JP2013009361A - Broadcasting communication cooperation reception device, and application server - Google Patents

Abstract

PROBLEM TO BE SOLVED: To authenticate an application working with a broadcasting program.SOLUTION: A broadcasting communication cooperation reception device 6 comprises: application start-up information storage means 605; verification key storage means 615; application acquisition means 611 for transmitting a request to an application server 51 by referring to an APL start-up information, and receiving an application with a signature in which time T and an electronic signature are given in response to the request; time information verification means 711 for determining whether or not current time agrees with a period shown by the time T which is given in the application with the signature; electronic signature verification means 712 for determining whether or not verification of the signature has succeeded by using the verification key, when the current time agrees with the time T; and application control means 609 for controlling a state of the application by referring to a control code showing a state such as automatic start-up described in the APL start-up information, when the verification of the signature has succeeded.

Description

  The present invention relates to a broadcasting / communication cooperation receiving apparatus that operates an application in cooperation with broadcasting and communication, and an application server that distributes the application.

  In recent years, a broadcasting / communication cooperation type system for realizing a service that links broadcasting and communication has been proposed (see Non-Patent Documents 1 and 2). In this broadcasting / communication cooperation type system, the broadcasting / communication cooperation receiving device is a receiver that receives a digital broadcast, and assumes that an application downloaded from an application server via a communication network is operated on the device. .

  Generally, public broadcasting services have high security, but countermeasures against malicious acts are necessary for communication network services. Conventionally, PKI (Public Key Infrastructure) is used as an authentication technique in a communication network.

Junji Matsumura and two others, “Examination of personalized system for broadcasting programs linked to Internet distribution information”, Proceedings of Annual Conference of the Institute of Image Information and Television Engineers, 2009, No. 3-8 The Japan Radio Industry Association, “Application Execution Environment for Digital Broadcasting Standard ARIB STD-B23 Version 1.2”, July 29, 2009, p.76-88

  In a broadcasting / communication cooperation type system, since an application is downloaded via a communication network, a technique for authenticating the application is required. Whether the application is an authorized application (hereinafter simply referred to as “A application”) indicating that the application has been approved by a predetermined administrator or not (hereinafter referred to as a general application). A mechanism for classification from the viewpoint of For example, a method in which a system administrator of a broadcasting / communication cooperation type system approves an application provided by a person who wants to participate such as an individual or an organization by a registration system and certifies an application that guarantees operation in the system as an A application. Can be considered.

  Also, for example, when the application is of a type linked to a broadcast program, the broadcaster or the system administrator who received the application strictly examines the provider or the application provided by the provider, and those applications that pass this examination are designated as broadcast programs. A method of authorizing as an A application that permits linked distribution is also conceivable.

For example, when the A application is authorized by the former method, participation of many application providers can be expected in the broadcasting / communication cooperation type system. This is referred to herein as the A application or system registration application in a broad sense.
In the case of an application that is linked to a broadcast program, the broadcast program is highly public and reliable, and the influence thereof is great. Therefore, it is considered preferable to authorize the A application by the latter method. This is referred to herein as a narrowly defined A application or broadcast station approval application.

  In a broadcasting / communication cooperation type system, as an example, a receiving device is linked to a broadcasting program being presented by selecting a broadcasting program multiplexed on broadcasting content transmitted by digital broadcasting on the user side of the receiving device. The service that automatically starts the application is assumed above. That is, in this service, an authentication mechanism for a narrowly defined A application or broadcast station approval application is desired. In this case, for example, if the technique described in Non-Patent Document 2 is applied, it is possible to provide a service for automatically starting an application. However, security countermeasures are insufficient as they are.

  The present invention has been made in view of the problems as described above. When an application linked to a broadcast program is acquired, the broadcast communication cooperation receiving apparatus that can verify whether the application is an application approved by a broadcast station, It is another object of the present invention to provide an application server that distributes an application approved by a broadcasting station.

  In order to solve the above problems, the broadcast communication cooperative receiving device according to claim 1 of the present invention receives broadcast content transmitted by a broadcast wave of digital broadcast and is linked to a broadcast program in the broadcast content. A broadcast communication cooperative receiving device that acquires the application operating on the receiving device from an application server that distributes the received application via a communication network, the application starting information storage unit, the verification key storage unit, and the application control unit And an application acquisition unit, and the application control unit includes a time information verification unit and an electronic signature verification unit.

  According to such a configuration, the broadcasting / communication cooperation receiving apparatus stores the application activation information for activating the application in the application activation information storage unit. Here, the application activation information includes an application identifier, an application location, a control code indicating a state including application activation, and the like. The broadcasting / communication cooperation receiving apparatus stores a verification key for verifying the signature added by the application server in the verification key storage unit. The broadcasting / communication cooperation receiving apparatus performs application acquisition control based on the location of the application described in the application activation information by the application control means, and indicates the state of the operation described in the application activation information. The state of the acquired application is controlled according to the control code. The broadcast communication cooperative receiving apparatus transmits a request for requesting the application to the application server at the arrangement location by the application acquisition unit, and time information and an electronic signature are added as a response to the request. Receive signed applications. Then, the broadcasting / communication cooperation receiving apparatus determines whether or not the application control unit determines whether the current time matches the period represented by the time information added to the acquired signed application by the time information verification unit. If the current time matches the period represented by the time information, the electronic signature verification means determines whether or not the signature verification is successful using the verification key, and the signature verification is successful. In this case, the acquired application is set as an A application approved by the broadcasting station, and the state of the application is controlled according to the control code.

  Further, the broadcast communication cooperative reception device according to claim 2 is the broadcast communication cooperation reception device according to claim 1, further comprising an application activation information extraction unit.

  According to such a configuration, the broadcasting / communication cooperation receiving device selects a broadcast program in the broadcast content in response to an external operation and presents it to an output means for presenting video and audio. Then, the application activation information extraction unit extracts the application activation information for the application linked to the broadcast program from the control signal multiplexed on the broadcast content. As a result, when a viewer who uses the broadcast communication cooperative reception device is watching a broadcast program in real time, the broadcast communication cooperative reception device authenticates the application linked to the broadcast program, and then uses the application activation information. It can be started automatically.

  According to a third aspect of the present invention, there is provided a broadcast communication cooperative reception device according to the first aspect of the present invention, further comprising a broadcast signal analysis unit.

  According to such a configuration, the broadcast communication cooperative receiving apparatus extracts the verification key multiplexed in the broadcast content by the broadcast signal analysis unit and stores it in the verification key storage unit. This eliminates the need for a viewer who uses the broadcast communication cooperative reception device to incorporate the verification key into the reception device, and also eliminates the need to incorporate the verification key when the broadcast communication cooperative reception device is shipped. Furthermore, the broadcast station approves the application linked to the broadcast program, obtains a verification key for verifying the signature of the side that distributes the application, and transmits this verification key to a plurality of broadcast communication cooperative receiving apparatuses. Can be sent all at once.

  Further, the application server according to claim 4 periodically updates the signature key with respect to the broadcasting / communication cooperation receiving device according to any one of claims 1 to 3 by using time information. An application server that distributes an application with a signature added by a signature key generated by an update method via a communication network, the key generation unit, the verification key transmission unit, the application storage unit, the partial key generation unit, the signature A key update unit, a signature key management unit, a request reception unit, a signature generation unit, and an application transmission unit are provided.

  According to such a configuration, the application server generates a master key by the key generation unit, generates a verification key for verifying the signature, and distributes the verification key via the communication network by the verification key transmission unit. To do. The application server stores an application linked to the broadcast program in the application storage unit. Then, the application server uses the partial key of the predetermined time information as the master key as a partial key used when the partial key generation unit replaces the signature key with the signature key of the predetermined time information at the update timing for updating the signature key. Is generated, stored in the storage unit, held, and output at the update timing. The application server updates the signature key held at the update timing by using the partial key output from the partial key generation unit by the signature key update unit, and updates the signature key by the signature key management unit. A process of storing and holding the signature key in the storage unit and a process of reading the signature key from the storage unit and outputting it to the signature key update unit are performed. Here, as the signature key periodic update method, for example, a key-insulated signature can be used. And an application server receives the request for request | requiring the said application via the said communication network from the said broadcast communication cooperation receiving apparatus by a request receiving means. Then, the application server tries to activate the application read from the storage unit by the signature key management unit with respect to the application read from the application storage unit in response to the request by the signature generation unit. The electronic signature is added with the signature key of the time information of the time to be added, the time information is added, and the application with the signature to which the electronic signature and the time information are added is sent to the request source of the request by the application transmission unit. Send over a communication network.

  According to the first aspect of the present invention, the broadcasting / communication cooperation receiving apparatus can verify the signature of the application linked to the broadcasting program by acquiring the verification key in advance. Therefore, when distributing an application that is linked to a broadcast program, if only the application that has passed the screening by the broadcaster or system administrator in advance is an A application, the broadcast / communication cooperation receiving device is linked to the program. It is possible to determine whether the acquired application is the A application.

  According to the second aspect of the present invention, the broadcasting / communication cooperative receiving apparatus can use the application activation information acquired during the selection of the broadcast program, so that the acquisition, authentication, and automatic activation of the application linked to the broadcast program can be performed. The series of processes can be executed without requiring an external operation.

  According to the third aspect of the present invention, the broadcasting / communication cooperative receiving apparatus can use the verification key multiplexed in the broadcast content, and therefore can easily pass the verification key.

  According to the invention of claim 4, the application server adds an electronic signature with a signature key that is periodically updated to an application linked to a broadcast program and adds time information of the electronic signature. By adding a signature to the application with a signature key corresponding to a future time, the application can be started at a future time.

