KR20130119838A - Digital system having rights identification information, application system, and service system - Google Patents

Abstract

Disclosed are a digital system, which contains authorized person identification information, an application system, a service system, and a method for providing the above. Also disclosed are a duplicated loan management system and a method for providing the same. The digital system includes the following parts: a memory part which pre-stores identification information of an authorized person for the digital system before the digital system requests a service, or before the digital system connects to the service system if the digital system requests the service after connecting to the service system; and a control part to read out the authorized person identification information stored in the memory part and transmit the information to the service system. The service system determines whether to allow the service based on the transmitted, authorized person identification information.

Description

Digital system having rights identification information, application system, and service system

The present invention relates to a digital system in which rights holder identification information is recorded and a service system capable of providing a service to a digital system in which the rights holder identification information is recorded, and more particularly, a right holder in which a predetermined digital system can identify an owner. By storing the identification information, the present invention relates to a system and a method of providing the same, which allows a proper authentication using the owner identification information.

With the development of information and communication technology, many digital systems (eg, PCs, tablets, navigation, music players, cameras, mobile phones, automotive digital systems, IPTVs, digital TVs, etc.) are widely sold and used.

In particular, as IT technologies are miniaturized and converged, digital systems are being manufactured and distributed not only to perform one function but also to be portable for users with various functions. For example, in the case of a mobile communication terminal (eg, a smart phone), various functions such as a camera, an information storage device, a banking (payment, transfer, etc.) as well as the original communication function are performed in a complex manner. At the same time, with the integration of devices while performing all the complex functions, these digital systems are becoming smaller enough for users to carry.

* With the convergence of various functions, digital systems are not just providing convenience to users, but also becoming an important means of profoundly affecting users' lives.

On the other hand, when the digital system is implemented to be accessible to the network, users through the digital system to provide a variety of network (eg, wired and wireless Internet) based services (eg, financial services such as login, payment or transfer) It is requested and provided to the provided service system.

However, in the case of such a network-based non-face-to-face service, the question of whether the user requesting the service is authorized to use the service, that is, the authentication problem, has always been an important problem. In other words, if the service is provided to a person who is not authorized to use the service when providing the service through the network, the personal information or assets of the legitimately authorized user may be seriously affected.

One of the major authentication methods in the related art has been to treat a person who knows certain information (who owns) as a legitimate user. For example, user authentication using login information (ID, Password, etc.), password, pattern information, or the like is one such example. This information-based authentication method has a problem in that it cannot perform any function as an authentication function when the information is known or leaked to others.

In addition, as one of some conventional authentication methods, a device authentication method using device identification information has been known. Such a device authentication method may be defined as a concept of providing a service only to a specific device regardless of who the user requests for the service. For example, the service provider stores device identification information that is permitted to provide a service, and the device may be authenticated by checking whether the identification information of the device (eg, a digital system) requesting the service corresponds to the previously stored device identification information. In addition, various concepts of authentication schemes have existed.

Although authentication methods are diversifying and developing, such authentication methods are mostly weak. In particular, the recent leakage of personal information by hackers and the leaked personal information is illegally distributed, which seriously raises the question of the security of the conventional authentication method.

In addition, due to the diversification of service types and the need for each service field, a concept authentication method may be required in which a service is granted only to a digital system in which a requester's right (eg, ownership, usage rights, etc.) for requesting a service is recognized. This may be especially the case in services that need to further verify the ownership of political party owners, for example in areas of issuance of accredited certificates or property, and in areas where the legal need for a clearer identification is required. Hereinafter, for the convenience of description, the rights will be described by taking the case of ownership as an example, but the scope of the present invention is not limited thereto.

For example, in the case of a service provider providing an internet payment service, when a specific user A requests a service to make an internet payment, the user must make a request through A's own digital system (eg, PC, mobile phone, laptop, tablet, etc.). There may be a need to allow a service. This need may be a concept of authentication that may be commonly required in various network based services as well as in payment services.

Similarly, the authentication method that can be used to realize the concept of authentication is a method in which a specific user directly checks the identification information of the device to be used by the user and registers it in advance in the system at the service providing side, or the device providing information at the service providing side. Extraction and use may exist. However, this method has a number of practical limitations, such as the following, so that it is not widely used as a normal authentication method.

First, it may not be easy for a user to check identification information of a corresponding device and directly register it. Depending on the actual user, there may be cases in which even the identification information of the device may not be recognized, and moreover, not many users know how and where the device identification information exists in the device. Even if a user correctly recognizes the device identification information, it may be annoying or burdensome to upload the identification information to the service of the service provider. Therefore, it can be said that the user directly provides the identification information of the device to the service provider, which has a lot of limitations in realization.

Due to such constraints, the conventional authentication method using device identification information uses a method in which a service provider extracts and uses device identification information. However, there are many limitations. In order for the service provider to acquire identification information of a device requesting a service, separate software or code for acquiring device identification information must be installed in the corresponding device, which is inconvenient to develop software or code accordingly. In addition, a system and a management cost for maintaining information (eg, device identification information and corresponding user information) required for authentication in a service system are incurred.

In addition, in order to extract device identification information, the above software or code needs to be installed in the corresponding device. For many reasons, the user does not actively agree that the service system extracts his or her device identification information. It is not easy for service systems to actively use identification information.

In addition, when a device is lost or stolen, such as by another person, and the other person registers the device in his or her account, an illegal holder authenticates the device through the device regardless of who is the proper owner of the device. There is a problem in that the concept of a policy or authentication that attempts to allow a service only to a device (digital system) owned by a party service requester as a result of receiving it cannot be achieved.

In addition, a plurality of users may use the service system through the same device. In this case, the same device identification information may be used as a plurality of user authentication means, so that only the device (digital system) owned by a party service requester may be identified. There is a problem in that the concept of policy or authentication to allow a service is not completely achieved.

Further, even if the service system acquires the device identification information as a more fundamental problem, it is not guaranteed that the registered device is owned by the specific user. That is, although the registered device can be guaranteed that it is being used by the user, it cannot be guaranteed that it is owned by the user, and thus it can be said to have an inherent limitation in using it as a means for authenticating the user. Therefore, conventional device identification information (e.g., serial number or hardware-specific code) can be used as an auxiliary means for self-identification, but it has inherent limitations that cannot be used as the main authentication means for identity verification. can do.

In addition, in the conventional authentication method using device identification information, since authentication is performed based on information stored in a service system that provides a service, information maintained in the service system, that is, user and device identification information corresponding to the user is damaged. If you do not want to perform the desired authentication function.

In addition, conventional information-based authentication or authentication methods using device identification information have many limitations and limitations.

Therefore, the technical problem to be achieved by the present invention is to specify a digital system owned by the service requester, through which the service method and system for the limited to allow the corresponding service to the requester owned digital system requesting the service To provide.

Accordingly, in the digital system in which the owner identification information is recorded according to an embodiment of the present invention, the digital system requesting a service from a predetermined service system uses the owner identification information of the owner of the digital system, and the digital system requests the service. When the service is requested before or after the digital system accesses the service system, the memory system records beforehand and the rights holder identification information stored in the memory unit is read out before accessing the service system. And a control unit for transmitting to the user, wherein it is determined by the service system whether the service is allowed based on the transmitted owner identification information, or a user corresponding to the owner identification information transmitted by the service system. Request service It is considered as a service requestor.

The rights holder identification information may be stored in the memory unit so as not to be deleted or changed by a user application.

The digital system may be characterized in that at least some functions of the digital system cannot be used unless the rights holder identification information is input to the digital system and recorded in the memory unit.

