In the telemedical system securely sharing encryption keys for enabling secure exchange of the encrypted biological data between the measurement terminal and the server to prevent the data from being stolen by the malicious third party, a service key is transferred to the second adapter attached to a measurement terminal from the server via the first adapter attached to the management apparatus. First, the first adapter attached to the management apparatus receives the service key from the server. Next, the first adapter is temporarily detached from the management apparatus and is attached to the measurement terminal to store the symmetric key. The first adapter is detached from the measurement terminal, and is attached to the management apparatus again. The service key received in the first adapter is encrypted using the symmetric key, and the encrypted key is transmitted to the second adapter attached to the measurement terminal.

BACKGROUND OF THE INVENTION

(1) Field of the Invention

The present invention relates to telemedical systems, and particularly to a telemedical system in which keys for encrypting biological data are shared securely.

(2) Description of the Related Art

In recent years, awareness about health has been growing. One example that demonstrates the trend is measures against obesity, and with the coming of aging society, demand for comprehensive medical services has been rising.

However, some are unable to receive sufficient medical attention due to the distance to a medical facility that poses a barrier for visiting the facility for medical examination. In addition, from the perspective of preventative medical care, there is a growing demand for detailed services which enables a user to measure or refer to his/her health condition anytime and anywhere to improve the user's health condition.

Various technical solutions have been proposed to solve the problems and to meet the demand. For example, sensors for measuring biological data such as body weight and blood pressure have been miniaturized and improved in accuracy, which enables sensing of more biological data. Meanwhile, the network technology has rapidly advanced along with the spread of the broadband network such as optical fiber networks, the increase in the number of hotspot access points, and the development of WiMAX. In response to the advancement, it is expected that a combination of the sensor technology and the network technology provides more advanced and convenient medical services. Prospective telemedical services using various telemedical systems include at-home medical examinations by doctor, provisions of a variety of supplemental information upon medical examination through constant monitoring of body weight and blood pressure, and health management by a user by referring to the user's body weight and blood pressure through a computer at home and a mobile phone when the user is out.

However, biological data such as body weight, body temperature and blood pressure is among the most important personal information. Thus, for implementing the above-described telemedical service that utilizes the network technology, it is necessary to prevent the biological data from being stolen, and to allow only the users to refer to the biological data by using techniques such as encryption.

In order to solve the problem, a health management support system that manages biological data by obtaining the biological data through a sensor and transmitting the data to a management server (for example, see Japanese Unexamined Patent Application Publication No. 2003-76791).

In addition, a contents information providing system that provides diverse information including medical information based on information read from tags attached to goods, although the information being read is not limited to biological data (for example, see Japanese Unexamined Patent Application Publication No. 2006-228174).

However, in the configuration shown in Japanese Unexamined Patent Application Publication No. 2003-76791, communication between the biological sensor and the dedicated terminal and between the dedicated terminal and the management center is encrypted, but not between the biological sensor and the management center. Due to this configuration, there is a possibility that the biological data is exposed in the dedicated terminal. In addition, since the key is embedded in the sensor, the key may also leak when the sensor is analyzed.

Furthermore, in the configuration shown in Japanese Unexamined Patent Application Publication No. 2006-228174, although encrypted communication is performed between the IC tag and the server, there is no description or suggestion for a key management method. Thus, the key may leak when the IC tag is analyzed.

As described above, with the conventional techniques, there is a possibility that an encryption key for encrypting biological data exchanged between a measurement terminal and a server leaks, which makes it difficult to prevent the data from being stolen by a malicious third party.

In view of the above-described problems, it is an object of the present invention to provide a telemedical system that can prevent the biological data from being stolen by a malicious third party by securely sharing symmetric keys for encrypting the biological data exchanged between the measurement terminal and the server.

SUMMARY OF THE INVENTION

In order to solve the above-described problem, a telemedical system according to one aspect of the present invention includes a management apparatus, a measurement apparatus and, a server. A service key is transferred from the server to a second adapter attached to a measurement terminal via a first adapter attached to a management apparatus. The first adapter attached to the management apparatus receives the service key from the server. Next, the first adapter is temporarily detached from the management apparatus and is attached to the measurement terminal to store a symmetric key. The first adapter is detached from the measurement terminal, and is attached to the management apparatus again. The service key received in the first adapter is encrypted using the symmetric key, and the encrypted key is transmitted to the second adapter attached to the measurement terminal. The service key used for encryption can be shared in the telemedical system.

In the telemedical system according to the one aspect of the present invention, keys for encryption can be securely shared. This enables secure exchange of the encrypted biological data between the measurement terminal and the server, and therefore the present invention can prevent the data from being stolen by the malicious third party.

The disclosure of Japanese Patent Application No. 2007-272115 filed on Oct. 19, 2007 including specification, drawings and claims is incorporated herein by reference in its entirety.