It is a figure which shows an example of a structure of the broadcast communication cooperation type system containing the broadcast communication cooperation receiving apparatus which concerns on embodiment of this invention. It is a figure which shows an example of the application for broadcast communication cooperation displayed on the broadcast communication cooperation receiving apparatus which concerns on embodiment of this invention. It is a sequence diagram which shows an example of a flow when a recommendation service is provided to the broadcast communication cooperation receiving apparatus which concerns on embodiment of this invention. It is a block diagram which shows the structural example of the application server which concerns on embodiment of this invention. It is a block diagram which shows the structural example of the broadcast communication cooperation receiving apparatus which concerns on embodiment of this invention. It is a sequence diagram which shows the flow of the key generation process by the application server which concerns on embodiment of this invention. It is a sequence diagram which shows the flow of the application authentication process by the broadcast communication cooperation receiving apparatus which concerns on embodiment of this invention. It is explanatory drawing of the authentication and starting of the application by the broadcast communication cooperation receiving apparatus which concerns on embodiment of this invention, Comprising: (a) has shown the update method of a signature key, (b) has each shown the application linked with the broadcast program. .

  Hereinafter, a mode for carrying out the broadcasting / communication cooperation receiving apparatus of the present invention will be described. Broadcast / communication cooperation system, 2. 2. Screen display example of a broadcasting / communication cooperation receiving apparatus; 3. Example of operation sequence between each server and broadcasting / communication cooperation receiving apparatus 4. Configuration of application server 5. Configuration of broadcasting / communication cooperation receiving device; 6. key generation processing; Application authentication processing, 8. This will be described in detail with reference to the drawings, divided into chapters of specific examples of starting linked applications.

[1. Broadcast / communication system]
A conceptual diagram of the configuration of the broadcasting / communication cooperation type system 1 is shown in FIG. As shown in FIG. 1, the broadcasting / communication cooperation type system 1 functionally includes a broadcasting station server group 4, a service provider server group 5, in addition to a broadcasting station 2 that performs current broadcasting using radio waves. And a broadcasting / communication cooperation receiving device 6. In FIG. 1, one broadcasting station 2, one broadcasting station server group 4, one service provider server group 5, and one broadcasting / communication cooperation receiving device 6 are illustrated, but there may be a plurality of each.

<Overview of users>
The main users of the broadcasting / communication cooperation type system 1 are, for example, broadcasting stations (broadcasting companies), service providers, and viewers.
The broadcasting station sends out a program accompanied by organization. Broadcast stations distribute programs to viewers by radio waves or the Internet. The broadcast station may provide the service provider with metadata related to the program in order to enhance the broadcast communication cooperation service described later.
A service provider is a person who provides a broadcasting / communication cooperation service, and is composed of an organization or an individual. A service provider is a person who produces or distributes content or an application (broadcast communication cooperation application, hereinafter also simply referred to as an application) for providing a service.
The viewer is a person who views the broadcast program by the broadcast communication cooperative receiving device 6 and enjoys the broadcast communication cooperative service. Hereinafter, the user refers to this viewer.

<Service>
Conventionally, a service refers to a series of programs that can be broadcast as part of a schedule organized by a broadcaster.
The broadcasting / communication cooperation service is an extension of the service concept in the conventional sense.
The broadcasting / communication cooperation service is apparently divided into a stream dependent service and an independent service.
The stream-dependent service includes an AV (Audio Video) stream transmitted by broadcasting or communication, and at least one application (broadcast communication cooperation application) that operates in conjunction therewith. In this stream-dependent service, an application can be started in conjunction with selection / reproduction of an AV stream to be transmitted by communication or channel selection of an AV stream to be transmitted by broadcast on the user side. In this case, in addition to activation and termination by the user, a provider of AV content such as a broadcaster can also control a life cycle such as automatic activation and termination of the application.

  The stand-alone service includes a real video / audio stream and includes at least one application (broadcast communication cooperation application). In this stand-alone service, an application is started by performing an operation selected by the user. Here, an application in an independent service (hereinafter referred to as an independent application) is, for example, an application created by a third party such as an individual who is not a broadcast station or a viewer regardless of a broadcast program, and a clock displayed on a display Etc.

  Even in the stand-alone service, when the broadcasting / communication cooperation receiving device 6 is powered on, the broadcasting / communication cooperation receiving device 6 is provided with a virtual channel for virtually receiving a virtual video / audio stream. When it is conceptually regarded as being, the broadcasting / communication cooperation service can be considered as a service (also referred to as a virtual service in this sense) that integrates a stream dependent service and an independent service.

<Broadcasting station>
The broadcast station 2 sends out broadcast content by broadcast waves, for example. The broadcasting station 2 can multiplex a signal for activating a broadcasting / communication cooperation service on a broadcasting wave.
In this embodiment, as an example, on the broadcast content transmission side, an application activation information file (hereinafter referred to as an APL activation information file) is transmitted by a specific module transmitted by the data carousel method. APL activation information is information necessary to activate an application. This APL activation information can be created based on, for example, an AIT (Application Information Table) defined by ARIB-J (ARIB STD-B23: see Non-Patent Document 2). For example, in the broadcasting / communication cooperation receiving apparatus 6 that has received the APL activation information described as “AUTO START”, the viewer can activate the application without performing a special operation for activating the application. When the APL activation information is filed as in this embodiment, it can be expressed in text format in XML format. In addition, when it is set as the form transmitted in the table | surface of SI (Service Information: Program arrangement | sequence information), APL starting information can be made into binary expression.

<Broadcasting station server group>
The broadcasting station (broadcasting company) configures and manages the broadcasting station server group 4 or both of the broadcasting station server group 4 and the service provider server group 5. That is, a broadcasting station (broadcasting company) may also serve as a service company.
As shown in FIG. 1, the broadcast station server group 4 includes a content management server 41, a user management server 42, a content distribution server 43, a broadcast station service server 44, a DB 45, and an API 46.

The content management server 41 manages programs and metadata. The program management function of the content management server 41 is a function for managing a program that has already been broadcast or a program that will be broadcast in the future. You may make it provide the program management server which performs only this program management.
The metadata management function of the content management server 41 is a function for managing metadata related to a program. You may make it provide the metadata management server which performs only this metadata management. Here, the metadata indicates, for example, a program title, a program ID, a program summary, performers, broadcast date and time, script, subtitles, commentary, and the like.

  The user management server 42 is a server that manages viewer data. The user management server 42 may be configured by a specific server such as a member information server for a specific viewer who has become a member of a net club or the like for performing an Internet member service. It may be configured as part of the management function.

The content distribution server 43 is a server for distributing content (for example, programs and metadata).
The broadcast station service server 44 is a server used when a broadcast station (broadcaster) provides a service to a service provider. Examples of services provided by broadcast stations (broadcasters) to service providers include social network services operated by broadcast stations, blog services for each broadcast program, and the like.

  The DB 45 is a data storage unit, and includes a part for storing content and metadata owned by a broadcasting station, and a general database. Note that the data stored in the DB 45 can be accessed only by the managing company (broadcasting company) and cannot be accessed by others.

  An API (Application Programming Interface) 46 is an API for providing data in response to a request from the service provider server group 5. The API format is determined in advance by agreement between the broadcasting station and the service provider. Communication between the broadcast station server group 4 and the service provider server group 5 can be in a REST (Representational State Transfer) format, for example. The API 46 is commonly provided by the servers included in the broadcasting station server group 4, but the API provided by each server does not have to be completely the same.

<Service provider server group>
The service provider configures and manages the service provider server group 5. As shown in FIG. 1, the service provider server group 5 includes an application server 51, a service server 52, a content distribution server 53, a DB 54, and an API 55.

  The application server 51 is a server that manages and distributes an application (hereinafter also referred to as a receiver application) that operates on the broadcasting / communication cooperation receiving device 6.

  The service server 52 is a server for providing a service in response to a request from the receiver application. The service server 52 represents, for example, a multilingual subtitle server, a speech speed conversion voice server, a social TV server, a recommendation server, a program review server, a bookmark server, and the like.

The multilingual subtitle server provides a service for displaying a menu so that desired subtitles can be selected from multilinguals when video / audio content (hereinafter referred to as AV content) is presented to the broadcasting / communication cooperation receiving device 6. It is a server for.
The speech speed conversion voice server is a server for providing a service for converting the original speed of spoken language to low speed and outputting the voice when the AV content is presented to the broadcasting / communication cooperation receiving device 6.
The social TV server is a server for providing a service capable of displaying a viewer's post such as a tweet on the screen of the broadcasting / communication cooperation receiving device 6 by overlaying it.
The recommendation server is a server for providing a service that informs viewers of recommended VOD (Video On Demand) program information as a recommended program from a program library provided on the Internet.
The program review server is a server for providing a service capable of displaying on the broadcasting / communication cooperation receiving device 6 comments and impressions and review evaluation points written by viewers who actually viewed the program.
The bookmark server is a server for providing a service for registering information on recommended programs so that the viewer can view the recommended program instead of immediately viewing it when the viewer is notified of the recommended program.

The content distribution server 53 is a server for providing content in response to a request from the receiver application. The content distribution server 53 represents, for example, a VOD distribution server, a caption distribution server, a multi-view distribution server, or the like.
The VOD distribution server is a server for distributing AV contents of VOD programs recommended for viewers, for example.
The subtitle distribution server is a server for distributing subtitles that overlap the AV content when the AV content is presented to the broadcasting / communication cooperation receiving device 6.
The multi-view distribution server is a server for distributing a multi-view camera image that is displayed in an overlapping manner with the AV content presented to the broadcast communication cooperative receiving device 6. Multi-view camera images will be described later.

