# US 8,543,832 B2 · Service provision system and communication terminal > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,832 B2 - Document ID: US8543832B2 - Status: Granted - Kind: B2 - Application number: 12/243,030 - Filed: 2008-10-01 - Published: 2009-04-16 - Granted: 2013-09-24 - Earliest claimed: 2007-10-15 - Assignees: Sony Corporation - Applicants: Hiroshi Abe - Inventors: Hiroshi Abe - Web page: https://patentgrep.com/patent/US8543832B2 ## CPC - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 2209/60: Digital content management, e.g. content distribution - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A first memory unit is arranged outside a block that is under security control. The block includes: a second memory unit; an acquisition unit for acquiring biological information on a living body from a captured image of a location of the living body; an encryption unit for encrypting attribute information with an encryption key; a registration unit for registering encrypted attribute information encrypted by the encryption unit into the first memory unit, and registering the biological information and the encryption key into the second memory unit; and a presentation unit for decrypting the encrypted attribute information with the encryption key and presenting the attribute information decrypted to the service provision server if the biological information registered in the second memory unit and biological information acquired by the acquisition unit coincide with each other. ## Claims ### Claim 1 A service provision system comprising: a service provision server; and a communication terminal capable of communicating with the service provision server over a network, the communication terminal including: a first memory unit arranged outside a block that is under security control, the first memory unit storing encrypted attribute information; a second memory unit arranged inside the block, the block having a higher security level than the first memory unit, the second memory unit storing an encryption key and biological information; an acquisition unit for acquiring the biological information on a living body from a captured image of a location of the living body, being arranged in the block; an encryption unit for encrypting user's attribute information on a service of the service provision server with the encryption key, being arranged in the block; a registration unit for registering the encrypted attribute information encrypted by the encryption unit into the first memory unit, and registering the biological information and the encryption key into the second memory unit, such that the biological information and encryption key are stored in the block having a higher security level that the first memory unit, the registration unit being arranged in the block; and a decryption unit for decrypting the encrypted attribute information registered in the first memory unit of the communication terminal with the encryption key registered in the second memory unit of the communication terminal if the biological information registered in the second memory unit of the communication terminal and biological information acquired by the acquisition unit of the communication terminal coincide with each other, the decryption unit being arranged in the block; and the service provision server including a provision processing unit for executing processing for providing its own service based on the attribute information decrypted by the decryption unit. ### Claim 2 A communication terminal capable of communicating with a service provision server over a network comprising: a first memory unit arranged outside a block that is under security control, the first memory unit storing encrypted attribute information; a second memory unit arranged inside the block, the block having a higher security level than the first memory unit, the second memory unit storing an encryption key and biological information; an acquisition unit for acquiring the biological information on a living body from a captured image of a location of the living body, being arranged in the block; an encryption unit for encrypting the attribute information with the encryption key, being arranged in the block; a registration unit for registering the encrypted attribute information encrypted by the encryption unit into the first memory unit, and registering the biological information and the encryption key into the second memory unit, such that the biological information and encryption key are stored in the block having a higher security level that the first memory unit, the registration unit being arranged in the block; and a presentation unit for decrypting the encrypted attribute information registered in the first memory unit of the communication terminal with the encryption key registered in the second memory unit of the communication terminal and presenting the attribute information decrypted to the service provision server if the biological information registered in the second memory unit of the communication terminal and biological information acquired by the acquisition unit of the communication terminal coincide with each other, the presentation unit being arranged in the block. ### Claim 3 (depends on 2) The communication terminal according to claim 2, further comprising a certificate acquisition unit for acquiring an attribute certificate generated by the service provision server, the attribute certificate including a user ID authenticated by a third party organization other than a registration apparatus and the service provision server, the attribute information, and an identifier for determining the presence or absence of tampering with the user ID and the attribute information, wherein the encryption unit encrypts the attribute certificate acquired by the certificate acquisition unit with an encryption key generated by a generation unit. ### Claim 4 (depends on 3) The communication terminal according to claim 3, wherein the certificate acquisition unit transmits attribute information input by a user to the service provision server over the network, and acquires an attribute certificate generated by the service provision server, the attribute certificate including the attribute information, the user ID, and the identifier. ### Claim 5 (depends on 2) The communication terminal according to claim 2, wherein: the attribute information includes a use privilege over the service of the service provision server; and the communication terminal further comprising an update unit for updating association of an encryption key with biological information and updating registration of encrypted attribute information in the first memory unit if the use privilege is modified, the update unit being arranged in the block. ### Claim 6 (depends on 2) The communication terminal according to claim 2, further comprising a generation unit for generating an encryption key unique to the attribute information, being arranged in the block, wherein the encryption unit encrypts the attribute information with the encryption key generated by the generation unit; the registration unit registers the encryption key into the second memory unit in association with the biological information; and the presentation unit decrypts the encrypted attribute information with the encryption key that is associated with the biological information registered in the second memory unit if the biological information registered and biological information acquired by the acquisition unit coincide with each other. ### Claim 7 (depends on 6) The communication terminal according to claim 6, wherein the generation unit generates the encryption key unique to the attribute information by using the biological information.