JP2007334826A - Right controller, right control system, right control method, and program for right control - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a right control system capable of transferring surely an electronic right to a specified user. <P>SOLUTION: An access code control means 13 generates an access code based on a right transfer request, and enciphers it by an open key of a user in a transferred side. A communication means 11 transmits the enciphered access code to the user terminal 4 in the transferred side. A right control means 12 stores a set of right information and the access code in a right information storage part 14. An access code decoding means 42 of the user terminal 4 in the transferred side decodes the enciphered access code by a secret key. A communication means 41 transmits a service provision request indicating the access code to a service providing device 2. A right confirming means 22 of the service providing device 2 receives the right information corresponding to the access code from a right controller 1, and determines service to be provided. A service providing means 23 provides the service to the user in the transferred side. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a rights management apparatus, a rights management system, a rights management method, and a rights management program, and in particular, a rights management apparatus and rights management capable of assigning rights to a user who is not managed by the rights manager. The present invention relates to a system, a rights management method, and a rights management program.

  With the widespread use of portable information terminals such as mobile phones, tickets for concerts, movies, etc. are issued to users and managed as electronic data indicating the right to enter, not paper media. However, it is easy to duplicate such electronic data. Therefore, if electronic data is stored in the user's portable information terminal, a malicious user can illegally duplicate and use the electronic data.

  In the conventional rights management system, the right of entry and the like is managed by the right issuer so that the right of entry and the like can be transferred while preventing unauthorized copying of electronic data. However, in the conventional rights management system, rights can be transferred between users under the control of the rights issuer, but rights cannot be freely transferred between users who are not under the control of the rights issuer. .

  An example of a conventional rights management system that solves this problem is described in Patent Document 1. FIG. 13 is a block diagram showing a configuration example of a conventional rights management system. The right management system shown in FIG. 13 includes a terminal device 11, a terminal device 12, and a ticket sales center 2 connected to each of the terminal devices 11 and 12 via a communication network. The ticket sales center 2 includes a reservation table 21, a transfer table 22, a ticket reservation receiving unit 23, a ticket transfer receiving unit 24, and a ticket reception receiving unit 25.

  The rights management system shown in FIG. 13 operates as follows. The transfer source user uses the terminal device 11 to reserve ticket purchase in the ticket reservation accepting means 23 of the ticket sales center 2. The ticket reservation accepting means 23 adds the reservation number and reservation authentication data to the reservation table 21, and transmits the reservation authentication data to the transfer source user. The reservation authentication data is data used for user authentication when the user purchases a ticket based on the reservation.

  When the transfer source user wants to transfer the reservation (right), the transfer source user makes a transfer request to the ticket transfer receiving means 24. The ticket transfer acceptance unit 24 performs user authentication of the transfer source user using the reservation authentication data. Then, when the authentication is successful, the ticket transfer acceptance unit 24 deletes the reservation of the transfer source user from the reservation table 21, adds a reservation number and transfer authentication data to the transfer table 22, and transfers the transfer authentication data. Notify the transfer source user.

  The transfer source user transmits transfer authentication data to the transfer destination user. The transfer destination user makes a ticket receipt request to the ticket receipt accepting unit 25 using the terminal device 12. The ticket receipt accepting unit 25 performs user authentication of the transfer destination user using the transfer authentication data. When the authentication is successful, the ticket reception receiving unit 25 deletes the reservation number and the transfer authentication data from the transfer table 22 and newly adds the transfer destination user reservation number and the reservation authentication data to the reservation table 21. The reservation authentication data is transmitted to the transfer destination user. As described above, the electronic right of ticket purchase reservation can be transferred.

Japanese Patent Laid-Open No. 2001-014409 (paragraphs 0013 to 0091, FIG. 1)

  The first problem of the conventional rights management system is that when transferring the transfer authentication data to the right transfer destination user, the transfer authentication data may be leaked and the right may be taken by a third party. It is.

  The reason is that there is no mechanism that only the transferee user can know the transfer authentication data when transmitting the transfer authentication data, so it is easy to send the transfer authentication data to a third party eavesdropping on the communication path. Because it will be known.

  The second problem of the conventional rights management system is that the rights manager cannot specify the transfer destination user even if the transfer destination user performs fraud.