  The DB 54 is a data storage unit that stores content, metadata, data created by a service provider, user data, applications, and the like. Note that the data stored in the DB 54 can be accessed only by the managed service provider and cannot be accessed by others.

  The API 55 is an API for providing an application, content, and service in response to a request from the receiver application. The API 55 is different from the API 46 described above, and each server included in the service provider server group 5 is provided in common for each service provider. However, it goes without saying that the API may be different for each service provider and for each server.

<Broadcast communication cooperative receiver>
The broadcasting / communication cooperation receiving device 6 receives a digital broadcast and acquires an application operating on the device from a communication network, and includes, for example, a TV, a set top box, a PC (Personal computer), a portable terminal, and the like. Is done. The broadcasting / communication cooperation receiving device 6 includes a basic function 61, a broadcasting / communication cooperation function 62, and an API 63.

The basic function 61 includes a function of receiving and displaying current broadcasting such as terrestrial digital broadcasting, BS digital broadcasting, and data broadcasting, and a function of connecting to the Internet.
The broadcasting / communication cooperation function 62 operates based on the API 63. That is, an OS (Operating System) installed as an application execution environment in the broadcasting / communication cooperation receiving device 6 executes the predetermined API 63 to realize the broadcasting / communication cooperation function 62. The broadcast communication cooperation function 62 includes a broadcast communication cooperation basic function and an optional function.
The basic function for broadcasting / communication cooperation is a function necessary for realizing the broadcasting / communication cooperation service. The basic functions for broadcasting / communication cooperation include, for example, an application control function, a drawing function, a synchronization control function, a security function, and the like.

The application control function indicates a function as an application manager that controls a life cycle such as activation and termination of an application.
The drawing function indicates a function of drawing an application at a predetermined position on the screen of the broadcasting / communication cooperation receiving apparatus 6 presenting AV content.
The synchronization control function indicates a function of performing control to synchronize the presentation time of the AV content received in real time by broadcasting and the presentation time of the application and content acquired via the communication network N. That is, the synchronization control function compares the time stamp of the data input as the broadcast stream with the time stamp of the data input as the communication stream, and matches the predetermined point of the broadcast stream with the corresponding point of the communication stream. I do.

  For example, in an application linked to a broadcast program, the security function authenticates the A application when only an application that has passed a screening by a broadcaster or a system administrator in advance is an A application.

The optional function is implemented as necessary, and examples thereof include a function for realizing a mobile terminal cooperation service.
The mobile terminal cooperation service includes a service that simplifies the procedure for individual viewers to log in to an ASP (Application Service Provider) by linking a mobile terminal and a stationary TV for a program recommendation service, for example. Including.

  The application 64 is downloaded, for example, from the application server 51 to the broadcasting / communication cooperation receiving device 6 and uses the broadcasting / communication cooperation function 62 through the API 63. All the applications 64 cannot access functions unique to the broadcasting / communication cooperation receiving apparatus 6 without going through the API 63.

  The API 63 is defined in advance so that the operation of the application 64 is the same without depending on the broadcast communication cooperative reception device 6, and is an API common to the broadcast communication cooperative reception devices 6. Hereinafter, an example of an API used by the broadcasting / communication cooperation receiving device 6 as the API 63 other than the API defined in ARIB-J will be described.

(1) getRunningApplications (): Get information about running applications Return value:
apps []: List of running applications (each application)
application_id: Application ID (null for general applications)
running_level: Execution level (authentication result and user setting status)
(2) queryApplicationInfo (): Acquires information about the specified application (3) saveApplicationToCache (): Saves the application on the server in the cache (4) queryApplicationInCache (): Searches for the application in the cache Arguments:
application_id: Application ID issued by the certification body
(5) getCurrentSTC (): obtains the current STC value (6) getCurrentPositionInProgram (): obtains the elapsed time from the start of the program (7) delayStreamPresentation (): starts the delayed presentation of the broadcast stream being presented (8 ) GetCurrentDelay (): Get the amount of delay time (from the original presentation time) of the broadcast stream being presented

[2. Example of screen display of broadcasting / communication cooperation receiver]
Here, an example of the relationship between the broadcasting / communication cooperation service, the application, and the content, and an example of the broadcasting / communication cooperation function 62 in the broadcasting / communication cooperation receiving device 6 will be described through the screen display example shown in FIG. FIG. 2 is a diagram illustrating an example of an application displayed on the broadcasting / communication cooperation receiving device according to the embodiment of the present invention. As shown in FIG. 2A, when the viewer is watching the AV content (digital broadcast program) 100 on the broadcast / communication cooperation receiving device 6, for example, by performing a remote control operation, The main menu 101 is displayed on the screen.

In this example, a subtitle 102, a comment 103, a recommendation 104, and a bookmark 105 are displayed on the main menu 101 displayed in a horizontally long toolbar shape at the bottom of the screen.
The caption 102 is a button for selecting a service to be displayed on the menu so that a desired caption can be selected from multiple languages.
The comment 103 is a button for selecting, for example, a service for posting a tweet or a comment.
The recommendation 104 is a button for selecting a service for displaying recommended VOD program information.
The bookmark 105 is a button for selecting a service for registering recommended program information so that the recommended program can be viewed later, not immediately.

  By scrolling the main menu 101 displayed in FIG. 2A horizontally, it is possible to select other services other than the above services. Examples of other services include a multi-view service. In the multi-view service, when AV content is presented to the broadcasting / communication cooperation receiving device 6, a subject in the AV content is viewed from a plurality of camera images captured by a plurality of cameras respectively arranged at different positions. The camera image selected by the user is distributed as a multi-view camera image, and is displayed overlapping the AV content.

  FIG. 2B shows a screen display example when the multi-view service is selected by horizontally scrolling the main menu 101 displayed in FIG. Here, one multi-view service includes a multi-view button (application) (not shown) on the main menu 101, still images 106, 107, and 108, which are multi-viewer selection data, and a multi-view video 109 (FIG. 2 ( c)). Among these, still images and moving image content are distributed from a multi-view distribution server as the content distribution server 53.

  In the example shown in FIG. 2B, the AV content 100 represents a state around the soccer goal viewed from the attack side in the soccer game. Further, the still image 106 shows a state of an attack side supporter in the auditorium, the still image 107 shows a state of supervision of the attacking team, and the still image 108 shows a state of the front of the goalkeeper. Here, when the viewer selects, for example, the still image 108, the video in front of the corresponding goalkeeper overlaps with a part of the entire display screen of the AV content 100 as shown in FIG. Are displayed as a moving image 109 synchronized with the AV content 100 and reproduced.

  The synchronization of the video in front of the goalkeeper and the video (AV content 100) around the soccer goal viewed from the attacking side is due to the broadcast communication cooperation function 62 of the broadcast communication cooperation reception device 6. Specifically, this is based on the synchronization control function as the basic function for broadcasting / communication cooperation of the broadcasting / communication cooperation function 62. An application operating on the broadcasting / communication cooperation receiving device 6 can use the broadcasting / communication cooperation function 62 (see FIG. 1) by calling, for example, getCurrentSTC () or delayStreamPresentation () as an API.

[3. Example of operation sequence between each server and broadcasting / communication cooperation receiving apparatus]
Here, an example of the relationship between the broadcasting / communication cooperation service, the application, and the content, and an example of the broadcasting / communication cooperation function 62 in the broadcasting / communication cooperation receiving device 6 will be described through the operation sequence example shown in FIG. FIG. 3 is a sequence diagram illustrating an example of a flow when a recommendation service is provided to the broadcast communication cooperative reception device according to the embodiment of the present invention.

  When the recommendation 104 is selected by the viewer from the main menu 101 displayed in FIG. 2A, illustration is omitted, but as the type of recommendation, for example, “recommended program related to the program currently being viewed” , “Recommended programs for you”, “Topic programs on the net”, “Programs that are popular on the net” are displayed, and information on the corresponding programs can be selected by scrolling for each item. . In this state, when the viewer selects, for example, “recommended program related to the program currently being viewed”, the broadcasting / communication cooperation receiving apparatus 6 requests the service provider server group 5 to request the recommended program. (S1).

  Then, the service provider server group 5 requests the interface section (API 46: see FIG. 1) of the broadcast station server group 4 for a “recommended program related to the program currently being viewed” by the viewer (see FIG. 1). S2). Then, the broadcasting station server group 4 transmits the corresponding recommended program (recommended program) and the like to the service provider server group 5 (S3). Then, the service provider server group 5 transmits the requested data (recommended program) or the like to the broadcasting / communication cooperation receiving device 6 (S5). The service provider server group 5 can also transmit to the broadcasting / communication cooperation receiving device 6 as necessary when there is an application (linked application) linked to the requested data (recommended program) (S4). .

  The above flow is an example, and the present invention is not limited to operating in the order described above. Further, there may be a case in which communication is performed only between the broadcasting / communication cooperation receiving device 6 and the service provider server group 5. For example, the service provider server group 5 may acquire necessary content from the broadcast station server group 4 in advance.

  In addition, for example, when the broadcast communication cooperative reception device 6 acquires an application from communication each time the application is executed (when acquired on the fly), an application server based on information multiplexed on the received broadcast wave An application request is made to the service provider server group 5 such as 51 (S1). Then, in the service provider server group 5, in response to a request from the broadcast communication cooperative reception device 6, the application server 51 notifies the broadcast communication cooperative reception device 6 of the storage location of the application and transmits the application (S4). Then, when the application is downloaded, the broadcasting / communication cooperation receiving device 6 activates and executes the application, requests content from the service provider server group 5 such as the content distribution server 53 (S1), and acquires the content ( S5).

