JP5952638B2 - Broadcast communication cooperative receiver and broadcast communication cooperative system - Google Patents

Description

  The present invention relates to a resource access control technique for a general application in a broadcasting / communication cooperation system using broadcasting and a communication network such as the Internet or a dedicated IP (Internet Protocol) line.

  In recent years, various services that link broadcasting and communication (hereinafter referred to as “broadcast communication cooperation service”) have been studied along with digitization of broadcasting and high-speed / broadband communication (for example, see Non-Patent Documents 1 and 2). ). In this broadcasting / communication cooperation service, it is assumed that various information related to broadcasting programs are acquired via a communication network and presented in combination with broadcasting. In addition, in order to enjoy the broadcasting / communication cooperation service, the receiver is assumed to use an application adapted to the broadcasting / communication cooperation service.

“Summary of Broadcast and Communication Collaboration Technology Research at STRL”, NHK STRL R & D, No. 124, 2011.11, P4-P9 “Overview and Technology of Hybridcast ™”, NHK STRL R & D, No. 124, 2011.11, P10-P17

  In order to realize a more attractive service for viewers in this broadcasting / communication cooperation service, not only applications created by broadcasting stations, but also various service providers and providers such as individuals are not valid (provider However, there is a demand for an environment in which applications can be provided to viewers. However, it is not certain that the operation that is expected from the broadcasting / communication cooperation system is guaranteed for the application whose provider is not valid, and it is permitted to access the resources of the receiver without restriction from the viewpoint of safety and publicity of broadcasting. I can't.

  Therefore, the present invention provides a broadcasting / communication cooperation receiving apparatus and a broadcasting / communication cooperation system capable of prohibiting unlimited resource access for an application whose provider is not valid in a broadcasting / communication cooperation service that links broadcasting and communication. The task is to do.

In view of the above-described problems, a broadcast communication cooperative reception device according to the first invention of the present application includes a broadcast transmission device that transmits a broadcast program, a broadcast communication cooperative reception device that receives a broadcast program, a signature key that generates a signature, and a signature key issuing device for issuing a search Akashikagi that corresponds to the signature key, and the certificate authority that issues certificates that contain validation key, the generated signature and certificate by signing key from signing key issuing apparatus, An application registration apparatus that is added to the application as verification information for verifying the application provider; an application server that stores at least one of the application to which the verification information is added and the application to which the verification information is not added; A broadcasting / communication cooperation receiving device provided in a broadcasting / communication cooperation system including: an application acquisition unit; It characterized in that it comprises the application determination unit, and resource access control means.

According to such a configuration, the broadcasting / communication cooperation receiving apparatus acquires the application stored in the application server via the network by the application acquiring unit.
Verification information is added to the application acquired by the application acquisition means when the provider is valid, and verification information is not added when the provider is not valid.

In the broadcast communication cooperative reception apparatus, the application determination unit determines whether the application provider acquired by the application acquisition unit is valid based on the verification information.
This verification information includes, for example, a signature and a certificate, and may further include information such as a revocation list, an application ID that uniquely identifies an application, and an operator ID that uniquely identifies a service provider. Good.
Further, the verification information may be a verification result in which the application provider is verified by the application registration apparatus.

  Then, the broadcasting / communication cooperative receiving apparatus performs resource access control for prohibiting access to a predetermined resource for the acquired application based on the determination result of the application determination unit by the resource access control unit. For example, if the application provider is not valid, the resource access control means prohibits the application from accessing a broadcast resource described later. On the other hand, if the provider of the application is valid, the resource access control means may not prohibit the application from accessing the broadcast resource. Thereby, the resource access control means can prohibit an application whose provider is not valid from accessing the resource without limitation.

  In the broadcast communication cooperative receiving apparatus according to the second invention of the present application, the application acquisition unit acquires an application to which a signature and a certificate generated by a signature key are added as verification information, and the application determination unit includes a certificate. If the certificate is valid, the certificate verification key verifies whether the signature is valid. If the signature is valid, the application provider It is determined that the application provider is not valid when the certificate is not valid or the signature is not valid.

  According to such a configuration, since the broadcasting / communication cooperation receiving apparatus uses a signature and certificate that are difficult to be fraudulent, for example, an application whose provider is not valid can access resources by impersonating the provider as a valid application. Can be prevented.

  Moreover, the broadcasting / communication cooperation receiving apparatus according to the third invention of the present application further includes a storage means in which a certificate is stored in advance, and the application acquisition means includes an application to which a signature generated by a signature key is added as verification information. The application determination means checks whether the certificate extracted from the storage means is valid based on the revocation list that is a list of revoked certificates. The verification key verifies whether the signature is valid. If the signature is valid, the application provider determines that the signature is valid. If the certificate is not valid or the signature is not valid, the application provider is invalid. It is characterized by determining.

  According to such a configuration, since the broadcasting / communication cooperation receiving apparatus uses a signature and certificate that are difficult to be fraudulent, for example, an application whose provider is not valid can access resources by impersonating the provider as a valid application. Can be prevented.

In addition, the broadcasting / communication cooperation receiving apparatus according to the fourth invention of the present application includes an application registration apparatus that verifies whether the provider of the application is valid based on the signature and certificate generated by the signature key. Provided in the broadcasting / communication cooperation system, the application acquisition unit acquires an application to which the verification result of the application provider is added as verification information by the application registration device, and the application determination unit, based on the verification information, It is characterized by verifying whether the provider of the application acquired by the application acquisition means is valid.
According to such a configuration, the broadcasting / communication cooperation receiving apparatus does not need to check the validity of the certificate and verify the validity of the signature.

In addition, the broadcasting / communication cooperation receiving apparatus according to the fifth aspect of the present application is an application registration apparatus that verifies whether an application provider is valid based on a signature generated by a signature key, a certificate, and a revocation list. Is included in the broadcasting / communication cooperation system, and the application acquisition means acquires the application to which the verification result of the application provider is added by the application registration device as the verification information, and the application determination means uses the verification information as the verification information. Based on this, it is characterized by verifying whether the provider of the application acquired by the application acquisition means is valid.
According to such a configuration, the broadcasting / communication cooperation receiving apparatus does not need to check the validity of the certificate and verify the validity of the signature.

  In view of the above-described problems, the broadcast communication cooperative system according to the sixth invention of the present application includes a broadcast communication cooperative receiver, a broadcast transmitter, a signature key issuing device, a certificate authority, an application, and an application according to the first invention of the present application. A registration apparatus and an application server are provided.

  According to such a configuration, the broadcasting / communication cooperation system determines whether or not the provider of the application acquired from the application server is valid based on the verification information by the broadcasting / communication cooperation receiving device. When the broadcast communication cooperative reception apparatus determines that the application provider is not valid, the broadcast communication cooperative system performs resource access control for prohibiting access to a predetermined resource for this application. That is, the broadcasting / communication cooperation receiving apparatus can prohibit an application whose provider is not valid from accessing a resource without limitation.

According to the present invention, the following excellent effects can be obtained.
According to the first and sixth inventions of the present application, not only an application whose provider such as a broadcasting station is valid but also an application whose provider such as a service provider is not valid can be acquired, and an application whose provider is not valid is an unlimited resource. Can be prohibited. Thus, according to the first and sixth inventions of the present application, since an application whose provider is not valid can be safely provided to the viewer, high safety can be ensured while encouraging the entry of a wide range of service providers.

  According to the second and third inventions of the present application, since a signature and a certificate that are difficult to be fraudulent are used, it is possible to correctly verify whether or not the provider is valid, and thus the safety can be further improved. For example, according to the second and third aspects of the present invention, an application whose provider is not valid can be prevented from impersonating the provider as a valid application and accessing resources.

  According to the fourth and fifth inventions of the present application, it is not necessary for the broadcasting / communication cooperation receiving device to check the validity of the certificate and verify the validity of the signature, thereby reducing the processing load on the broadcasting / communication cooperation receiving device. Thus, the broadcasting / communication cooperation receiving apparatus can be configured simply.

It is the schematic which shows the whole structure of the broadcast communication cooperation system which concerns on 1st Embodiment of this invention. It is a block diagram which shows the structure of the signature key issuing apparatus of FIG. It is a block diagram which shows the structure of the application server of FIG. It is a block diagram which shows the structure of the application ID and provider ID production | generation apparatus of FIG. It is a block diagram which shows the structure of the application registration apparatus of FIG. It is a block diagram which shows the structure of the receiver of FIG. It is a figure which shows the data structure of the resource access control table preset in the receiver of FIG. It is a sequence diagram which shows the operation | movement which starts A application in the broadcast communication cooperation system of FIG. It is a sequence diagram which shows the operation | movement which starts a general application in the broadcast communication cooperation system of FIG. It is a sequence diagram which shows the operation | movement which starts A application in the broadcast communication cooperation system which concerns on the modification 1 of this invention. It is a block diagram which shows the structure of the application registration apparatus which concerns on 2nd Embodiment of this invention. It is a block diagram which shows the structure of the receiver which concerns on 2nd Embodiment of this invention. It is a sequence diagram which shows the operation | movement which starts A application in the broadcast communication cooperation system which concerns on 2nd Embodiment of this invention. It is a sequence diagram which shows the operation | movement which starts A application in the broadcast communication cooperation system which concerns on the modification 2 of this invention. It is the schematic which shows the whole structure of the broadcast communication cooperation system which concerns on 3rd Embodiment of this invention. It is a sequence diagram which shows the operation | movement which starts A application in the broadcast communication cooperation system which concerns on 3rd Embodiment of this invention. It is a sequence diagram which shows the operation | movement which starts A application in the broadcast communication cooperation system which concerns on the modification 3 of this invention. It is a sequence diagram which shows the operation | movement which starts A application in the broadcast communication cooperation system which concerns on the modification 4 of this invention. It is a sequence diagram which shows the operation | movement which starts A application in the broadcast communication cooperation system which concerns on the modification 5 of this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings as appropriate. In each embodiment, means having the same function and the same step (process) are denoted by the same reference numerals, and the description thereof is omitted.