The control unit may further transmit hardware identification information of the digital system to the service system, and the service system may determine whether to provide the service further based on the received hardware identification information.

The memory unit may be a built-in internal memory so as not to be detached from the digital system.

The memory unit may include a memory area in which predetermined data can be written only once.

The memory unit may include a plurality of memory areas in which rights holder identification information may be recorded, and some of the plurality of memory areas correspond to identification information of a previous rights holder who has been an owner of the digital system, or a plurality of memory areas. May correspond to identification information of a plurality of current right holders.

The controller may store designation information designating a memory area corresponding to identification information of a current owner among the plurality of memory areas.

The controller may control not to record new data in a memory area in which the rights holder identification information is recorded.

The controller may further store the rights holder identification information in another storage area included in the digital system, and when the rights holder identification information stored in the memory unit and the rights holder identification information stored in the other storage area coincide, the memory unit or Any one of rights holder identification information stored in the other storage area may be transmitted to the service system.

The service system performs a user authentication procedure using user identification information of the user requesting the service and authentication information corresponding to the user identification information, and an owner authentication procedure for determining whether the user identification information and the owner identification information correspond to each other. In addition, the user authentication procedure and the owner authentication procedure may be determined to provide the service only after success.

The service may include at least one of a login service for logging in to the service system, a payment service provided by the service system, and an inquiry service for querying predetermined information stored in the service system.

An application system that may be installed in a digital system requesting a service to a predetermined service system for solving the technical problem may include owner identification information of an owner of the digital system before the digital system requests the service or the digital system. When the system requests the service after the system accesses the service system, a reader for acquiring from a previously recorded memory unit and the owner identification information acquired by the reader before the access to the service system are performed. And a transmission unit for transmitting to the service system, wherein it is determined by the service system whether to allow the service based on the transmitted owner identification information, or a user corresponding to the transmitted owner identification information is sent to the service system. By above service It is determined by the service requester requests.

Service system for providing a predetermined service requested from the digital system for solving the technical problem is an interface unit for receiving the owner identification information of the owner of the digital system from the digital system or an application system installed in the digital system and receiving And a service control unit for determining whether to allow the service based on the received rights holder identification information, or determining a user corresponding to the received rights holder identification information as a service requester requesting the service, wherein the rights holder identification information includes: Before the digital system requests the service or when the digital system requests the service after accessing the service system, the memory included in the digital system in advance before accessing the service system. Characterized in the book.

The rights holder identification information may be stored in a memory unit of the digital system so as not to be deleted or changed by a user application.

The interface unit further receives hardware identification information of the digital system from the digital system or an application system installed in the digital system, and the service controller allows whether to provide the service further based on the received hardware identification information. It may be determined whether or not to determine, or determine the user corresponding to the received owner identification information as a service requester for requesting the service.

The digital system further stores the rights holder identification information in another storage area included in the digital system, and when the rights holder identification information stored in the memory unit of the digital system matches the rights holder identification information stored in the other storage area, And may receive any one of rights holder identification information stored in the memory unit or the other storage area from the digital system.

The service control unit receives predetermined non-authentication information indicating that the interface unit does not receive the rights holder identification information from the digital system or the application system or that the rights holder identification information is not authenticated by the digital system, If the user corresponding to the request and the owner corresponding to the owner identification information received from the digital system do not correspond to each other, it may be determined not to allow the service.

The service control unit performs a user authentication procedure using user identification information corresponding to the request of the service and authentication information corresponding to the user identification information, and an owner authentication procedure for determining whether the user identification information and the owner identification information correspond to each other. In addition, the user authentication procedure and the owner authentication procedure must both succeed to determine that the service is allowed.

A method of providing a digital system for requesting a service in a service system for solving the technical problem is characterized in that the digital system transmits right holder identification information before the service is requested or after the digital system has connected to the service system A step of reading the owner identification information stored in the digital system and transmitting the read owner identification information to the service system before accessing the service system, It is determined by the service system whether the service is allowed or a user corresponding to the transmitted right holder identification information is determined as a service requester requesting the service by the service system.

Application system providing method that can be installed in a digital system requesting a service to a predetermined service system for solving the technical problem is before the application system requests the owner identification information of the owner of the digital system, or When the digital system requests the service after accessing the service system, before accessing the service system, acquiring from the memory unit which is recorded in advance, and obtaining the rights holder identification information obtained by the application system. And transmitting to the system, wherein it is determined by the service system whether or not the service is allowed based on the transmitted owner identification information, or a user corresponding to the owner identification information transmitted is read by the service system. Request service It is deemed to be a service requestor.

A service system providing method for providing a predetermined service requested from a digital system for solving the technical problem is that the service system receives rights holder identification information of the owner of the digital system from the digital system or an application system installed in the digital system. And determining, by the service system, whether to allow the service based on the received rights holder identification information, or determining a user corresponding to the received rights holder identification information as a service requester requesting the service. The identification information of the owner may be determined before the digital system requests the service or before accessing the service system when the digital system requests the service after accessing the service system. It is characterized in that which has been written to a memory unit included in the hair system.

According to the digital system, the application system, and the service system according to the technical idea of the present invention, there is an effect of creating a service structure in which only a service requested in the name of the owner recorded in the digital system is allowed. For example, when the owner identification information A is recorded in the digital system, only a service (payment, login, etc.) requested under the A name is allowed. Therefore, even if B wants to acquire and use the digital system arbitrarily, there is an effect that the service of the B person can not be used at all, thereby preemptively diminishing the intention of theft or malicious use of the digital system.

In addition, even if the information-based authentication method is broken by hackers or illegal users, the service can not be used in the name of the party user unless they occupy the digital system of the party user. Thus, if it is ensured that the occupancy of the digital system is made by the owner, there is an effect that can prevent the service from being provided to an unauthorized user. Therefore, when used in combination with a user authentication procedure such as login or other authentication methods, there is an effect that can provide an excellent security effect.

In addition, by preventing the deletion or modification of the rights holder identification information recorded in the digital system, it is possible to maintain the integrity of the rights holder identification information representing the rights holder of the digital system so that reliable information can be used in the service authentication procedure.

In addition, the right holder identification information of the digital system is not allowed to be deleted or changed, but it is possible to add it, thereby creating and maintaining a credible book (eg, a register) of ownership of the digital system.

In addition, there is an effect that can be used as identification information of the user by receiving the owner identification information itself that is maintained and managed in the digital system. For example, when a user wants to log in to a specific service system, the owner identification information itself can be used as identification information of a service requester such as an ID without having to generate an ID for login and input an ID every login. The owner identification information may be received from the digital system and used as an ID without having to input the ID.

In addition, in the conventional authentication method, there is an effect that the service system can remove the negative mind that the owner may have regarding the extraction of the device identification information. That is, according to the technical idea of the present invention, the owner identification information used in the present invention is the owner's own name and / or biometric information for clearly indicating the owner of the device, which means that the owner owns the device. It can be said to inform externally, there is no need to have any psychological rejection in providing it to the service system. Therefore, the present invention has the effect of solving the psychological and legal limitations associated with the 'personal information' that the conventional authentication method using the device identification information.

In addition, from the point of view of the service provider, it is not necessary to develop separate software or code that must be installed in the device in order to obtain device identification information, which is necessary in the conventional method, according to the system configuration method, if necessary (for example, , At the time of service request), the device may transmit the owner identification information to the service system. Accordingly, in the service system, the device identification information and corresponding user information should be separately maintained in addition to the information required for user authentication. However, according to the technical idea of the present invention, information (for example, ID and ID And the like), there is an effect that there is no need to additionally maintain and / or manage additional information for the right holder authentication.