[4. Application server configuration]
Here, a configuration example of the application server 51 will be described with reference to FIG. 4 (refer to FIG. 1 as appropriate). FIG. 4 is a block diagram showing a configuration example of the application server 51 according to the embodiment of the present invention. The application server 51 distributes the application to the broadcasting / communication cooperation receiving device 6 via the communication network N.

First, some assumptions about the application server 51 will be described.
In the following description, the application server 51 will be described as adding a signature to an application (linked application) linked to a broadcast program in the broadcast content for distribution. That is, the broadcasting / communication cooperation receiving device 6 receives broadcast content transmitted by a broadcast wave of digital broadcasting, and acquires an application that operates on the broadcasting / communication cooperation receiving device 6 from the application server 51 via the communication network N. To do.

  Further, the application server 51 generates a signature key by a periodic update method in which the signature key is periodically updated using time information. Then, the application server 51 uses, for example, a key-insulated signature as a signature key periodic update method. For this key insulated signature, see “Y. Dodis, J. Katz, S. Xu, and M. Yung:“ Strong Key-Insulated Signature Schemes ”, Proc. Of PKC'03, 2003, p.130-144. "It is described in.

Here, an outline of the signature key update will be described with reference to FIG.
At time 110 shown in FIG. 8A, if t ₀ represents the current time, t ₁ , t ₂ , t ₃ ... Represent future times, and t ₋₁ , t ₋₂ . Indicates. Note that the time intervals of t ₋₂ , t ₋₁ , t ₀ , t ₁ , t ₂ , t ₃ ... Do not need to be equal. In FIG. 8A, a period defined by each time is referred to as time information 120.

In the time information 120, for example, it referred to the period ending at time t ₁ beginning with the current time t ₀ and time information T.
In addition, a period starting at a future time t ₁ and ending at a time t ₂ is defined as time information T + 1. The future time will be expressed in the same manner.
Further, a period starting from the past time t _T-1 and ending at the current time t ₀ is defined as time information T-1. The same applies to the past time. Here, it is assumed that the end time of certain time information matches the start time of the next time information.

FIG. 8A shows a list of the signature keys 130 valid only during the period corresponding to the time information 120 and the partial keys 140 generated during the period corresponding to the time 110 and the time information 120. For example, the valid signature key during the period of time information T is SK _T , and the partial key generated at any timing during this period is ΔSK _{T + 1} . Then, by using the partial key ΔSK _{T + 1} with respect to the current signature key SK _T , it is possible to generate a signature key SK _{T + 1} for a period of future time information T + 1. That is, the signature key SK _T is updated using the partial key ΔSK _{T + 1} to become the signature key SK _{T + 1} . The same applies to the future and past times.

The signature key SK _T is valid only for the period of the time information T. In other words, the signature key SK _T is valid from time t ₀ to time t ₁ , but becomes invalid when time t ₀ has not yet been reached or when time t ₁ has passed. Note that the side that verifies the signature can verify the electronic signature using the same verification key regardless of the time.

In the notation of FIG. 8A, if the notation of the time information T from the time t ₀ to the time t ₁ is rewritten as T ₀ , the subscript of the start time of the period (time information), the subscript of the period, Therefore, if the time t is determined to represent the time information T, the period can be specified by the start time. Furthermore, if lowercase letters and uppercase letters are unified in this agreement, it means that time information T (period T) and time T are the same.

Therefore, in the description of the application server 51 of the present embodiment, the signing key of the time information T is referred to as the signing key of the time T for convenience. The time T may be a value obtained by quantifying the time that serves as a reference for managing the signature key (SK _T ) at the time T in the application server 51. Further, as the time T, for example, a value obtained by digitizing “year / month / day / hour / minute / second” can be used. As an example, in the case of time T, the period starts from the start time T, and the time of signature update timings t ₋₂ , t ₋₁ , t ₀ , t ₁ , t ₂ , t ₃ ... Shown in FIG. It is assumed that the intervals are equal and the period is, for example, 30 minutes according to the program scale of the broadcast program.

  Returning to FIG. 4, the configuration of the application server 51 will be described. In FIG. 4, importance is placed on the mutual relationship of the constituent elements constituting the application server 51 rather than the description along the time axis, and a certain time in the constituent elements that are the center of the description is uniformly expressed as a time T. did. However, in FIG. 4, when focusing only on the constituent elements that are the center of the description, the notation of time T represents a period (time information) as in FIG.

  As shown in FIG. 4, the application server 51 includes a key generation unit 511, a partial key generation unit 512, a signature key update unit 513, a signature key management unit 514, a signature generation unit 515, and an application storage unit 516. A verification key transmission unit 517, a request reception unit 518, and an application transmission unit 519.

The key generation means 511 generates a master key and a verification key for verifying the signature of the provider (service provider).
The key generation unit 511 outputs the master key to the partial key generation unit 512 and outputs the verification key to the verification key transmission unit 517. Here, the verification key is a key necessary for provider authentication (signature verification) as application authentication, and is notified to the viewer. In this embodiment, the verification key is notified from the application server 51 to the broadcasting / communication cooperation receiving device 6 via the broadcasting station 2.

Here, the generated master key and verification key are stored in a storage unit inside the application server 51. 4, denoted the master key and verification key are stored as the master key K _M and verification key K _P. The storage unit for storing a master key K _M is an excellent storage means tamper-resistant storage unit for storing a verification key K _P is a typical storage medium such as a memory or the like.

The partial key generation unit 512 generates a partial key used when updating the signature key. The partial key generation means 512 has a signature key (for example, FIG. 8) at an update timing (for example, t _{0 in} FIG. 8 (a)) for updating the signature key (for example, SK _{T-1 in} FIG. 8 (a)). The partial key at the predetermined time T (for example, ΔSK _{T in} FIG. 8A) is generated based on the master key as a partial key to be used when replacing with 8 (a) SK _T ), and stored in the storage unit. It is held and output at the update timing (for example, t _{0 in} FIG. 8A). Partial key generation unit 512 generates a partial key DerutaSK _T by a master key K _M and time T input.

In this embodiment, the partial key generation unit 512 generates and holds a partial key, determines whether or not the signature key update timing has come, and updates the signature key when the update timing comes. Output to means 513. Information about the time indicating the update timing is acquired from, for example, a clock. When the signature key update unit 513 generates a valid signature key at 13:30 to 13:30 (time information 13:00) at 12:30, the partial key generation unit 512 sets the partial key at time 13:00. Is generated and held at a predetermined timing before 12:30. Here, the generated partial key is stored in a storage unit inside the application server 51. The storage unit for storing the partial key is a general storage unit such as a memory. In FIG. 4, the stored partial key is represented as a partial key ΔSK _T.

  The signature key update unit 513 updates the signature key. The signature key update unit 513 uses the partial key output from the partial key generation unit 512 to update the signature key held in the storage unit by the signature key management unit 514 at the update timing. In addition, the signature key update unit 513 updates the signature key using a known key insulated signature. The signature key update unit 513 updates the signature key every 30 minutes, for example.

  The signature key management means 514 manages the signature key. The signature key managed here is the signature key updated (generated) by the signature key update unit 513. Also, signing key management means storing a signing key and outputting it as necessary. That is, the signature key management unit 514 performs a process of storing and holding the updated signature key in the storage unit and a process of reading the signature key from the storage unit and outputting the signature key to the signature key update unit 513. The signature key management unit 514 stores the updated signature key in the storage unit every 30 minutes, for example, and the signature key read out every 30 minutes, for example, at a timing deviated from the storage timing to the signature key update unit 513. Output.

Here, the signature key is stored in a storage unit inside the application server 51. The storage unit for storing the signature key is a general storage unit such as a memory. In FIG. 4, the stored signature key is denoted as SK _T. However, in FIG. 4, the signature key read from the storage unit by the signature key management unit 514 and output to the signature key update unit 513 is represented as a signature key SK _T-1 . This indicates that the signature key update unit 513 generates the signature key SK _T at time T by updating the signature key SK _T-1 when focusing on the signature key update unit 513. ing.

Also, the signature key signing key management unit 514 outputs the signature generation unit 515 reads from the storage unit was described as the signature key SK _T. This is because, when focusing the signature generation unit 515 as the center of description, the signature generation unit 515 represents the adding signature using the signing key SK _T.

  The signature generation means 515 adds an electronic signature and its time information to the application. This signature generation means 515 is a signature key at the time T at which an application read from the application storage means 516 in response to a request is read from the storage unit by the signature key management means 514 and the application is to be started. An electronic signature is added and the time T is added. Here, for example, when it is desired to activate the application at 13:00, the signature generation unit 515 uses a signature key valid at 13: 00 to 13:30 (time information 13:00) before the activation time. Can be added at the time.

The application storage unit 516 stores an application linked to a broadcast program, and is composed of, for example, a general hard disk. In the present embodiment, the broadcast station 2 broadcasts a broadcast program application integration, the verification key K _P of the application server 51 is generated, acquired before the application is delivered, it was decided it holds.

The verification key transmission unit 517 distributes the verification key K _P generated by the key generation unit 511 via the communication network N. This verification key transmission means 517 is constituted by a predetermined communication interface. Distribution method is arbitrary, in the present embodiment, as an example, as shown in FIG. 4, the verification key sending unit 517 transmits the verification key K _P to the broadcast station service server 44 through the communication network N, The broadcast station service server 44 is relayed to notify the broadcast station 2. In this case, as an example, the broadcast station service server 44, it was decided to send the broadcast station 2 verification key K _P via the dedicated line L between the broadcasting station 2. The broadcast station 2 may be notified off-line (for example, by mail).