  The rights management system shown in FIG. 13 is a user who does not have an account for the rights manager (that is, a user who is not under the management of the rights manager) as long as it has transfer authentication data. As a transfer destination user, the right can be transferred. Then, it does not authenticate who the transfer destination user is in the transfer of rights and the exercise of the transferred rights. Therefore, the right issuer cannot specify the transfer destination user even if the transfer destination user performs fraud.

  Accordingly, an object of the present invention is to provide a rights management apparatus, a rights management system, a rights management method, and a rights management program that can be assigned only by a destination user determined by a source user.

  It is also an object of the present invention to provide a rights management device, a rights management system, a rights management method, and a rights management program that can specify a destination user when a transfer destination user performs an illegal act.

  The rights management apparatus according to the present invention is a rights management apparatus that manages the assignment of rights to receive a service, and receives a rights assignment request that requests assignment of rights from a user terminal of a user to whom rights are assigned. Identification information management means for generating identification information corresponding to the right assignment request, encrypting the generated identification information, right information storage means for storing the right information indicating the contents of the rights and the identification information in association with each other The identification information transmitting means for transmitting the encrypted identification information to the transfer destination user terminal of the user to whom the right is transferred and the identification information received when the identification information is received from the service providing device. And a right management means for transmitting the corresponding right information to the apparatus.

  The right assignment request may include a public key, and the identification information management unit may encrypt the identification information with the public key.

  The right assignment request may include a public key certificate, and the right information storage unit may store the public key certificate in association with the right information and the identification information.

  A rights management system according to the present invention includes a rights management device that manages assignment of a right to receive a service, and a service providing device that performs processing for providing the service according to the right, and the rights management device assigns the right. An identification information management means for generating identification information corresponding to the right transfer request and encrypting the generated identification information when receiving a right transfer request for requesting transfer of the right from the user terminal of the user who performs the transfer Right information storage means for storing the right information indicating the content of the right and the identification information in association with each other, and the identification information transmitting means for transmitting the encrypted identification information to the transfer destination user terminal of the user who assigns the right And right management means for transmitting right information corresponding to the received identification information to the service providing apparatus when the identification information is received from the service providing apparatus. Upon receiving the identification information from the transfer destination user terminal, the service providing device provides a service to the user who assigns the right based on the confirmation request means for transmitting the identification information to the right management device and the right information from the right management device. Service providing means to provide.

  The right assignment request may include a public key, and the identification information management unit may encrypt the identification information with the public key.

  The right assignment request may include a public key certificate, and the right information storage unit may store the public key certificate in association with the right information and the identification information.

  The rights management device includes certificate verification means for determining whether or not the public key certificate received from the transfer source user terminal is valid, and the rights information storage means has the public key certificate valid by the certificate verification means. When it is determined that the public key certificate is determined, the public key certificate may be stored in association with the right information and the identification information.

  The rights management method according to the present invention is a rights management method for managing the assignment of a right to receive a service, when a right assignment request for requesting assignment of a right is received from a user terminal of a user who assigns the right. In addition, an identification information generation step for generating identification information corresponding to the right assignment request, an encryption step for encrypting the generated identification information, and information for storing the right information indicating the content of the right and the identification information in association with each other Received when receiving the identification information from the storage step, the identification information transmission step for transmitting the encrypted identification information to the transfer destination user terminal of the user to whom the right is transferred, and the service providing side device And a right information transmission step of transmitting right information corresponding to the identification information to the apparatus.

  In the encryption step, the identification information may be encrypted using the public key received together with the right transfer request.

  In the information storage step, the public key certificate received together with the right assignment request may be stored in association with the right information and the identification information.

  The right management program according to the present invention generates identification information corresponding to a right assignment request when receiving a right assignment request for requesting assignment of a right from a user terminal of a user who assigns the right to a computer. Identification information generation processing, encryption processing for encrypting the generated identification information, information storage processing for storing the right information indicating the contents of the rights and the identification information in association with each other, and the transfer destination of the user who assigns the right When the identification information transmission process for transmitting the encrypted identification information to the user terminal and the identification information is received from the device on the service providing side, the right information corresponding to the received identification information is transmitted to the device. The right information transmission process is executed.