(First embodiment)
[Broadcasting communication system configuration]
With reference to FIG. 1, the structure of the broadcast communication cooperation system 1 which concerns on 1st Embodiment of this invention is demonstrated.
The broadcasting / communication cooperation system 1 links broadcasting and communication, and provides various services to users (viewers) together with broadcasting programs. Specifically, the broadcasting / communication cooperation system 1 transmits a broadcast program to a broadcasting / communication cooperation receiving apparatus (hereinafter referred to as “receiver”) 80 via a broadcast wave W and various services via the network N. To the receiver 80. Then, the broadcasting / communication cooperation system 1 provides various services related to the broadcast program to the user by the application in the receiver 80. At this time, the broadcasting / communication cooperation system 1 prohibits access to the resources described later in the receiver 80 for an application whose provider is not valid from the viewpoint of safety (security) and broadcasting publicity.

The “application” is software that operates using the receiver 90 as an execution environment.
Some of these applications are added with verification information described later, and some are not added with verification information.
The application may be abbreviated as “application”.

  An application whose provider is valid (that is, an application created by a broadcasting station or a reliable service provider) is called an “A (Authorized) application”. In this embodiment, it is assumed that the application created by the service provider B is “A application”. The A application is an operation that is expected to be expected in the broadcasting / communication cooperation system 1, and after verification information is added by the application registration device 70 described later, it is stored in the application server 50B described later.

  An application whose provider is not valid (that is, an application created by an unreliable service provider or an individual) is called a “general application”. In the present embodiment, it is assumed that the application created by the service provider A is a “general application”. This general application is not guaranteed for the operation expected in the broadcasting / communication cooperation system 1, and is stored in the application server 50A described later in a state where verification information is not added.

The “broadcast station” is a program that sends a program with composition, and distributes the broadcast program to the user (viewer) through the broadcast wave W or the network N.
A “service provider” provides a service, and creates and distributes content and an application for providing the service.

As shown in FIG. 1, the broadcasting / communication cooperation system 1 includes a broadcasting transmission device 10, a signature key issuing device 20, a CA station (certification authority) 30, content distribution servers 40A and 40B, and application servers 50A and 50B. , An application ID / company ID generation device 60, an application registration device 70, and a receiver 80.
In the broadcasting / communication cooperation system 1, a CA station 30, content distribution servers 40A and 40B, application servers 50A and 50B, and a receiver 80 are connected via a network N.
In the following drawings, the alternate long and short dash line indicates offline or online transmission.

The broadcast transmitting apparatus 10 is a broadcasting facility for digital broadcasting that is installed in a broadcasting station and includes a program organization facility, a program transmission facility, a transmission facility, etc. (not shown). It is transmitted to the receiver 80.
In addition, although the broadcast transmission apparatus 10 demonstrates in the form which transmits a broadcast program as the broadcast wave W, you may transmit via a cable (not shown) and the network N. FIG.
Moreover, since the broadcast transmission apparatus 10 is a general structure, detailed description is abbreviate | omitted.

The signature key issuing device 20 is installed in a broadcasting station and issues a signature key (secret key) for generating a signature and a verification key (public key) necessary for verifying the signature. For example, the signing key issuing device 20 generates a signing key and a verification key for each reliable service provider. The signature key generated by the signature key issuing device 20 is distributed to the service provider B (specifically, the application registration device 70) by the broadcasting station. The verification key generated by the signature key issuing device 20 is distributed to the CA station 30 by the broadcasting station.
For example, the signature key and the verification key may be transmitted online such as the network N, or a recording medium storing the signature key and the verification key may be transmitted offline such as by mail.

  The CA station (certificate authority) 30 issues a certificate including the verification key distributed from the signature key issuing device 20. The CA station 30 is, for example, the X.264 of ITU (International Telecommunication Union). A certificate associated with the provider ID is generated by the method defined in 509. Then, the CA station 30 distributes the generated certificate to the application registration apparatus 70 online or offline. When the CA station 30 receives an inquiry (certificate inquiry) as to whether the certificate is valid or invalid from the receiver 80, the CA station 30 receives as an inquiry result whether the certificate is valid or invalid. To the machine 80.

Here, if an unreliable service provider or the like can arbitrarily install the CA station 30, all applications including general applications can be distributed as A applications. In order to prevent such a situation, the CA station 30 needs to be limited to a certificate approved by a broadcasting station or a system administrator (not shown) of the broadcasting / communication cooperation system 1.
Since the CA station 30 has a general configuration, detailed description thereof is omitted.
FIG. 1 shows the revocation list (CRL1, CLR2), but since it is not directly related to the present embodiment, the description will be given later (see Modification 1).

  The content distribution server 40 provides content to the receiver 80 via the network N in response to a request from an application of the receiver 80. Examples of the content distribution server 40 include a VOD (video on demand) distribution server, a caption distribution server, and a multi-view distribution server.

In the present embodiment, it is assumed that the content distribution server 40A is managed by the service provider A and the content distribution server 40B is managed by the service provider B.
Since the content distribution server 40 has a general configuration, a detailed description is omitted.

The application server 50 is a server that stores and manages applications created by each service provider. For example, the application server 50 transmits an application to the receiver 80 via the network N in response to a request from the receiver 80.
In the present embodiment, the application server 50A is managed by the service provider A, and the application server 50B is managed by the service provider B.

  The application ID / provider ID generation device 60 is managed by the service provider B, and generates an application ID that uniquely identifies the application and a provider ID that uniquely identifies the service provider B. Then, the application ID / business ID generation device 60 outputs the generated application ID and business ID to the application registration device 70.

The application registration device 70 adds verification information to an application created by the service provider B and registers the application as an A application. Specifically, the application registration device 70 generates a signature using the signature key from the signature key issuing device 20. Then, the application registration apparatus 70 adds the generated signature, the certificate from the CA station 30, and the application ID and the business ID from the application ID / business ID generation device 60 to the application as verification information. . Thereafter, the application registration apparatus 70 outputs the application with the verification information added to the application server 50B.
The application registration device 70 is managed by a system administrator.

  A receiver (broadcast communication cooperative receiver) 80 is installed at each user's home, etc., and can watch broadcast programs such as terrestrial digital broadcast, BS digital broadcast, and data broadcast, and can also receive applications via the network N. It is a receiving device capable of receiving. Then, the receiver 80 verifies whether or not the application provider is valid using the verification information. Furthermore, when the provider of the application is not valid, the receiver 80 prohibits access to some resources of the receiver 80 for this application.

Since the receiver 80 controls the acquisition, activation, termination, and the like of the application based on the application activation information, the application activation information will be described.
The “application activation information” is information for identifying an application such as an application identifier (ID), an application location, and additional information for controlling the application (application information table: AIT ( Information corresponding to Application Information Table).

Here, the application activation information can be multiplexed to a broadcast TS (Transport Stream) as an elementary stream (ES) and transmitted to the receiver 80, as in the AIT of the prior art. This technique is described in the reference document “Radio Industry Association,“ Application Execution Environment Standard for Digital Broadcasting, ARIB STD-B23 Version 1.2 ”, July 29, 2009, p.39-54”. ing.
The application activation information may be transmitted to the receiver 80 after being added to EIT (p / f) which is one of SI (program sequence information).
Further, the application activation information may be transmitted to the receiver 80 by a DSM-CC (Digital Storage Media-Command and Control) data carousel.
In this way, the broadcast communication cooperative system 1 can transmit the application activation information to the receiver 80 via the broadcast wave W.

  In addition, the broadcasting / communication cooperation system 1 may include an application activation information server (not shown) that transmits application activation information to the receiver 80 via the network N. This application activation information server is installed in, for example, a system administrator or each service provider, and stores and manages application activation information corresponding to each application.

  The application activation information transmission method depends on, for example, whether or not a certain application is linked to the composition channel. However, since it is not directly related to the present invention, detailed description thereof is omitted. Therefore, in the present embodiment, the application activation information may be transmitted by any of the methods described above.

[Configuration of signing key issuing device]
The configuration of the signature key issuing device 20 will be described with reference to FIG. 2 (see FIG. 1 as appropriate).
As shown in FIG. 2, the signature key issuing apparatus 20 includes a signature key / verification key generation unit 200, a verification key management unit 201, and a signature key management unit 202.

  The signature key / verification key generation unit 200 generates a signature key and a verification key. Here, the signature key / verification key generation unit 200 generates a signature key and a verification key for each reliable service provider by a general signature method such as a DSA signature, an RSA signature, or a signature using an elliptic curve, for example. To do. Then, the signature key / verification key generation unit 200 outputs the generated verification key to the verification key management unit 201, and outputs the generated signature key to the signature key management unit 202.

  The verification key management unit 201 stores and manages the verification key generated by the signature key / verification key generation unit 200. For example, the verification key management unit 201 receives the verification key from the signature key / verification key generation unit 200 and stores the verification key in a storage device (not shown) such as a memory or a hard disk in association with the provider ID. . Then, the verification key management unit 201 outputs the stored verification key.