In the present embodiment, in order to pass the verification key K _P to the broadcasting / communication cooperation receiving device 6, the broadcasting station 2 includes the control signal multiplexed in the broadcasting wave W for transmitting the AV content from the application server 51. The acquired verification key K _P is included.

  The request receiving unit 518 receives a request for requesting an application from the broadcasting / communication cooperation receiving device 6 via the communication network N. This request receiving means 518 is constituted by a predetermined communication interface. The request received here is output to the signature generation means 515.

  The application transmission unit 519 transmits the signed application to which the electronic signature and the time T are added by the signature generation unit 515 to the request source of the request via the communication network N. This request receiving means 518 is constituted by a predetermined communication interface.

[5. Configuration of broadcast communication cooperative receiver]
In addition to the tuner, the broadcasting / communication cooperation receiving device 6 includes, for example, an arithmetic device such as a CPU (Central Processing Unit), a storage device such as a memory and a hard disk, and an interface device that transmits and receives various types of information to and from the outside. As shown in FIG. 5, broadcast receiving means 601, broadcast signal analyzing means 602, video / audio decoding means 603, data broadcast decoding means 604, APL activation information storage means 605, communication transmitting / receiving means 606, APL activation information acquisition means 607, list control means 608, application control means 609, application storage means 610, application acquisition means 611, application cache 612, application execution means 613, composite display means 614, verification Key storage means 615 and resource management means 616 , And a resource access control unit 617, a.

  Here, if each of the means 601 to 617 is classified into only one of the basic function 61 of the broadcasting / communication cooperation receiving device 6 and the broadcasting / communication cooperation function 62 shown in FIG. A broadcast receiving means 601, a broadcast signal analyzing means 602, a video / audio decoding means 603, a data broadcast decoding means 604, and a communication transmitting / receiving means 606 are provided, and the broadcast communication cooperation function 62 is an APL activation information storage means 605. APL activation information acquisition means 607, list control means 608, application control means 609, application storage means 610, application acquisition means 611, application cache 612, application execution means 613, and composite display means 614 Verification key storage means 615, resource management means 616, resource It includes an access control unit 617, a. However, this is an example, and it cannot be simply separated.

  The broadcast receiving means 601 receives digital broadcast content (program data) transmitted by broadcast waves as a broadcast stream via an antenna ATN, and is a general digital broadcast tuner. The broadcast receiving unit 601 outputs the received / demodulated broadcast content to the broadcast signal analyzing unit 602.

  The broadcast signal analyzing unit 602 separates the video / audio stream, the SI (program arrangement information), and the data broadcast content multiplexed in the broadcast content received by the broadcast receiving unit 601, of which the video / audio stream is In addition to outputting to the video / audio decoding unit 603, the data broadcast content is output to the data broadcast decoding unit 604. Here, the SI is processed into a program table by a program table generating unit (not shown), and is presented to the output unit 630 via the composite display unit 614 when the user operates the operation input unit 620 such as a remote controller. . Note that the broadcast signal analysis unit 602 can switch the channel to be presented by a channel switching instruction from the operation input unit 620. The output unit 630 presents video and audio, and includes, for example, a display monitor such as a liquid crystal display, a speaker, and the like.

  In this embodiment, the broadcast signal analyzing unit 602 extracts the verification key multiplexed in the broadcast content and stores it in the verification key storage unit 615. Here, when the verification key is transmitted by, for example, ECM (Entitlement Control Message) which is common information, the broadcast signal analysis unit 602 extracts the verification key from the ECM.

  The video / audio decoding unit 603 decodes the video / audio stream separated by the broadcast signal analysis unit 602. When the video / audio is encoded by, for example, the MPEG2 encoding method, the video / audio decoding unit 603 outputs the video / audio data in an output format that can be decoded and displayed to the composite display unit 614. Output.

  The data broadcast decoding unit 604 decodes the data broadcast content separated by the broadcast signal analysis unit 602. The data broadcast decoding unit 604 has a function of extracting a file from a module transmitted by the data carousel method of data broadcasting, and the data broadcast content. And a BML browser function for browsing. The data broadcast decoding unit 604 outputs the decoded data broadcast content to the composite display unit 614.

  In this embodiment, the data broadcast decoding unit 604 extracts an APL activation information (application activation information) file for activating an application from a specific module transmitted by the data carousel method, and the APL activation information storage unit 605. It was decided to store in. In this sense, in this embodiment, the data broadcast decoding unit 604 functions as an application activation information extraction unit. That is, when the broadcasting / communication cooperation receiving device 6 selects a broadcast program in the broadcast content according to an external operation and presents it to the output unit 630, the data broadcast decoding unit 604 The APL activation information for the application linked to the broadcast program is extracted from the control signal multiplexed on the APL and stored in the APL activation information storage means 605. Of course, the application activation information extraction means may be provided separately, or other means may also serve. In addition, when the APL activation information file is updated, the data broadcast decoding unit 604 notifies the application control unit 609 to that effect.

  The APL activation information storage means (application activation information storage means) 605 stores APL activation information. For example, a general memory such as RAM (Random Access Memory) and ROM (Read Only Memory), a hard disk, etc. Consists of storage devices. Here, the APL activation information is information for activating the application on the broadcasting / communication cooperation receiving device 6, and includes, for example, an application identifier (ID), an application location (location address such as a URL), and the like. Information for specifying the application and additional information for controlling the application. This APL activation information is extracted by the data broadcast decoding means 604 or acquired by the APL activation information acquisition means 607.

  In the present embodiment, the APL activation information storage unit 605 also stores a list of identification information (activation application identification information) of applications being activated on the broadcasting / communication cooperation receiving device 6. This activated application identification information is created by the application control means 609.

  The communication transmitter / receiver 606 transmits / receives communication data to / from the service provider server group 5 via the communication network N, and is, for example, a communication control board.

  The APL activation information acquisition unit 607 acquires APL activation information from a known URL via the communication transmitting / receiving unit 606 and the communication network N, and stores it in the APL activation information storage unit 605. In the present embodiment, when the user performs an operation of selecting an application, the APL activation information acquisition unit 607 transmits the APL activation information about the application to a known URL via the communication transmission / reception unit 606 and the communication network N. And stored in the APL activation information storage means 605.

  Further, when the APL activation information acquisition unit 607 receives an APL activation information rewrite instruction from the application acquisition unit 611, the APL activation information storage unit 605 stores the corresponding APL activation information (external The location address (URL) described in the APL activation information related to the application according to the operation is rewritten to the memory address in the application storage means 610 in the broadcast communication cooperative reception device 6. In this sense, in this embodiment, the APL activation information acquisition unit 607 functions as a location address rewriting unit. Of course, the location address rewriting means may be provided separately, or other means may also be used. The application storage unit 610 indicates a disk device such as a hard disk.

  Based on the APL activation information stored in the APL activation information storage unit 605, the list control unit 608 uses a list of applications that can be used in the broadcasting / communication cooperation receiving device 6 as an application list (hereinafter simply referred to as a list). Created and output to the composite display means 614. This list control means 608 can be realized by, for example, a resident application launcher. The list control unit 608 can display a list to be presented by a list display / selection instruction from the operation input unit 620 and can accept the selection operation. Here, an application that operates on the broadcasting / communication cooperation receiving apparatus 6 can use the function of the list control unit 608 (broadcasting / communication cooperation function 62: see FIG. 1) by calling, for example, getRunningApplications as an API.

  Note that the launcher is not a broadcast communication cooperation application acquired through communication. This launcher may be installed in advance in the application storage unit 610 or the like at the time of shipment, for example. In the present embodiment, the list control unit 608 excludes applications that are performing background processing from the list among applications that can be used in the broadcasting / communication cooperation receiving device 6.

The application control unit 609 includes an application manager function that controls a life cycle such as activation and termination of an application, and a secure manager function that performs application authentication processing.
In the application control unit 609, the application manager function performs, for example, an application acquisition control based on the application location described in the APL activation information, and a control code indicating the operation state described in the APL activation information. Therefore, the acquired application state is controlled. Here, the operation state is, for example, application automatic start (control code “AUTO START”), standby (control code “PRESENT”), termination (control code “DESTROY”), forced termination (control code “KILL” or "KILL ALL") etc.
For this purpose, the application control unit 609 includes a start control unit 710, an end control unit 720, and a storage management unit 730. In the present embodiment, the start control unit 710 has a secure manager function.

The activation control unit 710 controls the activation of the application.
The application manager function in the activation control means 710 is as follows. The activation control means 710 is loaded into the memory when the application to be activated is a linked application linked to a digital broadcast program, and the control code “AUTO START” is described in the APL activation information. Start the running application and start it. If the control code “AUTO START” is not described in the APL activation information of the application to be activated, the activation control unit 710 activates the application according to the user's operation. If the control code “PRESENT” is described in the APL activation information, the activation control means 710 maintains the state (standby) loaded in the memory before the application is activated, and the application is in operation. If it is temporarily stopped, the state loaded in the memory (standby) is set.

  In the present embodiment, the activation control unit 710 includes a time information verification unit 711 and an electronic signature verification unit 712 as a secure manager function having priority over the application manager function.