  According to the present invention, only the transfer destination user determined by the transfer source user can transfer the right. Further, when the access code is configured to be encrypted with the public key of the transfer destination user, it is possible to prevent the third party from knowing the access code.

  In addition, when the transfer destination user's public key certificate is configured to be stored, the transfer destination user can be specified even if the transfer destination user performs fraud. In addition, since the user to whom the right is transferred can make a right transfer request to the right management apparatus and further transfer the right to another user, the right can be distributed in a tertiary manner.

Embodiment 1 FIG.
A first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration example of the first embodiment of the present invention.

  The right management system shown in FIG. 1 includes a right management apparatus 1 that manages a right to receive a service, and a service provision apparatus 2 that performs a process for providing the service. The rights management device 1 receives a rights assignment request indicating that the rights are assigned from the assignment source user terminal device 3 of the assignment source user who is the user to whom the right to receive the service is assigned, and performs the rights assignment processing. The service providing apparatus 2 provides a service to the transfer destination user in response to a service providing request for requesting the provision of the service received from the transfer destination user terminal apparatus 4 of the transfer destination user who is the user who receives the transfer of the right. Process. In the present embodiment, the right to receive service is generated by the right management apparatus 1.

  As shown in FIG. 1, the rights management apparatus 1 includes a communication means (identification information transmitting means) 11, a rights management means 12, an access code management means (identification information management means) 13, and a rights information storage unit (right information). Storage means) 14. For example, the right management apparatus 1 is configured by a server computer that provides a user with a service (right management service).

  The communication unit 11 transmits / receives information to / from the transfer source user terminal device 3 and the transfer destination user terminal device 4 via a communication network. If the transfer source user terminal device 3 and the transfer destination user terminal device 4 are mobile phones, a mobile communication network, the Internet, or the like corresponds to the communication network.

  The right information storage unit 14 is a storage medium that stores (stores) various types of information related to the right to receive services. FIG. 2 is an explanatory diagram showing a registered user table 51 and a non-registered user table 52 stored in the right information storage unit 14 in the first embodiment. As illustrated in FIG. 2, the right information storage unit 14 stores a set of a registered user account and right information, which is information indicating the contents of the right, using the registered user table 51, and a non-registered user table 52. Is used to store a set of right information and access code (identification information). That is, the right information storage unit 14 stores the registered user account and the right information in association with each other, and stores the right information and the access code in association with each other.

  The access code uniquely indicates the right assignment request received by the communication means 11, and is, for example, a code in which numbers, characters, symbols, and the like are randomly combined.

  The rights management means 12 requests the access code management means 13 to generate an access code when the communication means 11 receives a rights assignment request from the transfer source user terminal device 3. Then, the right management means 12 registers the transfer source user information (a set of the registered user account and the right information) stored (stored) by the right information storage unit 14 using the registered user table 51. The new information (a combination of right information and access code) is registered in the unregistered user table 52 of the right information storage unit 14. Further, the right management unit 12 transmits the encrypted access code to the transfer destination user terminal device 4 via the communication unit 11.

  Further, when the communication unit 11 receives a right acquisition request indicating an access code from the service providing apparatus 2, the right management unit 12 responds to the access code from the unregistered user table 52 of the right information storage unit 14. The right information to be read is read, and the read right information is transmitted to the service providing apparatus 2 via the communication unit 11.

  The access code management unit 13 generates an access code in response to a request from the right management unit 12, and encrypts the generated access code with the public key of the transfer destination user.

  As shown in FIG. 1, the service providing apparatus 2 includes a communication means (confirmation request means) 21, a right confirmation means 22, and a service provision means 23. For example, the service providing apparatus 2 is configured by a computer managed by a service provider.

  The communication means 21 transmits / receives information to / from the transfer destination user terminal device 4. For example, IrDA (Infrared Data Association) or Bluetooth is assumed as a communication mode with the transfer destination user terminal device 4. The right confirmation unit 22 confirms the content of the right information received from the right management device 1 by the communication unit 21, determines whether or not to provide the service to the transfer destination user, and determines the content of the service to be provided. Do.

  The service providing unit 23 provides the service to the transfer destination user according to the determination of the right confirmation unit 22. Various services can be considered. For example, a service such as watching a movie in a movie theater or watching a sport.