In addition, in the conventional authentication method using device identification information, since authentication is performed based on information stored in a service system that provides a service, information maintained in the service system, that is, user and device identification information corresponding to the user is damaged. If it is not possible to perform the desired authentication function, according to the technical idea of the present invention, since the owner identification information can be easily provided to the device there is an effect that can reduce this security burden of the service system.

In addition, there is a problem that the acquired device identification information, which is the biggest limitation in the authentication method using the conventional device identification information (for example, serial number or hardware-specific code, etc.) cannot be guaranteed to be owned by a specific user. It can be removed. That is, according to the conventional method, it can be guaranteed that a device corresponding to the acquired device identification information is used by a predetermined user, but it is not guaranteed that the user owns it. Accordingly, the conventional method has an inherent limitation in utilizing it as a user's identity authentication means, but can be used as an auxiliary means in identity authentication, but has an inherent limitation that cannot be used as a main authentication means. The mapping may use name and / or biometric information, etc. as information that can identify the owner (eg, owner) of the device, thereby ensuring that the device is the owner of the owner identification information recorded in the device, and accordingly There is a remarkable effect that the right holder identification information can be used as the main means of identity verification.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are included to provide a further understanding of the technical idea of the present invention, are as follows.
1 is a diagram showing a schematic system configuration for implementing a digital system in which right holder identification information is recorded according to an embodiment of the present invention.
2 is a diagram illustrating a schematic configuration of a digital system in which owner identification information is recorded according to an exemplary embodiment of the present invention.
3 is a view showing a schematic configuration of an application system according to an embodiment of the present invention.
4 is a diagram illustrating a schematic configuration of a service system according to an exemplary embodiment of the present invention.
5 and 6 are diagrams for explaining an example of a service procedure using a digital system in which rights holder identification information is recorded according to an embodiment of the present invention.
7 is a diagram illustrating an embodiment of a memory unit included in a digital system in which rights holder identification information is recorded according to an embodiment of the present invention.
FIG. 8 is a schematic flowchart illustrating a digital system providing method in which rights holder identification information is recorded according to an exemplary embodiment of the present invention.
9 is a schematic flowchart illustrating a service system providing method according to an exemplary embodiment of the present invention.

In order to fully understand the present invention, operational advantages of the present invention, and objects achieved by the practice of the present invention, reference should be made to the accompanying drawings and the accompanying drawings which illustrate preferred embodiments of the present invention.

Also, in this specification, when any one element 'transmits' data to another element, the element may transmit the data directly to the other element, or may be transmitted through at least one other element And may transmit the data to the other component.

Conversely, when one element 'directly transmits' data to another element, it means that the data is transmitted to the other element without passing through another element in the element.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to the preferred embodiments of the present invention with reference to the accompanying drawings. Like reference symbols in the drawings denote like elements.

1 is a diagram illustrating a schematic system configuration for implementing a digital system in which rights holder identification information is recorded according to an embodiment of the present invention.

Referring to FIG. 1, a digital system 100 for implementing a technical idea according to an embodiment of the present disclosure may be provided. The digital system 100 may transmit and receive necessary data through wired / wireless communication with a predetermined service system 300 capable of providing services to the digital system 100.

According to an embodiment of the present disclosure, a predetermined application system 200 for implementing the technical idea of the present invention may be installed in the digital system 100.

The digital system 100 may be defined to include all types of data processing devices that process digital data to perform a function originally defined in the digital system 100 or to generate a result required by a user. . The digital system 100 may be, for example, a computer (desktop, laptop, tablet PC, etc.), mobile phone, MP3, navigation, set-top box, automotive data processing system, digital TV with data processing device, digital wired / wireless telephone. It can be implemented in various systems such as digital devices for home automation. Hereinafter, the digital system 100 will be described mainly as a case of a mobile phone, but the scope of the present invention is not limited thereto.

The service system 300 may refer to any type of data processing apparatus that provides a predetermined service to the digital system 100. For example, the service system 300 determines whether to provide a corresponding function or resource for a function or resource requested by the digital system 100 through a wired or wireless network, and determines the function or resource according to a determination result. It may be any type of data processing device transmitting to the digital system 100 and / or other systems.

In addition, the service system 300 to provide a service to the digital system 100, not only transmits a response and / or resources to the digital system 100, but also requests of the digital system 100 It may include a procedure for transmitting and receiving predetermined information with another system to perform the.

For example, a predetermined service provided by the service system 300 to the digital system 100 may include a predetermined web provided by the service system 300 and / or the service system 300. A service for logging into a page or a web application, a service for enabling payment through the digital system 100, or a digital network 100 such as a 3G network or a 4G network. The technical expert of the present invention can easily deduce that the present invention can be very diverse according to an implementation example such as a network access service connected to a mobile communication network).

The application system 200 is installed in the digital system 100 is provided to implement the technical spirit of the present invention while making a call, response or communication with each of the digital system 100 and the service system 300 Can be. For example, the application system 200 may be provided with a predetermined software code (or application) that may be installed in the digital system 100 and hardware of the digital system 100 required to drive the software code (or application). It may be a system consisting of organic bonds. Therefore, in order to implement the technical idea of the present invention, only the digital system 100 itself may be provided, or an organic combination of the digital system 100 and the application system 200 may be provided.

When only the digital system 100 itself is provided, predetermined software code (or application) and / or firmware for performing the functions of the application system 200 on the digital system 100 itself (eg, an operation system). (FirmWare) may be included.

The digital system 100 may store owner identification information. The rights holder identification information may mean a person who has a right to own the digital system 100 or a person who has a right to use the digital system 100 properly. In addition, a person having various rights may be an owner according to the legal or factual state of the digital system 100. In the present specification, for the convenience of description, the owner will be described as an example of a person having ownership, that is, a right to possess, but the scope of the present invention is not limited thereto. For example, a digital system 100 provided to an employee at a particular company may have ownership in that particular company, and usage rights may be at the employee. At this time, for the technical idea of the present invention, the owner identification information stored in the digital system 100 may be identification information corresponding to the employee. Alternatively, specific company and employee information may be identification information. This may occur when the service system 300 is a corporate internal network or only an access is allowed to an individual belonging to a specific company or organization. As such, it can be easily understood by those of ordinary skill in the art that the right holder identification information can be transformed into various forms as necessary, such as ownership and use rights.

On the other hand, the owner identification information may be the name of the owner. However, in addition to the name, it may be any information (eg, social security number, biometric information (fingerprint, iris, voice information, etc.)) for identifying the owner. When the rights holder identification information is biometric information, the digital system 100 may be provided with a predetermined device capable of recognizing the biometric information. Further, as in the case of the name, the right holder identification information does not necessarily have to be unique information for each person. Because the name may have a person of the same name, the purpose and effect to achieve by the technical idea of the present invention is only distinguished who is the proper owner of the device and this identification information is authenticated by the service system 300 as an authentication means. This is because it is sufficient if it is used meaningfully.

The technical idea of the present invention may be implemented under the assumption that the rights holder identification information stored in the digital system 100 reflects the actual rights state. Therefore, when the owner identification information is recorded in the digital system 100, the owner identification information corresponding to the actual rights state should be recorded, and the recorded owner identification information needs to be guaranteed integrity. That is, it may be necessary that only an authorized system (or person) has access to the rights holder identification information, and that only an authorized system (or person) can modify (delete or change) the rights holder identification information.

Control of such access may be performed by the controller 110 of the digital system 100 to be described later. According to an embodiment of the present disclosure, the controller 110 may allow access of the owner identification information to all applications or processes. On the other hand, modification of the right holder identification information may be set to be impossible. The impossibility of modifying the rights holder identification information may be performed physically or by the control of the controller 110. According to another embodiment, the owner identification information may be modified only if the validity of the owner identification information to be newly recorded (that is, when the owner actually owns or uses the digital system 100) is authenticated. .