  The signature key management unit 202 stores and manages the signature key generated by the signature key / verification key generation unit 200. For example, the signature key management unit 202 receives the signature key from the signature key / verification key generation unit 200 and stores the signature key in a storage device (not shown) such as a memory or a hard disk in association with the provider ID. . Then, the signature key management unit 202 outputs the stored signature key to the application registration apparatus 70.

  In the signature key issuing device 20, the timing for generating the signature key and the verification key is arbitrary. For example, when the service provider B manually inputs a key generation command to the signature key issuing device 20, the signature key issuing device 20 generates and outputs a signature key and a verification key in accordance with the key generation command.

Application server configuration
The configuration of the application server 50 will be described with reference to FIG. 3 (see FIG. 1 as appropriate).
As shown in FIG. 3, the application server 50 includes an application input unit (application input unit) 500, an application storage unit (application storage unit) 501, and an application transmission unit (application transmission unit) 502.
Note that the application servers 50A and 50B in FIG. 1 have the same configuration, only whether or not verification information is added to the input application.

  The application input unit 500 is used to input an application created by each service provider. Then, the application input unit 500 writes the input A application in the application storage unit 501.

  The application storage unit 501 is a storage device such as a memory or a hard disk that stores the A application. Here, the location of the application A in the application storage unit 501 is described in the application activation information.

  The application transmission unit 502 transmits each application to the receiver 80 in response to a request from the receiver 80. Specifically, when receiving a request from the receiver 80 via the network N, the application transmission unit 502 reads an application corresponding to the request from the application storage unit 501. Then, the application transmission unit 502 transmits the read application to the receiver 80 via the network N.

[Configuration of App ID / Business ID Generation Device]
With reference to FIG. 4, the configuration of the application ID / business ID generation device 60 will be described (see FIG. 1 as appropriate).
As shown in FIG. 4, the application ID / business ID generation device 60 includes an application ID generation means (application ID generation means) 600, a business ID generation means 601, and an application ID / business ID output means (application ID). (Company ID output means) 602.

  The application ID generation unit 600 generates an application ID that uniquely identifies an application. For example, the application ID generation unit 600 generates an application ID expressed in a URI (Uniform Resource Identifier) format according to a preset naming convention. This naming convention includes, for example, an application ID that is an operator ID of the service provider B and a number that uniquely identifies an application within the service provider B. Then, the application ID generation unit 600 outputs the generated application ID to the application ID / provider ID output unit 602.

  The provider ID generation unit 601 generates a provider ID that uniquely identifies the service provider B. Then, the company ID generation unit 601 outputs the generated company ID to the application ID / company ID output unit 602.

  The application ID / company ID output means 602 receives the application ID from the application ID generation means 600 and the company ID from the company ID generation means 601. The application ID / company ID output means 602 outputs the application ID and the company ID to the application registration apparatus 70.

  In addition, in the application ID / provider ID generation device 60, the timing for generating the application ID and the proprietor ID is arbitrary. For example, when the service provider B manually inputs an ID generation command to the application ID / provider ID generation device 60, the application ID / provider ID generation device 60 determines the application ID and the provider in accordance with the ID generation command. ID is generated and output.

[Configuration of application registration device]
The configuration of the application registration device 70 will be described with reference to FIG. 5 (see FIG. 1 as appropriate).
As shown in FIG. 5, the application registration apparatus 70 includes an application input unit (application input unit) 700, an application ID / company ID input unit (application ID / company ID input unit) 701, and an application ID / company An ID adding unit (application ID / company ID adding unit) 702, a signature key input unit 703, a signature generation unit 704, a verification information adding unit 705, and an application output unit (application output unit) 706 are provided.

  The application input means 700 is used to input an application created by the service provider B. Then, the application input unit 700 outputs the input application to the application ID / provider ID adding unit 702.

  The application ID / provider ID input means 701 receives the application ID and the proprietor ID from the app ID / provider ID generation device 60. Then, the application ID / company ID input unit 701 outputs the input application ID and company ID to the application ID / company ID adding unit 702.

  The application ID / provider ID adding unit 702 adds the application ID and the provider ID input from the application ID / provider ID input unit 701 to the application input from the application input unit 700. Then, the application ID / provider ID adding unit 702 outputs the application to which the application ID and the provider ID are added to the verification information adding unit 705.

  The signature key input unit 703 receives the signature key (secret key) of the service provider B from the signature key issuing device 20. The signature key input unit 703 receives a certificate including the verification key of the service provider B from the CA station 30. Then, the signature key input unit 703 outputs the input signature key and certificate to the signature generation unit 704.

The signature generation unit 704 receives a signature key and a certificate from the signature key input unit 703, and generates a signature using the signature key. Here, for example, any one of identification information such as an operator ID and an application ID that uniquely identifies a service operator, a random number, or a binary code value of the application main body is used as a signature source message as a signature source. The signature generation unit 704 generates a signature by applying a signature algorithm (for example, DSA signature) to the signature source message, and outputs the signature and the certificate to the verification information addition unit 705.
This signature source message needs to be distributed to the receiver 80 by some method. For example, the signature source message may be added to the application.

That is, the signature generation unit 704 generates a signature represented by the following formula (1). In this formula (1), Sig is a signature, Signature_Ks is signature generation by a signature key (secret key), and Mes is a signature source message.
Sig = Signature_Ks (Mes) (1)

  The verification information addition means 705 adds the signature and certificate input from the signature generation means 704 to the application input from the application ID / business ID addition means 702. Then, the verification information adding unit 705 outputs this application to the application output unit 706. That is, the application ID, the operator ID, the signature, and the certificate are added as verification information to the application output by the verification information adding unit 705.

  The application output unit 706 receives an application from the verification information adding unit 705 and outputs the application to the application server 50B. That is, the application output unit 706 outputs the application to which the verification information is added to the application server 50B as the A application.

[Configuration of receiver]
The configuration of the receiver 80 will be described with reference to FIG. 6 (see FIG. 1 as appropriate).
As shown in FIG. 6, a receiver (broadcast communication cooperative receiving device) 80 includes a broadcast receiving unit 801, a broadcast signal analyzing unit 802, a video / audio decoding unit 803, a data broadcast decoding unit 804, and a communication transmitting / receiving unit. 805, application activation information acquisition means (application activation information acquisition means) 806, application activation information storage means (application activation information storage means) 807, list control means 808, application management / execution control means (application management / execution) Control means) 809, startup application identification information storage means (startup application identification information storage means) 810, application acquisition means (application acquisition means) 811, application storage means (application storage means) 812, application execution means (application Execution means) 813 and operation control means 814 Comprises a composite display unit 815, a security managing unit 816, and a resource management unit 819.

The broadcast receiving unit 801 receives broadcast data transmitted as a broadcast wave W via the antenna A. This broadcast receiving means 801 receives and demodulates broadcast data, performs error correction and TMCC (Transmission and Multiplexing Configuration Control) decoding, etc., and outputs it to the broadcast signal analysis means 802 as an MPEG2 transport stream (TS). To do.
The broadcast receiving means 801 is not limited to receiving a broadcast signal by radio waves via the antenna A, and may be a means for receiving a broadcast signal via a cable.

  The broadcast signal analyzing unit 802 analyzes PSI / SI (Program Specific Information / Program Information) in the stream data (transport stream) demodulated by the broadcast receiving unit 801, Data such as video, audio, and data broadcast corresponding to the selected channel is extracted. The channel selection is performed based on a channel switching instruction notified from the operation control means 814 described later.

  This broadcast signal analyzing means 802 outputs the extracted video, audio and other data in the PES (Packetized Elementary Stream) format to the video / audio decoding means 803 and extracts the section such as the extracted data broadcast data. The format data is output to the data broadcast decoding means 804.

At this time, the broadcast signal analysis unit 802 uses the application included in the EIT descriptor (application activation information descriptor), which is one of SI (program sequence information), from the stream data demodulated by the broadcast reception unit 801. Activation information may be extracted. Then, the broadcast signal analyzing unit 802 writes and stores the extracted application activation information in the application activation information storage unit 807. Furthermore, when the application activation information is extracted, the broadcast signal analysis unit 802 indicates that the application activation information has been notified (activation information notification), together with information for identifying the application (application ID), and application management / execution control unit 809. Notify
The EIT is generated, for example, when the broadcast transmission apparatus 10 (see FIG. 1) of the broadcasting station embeds application activation information in the EIT descriptor area.

<Specific examples of application control code>
The application control code will be specifically described because it relates to control of acquisition, activation, termination and the like of the application described later.
As described above, the application activation information descriptor includes a control code (application control code) for controlling the application state.
This application control code is basically the same as that defined in ARIB STD-B23. For example, “AUTOSTART” indicates that the broadcasting / communication cooperation receiving device 80 is an application that is automatically started regardless of a user operation. “PRESENT” indicates that the application is not automatically started.
“DESTROY” and “KILL” are control codes for instructing termination of the application. Whether the termination is normal termination (for example, termination after user confirmation) or forced termination (for example, user confirmation is performed). Immediately exit).

  As described above, this application control code is basically the same as that defined in ARIB STD-B23, but “KILLALL” is further added here. This “KILLALL” indicates forcibly termination of all currently activated applications in the receiver 80.

Hereinafter, the description of the configuration of the receiver 80 will be continued.
The video / audio decoding unit 803 decodes the video / audio (video stream and audio stream) extracted by the broadcast signal analysis unit 802. This video / audio decoding means 803, when the video / audio is encoded by, for example, the MPEG2 encoding method, is output to the composite display means 815 as video / audio data in an output format that can be decoded and displayed by MPEG2. Output.