  The transfer source user terminal device 3 includes a communication unit 31 and a transfer request generation unit 32. Note that the storage means (not shown) of the transfer source user terminal device 3 stores a public key certificate of the transfer destination user in advance and a method for contacting the transfer destination user terminal device 4 (for example, the electronic mail of the transfer destination user terminal device 4). Information indicating a mail address.) Is stored.

  The communication unit 31 transmits / receives information to / from the right management apparatus 1 via the communication network. The assignment request generation means 32 indicates that a right assignment request is requested, and generates a right assignment request including a public key certificate of the assignment destination user and information indicating a contact method with the assignment destination user terminal device 4. The communication unit 31 transmits the right assignment request generated by the assignment request generation unit 32 to the right management apparatus 1.

  The transfer destination user terminal device 4 includes a communication unit 41, an access code decoding unit 42, and a service request unit 43.

  The communication unit 41 transmits / receives information to / from the right management apparatus 1 via the communication network. The communication unit 41 transmits / receives information to / from the service providing apparatus 2. The access code decrypting unit 42 decrypts the encrypted access code received by the communication unit 41 from the right management device 1.

  The service request unit 43 transmits a service provision request including the access code decoded by the access code decoding unit 42 to the service providing apparatus 2 via the communication unit 41.

  The configuration of each unit in the right management apparatus 1 is realized by a control unit (such as a CPU) executing processing according to a control program stored in a storage unit (such as a memory). Specifically, the rights management device 1 receives a rights assignment request that requests the control unit of the computer to assign rights from the user terminal device 3 from which the rights are assigned. Identification information generation processing for generating identification information corresponding to the information, encryption processing for encrypting the generated identification information, information storage processing for storing the right information indicating the content of the rights and the identification information in association with each other, and rights Identification information transmission processing for transmitting the encrypted identification information to the transfer destination user terminal device 4 of the user who receives the information, and when the identification information is received from the device on the service providing side, A rights management program for executing rights information transmission processing for transmitting corresponding rights information to the device is installed.

  Next, the operation of the first exemplary embodiment of the present invention will be described with reference to the drawings.

  It is assumed that the transfer source user uses the transfer source user terminal device 3 to access the rights management apparatus 1 and purchases a predetermined service right. In this state, the transfer source user and the content of the rights purchased by the transfer source user are registered in the registered user table 51 of the right information storage unit 14. The transferee user registers with the certificate authority in advance, acquires the public key and private key, and further acquires the public key certificate. In addition, it is assumed that negotiations for the transfer of rights between the transfer source user and the transfer destination user have been established. As a method for negotiating the transfer of rights, for example, a case where the sale of rights is established at an Internet auction can be considered.

  FIG. 3 is a flowchart showing the operation of the transfer source user terminal device 3 according to the first embodiment.

  The right assignment request generation means 32 of the assignment source user terminal device 3 generates a right assignment request indicating that a right assignment is requested (step S101). The right transfer request includes the public key certificate of the transfer destination user and information indicating a contact method with the transfer destination user terminal device 4. The communication unit 31 transmits the transfer request generated by the transfer request generation unit 32 to the right management apparatus 1 (step S102).

  FIG. 4 is a flowchart showing the operation of the right management apparatus 1 according to the first embodiment.

  The rights management means 12 of the rights management apparatus 1 requests the access code management means 13 to generate an access code when the communication means 11 receives the rights assignment request. The access code management unit 13 generates an access code in response to a request from the right management unit 12 (step S201), and encrypts the generated access code with the public key of the transfer destination user (step S202).

  Then, the right management unit 12 deletes the combination of the account of the transfer source user and the right information registered in the registered user table 51 of the right information storage unit 14 (step S203), and the right information storage unit 14 does not A set of the right information and the access code generated by the access code management means 13 is registered in the registered user table 52 (step S204). The right management unit 12 transmits the access code encrypted by the access code management unit 13 to the transfer destination user terminal device 4 via the communication unit 11 (step S205).

  FIG. 5 is a flowchart showing the operation of the transfer destination user terminal device 4 in the first embodiment.

  The access code decrypting means 42 of the transfer destination user terminal device 4 decrypts the encrypted access code received by the communication means 41 from the right management device 1 (step S301). The service request unit 43 transmits a service provision request indicating the access code decoded by the access code decoding unit 42 and the service provision request to the service providing apparatus 2 via the communication unit 41 (step S302).