As such, when the rights holder identification information is recorded in the digital system 100, the recorded rights holder identification information may be used for authentication of a service requested by the digital system 100 to the service system 300.

The point in time at which the owner identification information is recorded in the digital system 100 may be at least before requesting the service from the service system 300. Alternatively, when the digital system 100 needs to access the service system 300 to use the service, the owner identification information is stored in the digital system 100 before accessing the service system 300. It may be. Therefore, the rights holder identification information handled in the technical idea of the present invention is information in which the technical meaning is distinguished from a service requester's name, a social security number, etc. received from a user when the digital system 100 actually requests a service.

According to an embodiment of the present disclosure, the owner identification information may be recorded in the digital system 100 only when validity is verified. Such recording of the rights holder identification information may be performed only by a predetermined predetermined subject, or may be performed by an actual rights holder (ie, a user). The recording of the rights holder identification information may be performed after a predetermined procedure is performed to determine whether the rights holder identification information to be recorded in the digital system 100 corresponds to the actual rights relationship, that is, whether the rights holder identification information is legitimate. have. The validity verification procedure of the right holder identification information may be performed by a predetermined offline procedure or an online procedure.

For example, when the digital system 100 is purchased, a predetermined subject such as a manufacturer, a distributor, or a national agency of the digital system 100 receives owner identification information to be recorded in the digital system 100 from the purchaser and receives the owner. Identification information may be recorded in the digital system 100 in a predetermined manner. The recording of the rights holder identification information in the digital system 100 may be performed only by a predetermined authorized entity (eg, manufacturer, distributor, etc.). At this time, the subject may check the document (for example, receipt, tax invoice, etc.) or information that can prove the right to the digital system 100 to the right holder. Even after a change of rights or the like occurs, the subject only checks the right holder identification information recorded in the digital system 100 only when checking the document or information confirming that the right to the digital system 100 has been changed. Additional records or changes can be made.

On the other hand, the act of recording the rights holder identification information in the digital system 100 is the person who purchased the digital system 100 or the person who has just received the right to use the digital system 100 from the purchaser, that is, It may be performed by the owner. When the rights holder identification information is recorded in the digital system 100 for the first time without the rights holder identification information recorded, the rights holder does not need a separate authentication process, and the rights holder uses a predetermined interface provided by the digital system 100. Identification information can also be recorded. This is because, when the digital system 100 is used for the first time, it is likely that the digital system 100 is used by a legitimate owner.

For example, when the digital system 100 is purchased and used for the first time (boot or power on, etc.), the OS or firmware of the digital system 100 may request the owner to input owner identification information. When the rights holder identification information is input, the digital system 100 may be implemented to operate normally. When the rights holder identification information is not input, the digital system 100 provides the digital system 100. It may be controlled to not perform at least some of the functions. For example, when the rights holder identification information is not recorded in the digital system 100, the controller 110 may disable a predetermined specific function among functions provided by the digital system 100. According to an implementation example, the controller 110 may activate only a function for receiving the rights holder identification information or a basic function, and control the other functions not to be used by the user. To this end, when the predetermined memory area in which the rights holder identification information is to be recorded maintains a default value when the digital system 100 is released from a manufacturer, the controller 110 may determine the digital system ( At least some of the functions provided by 100) may be disabled. According to an embodiment of the present invention, the controller 110 does not actively disable at least some of the functions of the digital system 100, but at least some of the functions by another system that can communicate with the digital system 100. May not be activated. For example, the rights holder identification information must be recorded in the memory unit 120 so that the digital system 100 can be registered in a predetermined communication company system. Otherwise, the digital system 100 cannot activate the network function. It may be. That is, when the rights holder identification information is recorded, the telecommunication company system may register the digital system 100 with the network so that the telecommunication company system can access the network.

In any case, the digital system 100 implements a function that can be normally provided by the digital system 100 only when the rights holder identification information is recorded in the memory unit 120 of the digital system 100. May be Such an embodiment may be particularly useful when a digital system communicates with internal and external service systems in a highly secure organization.

On the other hand, in the event of a change in the right to the digital system 100, the right holder before and / or after the change has to be verified by the online process through a predetermined online process, so that the record of the new owner identification information is not recorded. May be performed on system 100. There may be a variety of ways in which this validation process of the rights holder identification information can be carried out in an online process. For example, if a document or information that can demonstrate a change of rights online is submitted by a web page or web application operated by a given entity to admit the change of rights, the subject may verify the information and then check the digital system ( In operation 100), the predetermined confirmation information indicating that the change in the right is confirmed may be transmitted. Then, only when such confirmation information is received, the digital system 100 may provide a user with a function or UI for inputting new owner identification information. Of course, the validity verification procedure of the rights holder identification information may be performed even if the rights holder identification information is first recorded in the digital system 100.

In order to implement the technical idea of the present invention, a predetermined procedure or process for ensuring the validity of the rights holder identification information recorded in the digital system 100 may be performed online or offline. Of course, this verification process may not be necessary. For example, the rights holder identification information recorded in the digital system 100 does not require a separate validity verification procedure. If the rights holder identification information is recorded once, the change of the rights holder identification information or the recording of additional rights holder identification information is performed. May not be allowed.

According to an embodiment, the owner identification information may be recorded in the digital system 100 by the purchaser afterwards. For example, the owner identification information may be recorded when the enterprise purchases the digital system 100 and subsequently assigns or pays the digital system 100 to an employee. This may be especially the case when a large company or a company that emphasizes security purchases large amounts of digital systems and provides them to employees. Of course, it is also possible to enter the identification information of the company and / or employees from the time of purchase.

As such, when the owner identification information is recorded in the digital system 100, a predetermined protection mechanism may be required to ensure the integrity of the recorded owner identification information. This protection mechanism may be implemented by a feature of a hardware device (memory unit 120 described later) in which the rights holder identification information is recorded, and may be implemented in software under the control of the controller 110 included in the digital system 100. It may be implemented as.

As described above, assuming that the rightfulness of the rights holder identification information when the rights holder identification information is recorded in the digital system 100 and the integrity of the rights holder identification information after the recording are maintained, the rights holder identification information is stored in the digital system ( 100) may be treated as reliable information indicating who is entitled to justly use it.

Therefore, a useful service policy or authentication policy for providing a predetermined service can be newly and efficiently proposed.

The digital system 100, the application system 200, and the service system 300 for implementing the technical idea as described above will be described in more detail as follows.

2 is a diagram illustrating a schematic configuration of a digital system in which owner identification information is recorded according to an exemplary embodiment of the present invention.

Referring to FIG. 2, the digital system 100 (hereinafter, the digital system 100) in which the rights holder identification information is recorded includes a control unit 110 and a memory unit 120.

The memory unit 120 records owner identification information of the owner of the digital system 100. The rights holder identification information may be protected by some protection mechanism for ensuring integrity.

The rights holder identification information may be recorded in the memory unit 120 at least before the digital system 100 requests a predetermined service from the service system 300. The service system 300 when the digital system 100 needs to access the service system 300 (eg, a web page or an application server provided by the service system 300) to request the service. Before access to the owner identification information may be recorded in the memory unit 120. That is, the rights holder identification information may mean information that is previously bound to the digital system 100 independently of the service, rather than newly recorded or received from the user. Of course, the owner identification information may be recorded in the digital system 100 immediately before requesting or accessing the service from the service system 300. However, it does not receive an input for the service, but may refer to information which is separate from service user-related information as identification information for specifying the owner of the digital system 100.