The time information verification unit 711 determines whether or not the current time matches the period represented by the time T added to the acquired signed application. Here, that the current time matches the period represented by time T means that the current time is included in the period represented by time T. In the present embodiment, when the time T is referred to, a period starting from the start time T is set, and the application server 51 sets a valid signature key at 13:30 to 13:30 (time information 13:00) at 12:30, for example. If generated, the time T indicates 13: 0 to 13:30 (time information 13:00). Therefore, if the current time is 13:05, the current time matches the period represented by time T. On the other hand, if the current time is 12:55 or 13:35, the current time does not match the period represented by time T.
When the current time matches the time information T, the time information verification unit 711 notifies the electronic signature verification unit 712 to that effect.

  Further, when the time information verification unit 711 determines that the current time does not match the time information T and the time information T indicates the future, the time information verification unit 711 executes the determination after a predetermined time. When the time information T indicates the past, the application manager function of the activation control unit 710 executes error processing. In this case, the activation control unit 710 may display an error message such as “Application could not be activated” on the output unit 630 as a message indicating that an error has occurred.

The electronic signature verification unit 712 determines whether or not the signature verification is successful using the verification key when the current time matches the period represented by the time information T.
In this embodiment, when the electronic signature verification unit 712 receives a notification from the time information verification unit 711 that the current time matches the time information T, the electronic signature verification unit 712 reads the verification key from the verification key storage unit 615, A verification process corresponding to the signature method is executed. The electronic signature verification means 712 executes a verification process for verifying a known key insulated signature. When the verification is successful, the application manager function of the activation control unit 710 controls the state of the application according to the control code described in the APL activation information of the application acquired as the signed application.

  When the signature verification fails in the electronic signature verification unit 712, the application manager function of the activation control unit 710 executes error processing. In this case, the activation control means 710 indicates that an error has occurred, “Application authentication failed”, “The application to be activated has been certified as a general application”, or “Application cannot be activated. May be displayed on the output means 630.

The end control means 720 controls the end of the application.
When “DESTROY” is described in the APL activation information, the termination control means 720 performs post-processing necessary to terminate the application whose life cycle is controlled by the APL activation information, and then executes the application. finish.
When “KILL” is described in the APL activation information, the termination control unit 720 forcibly terminates the application whose life cycle is controlled by the APL activation information.
When “KILL ALL” is described in the APL activation information, the termination control means 720 is not limited to the application whose life cycle is controlled by the APL activation information, and is linked to broadcasting / communication regardless of linked / non-linked. All applications running on the receiving device 6 are forcibly terminated.
The termination control means 720 can terminate the application in accordance with the user operation.

The accumulation management unit 730 controls writing, reading, and erasing as processing related to application accumulation. The accumulation management unit 730 writes the conjunction application acquired by the application acquisition unit 611 in the application cache 612. In the present embodiment, the accumulation management unit 730 writes the conjunction application acquired by the application acquisition unit 611 in the application cache 612. Here, the application cache 612 indicates a cache memory.
Here, an application that operates on the broadcasting / communication cooperation receiving device 6 may use the function of the storage management unit 730 (broadcasting communication cooperation function 62: see FIG. 1) by calling, for example, saveApplicationToCache () as an API. it can.

  Further, the accumulation management unit 730 searches whether the application is stored in the application cache 612. Note that an application running on the broadcasting / communication cooperation receiving device 6 can use the function of the storage management means 730 (broadcasting communication cooperation function 62: see FIG. 1) by calling, for example, queryApplicationInCache () as an API. .

  Further, when the storage management unit 730 determines that no application is stored in the application cache 612, the storage management unit 730 controls the application acquisition unit 611 to acquire the application. The accumulation management unit 730 determines that the application is not stored when the cache hit does not occur, and determines that the application is stored when the cache hit occurs.

  When the application acquisition unit 611 acquires an application that operates on the broadcast communication cooperative reception device 6 in response to an operation from the outside, the application storage unit 610 stores an application corresponding to the operation. It consists of a general hard disk. The application storage unit 610 stores an unlinked application or an independent application that is not linked to a digital broadcast program. When an unlinked application is accumulated in the application accumulation unit 610, the corresponding APL activation information stored in the APL activation information storage unit 605 is rewritten by the APL activation information acquisition unit 607 as described later.

The application acquisition unit 611 acquires the application from the location address (URL) described in the APL activation information of the application via the communication transmission / reception unit 606 and the communication network N under the control of the application control unit 609. . In the present embodiment, the application acquisition unit 611 transmits a request for requesting an application to the application server 51 at the arrangement location, and the signed application with the time T and the electronic signature added as a response to the request. Receive. If the received signed application is not particularly distinguished, it may be simply referred to as an application.
In this embodiment, when the application acquisition unit 611 acquires a linked application linked to a digital broadcast program, the application acquisition unit 611 stores the linked application in the application cache 612 through the accumulation management unit 730 under the control of the application control unit 609.
Hereinafter, the conjunction application is typically treated as a signed application or a signed application.

  When the application acquisition unit 611 acquires a non-linked application in response to an operation from the outside, the application acquisition unit 611 stores it in the application storage unit 610 under the control of the application control unit 609. Since this unlinked application is typically not a signed application, it is treated as not being a signed application. In this case, if no special processing is performed, the application control unit 609 refers to the corresponding APL activation information stored in the APL activation information storage unit 605 in an attempt to activate the unlinked application stored in the application storage unit 610. Then, the storage location of the application described in the corresponding APL activation information indicates the URL ahead of the communication network N. In order to prevent such a situation, the application acquisition unit 611 outputs an APL activation information rewrite instruction to the APL activation information acquisition unit 607. As a result, the unlinked application stored in the application storage unit 610 can be activated.

  The application cache 612 is a cache that stores the application acquired by the application acquisition unit 611. Here, the cache is a means for realizing a storage hierarchy, and is constituted by a cache memory such as a semiconductor memory. For example, in the case of a linked application, after the APL activation information is stored in the APL activation information storage unit 605, the conjunction application that is activated with the APL activation information is stored in the application cache 612. At this time, it is not necessary to rewrite the APL activation information of the conjunction application. That is, unlike the application storage unit 610, the application cache 612 stores a location address (URL) described in the APL activation information of the application stored in the APL activation information storage unit 605 when the application is stored. ) Is not required to be rewritten.

  The application execution unit 613 executes an application, and broadcasts the linked application stored in the application cache 612 or the unlinked application stored in the application storage unit 610 under the control of the application control unit 609. Operate on the cooperative receiver 6. Data of an application operated by the application execution unit 613 is output to the composite display unit 614.

  Here, the application execution means 613 can execute a plurality of applications simultaneously. In this case, a plurality of applications belonging to the same service can be executed, or a plurality of applications belonging to different services can be executed. Further, when a plurality of applications are executed, at least one of the applications may perform background processing.

  Further, when data or content (moving image, audio, still image) is included in the service to which the application belongs as the application is executed, these are also executed in the service. These are called application data. Application data and the like are output to the composite display means 614. For example, when the application execution unit 613 executes the application and the application running on the apparatus requests the video / audio content from the content distribution server 53 or the like via the communication network N, the communication stream of the video / audio content is transmitted. It is acquired, reproduced, and output to the composite display means 614. Similarly, when an application running on the apparatus requests and obtains image data such as a still image or audio data, the data is output to the composite display unit 614. Note that application data and the like are also stored in the application cache 612.

The composite display unit 614 includes a broadcast content buffer (not shown) and a communication content buffer. The communication transmission / reception unit 606 generates a communication stream from the content distribution server 53 that distributes the content linked to the digital broadcast program. The received content and the digital broadcast program are synchronized and output to the output means 630.
Here, the application that operates on the broadcasting / communication cooperation receiving apparatus 6 uses the synchronization control function as the broadcasting / communication cooperation function 62 (see FIG. 1) by calling, for example, getCurrentSTC () or delayStreamPresentation () as the API. be able to.

  The composite display unit 614 includes video / audio data notified from the video / audio decoding unit 603, a data broadcast screen (data broadcast content) notified from the data broadcast decoding unit 604, list data notified from the list control unit 608, The application data notified from the application execution unit 613 is combined and output to the output unit 630 as image data and audio data. Note that the synthesis of image data can be realized by, for example, a general GDC (Graphic Display Controller).

  Also, the synthesis of audio data is, for example, of the audio / video data notified from the audio / video decoding means 603 in the same manner as the actual situation of a general baseball broadcast program and the switching or synthesizing process of the sub audio service. It means that one of the audio data and the audio data included in the application data is output to the output unit 630 as being switchable or synthesizable by a user operation.

  The verification key storage unit 615 stores the verification key generated by the application server 51. This verification key is used for verifying the signature added by the application server 51.

  The resource management unit 616 manages resources that can be used by applications that operate in the broadcast communication cooperative reception apparatus 6. The resource management unit 616 functions as a resource manager. Here, the resources are hardware and software, and can be classified into receiver resources, broadcast resources, and communication resources, for example.

Here, the receiver resource is a resource specific to the device, and includes, for example, video / audio output processing, channel selection processing, memory, storage, and the like.
The broadcast resource is a resource acquired by a broadcast wave, and includes, for example, video, audio, subtitles, PSI / SI (Program Specific Information / Service Information).
The communication resource is a resource acquired from the communication network N. For example, data (video, audio, subtitle, HTML content (transferred by UDP (User Datagram Protocol) or TCP (Transmission Control Protocol)) as a transport layer protocol is used. HTML browser).

  In the present embodiment, the resource management unit 616 determines whether or not allocation is possible according to a predetermined rule for, for example, a receiver resource and a communication resource. Among these, if it is a receiver resource, for example, when two applications that handle graphics are started simultaneously, it is possible to perform presentation control using a monitor screen according to a predetermined presentation policy for adjusting each other's operation. .