The data broadcast decoding unit 804 decodes the data broadcast data extracted by the broadcast signal analysis unit 802. This data broadcast decoding means 804 has the function of a BML browser that decodes the carousel, analyzes the BML, and converts the BML into an output format that can be displayed, and synthesizes and displays the converted display data (data broadcast data). Output to means 815.
Further, the data broadcast decoding unit 804 may extract the application activation information transmitted by the DSM-CC data carousel. Then, the data broadcast decoding unit 804 writes and stores the extracted application activation information in the application activation information storage unit 807.
In this embodiment, the data broadcast decoding unit 804 does not have to include the CRL extracting unit 804a. The CRL extracting unit 804a will be described later (see Modification 1).

The communication transmitting / receiving means 805 receives data such as applications and application activation information via the network N.
The application activation information acquisition unit 806 acquires activation information corresponding to the A application and the general application via the communication transmission / reception unit 805.

  For example, the application activation information acquisition unit 806 acquires application activation information from a predetermined server (application activation information server) at the time of activation (when the power is turned on), and writes the acquired application activation information in the application activation information storage unit 807. Remember. Alternatively, the application activation information acquisition unit 806 acquires application activation information when an instruction to display a list of applications (list display instruction) is notified by the user via an operation control unit 814 described later. Also good.

  The application activation information storage unit 807 stores application activation information, and is a storage medium such as a memory or a hard disk. In this case, the application activation information extracted by the broadcast signal analyzing unit 802 is written in the application activation information storage unit 807. The application activation information storage unit 807 stores the application activation information acquired by the application activation information acquisition unit 806.

The list control unit 808 is a launcher that displays a list of applications that can be started and controls application selection.
The list control unit 808 displays a list of applications that can be activated. That is, the list control unit 808 generates a list of applications corresponding to the application activation information stored in the application activation information storage unit 807 when a list display is instructed by the user via the operation control unit 814. The display data is output to the composite display means 815.

  The list control unit 808 selects an application based on a list selection instruction from the user instructed via the operation control unit 814 in the displayed application list. For example, the list control unit 808 is notified of a pressing signal of a direction (arrow) button (not shown) of the remote control device Ri as a list selection instruction via the operation control unit 814, and thus among the plurality of applications. , Recognizing which application is selected as an activation candidate and notifying a pressing signal of a decision button (not shown), the application in which the activation instruction is actually selected is recognized. Then, the list control unit 808 outputs a selected application notification including a number (application ID) for identifying the selected application to the application management / execution control unit 809.

The application management / execution control means 809 controls the life cycle of the application (the process from when the application is loaded and executed until it is terminated).
Specifically, when a resource allocation request is input from the application execution unit 813 described later, the application management / execution control unit 809 outputs (transfers) the resource allocation request to the resource management unit 819 described later.

The application management / execution control unit 809 receives a resource allocation request response from the resource management unit 819.
Here, when the resource allocation request response indicates that the resource allocation has succeeded, the application management / execution control unit 809 associates the resource allocation success with a memory or the like in association with the active application ID. Is written in a security information table (not shown) stored in
On the other hand, if the response to the resource allocation request is a resource allocation failure indicating that the resource allocation has failed, the application management / execution control unit 809 associates this resource allocation failure with a security information table in association with the active application ID. Write to.

The application management / execution control unit 809 receives an authentication result from an application authentication unit 817 described later. This authentication result includes information such as the ID of the application whose signature has been verified and a flag indicating the A application or the general application. Then, the application management / execution control unit 809 writes the input authentication result in the security information table in association with the active application ID.
As a result, the application management / execution control unit 809 can store and manage the success or failure of resource allocation to the running application, the allocated resource, and the authentication result.

Here, the application management / execution control unit 809 includes an activation control unit 809a, an end control unit 809b, and a storage management unit 809c.
The activation control unit 809a controls activation of the application acquired by the application acquisition unit 811.
Specifically, the activation control unit 809a corresponds to the application ID notified together with the activation information notification stored in the application activation information storage unit 807 when the activation information notification is notified from the broadcast signal analysis unit 802. When the application control code described in the application activation information is “AUTOSTART”, the application is activated.
That is, when the application control code is “AUTOSTART”, the activation control unit 809a notifies the application execution unit 813 that the application is to be executed (activation control instruction). This activation control instruction includes information (application ID, location, etc.) that identifies the application described in the application activation information. As a result, the application is automatically started regardless of the user's operation.

  When the notification of the selected application is notified from the list control unit 808, the activation control unit 809a executes the application on the application execution unit 813 regardless of the value of the application control code (activation control instruction). To be notified. As a result, the application selected from the list by the user is activated.

  The activation control unit 809a manages the activated application with identification information (application ID), and writes the activated application ID in the activated application identification information storage unit 810.

The termination control unit 809b performs termination control of the running application.
Specifically, the end control unit 809b corresponds to the application ID notified together with the activation information notification stored in the application activation information storage unit 807 when the activation information notification is notified from the broadcast signal analysis unit 802. When the application control code described in the application activation information is “DESTROY”, “KILL”, or “KILLALL”, the application is terminated.

  When the application control code is “DESTROY”, the termination control unit 809b instructs the application execution unit 813 to normally terminate the application corresponding to the notified application ID. When the application control code is “KILL”, the termination control unit 809b instructs the application execution unit 813 to forcibly terminate the application corresponding to the notified application ID.

When the application control code is “KILLALL”, the termination control unit 809b refers to the activated application identification information storage unit 810 and forcibly terminates all currently activated applications.
As a result, for example, when broadcasting contents to be urgently notified to viewers such as emergency alert broadcasting and earthquake early warning, the broadcaster notifies the receiver 80 of application activation information describing “KILLALL” in the application control. By doing so, resources such as a display screen can be preferentially used in an emergency.

The accumulation management unit 809c performs control to accumulate (install) the application in the receiver 80 (specifically, the application storage unit 812) in advance.
Specifically, the storage management unit 809c sends an application to the application storage unit 812 from the list control unit 808 together with information (application ID) for specifying the selected application selected by the user in the list of applications that can be started. When notified of the accumulation, the application acquisition unit 811 is notified that the application is acquired from the location of the application described in the application activation information and written to the application storage unit 812 (application acquisition instruction).
As a result, the application storage unit 812 stores the application selected by the user.

In addition, when accumulating (installing) an application in the application storage unit 812, the accumulation management unit 809c indicates the location (address) of the application in the application activation information corresponding to the application stored in the application activation information storage unit 807. Then, the application storage unit 812 is updated to refer to the address.
For example, the accumulation management unit 809c indicates the address notation of the application described as “http: ///” in the application activation information as a local address in the application storage unit 812 (address in the application storage unit 812). To “file: /// ˜” or the like. Of course, instead of directly changing the application activation information, a conversion rule that reads and refers to the address of the application activation information may be separately described in association with the application activation information.

Further, when the application management unit 809c stores (installs) the application in the application storage unit 812, the storage management unit 809c writes and manages the state that the application is stored in the application activation information storage unit 807.
On the other hand, the accumulation management unit 809c deletes the accumulated application in accordance with a user instruction. That is, the applications stored in the application storage unit 812 are displayed in a list by a stored application list display unit (not shown) in the storage management unit 809c, and selected by the user by an application selection deletion unit (not shown). It is deleted from the application storage means 812. At this time, the application selection / deletion unit (not shown) sets the corresponding application storage state to “not stored” in the application activation information storage unit 807.

  The activated application identification information storage unit 810 stores identification information (application ID) of an activated application, and is a storage medium such as a semiconductor memory. The activation application identification information storage unit 810 is written with an application ID when the application is activated by the activation control unit 809a, and is deleted when the application is terminated by the termination control unit 809b.

The application acquisition unit 811 acquires an application stored in the application server 50 via the communication transmission / reception unit 805.
When receiving an application acquisition instruction from the activation control unit 809a, the application acquisition unit 811 acquires a specified application from the location (address) of the application notified by the instruction, and executes the acquired application. Output to means 813.
In addition, when an application acquisition instruction is notified from the storage management unit 809c, the application acquisition unit 811 acquires the specified application from the location (address) of the application notified by the instruction, and stores the acquired application. Write and accumulate in the management means 809c.

Further, when the application acquisition unit 811 acquires an application, the application acquisition unit 811 outputs an authentication instruction to instruct authentication (determination) as to whether the application is an A application or a general application to the application authentication unit 817.
Thereby, the receiver 80 can reduce the number of times of application authentication, and can reduce the processing load of the receiver 80.
The authentication instruction output by the application acquisition unit 811 is illustrated as “authentication instruction 1” in FIG. The “authentication instruction 2” will be described later.

The application storage unit 812 stores the application acquired by the application acquisition unit 811 and is a storage medium such as a hard disk. The application stored in the application storage unit 812 is read and executed by the application execution unit 813.
The application stored in the application storage unit 812 is added with verification information (for example, application ID, company ID, signature, certificate) and a signature source message.