According to an embodiment, the rights holder identification information may be information for the digital system 100 to be used for the first time (and normally) by the user. Thus, the rights holder identification information may be used to purchase the digital system 100. It may also be information input by the owner and recorded in the memory unit 120 when first used by the owner (eg, booting or power-on).

The rights holder identification information recorded in the memory unit 120 may be implemented so as not to be deleted or changed. The right holder identification information is not deleted or changed by at least an operation of a user of the digital system 100 or an application program installed by a user who is not an OS of the digital system 100, that is, by a user application. May mean that the rights holder identification information is not deleted or changed, and does not mean that the rights holder identification information is not guaranteed to be deleted or changed even by abnormal procedures such as physical destruction or discharge of the memory unit 120. In order that the owner identification information is not deleted or changed by the user application, the owner identification information may be recorded in a memory area which is not accessed by the user application. Alternatively, a message call and / or I / O request for accessing a memory area in which the rights holder identification information is recorded by the user application is possible, but the data is written or deleted by the user application. The back may be all blocked or disabled by the controller 110. To this end, the controller 110 may monitor whether an I / O call for writing or deleting data to an address corresponding to the memory area is performed by software installed in the digital system 100 such as an OS or an application. .

As a result, an integrity protection mechanism may be implemented in software such that the rights holder identification information is not deleted or changed by an unauthorized user or process. That is, the operation may be performed by an OS or firmware defining an operation of the controller 110. As such, when the integrity of the modification of the rights holder identification information is implemented in software, when the validity verification procedure of the new rights holder identification information is performed, it may be possible to change from the existing rights holder identification information to the new rights holder identification information. Of course, even when the integrity of the rights holder identification information is implemented in software, modification of the already recorded rights holder identification information may be controlled to be impossible, and the digital system 100 may allow only additional recording of new rights holder identification information. This may be implemented.

According to another embodiment, the integrity of the owner identification information may be implemented in hardware. That is, the rights holder identification information may be implemented so as not to be deleted or changed by any software such as an OS or firmware having the root authority of the digital system 100. To this end, the memory area included in the memory unit 120 and in which the rights holder identification information is recorded may be implemented as a memory device (for example, a programmable read only memory (PROM), etc.) in which data can be written only once. A memory device capable of writing data only once may be included in the memory unit 120 to guarantee the integrity of the rights holder identification information in hardware. As such, when the integrity of the modification of the owner identification information is implemented in hardware, the recording of the owner identification information recorded may not be possible.

In addition, according to an embodiment in which the integrity is implemented in hardware, modification of the recorded rights holder identification information may not be possible and only the addition of rights holder identification information may be possible. To this end, the memory unit 120 may include a plurality of memory areas in which a plurality of rights holder identification information may be recorded, and each memory area may include various memory devices in which data as described above may be written only once. May be used.

An example of this is shown in Fig.

7 is a diagram illustrating an embodiment of a memory unit included in a digital system in which rights holder identification information is recorded according to an embodiment of the present invention.

Referring to FIG. 7, the memory unit 120 may include a plurality of memory regions 10, 11, and 12. Each of the plurality of memory areas 10, 11, and 12 may be embodied as an area in which one owner identification information can be recorded. As such, when the memory unit 120 includes a plurality of memory areas 10, 11, and 12 in which rights holder identification information can be recorded, the digital system 100 includes a plurality of rights holder identification information (eg, identification information). 1, identification information 2, and identification information 3) may be recorded. The plurality of rights holder identification information may mean a case where the rights holder for the digital system 100 has a plurality of names. Alternatively, the current right holder may be changed, and right holder identification information corresponding to the past right holder may be included in the plurality of right holder identification information because a change in the right of the digital system 100 occurs.

In any case, the control unit 110 may be able to recognize the owner identification information corresponding to the current at least one owner. To this end, the control unit 110 included in the digital system 100 designates a memory area (eg, 12) corresponding to identification information of a current owner among the plurality of memory areas 10, 11, and 12. Information (eg, pointer variables) may be stored in a predetermined storage device. For example, the designated information may store an address (adr 3.) value of the memory area 12 in which the rights holder identification information of the current owner is stored. When the current owner has a plurality of names, the designated information (eg, pointer variable) may have a plurality of address values.

According to an embodiment of the present disclosure, the digital system 100 always identifies the right holder of the current owner in the last area in which the owner identification information is recorded among the memory areas 10, 11, and 12 in which the plurality of owner identification information is recorded. It can also be treated as an area in which information is recorded. That is, without maintaining and / or managing separate designated information, the right holder identification information of the memory area (eg, 12) in which the right holder identification information was last recorded may be treated as identification information of the right holder corresponding to the current right holder. . According to an exemplary embodiment, the controller 110 may record predetermined designation information indicating the current owner directly in each memory area (eg, 10, 11, 12). In this case, the designation information may be, for example, It may be implemented with simple flag information such as 0 or 1.

Meanwhile, as described above, at least some of the plurality of memory areas 10, 11, and 12 may be embodied as memory elements in which only one data can be written. Of course, it may be implemented as a memory device that can be recorded and deleted a plurality of times, in this case, the control to ensure the integrity of the modification of the rights holder identification information by software to be performed by the controller 110 Can be.

In addition, the memory unit 120 may include only one memory area for recording owner identification information.

On the other hand, access to the owner identification information may be possible by the user application. According to an embodiment of the present disclosure, a user application accessible to the rights holder identification information may also be limited or selected by the controller 110.

In addition, the memory unit 120 in which the rights holder identification information is recorded may be implemented as an internal memory mounted in the digital system 100. Therefore, the digital system 100 may be implemented to prevent the memory unit 120 from being removed by a malicious user so as not to disable the authentication using the right holder identification information according to the spirit of the present invention. Being mounted inside the digital system 100 means that the owner or a non-owner cannot remove the internal memory, or must disassemble the hardware configuration included in the digital system 100 in order to detach the internal memory. This may mean that the physical work of the user is required to be performed. That is, when the digital system 100 is manufactured, sold or distributed, it may mean that the internal memory is not implemented to be removed or detached in a manner that is allowed or intended for the general user. For example, when a predetermined open part (eg, a cell phone battery cover) is included in the housing of the digital system 100, it means that the internal memory is not removable or separated even if the open part is separated. can do. That is, it may mean a memory built in the digital system 100, not a memory implemented to be removable by a general user such as a USIM card of a mobile phone. The internal memory may be, for example, a system memory included in the digital system 100 or a memory provided in hardware (eg, a CPU, a network device, a video device, etc.) of the digital system 100 itself, but is not limited thereto. It doesn't work.

Meanwhile, in one embodiment of the present invention, the rights holder identification information recorded in the digital system 100 may be stored in the memory unit 120 together with boot firmware. The boot firmware has the control authority of the digital system 100 for the first time when the digital system 100 is powered on, and initializes the system and loads an operating system in the main memory for driving the digital system. do. Therefore, by storing the rights holder identification information together with the boot firmware, when a malicious user forcibly removes the memory unit 120 in which the rights holder identification information is recorded, booting is performed to perform the initial booting process of the digital system 100. The firmware can also be removed. Therefore, when the memory unit 120 is removed, the digital system 100 may not be used normally.

In some implementations, the owner identification information may be stored in the memory unit 120 in a state of being stored by a predetermined encryption protocol.

Referring back to FIG. 2, the control unit 110 may read the rights holder identification information stored in the memory unit 120 and transmit the read information to the service system 300. According to an embodiment, as described below, the owner identification information read to the application system 200 may be transmitted.