  FIG. 6 is a flowchart showing the operation of the service providing apparatus 2 according to the first embodiment.

  The right confirmation unit 22 of the service providing device 2 accesses the right management device 1 via the communication unit 41 based on the service provision request received from the transfer destination user terminal device 4 by the communication unit 41. Request is made to transmit the right information corresponding to the code (step S401). Specifically, the communication unit 41 transmits a right acquisition request indicating the access code and a request for transmitting right information to the right management apparatus 1.

  When the communication means 11 receives a right acquisition request indicating an access code from the service providing apparatus 2, the right management means 12 of the right management apparatus 1 receives the access code from the unregistered user table 52 of the right information storage unit 14. The right information corresponding to is read, and the read right information is transmitted to the service providing apparatus 2 via the communication unit 11.

  The right confirmation unit 22 of the service providing apparatus 2 confirms whether the communication unit 21 has received the right information from the right management apparatus 1 (step S402). When the communication means 21 receives the rights information from the rights management apparatus 1 (Y in step S402), the rights confirmation means 22 determines the contents of the service provided to the transfer destination user based on the contents of the rights information. (Step S403). Then, the service providing unit 23 provides the transfer destination user with the service determined by the right confirmation unit 22 (step S404).

  In step S402, when the communication unit 21 does not receive the right information from the right management device 1, the right confirmation unit 22 transmits information indicating an error to the transfer source user terminal device 4 via the communication unit 21. (Step S405).

  In the present embodiment, the transfer source user terminal device 3 transmits the transfer destination user's public key to the rights management device 1, and the rights management device 1 encrypts the access code with the transfer destination user's public key and transfers the transfer destination user. Since it is transmitted to the terminal device 4, only the transfer destination user can know the access code and enjoy the right.

  Also, since the rights management device 1 manages the rights information and the rights information is not transmitted to the terminal device owned by each user, each user cannot illegally copy the rights information, and the access code Only the knowing user (transferee user in this embodiment) can exercise the right indicated by the right information.

Embodiment 2. FIG.
Next, a second embodiment of the present invention will be described with reference to the drawings. FIG. 7 is a block diagram illustrating a configuration example of the second exemplary embodiment of the present invention.

  The right management system shown in FIG. 7 is different from the configuration of the right management system in the first embodiment in that the right management device 1 includes a certificate verification unit 15 in addition to the configuration shown in FIG.

  FIG. 8 is an explanatory diagram showing a registered user table 61 and a non-registered user table 62 stored in the right information storage unit 14 in the second embodiment. As shown in FIG. 8, the registered user table 61 of the right information storage unit 14 in the second embodiment is registered with the registered user account and right information, and the non-registered user table 62 is not registered. A set of a registered user's public key certificate, right information, and access code is registered.

  Other configurations are the same as the configuration of the rights management system shown in FIG. 1, and therefore, the same reference numerals as those in FIG.

  The certificate verification unit 15 verifies the public key certificate of the transfer destination user received from the transfer source user terminal device 3 by the communication unit 11 and given from the right management unit 12. When the public key certificate is valid, the right management unit 12 deletes the combination of the account of the registered user (transfer source user) and the right information from the registered user table 61 of the right information management unit 14 and performs non-registration. In the user table 62, a set of a public key certificate of the transfer destination user, its right information, and an access code is registered.

  Next, the operation of the second exemplary embodiment of the present invention will be described with reference to the drawings.

  FIG. 9 is a flowchart showing the operation of the transfer source user terminal device 3 in the second embodiment.

  The operation until the transfer source user terminal device 3 transmits a right transfer request to the right management device 1 is the same as the operation (step S101 and step S102) in the first embodiment, and the description thereof is omitted. The right transfer request received from the transfer source user terminal device 3 by the communication unit 11 of the right management apparatus 1 includes the public key certificate of the transfer destination user.

  When the communication means 11 receives the right assignment request, the certificate verification means 15 of the right management apparatus 1 verifies the public key certificate included in the right assignment request (step S501). It is confirmed whether it is valid (step S502).