The application execution unit 813 starts and ends an application based on an instruction (startup control instruction) from the application management / execution control unit 809.
When the application execution unit 813 is instructed to execute the application notified from the activation control unit 809a, the application execution unit 813 determines whether to execute the application based on information (application ID, location, etc.) specifying the application included in the activation control instruction. In addition, data necessary for executing the application (for example, metadata, icon data, etc.) is acquired from the acquisition source of the application.
Then, the application execution unit 813 expands (loads) the application in a memory (not shown) and executes the application.
Note that the application execution unit 813 reads the application storage unit 812 from the application storage unit 812 when the acquisition source of the application included in the activation control instruction is an address of the local disk (application storage unit 812) such as “file: /// ˜”. Read and execute the application. The application execution unit 813 instructs the application acquisition unit 811 to acquire the application when the acquisition source of the application included in the activation control instruction is an address on the network such as “http: ///”. Application acquisition instruction), acquire and execute the application.
Image and audio data accompanying execution of this application is output to the composite display means 815.
Further, when instructed to terminate the application notified from the termination control unit 809b, the application execution unit 813 terminates the instructed application.

Here, the application execution unit 813 outputs a resource allocation request to the resource management unit 819 via the application management / execution control unit 809 when the application being started calls an API (Application Program Interface) that accesses the resource. To do.
This resource allocation request is a request for resource allocation, and includes, for example, an API name called by a running application.

The application execution means 813 receives a resource allocation request response from the resource management means 819.
If the response to the resource allocation request is a successful resource allocation, the application execution unit 813 calls the API and uses the resource allocated by the resource management unit 819.
On the other hand, when the response to the resource allocation request is a resource allocation failure, the application execution unit 813 performs an arbitrary process for each application such as security-related exception processing or application termination.

  Here, the application execution unit 813 notifies the active application by an interrupt signal or the like, for example, from the termination control unit 809b, and terminates the application.

  The application execution unit 813 has been described as outputting a resource allocation request to the resource management unit 819 via the application management / execution control unit 809, but is not limited thereto. Specifically, the application execution unit 813 may directly output a resource allocation request to the resource management unit 819 (not shown).

The operation control unit 814 controls a user operation (for example, channel change or the like) on the receiver 80 via an input unit such as an external remote controller Ri.
This operation control means 814 notifies the broadcast signal analysis means 802 of a channel switching instruction including the channel number of the selected channel, when a change of channel is instructed by the user via the remote controller Ri. As a result, the channel currently being viewed is selected.

The composite display means 815 combines and displays video and audio. The composite display means 815 includes video data / audio data decoded by the video / audio decoding means 803, display data of the data broadcast decoded by the data broadcast decoding means 804, and display data of the list generated by the list control means 808. The display data of the application generated by the application execution unit 813 is combined and displayed.
Note that the synthesized display unit 815 outputs the synthesized audio as an audio signal to an audio output device Sp such as a speaker connected to the outside, and the synthesized video (image) is externally connected as a video signal. Output to a video display device Mo such as a liquid crystal display.

  The security management unit 816 manages the security of the receiver 80, and includes an application authentication unit (application determination unit) 817 and a resource access control unit 818.

  Based on the verification information, the application authentication unit (application determination unit) 817 determines whether the application provider acquired by the application acquisition unit 811 is valid according to the authentication instruction input from the application acquisition unit 811. Authentication (determination). Then, the application authentication unit 817 authenticates (determines) this application as an A application when the application provider is valid, and authenticates (determines) this application as a general application when the application provider is invalid (application). Authentication).

<Specific examples of application authentication>
A specific example of application authentication will be described below.
As shown in FIG. 6, the application authentication unit 817 includes a verification information management unit (storage unit) 817a, a certificate confirmation unit 817b, and a signature verification unit 817c.

When the authentication instruction is input, the application authentication unit 817 extracts the verification information and the signature source message from the application storage unit 812 and writes them in the verification information management unit 817a.
The verification information management unit 817a stores and manages verification information (for example, application ID, business operator ID, signature, certificate) and a signature source message.

  The certificate confirmation unit 817b confirms whether or not the certificate stored in the verification information management unit 817a is valid. Specifically, the certificate confirmation unit 817 b outputs a certificate query including the verification information provider ID to the CA station 30 via the communication transmission / reception unit 805. Then, the certificate confirmation unit 817b receives an inquiry result indicating whether the certificate is valid or invalid from the CA station 30 in response to the certificate inquiry.

Here, when the inquiry result is valid, the certificate confirmation unit 817b instructs the signature verification unit 817c to verify the signature (signature verification instruction).
On the other hand, when the inquiry result is invalid, the certificate confirmation unit 817b authenticates (determines) that the application provider is not valid (general application). Then, the certificate confirmation unit 817b outputs the authentication result to the application management / execution control unit 809 and the resource access control unit 818.
Note that the certificate checking unit 817b performs the same processing even when a certificate is not attached to the application.

  The signature verification unit 817c verifies whether the signature stored in the verification information management unit 817a is valid. Here, when the signature verification instruction is input from the certificate confirmation unit 817b, the signature verification unit 817c verifies whether the signature is valid by using the certificate verification key.

That is, the signature verification unit 817c verifies the signature added to the application by applying a signature verification algorithm to the signature source message (see Expression (2)). In this equation (2), Verify_Kp is signature verification using a verification key (public key).
Verify_Kp (Mes, Sig) <=> 1 Formula (2)

Here, when the result of Verify is 1, since the signature is valid, the signature verification unit 817c authenticates (determines) that the application provider is valid (A application).
On the other hand, if the Verify result is not 1, the signature is not valid, and the signature verification unit 817c authenticates (determines) that the application provider is not valid (general application).

Then, the application authentication unit 817 gives the application management / execution control unit 809 and the resource access control unit 818 the authentication result of the ID of the application whose signature has been verified and the information indicating whether the provider of the application is valid. Output.
This authentication result is, for example, a flag indicating that 0: the provider is a legitimate application (A application) and 1: the provider is a legitimate application (general application).

  The resource access control means 818 performs resource access control for this application when the provider of the application acquired by the application acquisition means 811 is not valid (general application). In the present embodiment, the resource access control means 818 performs resource access control based on a preset resource access control table.

<Resource access control>
With reference to FIG. 7, the resource access control by the resource access control means 818 will be specifically described (see FIG. 6 as appropriate).
This resource access control table is a table in which resources that can be accessed and resources that cannot be accessed by each of the A application and the general application are set in advance. As shown in FIG. 7, the resource access control table has data items such as an API identifier, an API name, a resource type, and an access right.

The API identifier is an identifier that uniquely identifies an API that accesses a resource.
The API name is the name of the API that accesses the resource.
The resource type is information indicating the resource accessed by the API.
The access authority indicates whether each of the A application and the general application can access the resource.

This resource is a content element and a receiver resource that are necessary for the operation of the application, and includes, for example, a broadcast resource, a communication resource, and a receiver resource.
This broadcast resource is a resource handled by the broadcast wave W, and can include, for example, video, audio, captions, PSI (Program Specific Information) / SI (Service Information).
The communication resource is a resource handled in the network N, and examples thereof include TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).
Furthermore, the receiver resource is a resource related to software and hardware of the receiver 80, and examples thereof include video / audio output processing, channel selection processing, memory, and storage.

  In the resource access control table of FIG. 7, a dedicated API for accessing the resource is defined for each resource. In this example, the API for accessing the resource “video” is “subA ()”, the API for accessing the resource “audio” is “subB ()”, and the API for accessing the resource “subtitle” is “subC ( ”” And the API for accessing the resource “memory” is “subD ()”.

  Also, in this resource access control table, the A application has access authority for broadcasting resources such as “video”, “audio”, “caption” (access authority for A application), and therefore accesses these resources. Show what you can do. Furthermore, this resource access control table indicates that the A application can access receiver resources such as “memory” as well as broadcast resources.

  Further, in this resource access control table, the general application has access authority (general application access authority) for broadcasting resources such as “video”, “audio”, “caption”, etc., so that these resources are accessed. Indicates that it cannot be done. On the other hand, this resource access control table indicates that even a general application can access receiver resources such as “memory”.

  That is, the resource access control table in FIG. 7 is set so that the A application can access a wider range of resources than the general application. In other words, this resource access control table is set so that general applications cannot access resources such as broadcasting resources from the viewpoint of safety and publicity of broadcasting.

  Here, a person having authority such as a broadcasting station may create this resource access control table, transmit it to the receiver 80 via the broadcast wave W or the network N, and store it in the receiver 80. Good. Thereby, in the receiver 80, resources that can be accessed by the general application can be managed by the broadcasting station, and maintainability is improved.

  Note that the resource access control table is not limited to the example of FIG. For example, resources other than broadcast resources and receiver resources (for example, communication resources such as “TCP”) can be set in the resource access control table.

  The resource access control unit 818 receives the authentication result from the application authentication unit 817. Then, when the resource assignment availability inquiry is input from the resource management means 819, the resource access control means 818 determines whether or not resources can be assigned according to the resource assignment availability inquiry.

Specifically, when the authentication result (determination result) is an A application, the resource access control unit 818 uses the API name included in the resource allocation permission query as a search key of the resource access control table, and sets the access authority of the A application. Search to determine whether resources can be allocated. For example, when the A application calls “subA ()”, the resource access control unit 818 determines that the resource can be allocated because the access authority of the resource “video” is “◯”. Then, the resource access control unit 818 outputs to the resource management unit 819 the resource allocatable status indicating that the resource can be allocated.
When the access authority of the A application is “x”, the resource access control unit 818 prohibits access to the resource even for the A application.

  On the other hand, when the authentication result (determination result) is a general application, the resource access control unit 818 searches the access authority of the general application using the API name included in the resource allocation permission query as a search key of the resource access control table. Determine whether resources can be allocated. For example, when the general application calls “subA ()”, the resource access control unit 818 determines that the resource allocation is impossible because the access authority of the resource “video” is “x”. When the general application calls “subD ()”, the resource access control unit 818 determines that the resource can be allocated because the access authority of the resource “memory” is “◯”. After that, the resource access control unit 818 outputs to the resource management unit 819, based on the determination result, either resource allocation impossible indicating that resource allocation is impossible or resource allocation possible.