In the present specification, the control unit 110 transmits the rights holder identification information to a predetermined system, as well as the control unit 110 actively transmitting the rights holder identification information, and the system notifies the rights holder identification information. When requesting the control unit 110 to access, it may be a meaning including a series of processes to allow the system to obtain the owner identification information manually by allowing the request.

The controller 110 may specify the owner identification information corresponding to the current owner in order to read the owner identification information to the service system 300. For this purpose, predetermined designation information may be separately maintained / managed as described above, or the last recorded rights holder identification information may be specified as identification information corresponding to the current rights holder.

Then, the controller 110 may transmit the rights holder identification information specified to the service system 300, and the rights holder identification information transmitted is a service requested by the digital system 100 by the service system 300. It can be used to authenticate whether to allow. The service system 300 may use various aspects of using the rights holder identification information to determine whether to allow the service. For example, when the owner reports or registers that the digital system 100 is lost to a specific service system 300, the service system 300 will not allow the service by comparing the registered information with the owner identification information. You can also extract the request. Alternatively, it may be determined in advance whether information of a user (eg, a name corresponding to an ID) and the owner identification information stored in the service system 300 correspond to each other. Alternatively, it may be determined whether the input information input from the digital system 100 and the rights holder identification information correspond to each other when the service is requested. Then, the service may be allowed only for the service requested in the name of the person who is recognized as having the right with respect to the digital system 100.

A schematic configuration of such a service system 300 is shown in FIG.

In addition, a schematic configuration of an application system 200 installed in the digital system 100 to implement the technical idea of the present invention is shown in FIG. 3.

3 is a view showing a schematic configuration of an application system according to an embodiment of the present invention. 4 is a diagram illustrating a schematic configuration of a service system according to an exemplary embodiment of the present invention.

Referring to FIG. 3, in the application system 200 according to an embodiment of the present invention, the software code that can be installed in the digital system 100 and the hardware of the digital system 100 for driving the software code are organic. It may be a combined system. That is, the application system 200 may be implemented by installing predetermined software code (eg, an application) that performs the function of the application system 200 in the digital system 100.

The application system 200 includes a reader 210 and a transmitter 220.

The reader 210 may acquire rights holder identification information recorded in the memory unit 120 of the digital system 100. In order to obtain the rights holder identification information, the reader 210 may receive information on what rights holder identification information corresponding to the current rights holder is from the control unit 110 included in the digital system 100. That is, the reader 210 receives information (eg, an address, etc.) about a memory area in which rights holder identification information corresponding to a current owner is stored from the controller 110 and based on the received information. The reader 210 may directly read the owner identification information. Alternatively, the reader 210 may receive the owner identification information read from the controller 110. In any case, the reader 210 may obtain owner identification information corresponding to the current owner of the digital system 100. Then, the transmitter 220 may transmit the rights holder identification information obtained by the reader 210 to the service system 300.

Therefore, when the application system 200 is installed, the digital system 100 simply records the rights holder identification information in the memory unit 120 and performs only a function of protecting the integrity of the recorded rights holder identification information. In order to use the owner identification information, software for the application system 200 may need to be installed in the digital system 100.

In addition, when it is necessary to implement only the authorized application system 200 to access the owner identification information, the control unit 110 included in the digital system 100 by installing such an application system 200 May easily enable limited access to the owner identification information by using the list for the authorized application system 200.

Meanwhile, referring to FIG. 4, the service system 300 includes a service control unit 310 and an interface unit 320.

The service system 300 does not mean any one physical device, and a plurality of physical devices for providing a service requested by the digital system 100 are organically combined to constitute the service system 300. You may.

The interface unit 320 may receive owner identification information corresponding to the owner of the digital system 100 from the digital system 100 or the application system 200.

Then, the service controller 310 may determine whether to allow the requested service from the digital system 100 based on the received owner identification information. Determining whether the service is allowed or not based on the rights holder identification information means that the rights holder identification information is used to allow the service, and only the rights holder identification information is used to determine whether the service is allowed. It may not mean to be.

Accordingly, the service controller 310 compares the owner identification information with predetermined information, that is, a user authentication procedure such as login authentication or a predetermined hardware identification included in the digital system 100 in addition to the owner authentication procedure. A device authentication process using information may be further performed. For example, the user authentication procedure may include identification information (eg, login ID, biometric information) of a user requesting a service through the digital system 100 and authentication information (eg, password, the service system) corresponding to the user identification information. The biometric information registered at 300).

Meanwhile, the rights holder authentication procedure may mean a procedure for authenticating whether a user who requests the service, that is, a user corresponding to user identification information and the rights holder identification information correspond to each other. For example, when the user identification information is a login ID, the service system 300 may store a login ID and ID identification information (eg, name, biometric information, etc.) corresponding to the login ID. Then, the service controller 310 may compare the login ID and / or the ID identification information with the owner identification information to determine whether they correspond to each other. The ID identification information may include the owner identification information.

On the other hand, in order for the service controller 310 to perform the rights holder authentication procedure, the user identification information may not necessarily be stored in the service system 300 in advance. For example, in the case of a predetermined service that can be provided without performing login, the user identification information may be input from the digital system 100 upon request of the service. For example, when the service system 300 is a system for providing a payment service, the service system 300 may identify information (eg, name, phone number, card, etc.) for identifying a user requesting payment without having to log in. Information, etc.) may be input from the digital system 100. Then, the service control unit 310 may perform a rights holder authentication process by determining whether the received information and the rights holder identification information correspond to each other.

This example will be described in detail with reference to FIGS. 5 and 6.

5 and 6 are diagrams for explaining an example of a service procedure using a digital system in which right holder identification information is recorded according to an embodiment of the present invention.

FIG. 5 illustrates a case where a service requested by the digital system 100 is a login service for logging in to a web page provided by the service system 300, and FIG. 6 requests by the digital system 100. For example, the service is a payment service provided by the service system 300. In addition, the payment service may be a service provided even without logging in. The technical idea of the present invention can be applied to a wide variety of services, such as services for which specific information is queried, financial services, and payment services through digital TV, such as IPTV, in addition to the services illustrated in FIGS. 5 and 6. The average expert in the art will be able to reason easily.

First, referring to FIG. 5, the digital system 100 may access a predetermined web page provided by the service system 300. The digital system 100 may store owner identification information of the digital system 100 in the memory unit 120 before accessing the web page.

Thereafter, the digital system 100 may request a login to the service system 300 (S10). That is, the digital system 100 may request a login service from the service system 300. Then, the interface unit 320 of the service system 300 may transmit a predetermined response to the digital system 100 (S20). The response may include a signal indicating that an existing user authentication procedure provided by the web page is successful, for example, a login authentication procedure using a login ID and a password. The response may include a request for requesting the owner identification information.

In some embodiments, the response may be a request signal for requesting the rights holder identification information before performing the user authentication procedure.

In any case, the control unit 110 of the digital system 100 or the transmission unit 220 of the application system 200 receives the rights holder identification information stored in the memory unit 120. (S30).

The service control unit 310 may transmit a response requesting the rights holder identification information to the digital system 100 through the interface unit 320 if the user authentication procedure using the login ID and password is successful. If there is, first, a response for requesting the owner identification information may be transmitted to the digital system 100 to receive the owner identification information.

Then, the service controller 310 may determine to allow the service only when both the user authentication procedure and the rights holder authentication procedure succeed. In other words, you can allow logins. Of course, according to the implementation example, the user authentication procedure may not be performed at all, and if only the owner authentication procedure succeeds, it may be determined to allow the service.

When the user authentication procedure and the owner authentication procedure are both successful to allow the service, the user requesting the service knows login information (ID, password), and the user specified by the login information (that is, the corresponding ID). May imply that the service has been requested by the digital system 100 having rights (eg, ownership).

