information to the terminal device of claim 2,

the electronic information providing method includes the steps of:

a designation information transmission step of transmitting, by the designation information transmission device, designation information for designating an intermediary device that activates an authentication information transmission device by a display device of the terminal apparatus;

an authentication result receiving step of receiving an authentication result from the terminal device by the authentication result receiving means;

and an electronic information transmission step of transmitting the electronic information by the electronic information transmission device based on the received authentication result.

11. A terminal device computer program for realizing a display function, an intermediary function, and an authentication information transmission function by a computer,

the display function includes: a display function of displaying electronic information provided on a network as viewable; a designation information receiving function of receiving designation information designating the mediation function; a specifying function of specifying the mediation function using the received specification information,

the mediation function is designated by the designation function, the authentication information transmission function is activated,

the authentication information sending function is activated by the intermediary function and sends the device authentication information to the authentication server.

12. A providing server computer program executed by a computer that provides electronic information to the terminal device of claim 2, the providing server computer program implementing, with the computer, the functions of:

a designation information transmission function of transmitting designation information for designating an intermediary function for starting the authentication information transmission function by a display function of the terminal device;

an authentication result receiving function for receiving an authentication result from the terminal device;

and an electronic information transmitting function for transmitting the electronic information based on the received authentication result.

13. A storage medium readable by a computer storing a computer program for a terminal device that realizes a display function, an intermediary function, and an authentication information transmission function by the computer,

the display function includes: a display function of displaying electronic information provided on a network as viewable; a designation information receiving function of receiving designation information designating the mediation function; a designation function of designating the mediation apparatus using the received designation information,

the mediation function is designated by the designation function, the authentication information transmission function is activated,

the authentication information sending function is activated by the intermediary function and sends the device authentication information to the authentication server.

14. A storage medium storing a providing server computer program executed in a computer that provides electronic information to the terminal device of claim 2, the storage medium being readable by a computer storing the providing server computer program that realizes by the computer:

a designation information transmission function of transmitting designation information for designating an intermediary function for starting the authentication information transmission function by a display function of the terminal device;

an authentication result receiving function for receiving an authentication result from the terminal device;

and an electronic information transmitting function for transmitting the electronic information based on the received authentication result.

15. A terminal device comprising an information communication means, an electronic information utilization means, and an authentication information management means,

the information communication apparatus includes: a function of receiving authentication trigger information necessary for using electronic information provided on a network, a function of analyzing specification information specifying the electronic information usage device from the authentication trigger information, a function of specifying the electronic information usage device based on the specification information,

the electronic information utilization device is designated by the designation function, the authentication information management device is activated,

the authentication information management device is activated by the electronic information utilization device, and reads the device authentication information and transmits the device authentication information to the authentication server.

16. The terminal device of claim 15,

the authentication information management apparatus receives an authentication result from the authentication server,

the electronic information utilization apparatus transmits the authentication result to a providing server that provides electronic information,

the information communication device receives the electronic information transmitted from the providing server based on the authentication result.

17. The terminal device of claim 16,

the electronic information utilization device includes: the function is used to utilize the electronic information received from the providing server.

18. The terminal device of claim 17,

the electronic information utilization device provides the user with the electronic information for viewing, and reproduces the electronic information as music content or reproduces the electronic information as moving picture content.

19. The terminal device of claim 15,

the authentication trigger information includes authentication server connection information for connecting to the authentication server.

20. The terminal device of claim 19,

the authentication trigger information includes authentication server connection information of each of the authentication servers which is sorted according to a priority order of connection.

21. The terminal device of claim 16,

the authentication trigger information includes providing server connection information for connecting to the providing server, and the authentication result is connected to the providing server using the providing server connection information.

22. A providing server that provides electronic information requiring authentication to a terminal device, comprising:

an authentication trigger information transmitting means for transmitting authentication trigger information including designation information for designating an electronic information utilization device for activating the authentication information management device to the terminal device;

an authentication result receiving device that receives an authentication result for the terminal device in an authentication server from the terminal device;

and an electronic information providing device for providing electronic information based on the received authentication result.