Returning to FIG. 6, the description of the configuration of the receiver 80 will be continued.
The resource management unit 819 manages various resources. Here, when a resource allocation request is input from the application execution unit 813, the resource management unit 819 outputs a resource allocation enable / disable inquiry to the resource access control unit 818 in response to the resource allocation request.
This resource allocation availability inquiry is an inquiry to the resource access control means 818 for resource allocation availability, and includes, for example, the API name stored in the resource allocation request.

Further, the resource management unit 819 receives a resource allocation availability response from the resource access control unit 818.
Here, the resource management means 819 allocates a resource to the running application when the resource allocation availability response is resource allocation possible. Then, the resource management unit 819 outputs, to the application management / execution control unit 809 and the application execution unit 813, resource allocation success indicating that the resource allocation has been successful.
On the other hand, the resource management unit 819 sends a resource allocation failure indicating that the resource allocation has failed to the application management / execution control unit 809 and the application execution unit 813 when the resource allocation availability response is not resource allocation. Output.

[Operation of broadcasting / communication cooperation system: Application A]
A case where the receiver 80 activates the A application (FIG. 8) and a case where the receiver 80 activates the general application (FIG. 9) will be described as operations of the broadcasting / communication cooperation system 1 in FIG. 1.

  As shown in FIG. 8, the broadcasting / communication cooperation system 1 issues a signature key (secret key) and a verification key (public key) corresponding to the signature key by the signature key issuing device 20. Here, the signature key issuing device 20 generates and issues a signature key and a verification key by a general signature method such as a DSA signature, an RSA signature, or a signature using an elliptic curve, for example (step S1).

  The broadcasting / communication cooperation system 1 distributes the generated verification key to the CA station 30 by the signature key issuing device 20 (step S2) and distributes the generated signature key to the application registration device 70 (step S3).

  The broadcasting / communication cooperation system 1 generates an application ID and a provider ID by the application ID / provider ID generation device 60 (step S4). Then, the broadcasting / communication cooperation system 1 outputs the application ID and the provider ID generated by the application ID / provider ID generation device 60 to the application registration device 70 (step S5).

  In the broadcasting / communication cooperation system 1, the CA station 30 generates a certificate including the verification key from the signature key issuing apparatus 20 (step S6). Then, the broadcasting / communication cooperation system 1 outputs the certificate to the application registration apparatus 70 by the CA station 30 (step S7).

  The broadcasting / communication cooperation system 1 generates a signature using the signature key input from the signature key issuing device 20 by the application registration device 70. Here, the application registration apparatus 70 uses the signature key to generate a signature by applying a signature algorithm (for example, DSA signature) to the signature source message (step S8).

  The broadcasting / communication cooperation system 1 uses the application registration device 70 to add the application ID, the business operator ID, the signature, and the certificate to the application as verification information (step S9). Then, the broadcasting / communication cooperation system 1 outputs the A application to which the verification information is added to the application server 50B by the application registration apparatus 70, and is stored and managed as the A application by the application server 50B (step S10). .

  The broadcasting / communication cooperation system 1 requests the application A from the application server 50B by the receiver 80 (step S11). Then, the broadcasting / communication cooperation system 1 acquires the requested A application from the application server 50B by the receiver 80 (step S12).

  The broadcasting / communication cooperation system 1 uses the receiver 80 to inquire the CA station 30 whether the certificate is valid (step S13). Then, the broadcasting / communication cooperation system 1 outputs the inquiry result to the receiver 80 by the CA station 30 (step S14).

The broadcasting / communication cooperation system 1 verifies whether or not the application provider is valid by the receiver 80. In other words, the receiver 80 confirms the validity of the certificate and verifies the validity of the signature based on the inquiry result from the CA station 30 (step S15).
Here, since the certificate is valid and the signature is valid, the broadcasting / communication cooperation system 1 activates the acquired application as the A application by the receiver 80 (step S16).

[Broadcast communication system operation: General application]
As shown in FIG. 9, the broadcasting / communication cooperation system 1 requests a general application from the application server 50A (step S11 ′). Then, the broadcasting / communication cooperation system 1 acquires the requested general application from the application server 50A by the receiver 80 (step S12 ′).

The broadcasting / communication cooperation system 1 verifies whether or not the provider of the application is valid by using the receiver 80 (step S15 ′). Here, since the certificate is not added to the application, the broadcasting / communication cooperation system 1 starts up the acquired application as a general application by the receiver 80 (step S16 ′).
In the following embodiments, when the application provider is not valid, the operation is the same as that in FIG.

  As described above, the receiver 80 according to the first embodiment of the present invention can acquire not only an application whose provider such as a broadcasting station is valid but also an application whose provider such as a service provider is not valid. Access to a predetermined resource is prohibited for an application whose origin is not valid. That is, the receiver 80 can prohibit unlimited resource access for an application whose provider is not valid.

  In addition, since the receiver 80 uses a signature and a certificate that are difficult to be fraudulent, the security can be further improved. Accordingly, in the receiver 80, for example, an application (general application) created by the service provider A can be prevented from accessing a resource by impersonating an application (A application) created by the service provider B.

In this embodiment, the application authentication is performed when the application is acquired. However, the present invention can also perform the application authentication when the application is activated. In this case, each time the activation control unit 809a activates an application, an authentication instruction is output to the application authentication unit 817 ("authentication instruction 2" in FIG. 7), and application authentication is performed, thereby improving safety. To do.
In this way, since it is only necessary to verify the signature at any timing when the application is acquired or when the application is activated, the design flexibility of the receiver 80 can be improved.

  In the present embodiment, the service provider that creates the A application and the general application is described as one, but a plurality of service providers may be used. Moreover, the same service provider may produce both the A application and the general application. Further, a broadcast station may produce an application as a service provider.

(Modification 1)
[Broadcasting communication system configuration]
Returning to FIG. 1, the broadcasting / communication cooperation system 1 according to the first modification of the present invention will be described while referring to differences from the first embodiment.
In the broadcasting / communication cooperation system 1, the CA station 30 issues a revocation list (CRL: Certificate Revocation List) and the receiver 80 checks the validity of the certificate based on the revocation list in the first embodiment. And different.

  The CA station 30 generates a certificate for each service provider (a certificate associated with the provider ID. The CA station 30 transmits the generated certificate to the receiver 80 online or offline.

  Further, the CA station 30 generates a revocation list that is a list of revoked certificates. For example, when the service provider B becomes unreliable, the broadcasting station instructs the CA station 30 to revoke the certificate of the service provider B. Then, the CA station 30 generates a revocation list in which the service provider B's business ID is stored.

  This revocation list can be transmitted to the receiver 80 via the broadcast wave W or the network N. Note that whether the revocation list is transmitted by the broadcast wave W or the network N is determined in advance by, for example, a broadcasting station.

  Here, when the revocation list is transmitted by the broadcast wave W, the CA station 30 outputs the revocation list to the broadcast transmitting apparatus 10. In this case, for example, the broadcast transmitting apparatus 10 transmits the revocation list input from the CA station 30 to the receiver 80 by the DSM-CC data carousel (“CRL1” in FIG. 1).

  On the other hand, when the revocation list is transmitted in the network N, the CA station 30 outputs this revocation list to the application registration device 70. In this case, the application registration apparatus 70 adds the revocation list input from the CA station 30 to the application and outputs it to the application server 50B. Then, the receiver 80 acquires a revocation list together with this application from the application server 50B (“CRL2” in FIG. 1).

[Configuration of application registration device]
The configuration of the application registration device 70 will be described with reference to FIG. 5 (see FIG. 1 as appropriate).

  The signature key input unit 703 receives the signature key of the service provider B from the signature key issuing device 20. In addition, the signature key input unit 703 receives a certificate including the verification key of the service provider B and the revocation list from the CA station 30. Then, the signature key input unit 703 outputs the input signature key, certificate, and revocation list to the signature generation unit 704.

The signature generation unit 704 receives a signature key, a certificate, and a revocation list from the signature key input unit 703, and generates a signature using the signature key. Then, the signature generation unit 704 outputs the generated signature, certificate, and revocation list to the verification information addition unit 705.
The signature generation method is the same as that in the first embodiment, and thus detailed description thereof is omitted.

  The verification information addition unit 705 adds the signature key, certificate, and revocation list input from the signature generation unit 704 to the application input from the application ID / provider ID addition unit 702. Then, the verification information adding unit 705 outputs this application to the application output unit 706. In other words, the application ID, the operator ID, the signature, the certificate, and the revocation list are added as verification information to the application output by the verification information adding unit 705.

[Receiver configuration]
The configuration of the receiver 80 will be described with reference to FIG. 6 (see FIG. 1 as appropriate).
As shown in FIG. 6, the receiver 80 further includes CRL extracting means 804a.
Here, it is assumed that the receiver 80 is preliminarily distributed with a certificate associated with the carrier ID, and the verification information management unit 817a stores and manages this certificate.

The CRL extracting unit 804a extracts the revocation list transmitted in the DSM-CC data carousel. Then, the CRL extraction unit 804a writes the extracted revocation list into the verification information management unit 817a.
When the authentication instruction is input, the application authentication unit 817 extracts the revocation list added to the application from the application storage unit 812 and writes it to the verification information management unit 817a.