Therefore, according to the technical idea of the present invention, even if a person who is not a party right holder knows the ID and password of a specific account, login information is leaked to the digital system 100 in which rights holder identification information of the owner corresponding to the ID is recorded. Unless a login is requested, the login can be denied. For example, even if someone knows the login information, if there is no digital system 100 owned by the person corresponding to the ID, the login may be denied.

For example, according to the spirit of the present invention, there may exist a digital system 100 in which rights holder identification information corresponding to user A is recorded. Then, even if the user B knows the login information of A of the predetermined web page, the user can log in to the web page only if there is a digital system 100 in which the owner identification information of A is recorded.

In addition, even when the user B steals or arbitrarily uses the digital system 100 in which the rights holder identification information of A is recorded, there is an effect that the account of the B person cannot log in. This is because, in this case, the user authentication procedure can pass, but not the rights holder authentication procedure.

In general, when the user authentication procedure is incapacitated, the login information of a party nominee is leaked. In this case, a user who wants to use the leaked login information maliciously can acquire the digital system 100 of the party nominee. Since it is not common, according to the technical idea of the present invention, the security of authentication is significantly increased.

In addition, even when there is a malicious user who steals or acquires the digital system 100 and wants to use it arbitrarily, the malicious user requests a service in the name of the digital system 100 (eg, his account). Since the service is not available for login, etc.), there is an effect of significantly reducing the intention of stealing or exploiting the digital system 100 of another person in advance.

Meanwhile, referring to FIG. 6, a user may request a predetermined payment service from the service system 300 through the digital system 100 (S40). The payment service may be a service performed even without logging in. Then, the user may input payment information, that is, payment information, into a predetermined web page or web application provided by the service system 300. The payment information may include, for example, information about a payment means (for example, a phone corresponding to a phone number or a card corresponding to card information) such as a phone number or card information. In some embodiments, information representing a user such as a name may be further included in the payment information.

After the user inputs the payment information through the digital system 100 and requests a payment service, the payment information may be transmitted to the service system 300. Then, the service system 300 may transmit a predetermined response to request the owner identification information recorded in the memory unit 120 to the digital system 100 (S50). Then, the digital system 100 may transmit the owner identification information to the service system 300.

The service controller 310 receiving the rights holder identification information through the interface unit 320 may determine whether the received rights holder identification information corresponds to user identification information corresponding to the payment information. The user identification information corresponding to the payment information may be the information when the payment information includes information for identifying a user (eg, name, social security number, biometric information, etc.). When information for identifying the user is not included in the payment information, the service controller 310 may specify user identification information by using the information about the payment means.

For example, when the information to be entered by the user for payment is a name and a phone number (or card information), the service control unit 310 is based on whether the name and the owner identification information (eg, name) correspond to each other. The holder's certification process can be performed. If the information input by the user includes only information on payment means such as a telephone number (or card information), the service control unit 310 may identify the user's identification information (for example, the phone number (or card information)). The identification information of the user may be confirmed through communication with another system (eg, a communication company system or a card company system) storing the name. In addition, the owner authentication procedure may be performed by comparing the identified identification information with the owner identification information.

As a result, when the service provided by the service system 300 is a service that does not need to log in, the service control unit 310 of the user who requests a service through the information input by the digital system 100. It is possible to specify the user identification information, and determine whether the specified user identification information and the owner identification information correspond to each other. In addition, in order to specify user identification information, communication with a predetermined other system may be performed. Of course, the user identification information specified is preferably the same kind of information as the owner identification information.

Therefore, according to the technical concept of the present invention, even in a service that does not perform a user authentication procedure such as login, the service can be allowed only when the name of the person requesting the service and the owner corresponding to the owner identification information match.

Therefore, even when a malicious user knows payment information of another person, payment may not be performed unless a payment request is made through the digital system 100 to which the other person has a right.

As described above, the digital system 100 has an effect of allowing the service system 300 to perform a rights holder authentication process through rights holder identification information. In addition, the digital system 100 transmits hardware identification information (eg, MAC address, hardware-specific code, etc.) of the digital system 100 to the service system 300 to further perform the device authentication procedure as described above. You can send more. The hardware identification information may be hardware identification information of the digital system 100 itself when identification information corresponding to the digital system 100 itself exists, and according to an implementation example, the hardware identification information may be provided to the digital system 100. It may mean identification information of a predetermined hardware device (eg, CPU, USIM, network device, etc.) included.

Of course, when the application system 200 is installed, the application system 200 may obtain identification information of the hardware and transmit the identification information to the service system 300.

Then, the service system 300 may allow the service to be limited to predetermined hardware by comparing the received hardware identification information with previously stored hardware identification information.

As a result, according to the spirit of the present invention, the service may be allowed only through the digital system 100 in which the request holder of the requested service has a right. At the same time, when there are a plurality of digital systems 100 to which the rights holder has rights, all of them or only a predetermined digital system 100 can be provided with the service.

Meanwhile, the rights holder identification information recorded in the digital system 100 is preferably information whose integrity is protected in the manner described above. However, there may be a case where the integrity of the owner identification information is damaged by an unexpected error or attack. The present invention may provide a technical idea that a malicious user may not arbitrarily use the digital system 100 even when the integrity of the owner identification information is compromised.

To this end, the controller 110 may further store the rights holder identification information in another storage area included in the digital system. The other storage area may be an area of the memory unit 120 or an area included in a storage device separate from the memory unit 120. That is, the digital system 100 may duplicate and store and protect the rights holder identification information.

Therefore, the controller 110 may authenticate the validity of the rights holder identification information by itself. For example, in order for the rights holder identification information to be valid, the rights holder identification information recorded in the memory unit 120 and the rights holder identification information stored in another predetermined storage area are preferably the same information. Therefore, if an unexpected attack or integrity protection mechanism does not operate properly and the rights holder identification information recorded in the memory unit 120 is changed, the controller 110 identifies the rights holder recorded in the memory unit 120. You can also deauthorize the information as invalid.

If the controller 110 changes the owner identification information recorded in the memory unit 120 by a normal process, the controller 110 may synchronize the two information by changing the information stored in the other storage area. Can be. However, when the owner identification information recorded in the memory unit 120 is changed by an abnormal process, the owner identification information may be deauthenticated.

Therefore, when the controller 110 has not authenticated the rights holder identification information, the rights holder identification information may not be transmitted to the service system 300 or the application system 200, or the rights holder is transmitted. The identification information may be transmitted with predetermined information so that the service system 300 or the application system 200 can confirm that the identification information is unauthorized information.

Then, when the service system 300 does not receive the rights holder identification information from the digital system 100 or the application system 200 or receives predetermined non-authentication information indicating that the rights holder identification information has been deauthenticated, You can also decide not to allow the service. Of course, when the owner identification information is not received, the owner identification information may not be recorded in the memory unit 120 from the beginning, and even in this case, the service system 300 may not permit the service. .

Therefore, even when the integrity of the rights holder identification information is broken in a way that the digital system 100 does not predict, there is an effect that at least another person can use the service under the right rights holder's name. On the other hand, if such integrity is broken, a procedure of newly recording the rights holder identification information may be performed after a process of validating the rights holder identification information by a predetermined authorized subject or user as described above.

FIG. 8 is a schematic flowchart illustrating a digital system providing method in which rights holder identification information is recorded according to an exemplary embodiment of the present invention.

Referring to FIG. 8, the digital system 100 may store rights holder identification information in a predetermined area (S100). Then, the digital system 100 may perform a predetermined protection mechanism for protecting the integrity of the rights holder identification information (S110). The protection mechanism may include a process for preventing the rights holder identification information from being modified by a process in which the controller 110 is not authorized.