  When the certificate verification unit 15 determines that the public key certificate is valid (Y in step S502), the access code management unit 13 generates an access code (step S503), and transfers the generated access code. Encryption is performed using the public key of the previous user (step S504).

  Further, the right management means 12 deletes the combination of the transfer source user account and the right information registered in the registered user table 61 of the right information storage unit 14 (step S505), and stores it in the unregistered user table 62. Then, a set of the public key certificate of the transfer destination user, the right information thereof, and the access code is registered (step S506). The right management unit 12 transmits the access code encrypted by the access code management unit 13 to the transfer destination user terminal device 4 via the communication unit 11 (step S507).

  When the certificate verification unit 15 determines that the public key certificate is not valid (N in step S502), the right management unit 12 indicates an error to the transfer source user terminal device 3 via the communication unit 11. Information is transmitted (step S508).

  The operation after the right management means 12 transmits the access code encrypted by the access code management means 13 to the transferee user terminal device 4 via the communication means 11 is the process after step S301 in the first embodiment. Since it is the same as the operation, the description is omitted.

  In this embodiment, since the public key certificate of the transfer destination user who is a non-registered user is verified, the identity of the transfer destination user can be confirmed. Furthermore, since the public key certificate and the right information are stored together, it is possible to specify the transfer destination user when the transfer destination user performs fraud.

Embodiment 3 FIG.
A third embodiment of the present invention will be described with reference to the drawings. FIG. 10 is a block diagram showing a configuration example of the third embodiment of the present invention.

  The rights management system shown in FIG. 10 is similar to the first embodiment shown in FIG. 1 and the second embodiment shown in FIG. , And a service providing apparatus 102 that transmits / receives information to / from the transfer destination user terminal apparatus 104.

  The right management program 111 is installed in the right management apparatus 101 and controls the operation of the right management apparatus 101. That is, the rights management apparatus 101 is made to receive and process a rights assignment request, and transmit the encrypted access code to the assignment destination user terminal apparatus 104. That is, the right management apparatus 101 performs the same operation as the operation of the right management apparatus 1 in the first and second embodiments according to the control of the right management program 111.

  The service providing program 112 is installed in the service providing apparatus 102 and controls the operation of the service providing apparatus 102. That is, the service providing apparatus 102 receives a service provision request, determines the contents of the service to be provided, and causes the transfer destination user to provide the service. That is, the service providing apparatus 102 performs the same operation as the operation of the service providing apparatus 2 in the first embodiment and the second embodiment according to the control of the service providing program 112.

  The transfer source user terminal program 113 is installed in the transfer source user terminal device 103 and controls the operation of the transfer source user terminal device 103. That is, a right assignment request is transmitted to the right management apparatus 101. That is, the transfer source user terminal device 103 performs the same operation as that of the transfer source user terminal device 3 in the first embodiment and the second embodiment in accordance with the control of the transfer source user terminal program 113.

  The transfer destination user terminal program 114 is installed in the transfer destination user terminal device 104 and controls the operation of the transfer destination user terminal device 104. That is, a service provision request is transmitted to the service provision apparatus 102. That is, the transfer destination user terminal device 104 performs the same operation as that of the transfer destination user terminal device 4 in the first embodiment and the second embodiment in accordance with the control of the transfer destination user terminal program 114. .

  In the present embodiment, each device is equipped with a program that causes the device to execute the same operation as that of the corresponding device in the first embodiment and the second embodiment. The same effects as those of the second embodiment and the second embodiment can be obtained.

  Next, specific examples of the present invention will be described with reference to the drawings. This example corresponds to the second embodiment of the present invention. FIG. 11 is a block diagram showing the configuration of the embodiment of the present invention.

  The ticket management system shown in FIG. 11 includes a ticket sales site 121 provided in the right management device, and a movie theater entrance gate device 122. Each device is connected to a user A mobile phone 123 and a user B mobile phone 124 via a communication network 151.

  The entrance gate device 122 corresponds to the service providing device 2 in the second embodiment, the user A mobile phone 123 corresponds to the transfer source user terminal device 3 in the second embodiment, and the user B mobile phone. The telephone 124 corresponds to the transfer destination user terminal device 4 in the second embodiment.