  The certificate confirmation unit 817b confirms whether the certificate of the verification information management unit 817a is valid based on the revocation list of the verification information management unit 817a. Specifically, the certificate confirmation unit 817b reads out the business operator ID and the revocation list stored in the verification information management unit 817a. Also, the certificate confirmation unit 817b reads out the service provider certificate corresponding to the read out provider ID from the verification information management unit 817a. Then, the certificate confirmation unit 817b confirms whether or not the provider ID of the read certificate is included in the revocation list.

  Here, when the provider ID is not included in the revocation list (when the certificate is valid), the certificate confirmation unit 817b verifies the signature to the signature verification unit 817c using the verification key included in the certificate. (Signature verification instruction).

On the other hand, when the provider ID is included in the revocation list (when the certificate is invalid), the certificate confirmation unit 817b authenticates (determines) that the application provider is not valid (general application). Then, the certificate confirmation unit 817b outputs the authentication result to the application management / execution control unit 809 and the resource access control unit 818.
In this way, the receiver 80 can check the validity of the certificate based on the revocation list.

[Broadcast communication system operation]
With reference to FIG. 10, operation | movement of the broadcast communication cooperation system 1 which concerns on the modification 1 of this invention is demonstrated (refer FIG. 1 suitably).
In the following description, the processing of step S1 to step S6 is the same as that of each step in FIG.

  The broadcasting / communication cooperation system 1 distributes the generated certificate to the receiver 80 by the CA station 30 (step S21). Also, the broadcasting / communication cooperation system 1 generates a revocation list by the CA station 30 (step S22).

  When transmitting the revocation list by the broadcast wave W, the broadcasting / communication cooperation system 1 outputs the revocation list to the broadcast transmitting apparatus 10 by the CA station 30 (step S23). Then, the broadcasting / communication cooperation system 1 transmits the revocation list to the receiver 80 using the DSM-CC data carousel by the broadcast transmitting apparatus 10 (step S24).

  When the revocation list is transmitted in the network N, the broadcasting / communication cooperation system 1 outputs the revocation list to the application registration apparatus 70 by the CA station 30 (step S23 ′).

Since the process of step S25 is the same process as step S8 of FIG. 8, detailed description is abbreviate | omitted.
The broadcasting / communication cooperation system 1 adds the application ID, the operator ID, the signature, and the revocation list to the application as verification information by the application registration device 70 (step S26).
Needless to say, when the revocation list is transmitted by the broadcast wave W (steps S23 and S24), the revocation list is not added in the process of step S9.

Since the processes in steps S27 to S29 are the same as those in steps S10 to S12 in FIG. 8, detailed description thereof is omitted.
The broadcasting / communication cooperation system 1 verifies whether or not the application provider is valid by the receiver 80. In other words, the receiver 80 checks whether the certificate is valid based on the revocation list and verifies whether the signature is valid (step S30).
Since the process of step S31 is the same process as step S16 of FIG. 8, detailed description is abbreviate | omitted.

  As described above, the receiver 80 according to the first modification of the present invention can easily revoke a certificate using the revocation list in addition to the same effects as those of the first embodiment. As a result, in the first modification of the present invention, the certificate management cost in the broadcasting / communication cooperation system 1 can be reduced.

  In the first modification of the present invention, the revocation list is transmitted by either the broadcast wave W or the network N, but the revocation list may be transmitted by both. That is, the receiver 80 acquires the revocation list added to the application via the network N and also acquires the revocation list transmitted on the broadcast wave W. In this case, the revocation list acquired by the broadcast wave W is newer than the revocation list acquired by the network N. Therefore, the receiver 80 confirms the validity of the certificate based on the revocation list acquired by the broadcast wave W.

(Second Embodiment)
With reference to FIG. 11, a difference from the first embodiment will be described for the broadcast communication cooperation system 1 (hereinafter, “broadcast communication cooperation system 1 ′”) according to the second embodiment of the present invention (see FIG. 1 as appropriate). ).
This broadcasting / communication cooperation system 1 ′ is different from the first embodiment in that the application registration apparatus 70 ′ verifies the validity of the certificate and verifies the validity of the signature.

[Configuration of application registration device]
The configuration of the application registration apparatus 70 ′ will be described (see FIG. 1 as appropriate).
As shown in FIG. 11, the application registration apparatus 70 ′ includes a storage unit 705a, a certificate confirmation unit 705b, and a signature verification unit 705c in order to confirm the validity of the certificate and verify the validity of the signature. Further prepare.

  The storage unit 705a stores and manages the application ID, company ID, signature, certificate, and the like input to the verification information adding unit 705. The certificate stored in the storage unit 705a is referred to by a certificate confirmation unit 705b and a signature verification unit 705c described later.

  The certificate confirmation unit 705b confirms whether or not the certificate stored in the storage unit 705a is valid. Specifically, the certificate confirmation unit 705b confirms the validity of the certificate by the same method as the certificate confirmation unit 817b in FIG.

If the certificate is valid, the certificate confirmation unit 705b instructs the signature verification unit 705c to verify the signature (signature verification instruction).
On the other hand, if the certificate is invalid, the certificate confirmation unit 705b adds a verification result indicating that the application provider is not valid as verification information to the application.
This verification result is, for example, a flag indicating that 0: the provider is a legitimate application (A application) and 1: the provider is a legitimate application (general application).

  The signature verification unit 705c verifies whether the signature stored in the storage unit 705a is valid. Specifically, the signature verification unit 705c verifies the validity of the signature by the same method as the signature verification unit 817c of FIG.

If the signature is valid, the signature verification unit 705c adds a verification result indicating that the application provider is valid as verification information to the application.
On the other hand, when the signature is not valid, the signature verification unit 705c adds a verification result indicating that the application provider is not valid as verification information to the application.

  In this way, the application registration apparatus 70 ′ can confirm the validity of the certificate and verify the validity of the signature, and add the verification result to the application.

[Receiver configuration]
With reference to FIG. 12, the configuration of the receiver 80 ′ will be described (see FIG. 1 as appropriate).
As shown in FIG. 12, the receiver (broadcast communication cooperative receiving device) 80 ′ includes a verification result determination unit 817d instead of the certificate confirmation unit 817b and the signature verification unit 817c.

When the authentication instruction is input, the application authentication unit 817 extracts the verification result (verification information) from the application storage unit 812 and writes it in the verification information management unit 817a.
That is, the verification information management means 817a stores and manages the verification result added to the application.

  The verification result determination unit 817d verifies whether the provider of the application acquired by the application acquisition unit 811 is valid based on the verification result (verification information) stored in the verification information management unit 817a. It is.

Here, when the verification result = 0, the verification result determination unit 817d authenticates (determines) that the application provider is valid (A application).
On the other hand, when the verification result = 1, the verification result determination unit 817d authenticates (determines) that the application provider is not valid (general application).

  Then, the verification result determination unit 817d uses the application ID for verifying the validity of the provider and information such as a flag indicating whether the provider is valid as an authentication result, and the application management / execution control unit 809. And output to the resource access control means 818.

[Broadcast communication system operation]
With reference to FIG. 13, the operation of the broadcasting / communication cooperation system 1 ′ according to the second embodiment of the present invention will be described (see FIG. 1 as appropriate).

The broadcasting / communication cooperation system 1 ′ verifies whether or not the application provider is valid by the application registration device 70 ′. That is, the application registration apparatus 70 ′ verifies the validity of the certificate and verifies the validity of the signature based on the inquiry result from the CA station 30 (step S51).
In the following description, it is assumed that the application provider is valid.

The broadcasting / communication cooperation system 1 ′ adds the application ID and the verification result (verification information) to the application by the application registration device 70 ′ (step S52).
Since the processes in steps S53 to S55 are the same as those in steps S10 to S12 in FIG. 8, detailed description thereof is omitted.

The broadcasting / communication cooperation system 1 ′ determines whether or not the provider of the application is valid based on the verification result by the receiver 80 ′. Here, when the verification result = 0, the receiver 80 ′ determines that the application provider is valid. On the other hand, if the verification result = 1, the receiver 80 ′ determines that the application provider is not valid (step S56).
Since the process of step S57 is the same as that of step S16 of FIG. 8, detailed description thereof is omitted.

  As described above, similarly to the first embodiment, the receiver 80 ′ according to the second embodiment of the present invention can prohibit unlimited resource access for an application whose provider is not valid. Furthermore, the receiver 80 'does not need to check the validity of the certificate and verify the validity of the signature, and can reduce the processing load on the receiver 80'. Therefore, the receiver 80 'can be simplified in configuration, and can be easily applied to a set top box where resources such as a CPU and a memory are limited.

(Modification 2)
Returning to FIG. 11, a difference from the second embodiment will be described regarding the broadcasting / communication cooperation system 1 ′ according to the second modification of the present invention (see FIG. 1 as appropriate).
In this broadcasting / communication cooperation system 1 ′, the CA station 30 outputs the revocation list to the application registration device 70. The broadcast communication cooperation system 1 ′ differs from the second embodiment in that the application registration device 70 ′ confirms the validity of the certificate based on the revocation list as in the first modification.

[Configuration of application registration device]
The configuration of the application registration apparatus 70 ′ will be described (see FIG. 1 as appropriate).
The storage unit 705a stores and manages the application ID, the company ID, the signature, the certificate, the revocation list, and the like input to the verification information adding unit 705. The revocation list stored in the storage unit 705a is referred to by a certificate confirmation unit 705b described later.