In addition, the digital system 100 may authenticate the validity of the rights holder identification information before transmitting the rights holder identification information to the service system 300 that the digital system 100 requests the service (S120).

In addition, the owner identification information may be transmitted to the service system 300 only when validity is verified (S130). Or it may be transmitted to the application system 200. If the validity is not authenticated, the service may not be allowed by not transmitting the rights holder identification information or transmitting non-authentication information (S140).

9 is a schematic flowchart illustrating a service system providing method according to an exemplary embodiment of the present invention.

Referring to FIG. 9, the service system 300 may receive owner identification information from the digital system 100 (S210). The rights holder identification information may be actively transmitted by the digital system 100 to the service system 300, and when the service system 300 makes a request to the digital system 100 or the application system 200. It may be transmitted only to the service system 300 (S200).

Then, the service system 300 is a predetermined owner to check whether the user corresponding to the service request (for example, the user corresponding to the login ID or the user corresponding to the payment information, etc.) and the owner corresponding to the owner identification information. The authentication procedure may be performed (S230). The user authentication procedure may be further performed before or after the rights holder authentication procedure (S220).

Then, if the rights holder authentication procedure (or at least one of the user authentication procedures) does not pass, the service system 300 may determine not to allow the service requested from the digital system 100 (S250). If the rights holder identification information (and user authentication procedure) is passed, the service system 300 may allow the requested service (S240).

According to an embodiment of the present invention, since the owner of the digital system 100 is recorded in the digital system 100 in advance, a new type of web service may be variously serviced. For example, when logging in to a specific web service, the owner identification information according to the technical idea of the present invention may be used without using the login ID. Of course, in this case, it may be more preferable that the owner identification information is unique for each user. For example, the name of the owner of the mobile phone may be recorded on the mobile phone. Then, the service may be implemented such that the mobile phone is always accessible only to the owner's account. If a plurality of users can use the same name (ie, owner identification information), the service system 300 corresponds to the owner identification information and maintains unique information (eg, device identification information, etc.) for each user. It may be. In this case, the particular service has the effect of determining the account available by the device, i.e., the digital system 100. Of course, in the case of finally determining whether to allow the service (login), the authentication procedure through a password or the like may be further passed.

According to the technical idea of the present invention, the digital system 100 may have the effect of providing the service only in the name of the owner (or other right holder) of the digital system 100 in various services such as payment as well as payment. have.

That is, according to the technical idea of the present invention, the identification of the service requester requesting the service is not recorded in the digital system 100, but is identification information (for example, ID) inputted through the digital system 100. There is an effect that can be achieved by the owner identification information. Thus, regardless of who the service requester actually requests (eg, owner, stealer, acquirer, etc.) through the digital system 100, the service system 300 determines the owner identification information as a service requester. can do. Accordingly, the service requester may perform login by simply inputting authentication information such as a password without having to input a login ID or the like. According to this technical idea, since the user cannot select the name of the person requesting the service, the user may always provide the effect of using the service only with the account or the name corresponding to the rights holder identification information. In addition, it can provide an effect that can block the intention to abuse the digital system of others as its own system.

In addition, according to the technical idea of the present invention, even if a person who steals or misuses personal information does not possess the digital system 100 in the name of the owner, even if the personal information is misused, the personal information may be misused or misused. There is also an effect that can reduce the intention itself.

The method for providing a digital system, an application system, and / or a service system according to an exemplary embodiment of the present invention may be embodied as computer readable codes on a computer readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a hard disk, a floppy disk, an optical data storage device, and the like in the form of a carrier wave (for example, . In addition, the computer-readable recording medium may be distributed over network-connected computer systems so that computer readable codes can be stored and executed in a distributed manner. And functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers skilled in the art to which the present invention pertains.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

Claims (12)

In a digital system requesting a service from a predetermined service system,
A memory unit which records in advance owner's identification information of the owner of the digital system; And
And a control unit for reading out the right holder identification information stored in the memory unit and transmitting it to the service system.
Based on the rights holder identification information transmitted, only the service of the rights holder corresponding to the rights holder identification information is allowed by the service system,
The memory unit,
Includes a plurality of memory areas in which rights holder identification information can be recorded,
In some of the plurality of memory areas, identification information of a previous owner who has been an owner of the digital system is recorded or
And at least one current owner's identification information is recorded in at least one of the plurality of memory areas.
In a digital system requesting a service from a predetermined service system,
A memory unit which records in advance owner's identification information of the owner of the digital system; And
And a control unit for reading out the right holder identification information stored in the memory unit and transmitting it to the service system.
Based on the rights holder identification information transmitted, only the service of the rights holder corresponding to the rights holder identification information is allowed by the service system,
By the service system,
A user authentication procedure using user identification information of the user requesting the service and authentication information corresponding to the user identification information, and an owner authentication procedure for determining whether the user identification information and the owner identification information correspond to each other;
A digital system in which rights holder identification information for providing the service is recorded only when both the user authentication procedure and the rights holder authentication procedure are successful.
In a digital system requesting a service from a predetermined service system,
A memory unit which records in advance the name of the owner of the digital system; And
And a control unit for reading the name stored in the memory unit and transmitting the read name to the service system.
And only the service of the rights holder's name corresponding to the transmitted name is allowed by the service system.
The method of claim 3, wherein the digital system,
At least part of the function of the digital system cannot be used unless the name is input to the digital system and recorded in the memory unit.
The method of claim 3, wherein the memory unit,
Includes a plurality of memory areas where names can be recorded,
Some of the plurality of memory areas may include a name of a previous owner who was an owner of the digital system, or
And at least one current owner's name is recorded in at least one of the plurality of memory areas.
6. The apparatus of claim 5,
And rights holder identification information for storing designation information designating a memory area corresponding to a name of the at least one current rights holder of the plurality of memory areas.
The method of claim 3, wherein the service system,
A user authentication procedure using user identification information of the user requesting the service and authentication information corresponding to the user identification information, and an owner authentication procedure for determining whether the user identification information and the name correspond to each other;
And a rights holder identification information for determining that the user authentication procedure and the rights holder authentication procedure must be successful to provide the service.
An application system that can be installed in a digital system that requests a service to a predetermined service system,
A reading unit for obtaining the name from a memory unit which records in advance the name of the owner of the digital system; And
A transmission unit for transmitting the name obtained by the reading unit to the service system,
And only a service of an owner name corresponding to the name transmitted is allowed by the service system.
1. A service system for providing a predetermined service requested from a digital system,
An interface unit for receiving a name of an owner pre-stored in a memory unit of the digital system from the digital system or an application system installed in the digital system; And
And a service control unit for allowing only the service of the rights holder's name corresponding to the received name to the digital system.
In the digital system providing method for requesting a service to a predetermined service system,
The digital system pre-recording the name of the owner of the digital system in a memory unit; And
Reading, by the digital system, the stored name and transmitting the stored name to the service system;
And only a service of an owner name corresponding to the name transmitted is allowed by the service system.
In the method of providing an application system that can be installed in a digital system that requests a service to a predetermined service system,
Acquiring, by the application system, the name from a memory unit which records in advance the name of the owner of the digital system; And
Transmitting, by the application system, the obtained name to the service system;
And only a service of an owner name corresponding to the name transmitted is allowed by the service system.
In the service system providing method for providing a predetermined service requested from a digital system,
Receiving, by the service system, a name of an owner previously recorded in the memory unit of the digital system from the digital system or an application system installed in the digital system;
And allowing the service only if the service system is a service of an owner name corresponding to the received name.

Images