Security group management system

• US 20060174121A1
• Filed: 01/04/2006
• Published: 08/03/2006
• Est. Priority Date: 01/11/2005
• Status: Active Grant

• Current Assignee: NTT Docomo Incorporated (Nippon Telegraph and Telephone Corporation)
• Original Assignee: NTT Docomo Incorporated (Nippon Telegraph and Telephone Corporation)
• Inventors: Omae, Koji, Matsumoto, Yoichi
• Granted Patent: US 7,647,036 B2
• Time in Patent Office: Days
• US Class Current: 713/172
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04M 2203/2044 Group features, e.g. closed user group
• CPC Class Codes: H04M 2203/6081 Service authorization mechanisms
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 4/06 Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
• CPC Class Codes: H04W 4/08 User group management
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities
• CPC Class Codes: H04W 84/042 Public Land Mobile systems, e.g. cellular systems

Abstract

A security group management system includes a cellular mobile station (2), two or more devices (3) belonging to a group, and a group management server (1). The group management server comprises a storage unit (11, 13) configured to store information about the cellular mobile station registered by a member of the group and group information about the group in advance; and a group information providing unit (16) configured to supply the group information in response only to an access from the registered cellular mobile station. The cellular mobile station has a group information transmission unit (23) configured to supply the group information to the devices so as to allow the devices to recognize that the devices belong to the group and to perform secure mutual connection and/or resource sharing among the devices.

Claims

1. A security group management system including a cellular mobile station, two or more devices belonging to a group, and a group management server,

wherein the group management server comprises:

a storage unit configured to store information about the cellular mobile station and group information about the group in advance; and

a group information providing unit configured to supply the group information in response only to an access from the registered cellular mobile station; and

wherein the cellular mobile station has a group information transmission unit configured to supply the group information to the devices so as to allow the devices to recognize that the devices belong to the group and to perform secure mutual connection and/or resource sharing among the devices.

2. The security group management system of claim 1, wherein the group information is an electronic certificate containing a first public key allocated to the group and signed by a first private key paired with the first public key.

3. The security group management system of claim 2, wherein when one of the devices has received the electronic certificate, the device thereafter relies on a publisher of the electronic certificate as a certificate authority.

4. The security group management system of claim 2, wherein the group information is a device key pair consisting of a second private key and a second public key allocated for each of the devices.

5. The security group management system of claim 1, wherein the group information is a symmetric key allocated to the group.

6. The security group management system of claim 1, wherein the group information is a device list listing the devices belonging to the group.

7. The security group management system of claim 1, wherein communication between the cellular mobile station and the group management server is started after SSL client authentication is successful.

8. The security group management system of claim 1, wherein the cellular mobile station and the devices have short-range wireless interfaces, and the group information is supplied from the cellular mobile station to the devices via short-range wireless communications.

9. The security group management system of claim 1, wherein at least one of the devices has a hardware button for limiting receipt of the group information to a prescribed period of time after the hardware button is depressed.

10. The security group management system of claim 1, wherein the storage unit includes:

a first storage unit configured to store a group identification in association with the group information;

a second storage unit configured to store an individual identification representing an individual belonging to the group and using the cellular mobile station, in association with the group ID, and

a third storage unit configured to store a cellular mobile station identification representing the cellular mobile station in association with the individual identification.

11. The security group management system of claim 10, wherein the cellular mobile station identification is registered and updated in the third storage unit in response to a request from the cellular mobile station.

12. The security group management system of claim 1, wherein the group management server produces and outputs a two-dimensional code containing an individual ID representing a user of the cellular mobile station and a network address of the group management server, and the cellular mobile station has a code reader for reading the two-dimensional code distributed to the user to access the group management server.

13. The security group management system of claim 1, wherein the storage unit further stores device identification for specifying each of the devices and an attribute of the associated one of the devices, in association with a cellular mobile station identification specifying the cellular mobile station.

14. The security group management system of claim 13, wherein the device identification is acquired by the cellular mobile station from the device, and supplied from the cellular mobile station to the group management server.

15. The security group management system of claim 13, wherein the device identification is produced by a user of the cellular mobile station, given to the device, and registered and updated in the storage unit of the group management server.

16. The security group management system of claim 13, wherein the storage unit stores a typical application of each of the devices as the attribute, in association with a traffic priority level for the device.

17. The security group management system of claim 16, wherein the storage unit temporarily changes the traffic priority level in response to a request from the cellular mobile station, and the group information providing unit informs the devices of the change via the cellular mobile station.

18. The security group management system of claim 16, wherein at least one of the devices has two or more wireless interfaces, and the wireless interfaces are grouped into an ordinary traffic group and a preferential traffic group so as to prevent frequencies from overlapping each other.

19. The security group management system of claim 16, wherein upon receiving a request for content delivery from the cellular mobile station, the group management server selects a most appropriate device to receive the content from the storage unit and deliver the content to the selected device.

20. The security group management system of claim 1, wherein the group management server further comprises:

a service charge calculation unit configured to calculate a service charge based upon at least one of a storage area utilization size, service utilization time, access counts, accessing time, and an acquired information amount.

21. A security group management method applied to a mesh network including a cellular mobile station, two or more devices belonging to a group, and a group management server, the method comprising the steps of:

registering the cellular mobile station in the group management server in advance;

generating and storing group information for the group in the group management server;

supplying the group information from the group management server to the cellular mobile station in response only to an access from the registered cellular mobile station, and

supplying the group information from the cellular mobile station to the devices so as to allow the devices to recognize that the devices belong to the group and to perform secure mutual connection and/or resource sharing among the devices.