  In the present embodiment, the resource management unit 616 follows the instruction of the resource access control unit 617 to determine whether or not to allocate a broadcast resource, for example. Specifically, for example, when a broadcast resource is requested from a running application, the resource management unit 616 inquires of the resource access control unit 520 whether or not the resource can be allocated, and receives a notification that allocation is possible. Allocate resources. Here, the resource request from the application being executed specifically means a resource request from the application control unit 409.

The resource access control unit 617 determines whether or not resource allocation, which is inquired from the resource management unit 616, can be performed based on application authentication.
In the present embodiment, the resource access control unit 617 determines whether or not the allocation regarding the broadcast resource is possible. The resource access control unit 617 determines whether or not the application inquired from the resource management unit 616 is an authenticated application. If the application is authenticated, the resource access control unit 617 returns an allocatable notification; otherwise, Returns an unallocated notification.

  As a result, broadcast resources are allocated to the running conjunction application (A application). Note that an application (general application) that has not succeeded in signature verification cannot be activated and therefore does not request a resource.

[6. Key generation process]
Here, as a premise of application authentication, the key generation processing will be described with reference to FIG. FIG. 6 is a sequence diagram showing a flow of key generation processing by the application server according to the embodiment of the present invention.
First, the application server 51, the key generation unit 511 generates a master key _{K M} (step S11), and then generates a verification key _{K P} for verifying the signature (step S12). In addition, the application server 51 transmits the generated verification key K _P to the broadcasting station service server 44 via the communication network N by the verification key transmission unit 517 (step S13).

When the broadcast station service server 44 receives the verification key K _P via the communication network N (step S14), the broadcast station service server 44 sends the received verification key K _P to the broadcast station (digital broadcast transmission device) 2 via the dedicated line L, for example. Transmit (step S15). Broadcasting station (digital broadcast transmitting apparatus) 2 receives the verification key K _P and (step S16), and including a verification key K _P to the control signal multiplexed in the broadcast stream (step S17), and sends the broadcast wave W (Step S18).

The broadcasting / communication cooperation receiving device 6 receives the broadcast wave W by the broadcast receiving means 601 (step S19), and the broadcast signal analyzing means 602 separates the broadcast stream into AV contents and control signals (step S20). A verification key K _P is extracted from the control signal (step S 21) and stored in the verification key storage unit 615.

On the other hand, the application server 51 uses the partial key generation unit 512 to determine whether it is the generation timing of the partial key (step S31). If it is not the generation timing of the partial key (step S31: No), the application server 51 waits and reaches the generation timing of the partial key (step S31: Yes). The application server 51 uses the partial key generation means 512 to execute the partial key ΔSK _T. Is generated (step S32). Here, T is the time information of the signature key using this partial key. Then, the partial key generation unit 512 determines whether or not it is the signature key update timing, and outputs the partial key ΔSK _T at the update timing. Then, the signature key update unit 513 acquires the signature key acquired from the signature key management unit 514. SK _T-1 is updated using the partial key ΔSK _T to generate a signature key SK _T (step S33), and the signature key management means 514 stores the updated signature key SK _T (step S34), The process returns to step S31.

[7. Application authentication process]
Here, the application authentication process will be described with reference to FIG. 7 (see FIGS. 4 and 5 as appropriate). FIG. 7 is a sequence diagram showing a flow of application authentication processing by the broadcast communication cooperative reception apparatus according to the embodiment of the present invention.
First, the broadcasting / communication cooperation receiving device 6 requests an application linked to AV content (digital broadcast program) by the application acquisition unit 611 under the control of the application control unit 609 (step S41). That is, the application acquisition unit 611 transmits a request for requesting an application to the application server 51 at the arrangement location described in the APL activation information via the communication transmission / reception unit 606 and the communication network N.

  Then, the application server 51 receives a request from the broadcast communication cooperative receiving device 6 via the communication network N by the request receiving unit 518 (step S42), and the signature generating unit 515 An electronic signature is added with a signature key (signature key at time T) at the time (start time) at which the application is to be activated (step S43). At this time, the signature generation means 515 adds time information (referred to as the time T of the signature key, hereinafter simply referred to as T) to the requested application together with the electronic signature. Then, the application server 51 transmits the signed application to the request source of the request via the communication network N by the application transmission unit 519 (step S44).

  Then, the broadcasting / communication cooperation receiving device 6 receives the signed application via the communication network N by the application acquiring unit 611 (step S45). The received signed application is stored in the application cache 612. Then, the broadcasting / communication cooperation receiving device 6 determines whether or not the current time matches the time information (T) added to the signed application by the time information verification unit 711 (step S46). If the current time matches the time information (T) added to the signed application (step S46: Yes), the electronic signature verification unit 712 determines whether or not the signature verification is successful (step S46). S47). If the signature verification is successful (step S47: Yes), the activation control unit 710 activates the cached application (step S48).

On the other hand, when the time information verification unit 711 determines in step S46 that the current time does not match the time information (T) added to the signed application (step S46: No), the time information (T) Indicates the future (step S49: No), the broadcasting / communication cooperation receiving device 6 stands by and returns to step S46. On the other hand, if the time information (T) indicates the past (step S49: Yes), the process proceeds to step S50, and error processing is executed.
If the signature verification fails in step S47 (step S47: No), the activation control unit 710 executes error processing (step S50).

[8. Specific example of starting linked application]
Here, a specific example of starting the conjunction application will be described with reference to FIG. 8B (refer to FIGS. 4 and 5 as appropriate). FIG. 8B shows a broadcast program in the form of a program guide and an application linked to the broadcast program. The application information denoted by reference numeral 150 in FIG. 8B is information indicating whether or not there is an application that is linked to the AV content (program). The program information 160 is AV content (program) information associated with a channel of a predetermined broadcast station, and indicates, for example, a start time, a program length, and an end time.

  In the example shown in FIG. 8B, the linked application A exists for a sports program from 18:00 to 18:50 on the channel “CH1”. If the control signal for automatically starting the linked application A in the broadcasting station is multiplexed with the broadcast wave in the range of 17:55 to 19:00, application authentication fails in the period before 18:00. Therefore, the broadcasting / communication cooperation receiving device 6 restricts the presentation of the conjunction application A acquired before, for example, 18:00, and starts the conjunction application A simultaneously with the successful authentication of the conjunction application A at 18:00. can do. If the control signal for terminating linked application A at the broadcast station is multiplexed to the broadcast wave at 18:50, linked application A can be terminated at the end of the sports program (18:50). .

  In the example shown in FIG. 8B, no linked application exists for a weather forecast program from 18:50 to 19:00 and a special program after 19:30. In addition, linked application B exists for news programs from 19:00 to 19:30. Furthermore, the linked application C exists for the time zone of 19:10 to 19:20 in the middle of this news program. That is, a plurality of linked applications may be activated simultaneously for one AV content (program). For example, a service provider that provides the linked application C is different from a service provider that provides the linked application B. Then, the broadcasting / communication cooperation receiving apparatus 6 acquires the verification key for the conjunction application B and the verification key for the conjunction application C in advance, and independently performs the authentication of the conjunction application B and the authentication of the conjunction application C. Do.

  In this case, in order to start the linked application C when 10 minutes have passed since the start of the news program, the application server 51 on the service provider side is set in advance so that the signature key becomes valid at this timing. Is also possible. As a result, even if the control signal for automatically starting the linked application C in the broadcasting station is multiplexed with the broadcast wave in the range of 19: 0 to 19:30, the application is applied during the period of 19: 0 to 19:10. Because the authentication fails, the broadcasting / communication cooperation receiving device 6 restricts the presentation of the conjunction application C acquired at, for example, 19:00, and when the conjunction application C is successfully authenticated, the conjunction application C is activated at 19:10. can do.

As described above, according to the network-linked digital terrestrial television broadcasting receiving apparatus 6 of the present embodiment, an application linked to the broadcast program by previously obtaining the verification key K _P required to verify the signature added by the distribution side of the application The signature added to the application when it is acquired from the communication network can be verified. Therefore, when the service provider distributes the application linked to the broadcast program, if only the application that has passed the screening by the broadcaster or the system administrator in advance is the A application, the broadcast communication cooperative receiving device 6 It is possible to determine whether or not the application acquired from the communication network N in conjunction with the program is the A application, and security can be improved.

  In addition, the broadcasting / communication cooperation receiving device 6 acquires an application linked to the broadcast program from the application server 51 at the location described in the APL activation information acquired from the broadcast wave during the selection of the broadcast program, and the A application It is possible to automatically start the application after verifying whether or not. Therefore, it is possible to realize a service in which a viewer who is watching a broadcast program automatically presents a safe application distributed from the communication network N in conjunction with the program without performing a special operation.

  In addition, the application server 51 adds an electronic signature to the application linked to the broadcast program with a signature key of the periodic update method and adds a time T of the electronic signature, so that the application can be set at a future time. By adding a signature with a corresponding signature key, the application can be started at a future time. Therefore, it is also possible to start the application after waiting for the desired time in conjunction with the broadcast program. Therefore, it is possible to increase variations of services that can be provided to viewers using an application linked to a broadcast program.

  As mentioned above, although this invention was demonstrated based on embodiment, this invention is not limited to this, You may comprise like the following modifications 1-4.