  FIG. 12 is an explanatory diagram showing a registered user table 201 and a non-registered user table 202 stored in the right management apparatus in which the ticket sales site 121 is provided. As shown in FIG. 12, a pair of registered user account and right information is registered in the registered user table 201, and a public key certificate and right information of the non-registered user are registered in the non-registered user table 202. A set with an access code is registered.

  The user A is provided with a ticket sales site 121 via the communication network 151 using the user A mobile phone 123 for a right transfer request indicating the public key certificate and the e-mail address of the user B. Send to the rights management device.

  The rights management apparatus provided with the ticket sales site 121 verifies the public key certificate of the user B by using PKI (Public Key Infrastructure). If the public key certificate is valid, the rights management apparatus provided with the ticket sales site 121 generates an access code and encrypts the access code using the public key in the public key certificate.

  The rights management apparatus provided with the ticket sales site 121 deletes the pair of the user A account and the rights information registered in the registered user table 201 and discloses the user B in the unregistered user table 202. A pair of a key certificate, right information, and an unencrypted access code is registered. Further, the right management apparatus provided with the ticket sales site 121 transmits the encrypted access code to the user B mobile phone 124 via the communication network 151 by e-mail.

  The user B mobile phone 124 decrypts the encrypted access code using the secret key in accordance with the operation of the user B, and transmits the decrypted access code to the entrance gate device 122. For example, the user B mobile phone 124 performs short-range wireless communication such as infrared communication and transmits an access code to the entrance gate device 122 or transmits an access code to the entrance gate device 122 via the mobile phone communication network. Or

  The entrance gate device 122 transmits a right acquisition request indicating the received access code and a request for transmission of right information to the right management device provided with the ticket sales site 121 via the communication network 151.

  The entrance gate device 122 provides a movie viewing service to the user B based on the right information received from the right management device via the communication network 151. Specifically, for example, the entrance gate device 122 opens the entrance gate of a movie theater.

  When the transfer destination user (user B) performs an illegal act with the transferred right, the right management device provided with the ticket sales site 121 is registered in the non-registered user table 202 in association with the right information. The user B is identified by checking the public key certificate. Since the public key certificate of the transfer destination user is verified to authenticate the user B at the time of the transfer request, the right management apparatus provided with the ticket sales site 121 can identify the user B.

  It should be noted that the rights management device provided with the ticket sales site 121 is, for example, the non-registered user table 202 until the movie theater release period that can be viewed by the user B based on the rights indicated by the rights information has passed. The user B's public key certificate, the right information, and the unencrypted access code pair are not erased, and when the theater release period of the movie has passed, the user B's release from the unregistered user table 202 Erase the set of key certificate, rights information and unencrypted access code. Here, for example, when the entrance gate device 122 serving as a service providing device has passed the movie theater release period, the right management device provided with the ticket sales site 121 indicates that the movie theater release period has passed. You may be notified.

  In this embodiment, the identity of the user B is verified by verifying the public key certificate of the user B who is a non-registered user, and further, the public key certificate and the right information are stored together. The user B can be specified when fraud is performed.

  According to the present invention, the present invention can be applied to a rights management device that assigns rights issued as electronic data, a rights management system, a program for realizing the rights management device on a computer, and the like.

It is a block diagram which shows the structural example of the 1st Embodiment of this invention. In 1st Embodiment, it is explanatory drawing which shows the table for registered users and the table for unregistered users which the right information storage part has memorize | stored. It is a flowchart which shows operation | movement of the transfer origin user terminal device in 1st Embodiment. It is a flowchart which shows operation | movement of the rights management apparatus in 1st Embodiment. It is a flowchart which shows operation | movement of the transfer destination user terminal device in 1st Embodiment. It is a flowchart which shows operation | movement of the service provision apparatus in 1st Embodiment. It is a block diagram which shows the structural example of the 2nd Embodiment of this invention. It is explanatory drawing which shows the table for registered users and the table for non-registered users which the right information storage part has memorize | stored in 2nd Embodiment. It is a flowchart which shows operation | movement of the transfer origin user terminal device in 2nd Embodiment. It is a block diagram which shows the structural example of the 3rd Embodiment of this invention. It is a block diagram which shows the structure of the Example of this invention. It is explanatory drawing which shows the table for registered users and the table for unregistered users which the right management apparatus with which the ticket sales site is provided memorize | stores. It is a block diagram which shows the example of 1 structure of the conventional rights management system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1,101 Rights management apparatus 11 Communication means 12 Rights management means 13 Access code management means 14 Rights information storage part 15 Certificate verification means 111 Rights management program 112 Service providing program 113 Assignment source user terminal program 114 Assignment destination user terminal Program 2, 102 Service providing device 21 Communication means 22 Rights confirmation means 23 Service providing means 3, 103 Assignment source user terminal device 31 Communication means 32 Assignment request generation means 4, 104 Assignment destination user terminal device 41 Communication means 42 Access code decryption Means 43 Service request means 51, 61 Registered user table 52, 62 Unregistered user table