The certificate confirmation unit 705b confirms whether the certificate is valid based on the revocation list of the storage unit 705a. Since this certificate confirmation unit 705b confirms the validity of the certificate by the same method as in the first modification, detailed description thereof is omitted.
In this way, the application registration apparatus 70 ′ can confirm the validity of the certificate based on the revocation list.

[Broadcast communication system operation]
With reference to FIG. 14, operation | movement of the broadcast communication cooperation system 1 'which concerns on the modification 2 of this invention is demonstrated (refer FIG. 1 suitably).

The broadcasting / communication cooperation system 1 ′ outputs the generated certificate to the application registration apparatus 70 ′ by the CA station 30 (step S61).
Since the process of step S62 is the same process as step S22 of FIG. 10, detailed description is abbreviate | omitted.

Broadcast / communication cooperation system 1 'outputs the revocation list | wrist produced | generated by CA station 30 to application registration apparatus 70' (step S63).
Since the process of step S64 is the same as that of step S25 of FIG. 10, detailed description thereof is omitted.

The broadcasting / communication cooperation system 1 ′ verifies whether or not the application provider is valid by the application registration device 70 ′. That is, the application registration apparatus 70 ′ checks whether the certificate is valid based on the revocation list and verifies whether the signature is valid (step S65).
Since the processes in steps S66 to S71 are the same as the processes in steps S52 to S57 in FIG.

  As described above, the receiver 80 ′ according to the second modification of the present invention can easily revoke a certificate using the revocation list in addition to the same effects as those of the second embodiment. As a result, in the second modification of the present invention, the certificate management cost in the broadcasting / communication cooperation system 1 ′ can be reduced.

(Third embodiment)
[Broadcasting communication system configuration]
With reference to FIG. 15, the difference of the configuration of the broadcast communication cooperation system 1 ″ according to the third embodiment of the present invention from the first embodiment will be described.
The broadcasting / communication cooperation system 1 ″ further includes a repository 50 C and an application management device 90, and a signature key issuing device 20 ″, a repository 50 C, an application ID / provider ID generation device 60, and the like by a system administrator. The application registration apparatus 70 ″ is managed differently from the first embodiment.

  The “system administrator” is an organization that approves the A application. For example, when approving an application created by a certain service provider as an A application, the system administrator manually verifies whether or not the application performs an operation expected in the broadcasting / communication cooperation system 1 ″. Then, the system administrator registers the A application in the repository 50C described later.

  The signature key issuing device 20 ″ generates a signature key and a verification key that are common to the broadcasting / communication cooperation system 1 ″. The signature key generated by the signature key issuing device 20 ″ is distributed to the application registration device 70 ″. The verification key generated by the signature key issuing device 20 is distributed to the CA station 30 by the system administrator.

  The repository 50C (50) stores and manages the A application. Then, the repository 50C transmits the stored A application to the receiver 80 via the network N in response to a request from the receiver 80, for example.

The application registration device 70 ″ adds verification information to the application from the application management device 90 and registers this application as an A application. Here, the application registration device 70 ″ generates a unique signature for each service provider and application, for example, using the signature key from the signature key issuing device 20 ″.
As described above, even when the signature key and the verification key are shared by the service provider, since the signature is unique to each service provider and the application, the receiver 80 determines whether the provider of the application is valid. Can be verified.

  The application management device 90 is managed by the service provider B, and stores and manages applications created by the service provider B. Here, the application stored in the application management apparatus 90 is transmitted to the application registration apparatus 70 ″ via the network N, for example. Alternatively, the recording medium storing the application may be mailed to the system administrator, and the system administrator may manually input the application to the application registration apparatus 70 ″.

Note that each device in FIG. 15 has the same configuration as each device in FIG.
Also, as shown in FIG. 16, the broadcasting / communication cooperation system 1 ″ performs the same operation as in FIG.

  As described above, similarly to the first embodiment, the receiver 80 according to the third embodiment of the present invention can prohibit unlimited resource access for an application whose provider is not valid. In addition, since the receiver 80 uses a signature and a certificate that are difficult to be fraudulent, the security can be further improved.

(Modification 3 to Modification 5)
Note that the broadcasting / communication cooperation system 1 '' of FIG. 15 can be applied not only to the first embodiment, but also to the second embodiment and Modifications 1 and 2 (Modifications 3 to 3, respectively). 5). In this case, the broadcasting / communication cooperation system 1 ″ according to the modified examples 3 to 5 operates in the same manner as in FIGS. 10, 13 and 15 as illustrated in FIGS. Is omitted.

1, 1 ′, 1 ″ Broadcast communication cooperation system 10 Broadcast transmission device 20, 20 ″ Signature key issuing device 200 Signature key / verification key generation unit 201 Verification key management unit 202 Signature key management unit 30 CA station (certification authority)
40, 40A, 40B Content distribution server 50, 50A, 50B Application server 50C Repository (application server)
500 Application input means (application input means)
501 Application storage means (application storage means)
502 Application transmission means (application transmission means)
60 Application ID / Business ID Generation Device 600 Application ID Generation Unit (Application ID Generation Unit)
601 business ID generation means 602 application ID / business ID output means (application ID / business ID output means)
70, 70 ', 70 "Application registration device 700 Application input means (application input means)
701 Application ID / enterprise ID input means (app ID / enterprise ID input means)
702 Application ID / provider ID adding means (app ID / provider ID adding means)
703 Signature key input means 704 Signature generation means 705 Verification information addition means 705a Storage means 705b Certificate confirmation means 705c Signature verification means 706 Application output means (application output means)
80 Receiver (Broadcasting communication cooperative receiver)
801 Broadcast receiving means 802 Broadcast signal analyzing means 803 Video / audio decoding means 804 Data broadcast decoding means 804a CRL extracting means 805 Communication transmitting / receiving means 806 Application activation information acquisition means (application activation information acquisition means)
807 Application activation information storage means (application activation information storage means)
808 List control means 809a Start control means 809b End control means 809c Storage management means 809 Application management / execution control means (application management / execution control means)
810 Activation application identification information storage means (activation application identification information storage means)
811 Application acquisition means (application acquisition means)
812 Application storage means (application storage means)
813 Application execution means (application execution means)
814 Operation control means 815 Composite display means 816 Security management means 817 Application authentication means (application authentication means, application determination means)
817a Verification information management means (storage means)
817b Certificate confirmation means 817c Signature verification means 818 Resource access control means 819 Resource management means 90 Application management apparatus

Claims (6)

A broadcast transmitting apparatus for transmitting a broadcast program, the network-linked digital terrestrial television broadcasting receiver for receiving said broadcast program, a signature key issuing device for issuing a search Akashikagi that corresponds to the signature key and the signature key to generate a signature, the a certificate authority that issues certificates that contain the verification key, the signature key issued signature and the certificate generated by the signature key from the device, as verification information for verifying the application provider to the application The broadcast communication cooperative reception provided in a broadcast communication cooperative system including an application registration device to be added, and an application server that stores at least one of the application to which the verification information is added and the application to which the verification information is not added. A device,
Application acquisition means for acquiring an application stored in the application server via a network;
Based on the verification information, application determination means for determining whether or not the provider of the application acquired by the application acquisition means is valid;
Resource access control means for performing resource access control for prohibiting access to a predetermined resource for the acquired application based on the determination result of the application determination means;
A broadcasting / communication cooperative receiving apparatus comprising: The application acquisition means acquires an application to which the signature generated by the signature key and the certificate are added as the verification information,
The application determination unit confirms whether or not the certificate is valid, and if the certificate is valid, verifies whether or not the signature is valid by a verification key of the certificate. When the signature is valid, it is determined that the application provider is valid, and when the certificate is not valid or the signature is not valid, it is determined that the application provider is not valid. The broadcasting / communication cooperation receiving apparatus according to claim 1. The broadcasting / communication cooperation receiving apparatus further includes storage means in which the certificate is stored in advance,
The application acquisition means acquires an application to which a signature generated by the signature key is added as the verification information,
The application determination unit checks whether the certificate extracted from the storage unit is valid based on a revocation list that is a list of revoked certificates, and if the certificate is valid, If the signature is valid, the application provider determines that the signature is valid, and the certificate is not valid or the signature is not valid. The broadcasting / communication cooperation receiving apparatus according to claim 1, wherein the application provider is determined not to be valid. The broadcast communication cooperation receiving apparatus includes the application registration apparatus that verifies whether the provider of the application is valid based on the signature generated by the signature key and the certificate. Provided in the system,
The application acquisition unit acquires an application to which the verification result of the application provider is added by the application registration device as the verification information,
The broadcast communication cooperative reception according to claim 1, wherein the application determination unit verifies whether the provider of the application acquired by the application acquisition unit is valid based on the verification information. apparatus. The broadcasting / communication cooperation receiving device includes the application registration device that verifies whether the application provider is valid based on a signature generated by the signature key, the certificate, and a revocation list. Provided in the broadcasting and communication cooperation system,
The application acquisition unit acquires an application to which the verification result of the application provider is added by the application registration device as the verification information,
The broadcast communication cooperative reception according to claim 1, wherein the application determination unit verifies whether the provider of the application acquired by the application acquisition unit is valid based on the verification information. apparatus. The broadcasting / communication cooperation receiving device according to claim 1,
A broadcast transmission device for transmitting the broadcast program;
A signature key issuing device for issuing the signature key and the verification key;
A certificate authority that issues a certificate including the verification key;
An application registration device for adding the verification information to the application;
An application server that stores at least one of the application to which the verification information is added and the application to which the verification information is not added;
A broadcasting / communication cooperation system comprising:

Images