DESCRIPTION OF THE PREFERRED EMBODIMENT(S)

The telemedical system in a first aspect of the present invention includes a first adapter that is attachable to a measurement terminal that obtains biological data of a user of the measurement terminal by measuring the user and to a management apparatus that manages the measured biological data; a second adapter that is attachable to the measurement terminal; and a server which communicates with the first adapter, in which the first adapter includes: a key holding unit which receives, from the server, a service key used for encrypting the biological data and to store the received service key, when the first adapter is attached to the measurement terminal; a first symmetric key generating unit which obtains unique information of the measurement terminal from the measurement terminal and to generate a symmetric key based on the obtained unique information, when the first adapter is attached to the management apparatus while the service key is stored in the key holding unit; a key encryption unit which encrypts the service key using the symmetric key and to store the encrypted service key in the key holding unit, when the first adapter is attached to the management apparatus; and a first communication unit which transmits the encrypted service key to the second adapter attached to the measurement terminal, and the second adapter includes: a second symmetric key generating unit which obtains from the measurement terminal the unique information of the measurement terminal and to generate a symmetric key based on the obtained unique information, when the second adapter is attached to the measurement terminal; a key decryption unit which decrypts the encrypted service key using the symmetric key generated in the second symmetric key generating unit, when the second adapter receives the encrypted service key from the first adapter; and a second communication unit which encrypts, using the decrypted service key, the biological data of the user measured by the measurement terminal and to transmit the encrypted biological data to the server via the first adapter.

According to this aspect, the service key is transferred to the second adapter attached to a measurement terminal from the server via the first adapter attached to the management apparatus. More specifically, first, the first adapter attached to the management apparatus receives the service key from the server. Next, the first adapter is temporarily detached from the management apparatus and is attached to the measurement terminal to store the symmetric key. The first adapter is detached from the measurement terminal, and is attached to the management apparatus again. The service key received in the first adapter is encrypted using the symmetric key, and the encrypted key is transmitted to the second adapter attached to the measurement terminal.

Accordingly, the symmetric key is obtained through hand-carry of the first adapter by the user, and thus the symmetric key does not leak outside the telemedical system via the network. Confidentiality of the service key is securely protected since the service key encrypted using the confidential symmetric key is transmitted to the measurement terminal and the service key is decrypted only in the measurement terminal. Furthermore, even when the measurement information from the measurement terminal is transmitted to the server, confidentiality of the transmitted measurement information is guaranteed since the measurement information is encrypted using the highly confidential service key.

In addition, the first adapter and the second adapter include control function such as decryption and encryption of the service key and generation of the symmetric key, and communication function. Thus, the management terminal or the measurement terminal may not necessarily include control function or communication function. This allows use of the conventional configuration to the measurement terminal, in addition to the reduction in the assembly cost of the measurement terminal.

Furthermore, in the telemedical system in the first aspect of the present invention, in the first adapter, the first symmetric key generating unit may not generate the symmetric key when the first adapter is attached to the measurement terminal while the service key is not stored in the key holding unit.

Furthermore, in the telemedical system in the first aspect of the present invention, the first symmetric key generating unit may delete the symmetric key and the service key after the first communication unit transmits the encrypted service key to the second adapter. Furthermore, in the telemedical system in the first aspect of the present invention, the second symmetric key generating unit may delete the symmetric key generated in the second symmetric key generating unit after the key decryption unit decrypts the encrypted service key using the symmetric key.

Furthermore, in the telemedical system in the first aspect of the present invention, the first symmetric key generating unit may generate the symmetric key based on the unique information of the measurement terminal using a predetermined calculation method, and the second symmetric key generating unit may generate the symmetric key based on the unique information of the measurement terminal using the predetermined calculation method.

Furthermore, in the telemedical system in the first aspect of the present invention, the first symmetric key generating unit and the second symmetric key generating unit may generate the symmetric key using a hash function as the predetermined calculation method.

Furthermore, in the telemedical system in the first aspect of the present invention, the first symmetric key generating unit and the second symmetric key generating unit may generate the symmetric key using a unique identifier of the measurement terminal as the unique information of the measurement terminal.

Furthermore, the telemedical system in a second aspect of the present invention includes a first adapter in a telemedical system including the first adapter, a second adapter, and a server, the first adapter being attachable to a measurement terminal that measures biological data of a user of the measurement terminal and being attachable to a management apparatus that manages the measured biological data, the second adapter being attachable to the measurement terminal, and the server communicating with the first adapter, the first adapter including: a key holding unit which receives a service key used for encrypting the biological data, from the server and to store the received service key when the first adapter is attached to the measurement terminal; a symmetric key generating unit which obtains unique information of the measurement terminal from the measurement terminal and to generate a symmetric key based on the obtained unique information, when the first adapter is attached to the management apparatus while the service key is stored in the key holding unit; a key encryption unit which encrypts the service key using the symmetric key and to store the encrypted service key in the key holding unit, when the first adapter is attached to the management apparatus; and a communication unit which transmits the encrypted service key to the second adapter attached to the measurement terminal.