Claims (11)

A rights management device that manages the transfer of rights to receive services,
Identification information for generating identification information corresponding to the right assignment request and encrypting the generated identification information when receiving a right assignment request for requesting assignment of the right from the user terminal of the user who assigns the right Management means;
Rights information storage means for storing rights information indicating the content of rights and identification information in association with each other;
Identification information transmitting means for transmitting encrypted identification information to a transfer destination user terminal of a user who receives the right;
A right management device comprising: right management means for transmitting right information corresponding to the received identification information to the device when the identification information is received from the device on the service providing side. The right transfer request includes the public key,
The rights management apparatus according to claim 1, wherein the identification information management means encrypts the identification information with a public key. The right transfer request includes the public key certificate,
The rights management apparatus according to claim 1 or 2, wherein the rights information storage means stores the public key certificate in association with the rights information and the identification information. A right management device that manages assignment of a right to receive a service, and a service providing device that performs a process for providing a service according to the right;
The right management device includes:
Identification information for generating identification information corresponding to the right assignment request and encrypting the generated identification information when receiving a right assignment request for requesting assignment of the right from the user terminal of the user who assigns the right Management means;
Rights information storage means for storing rights information indicating the content of rights and identification information in association with each other;
Identification information transmitting means for transmitting encrypted identification information to a transfer destination user terminal of a user who receives the right;
A right management means for transmitting right information corresponding to the received identification information to the service providing apparatus when the identification information is received from the service providing apparatus;
The service providing apparatus includes:
Upon receiving the identification information from the transfer destination user terminal, confirmation request means for transmitting the identification information to the rights management device;
Service provision means for providing a service to a user who assigns a right based on the right information from the right management apparatus. The right transfer request includes the public key,
The rights management system according to claim 4, wherein the identification information management means encrypts the identification information with a public key. The right transfer request includes the public key certificate,
6. The rights management system according to claim 4, wherein the rights information storage means stores the public key certificate in association with the rights information and the identification information. The rights management device includes certificate verification means for determining whether or not the public key certificate received from the transfer source user terminal is valid,
7. The rights management according to claim 6, wherein the rights information storage means stores the public key certificate in association with the rights information and the identification information when the certificate verification means determines that the public key certificate is valid. system. A rights management method for managing the transfer of rights to receive services,
An identification information generation step of generating identification information corresponding to the right assignment request when receiving a right assignment request for requesting assignment of the right from the user terminal of the user who assigns the right;
An encryption step for encrypting the generated identification information;
An information storage step for storing the right information indicating the content of the right and the identification information in association with each other;
An identification information transmission step of transmitting encrypted identification information to a transfer destination user terminal of a user who receives the right;
A right management method comprising: a right information transmission step of transmitting right information corresponding to the received identification information to the device when the identification information is received from the device on the service providing side. 9. The rights management method according to claim 8, wherein in the encryption step, the identification information is encrypted using the public key received together with the right assignment request. The rights management method according to claim 8 or 9, wherein, in the information storage step, the public key certificate received together with the right assignment request is stored in association with the right information and the identification information. On the computer,
An identification information generation process for generating identification information corresponding to the right transfer request when receiving a right transfer request for requesting transfer of the right from the user terminal of the user who transfers the right;
An encryption process for encrypting the generated identification information;
Information storage processing for storing the right information indicating the content of the right and the identification information in association with each other;
Identification information transmission processing for transmitting encrypted identification information to a transfer destination user terminal of a user who receives the right;
A right management program for executing right information transmission processing for transmitting right information corresponding to received identification information to the device when the identification information is received from the device providing the service.

Images