23. An electronic information utilization method for use in a terminal device including an information communication device, an electronic information utilization device, and an authentication information management device, comprising the steps of:

an information communication step of processing, by the information communication apparatus: a function of receiving authentication trigger information necessary for using electronic information provided on a network, a function of analyzing specification information specifying the electronic information usage device from the authentication trigger information, and a function of specifying the electronic information usage device based on the specification information;

a start-up step of starting up the authentication information management apparatus, designated by the designation function of the information communication step;

and an authentication information management step of starting the authentication information management device in the start-up step, reading the device authentication information, and transmitting the device authentication information to an authentication server.

24. The electronic information utilization method according to claim 23,

the authentication information management step includes

The authentication information management device receives an authentication result from the authentication server, transmits the authentication result to a providing server that provides electronic information,

the information communication step includes an electronic information receiving step in which the information communication device receives electronic information transmitted from the providing server based on the authentication result.

25. The electronic information utilization method according to claim 24,

the method includes an electronic information utilization step, wherein the electronic information utilization device further includes a utilization function of utilizing the electronic information received from the providing server.

26. The electronic information utilization method according to claim 25,

the electronic information utilization device provides the electronic information to a user for viewing, and reproduces the electronic information as music content or reproduces the electronic information as moving picture content.

27. The electronic information utilization method according to claim 23,

the authentication trigger information includes authentication server connection information for connecting to the authentication server.

28. The electronic information utilization method according to claim 27,

the authentication trigger information includes authentication server connection information of each of the authentication servers which is sorted according to a priority order of connection.

29. The electronic information utilization method according to claim 24,

the authentication trigger information includes providing server connection information for connecting to the providing server,

the authentication information management step connects the authentication result to the providing server using the connection information of the providing server.

30. An electronic information providing method used in a providing server for providing electronic information requiring authentication to a terminal device, comprising the steps of:

an authentication trigger information transmitting step of transmitting authentication trigger information including designation information for designating an electronic information utilization device which starts an authentication information management device to the terminal device;

an authentication result receiving step of receiving an authentication result for the device in an authentication server from the terminal device;

an electronic information providing step of providing electronic information based on the received authentication result.

31. A terminal device computer program comprising an information communication function, an electronic information utilization function, and an authentication information management function,

the information communication function includes: a function of receiving authentication trigger information necessary for using electronic information provided on a network, a function of analyzing specification information specifying the electronic information usage device from the authentication trigger information, a function of specifying the electronic information usage device based on the specification information,

the electronic information utilization device is designated by the designation function, the authentication information management device is activated,

the authentication information management device is activated by the electronic information function device, reads out device authentication information, and transmits the device authentication information to the authentication server.

32. The terminal device computer program of claim 31, implemented with a computer to:

an authentication result receiving function for receiving an authentication result from the authentication server;

an authentication result transmitting function for transmitting the received authentication result to a providing server for providing electronic information;

and an electronic information receiving function for receiving the electronic information transmitted from the providing server based on the transmitted authentication result.

33. The terminal device computer program of claim 31,

the electronic information utilization function includes: the function is used to utilize the electronic information received from the providing server.

34. The terminal device computer program of claim 33,

the electronic information utilization function provides the electronic information to a user for viewing, and reproduces the electronic information as music content or reproduces the electronic information as moving picture content.

35. The terminal device computer program of claim 31,

the authentication trigger information includes authentication server connection information for connecting to the authentication server.

36. The terminal device computer program of claim 31,

the authentication trigger information includes a plurality of authentication servers, and includes authentication server connection information for each of the authentication servers, which is sorted according to a priority order of connection.

37. The terminal device computer program of claim 32,

the authentication trigger information includes connection information for connecting to the providing server, and the authentication result is connected to the providing server using the connection information of the providing server.

38. A providing server computer program used in a providing server that provides electronic information requiring authentication to a terminal device, characterized in that the following functions are implemented by a computer:

an authentication trigger information transmitting function of transmitting authentication trigger information including designation information for designating an electronic information utilization device for starting an authentication information management device to the terminal device;

an authentication result receiving function of receiving an authentication result of the device in an authentication server from the terminal device;

and an electronic information providing function of providing electronic information based on the received authentication result.