(Modification 1)
In the first modification, when approved by the system administrator, a model that is an A application (A application in a broad sense or a system registration application) and authentication of a narrowly defined A application (broadcast station approval application) are used in combination. is there. In the embodiment, since the authentication of the application linked to the broadcast program is the main objective, among all the service providers that provide the application in the broadcasting / communication cooperation type system 1, the application linked to the broadcast program is received from the broadcasting station. Some service providers entrusted with distribution (operator of the application server 51 shown in FIG. 4) individually generate verification keys, and the broadcasting / communication cooperation receiving device 6 authenticates the A application by signature verification. . That is, some service providers trusted by the broadcasting station are models that generate verification keys and behave as existence (pseudo-administrators) like system administrators who approve their own A applications. However, in this model, there are a plurality of pseudo administrators. Such a model is suitable for authentication of a narrowly-defined A application, that is, a broadcast station approval application.

  In the first modification, among all the service providers that provide the application in the broadcasting / communication cooperation type system 1, for example, a number of service businesses approved by the system administrator who has generated a unique verification key in the system. Will add an electronic signature to the application. However, operators other than some service providers (operators of the application server 51 shown in FIG. 4) entrusted with distribution of applications linked to broadcast programs need only add a signature to the application, and time information The addition of (time T) is not essential. In the broadcasting / communication cooperation receiving device 6, when the time T is not added to the signed application, the processing of the electronic signature verification unit 712 may be performed by skipping the processing of the time information verification unit 711.

Moreover, in the case of the modification 1, the said embodiment is deform | transformed in each point of following (1)-(3).
(1) The A application in a broad sense is registered in the repository indicating the application accumulation location, and the repository position is known to the broadcasting / communication cooperation receiving device 6. Further, the A application in the broad sense can use the API 46 (see FIG. 1) of the broadcast station server group 4, but the general application other than the A application in the broad sense uses the API 46 of the broadcast station server group 4. It is not possible. In addition, when the repository means the collection place of the A application in a narrow sense, it corresponds to the application server 51 shown in FIG. 4 and particularly means the application storage unit 516 and the like.

(2) In the broadcasting / communication cooperation function 62 (see FIG. 1) of the broadcasting / communication cooperation receiving device 6, the security function includes a function of performing control to change the way of displaying the application screen according to a predetermined policy level. Can do. For example, if it is an A application in a broad sense, it is allowed to overlap with the AV content presented to the broadcasting / communication cooperation receiving apparatus 6, and if it is a general application other than the A application in a broad sense, no overlap is allowed (AV content is not allowed). Display in an L-shaped area outside the frame of the display area).

(3) The resource access control means 617 of the broadcasting / communication cooperation receiving device 6 determines whether or not the application is authenticated as an A application in a narrow sense, and whether or not the application is authenticated as an A application in a broad sense. This is used in combination with the process of determining whether or not. Then, the resource access control means 617 determines whether or not the application inquired from the resource management means 616 is an application that has been authenticated as an A application in a narrow sense or a broad sense. Returns a possible notification, otherwise returns a non-assignable notification. As a result, broadcast resources are allocated to a running linked application (A application in a narrow sense) or an application registered in a repository (A application in a broad sense). On the other hand, broadcast resources are not allocated to running non-linked applications and independent applications (general applications other than the A application in a broad sense) that are not registered in the repository. Note that an application that has not been successfully processed by the electronic signature verification unit 712 after the processing of the time information verification unit 711 (a general application other than the A application in a narrow sense) cannot be activated and therefore does not request a resource.

(Modification 2)
The broadcasting / communication cooperation receiving device 6 according to the embodiment can be realized by operating a general computer including a tuner by a program that functions as each of the above-described units. This program (program execution control program of the broadcasting / communication cooperation receiving apparatus) can be distributed via a communication line, or can be distributed by writing on a recording medium such as a DVD or CD-ROM. .
The application server 51 of the embodiment can be realized by operating a general computer by a program that functions as each of the above-described units. This program (application server program) can be distributed via a communication line, or can be distributed by writing on a recording medium such as a DVD or CD-ROM.

(Modification 3)
In the broadcasting / communication cooperation receiving device 6 of the embodiment, the application is automatically started when the viewer receives the APL activation information described as “AUTO START” while viewing the digital broadcast program. Furthermore, the following functions (4) and (5) may be added.
(4) While presenting a digital broadcast, the user presses an H button (broadcast / communication cooperation service screen transition button) provided in advance on the remote controller, thereby transitioning to the broadcast / communication cooperation service screen.
(5) A broadcasting / communication cooperation service screen transition dedicated API for transitioning from BML to the broadcasting / communication cooperation service screen is newly provided and prepared. While presenting digital broadcast, the user presses the D button (data broadcast transition button) provided on the remote control to transition to the data broadcast screen, and then, on the data broadcast screen, the broadcast communication cooperation service screen transition dedicated When the user performs an operation of selecting a dedicated button provided corresponding to the API, the screen changes to the broadcast communication cooperation service screen.

(Modification 4)
In the broadcasting / communication cooperation type system of the above embodiment, it has been described that the APL activation information file is transmitted by the specific module transmitted by the data carousel method on the broadcast content transmission side. In addition, a descriptor for APL activation information may be added to the event information table (EIT: Event Information Table) and transmitted, or a dedicated elementary stream (ES: Elementary Stream) for APL activation information may be transmitted. ) May be multiplexed in a broadcast TS (Transport Stream), or only information indicating the location address of the APL activation information may be transmitted.
In addition, when authenticating an application linked to a broadcast program in the form of using a certificate from a third party in addition to an electronic signature, the application linked to the broadcast program is not transmitted from a communication network. You may make it transmit an APL starting information file.

1 Broadcasting / communication cooperation type system 2 Broadcasting station (digital broadcasting transmitter)
4 broadcast station server group 41 content management server 42 user management server 43 content distribution server 44 broadcast station service server 45 DB
46 API
5 Service Provider Server Group 51 Application Server 511 Key Generation Unit 512 Partial Key Generation Unit 513 Signature Key Update Unit 514 Signature Key Management Unit 515 Signature Generation Unit 516 Application Storage Unit 517 Verification Key Transmission Unit 518 Request Reception Unit 519 Application Transmission Unit 52 Service server 53 Content distribution server 54 DB
55 API
6 Broadcast / communication cooperation receiving device 61 Basic function 62 Broadcast / communication cooperation function 63 API
64 applications (broadcast communication cooperation applications)
601 Broadcast receiving means 602 Broadcast signal analyzing means 603 Video / audio decoding means 604 Data broadcast decoding means (application activation information extracting means)
605 APL activation information storage means (application activation information storage means)
606 Communication transmitting / receiving means (delay time output means)
607 APL activation information acquisition means 608 list control means 609 application control means 610 application storage means 611 application acquisition means 612 application cache 613 application execution means 614 composite display means (delay time output means)
615 Verification key storage means 616 Resource management means 617 Resource access control means 620 Operation input means 630 Output means 710 Start control means 711 Time information verification means 712 Electronic signature verification means 720 Termination control means 730 Storage management means ATN Antenna N Communication network L Dedicated line

Claims (4)

The broadcast content transmitted by the broadcast wave of the digital broadcast is received, and the application operating on the receiving device is acquired via a communication network from an application server that distributes an application linked to a broadcast program in the broadcast content. A broadcast communication cooperation receiving device,
Application activation information storage means for storing application activation information for activating the application;
Verification key storage means for storing a verification key for verifying a signature added by the application server;
The application acquisition control is performed based on the location of the application described in the application activation information, and the acquired application state is controlled according to the control code indicating the operation state described in the application activation information. Application control means;
An application acquisition means for transmitting a request for requesting an application to the application server at the placement location, and receiving a signed application to which time information and an electronic signature are added as a response to the request;
The application control means includes
Time information verification means for determining whether or not the current time matches the period represented by the time information added to the acquired signed application;
Electronic signature verification means for determining whether or not signature verification is successful using the verification key if the current time matches the period represented by the time information,
A broadcasting / communication cooperative reception apparatus that controls the state of the acquired application according to the control code when signature verification is successful.   When a broadcast program in the broadcast content is selected according to an external operation and presented to an output means for presenting video and audio, the control signal multiplexed on the broadcast content The broadcasting / communication cooperation receiving apparatus according to claim 1, further comprising application activation information extracting means for extracting the application activation information for an application linked to a broadcast program.   The broadcast communication cooperation according to claim 1 or 2, further comprising broadcast signal analysis means for extracting the verification key multiplexed in the broadcast content and storing it in the verification key storage means. Receiver device. 4. A signature is added to a broadcasting / communication cooperation receiving device according to any one of claims 1 to 3 using a signature key generated by a periodic update method in which a signature key is periodically updated using time information. An application server that distributes an application via a communication network,
A key generation means for generating a master key and generating a verification key for verifying the signature;
Verification key transmission means for distributing the verification key via the communication network;
Application storage means for storing an application linked to the broadcast program;
The partial key of the predetermined time information is generated based on the master key as a partial key used when replacing the signature key with the signature key of the predetermined time information at the update timing for updating the signature key, and is stored and stored in the storage unit And a partial key generation means for outputting at the update timing;
A signature key updating unit that updates a signature key held at the update timing using the partial key output from the partial key generation unit;
A signature key management unit that performs a process of storing and holding the updated signature key in a storage unit and a process of reading the signature key from the storage unit and outputting the signature key to the signature key update unit;
Request receiving means for receiving a request for requesting the application from the broadcasting / communication cooperation receiving device via the communication network;
For the application read from the application storage unit in response to the request, an electronic signature is read with the signature key of the time information read from the storage unit by the signature key management unit and the time information for starting the application. And signature generation means for adding the time information,
Application transmitting means for transmitting the signed application to which the electronic signature and time information are added to the request source of the request via the communication network;
An application server comprising:

Images