The above-described aspects may not only be implemented as an apparatus, but also be implemented as an integrated circuit including processing units included in the apparatus, a method including the processing units configuring the apparatus as steps, or a program causing a computer to execute the steps. The program may be distributed via the recording medium such as CD-ROM, or the communication medium such as the Internet.

An embodiment of the telemedical system according to the present invention is hereafter described with reference to the drawings.

A telemedical system1is according to the embodiment of the present invention will be hereinafter described.

FIG. 1shows an example of the telemedical system1according to the embodiment of the present invention. Here, as an example of specific service, a service in which a health care service vendor that operates the server13manages history of clients' (users') body weight data as their biological data using the network.

The telemedical system1includes the external network11, the internal network12, the server13, the user terminal14, the user terminal adapter15, the measurement terminal16, and the measurement terminal adapter17.

Note that, although only one measurement terminal16and measurement terminal adapter17are illustrated inFIG. 1, there may be multiple measurement terminals16and multiple measurement terminal adapters17. In addition, although the user terminal14includes a user interface, the user terminal14may operate as a gateway without a user interface function.

The server13and the user terminal14are connected to the external network11. The external network11is a Wide Area Network such as the Internet. Note that the external network11may be a network, for example, a telephone line or a dedicated line.

The user terminal adapter15and the measurement terminal adapter17are connected to the internal network12. The internal network12is a short range wireless communication path, and is implemented, for example, by Bluetooth™.

The server13provides the user terminal14with the body weight management service. For example, the server13provides the services including:

(1) distribution of a service key to the measurement terminal adapter17inserted in the measurement terminal16of a registered user via the user terminal adapter15inserted in the user terminal14;

(2) collection of encrypted body weight data collected in the user terminal14; and

(3) data provision for display of the body weight data collected in the server13in the user terminal14.

The user terminal14is operated by the user, and is, for example, a personal computer or a digital television. Furthermore, the user terminal14includes a slot to which the user terminal adapter15can be inserted.

When the user terminal adapter15is inserted, the user terminal14is capable of, for example, joining the body weight data management service provided by the vendor offering health care service and operating the server13and displays the body weight data. More specifically, the user terminal14to which the user terminal adapter15is inserted can provide the user with the following services:

(1) user registration at the server13;

(2) collection of the body weight data measured in the measurement terminal16;

(3) registration of the collected encrypted bodyweight data on the server13; and

(4) display of the history of the body weight data managed in the server13.

Here, the measurement terminal16is a weighing scale that can measure the user's body weight. Furthermore, the measurement terminal16includes a slot to which the measurement terminal adapter17can be inserted. When the measurement terminal adapter17is inserted, the measurement terminal16is capable of registering the body weight data on the server13via the user terminal14. More specifically, the measurement terminal16to which the measurement terminal adapter17is inserted, can provide the following services:

(1) measurement of the user's body weight; and

(2) encryption of the measured body weight data using a service key and transmits the encrypted body weight data to the user terminal14.

Note that the user terminal adapter15is inserted to the slot in the user terminal14when in use. The user terminal adapter15can provide the user with the following services:

(1) reception of the service key from the server13via the external network11;

(2) transmission of the service key encrypted using a symmetric key generated from the unique information of the measurement terminal16to the measurement terminal adapter17;

(3) transmission of the measured body weight data to the server13via the external network11after the body weight data is encrypted using the service key in the measurement terminal adapter17; and

(4) obtainment of the body weight data managed in the server13and display of the body weight data on the user terminal14.

Here, instead of the user terminal14, the user terminal adapter15receives and holds the service key transmitted from the server13in order to prevent the data from being stolen by a malicious third party or leaks of the data to a third party.

The measurement terminal adapter17is inserted to the slot in the measurement terminal16when in use.

The measurement terminal adapter17performs the following:

(1) reception of the service key from the user terminal adapter15; and

(2) encryption of the body weight data measured in the measurement terminal16and transmission of the body weight data to the user terminal adapter15via the internal network12.

Here, instead of the measurement terminal16, the measurement terminal adapter17holds the service key in order to prevent the data from being stolen by a malicious third party or leaks of the data to a third party. The measurement terminal adapter17encrypts and transmits the encrypted biological data such as body weight data for the same reason.

As described above, the user terminal14and the measurement terminal16do not hold the service key for encrypting the body weight which is biological data, in order to prevent the biological data from being stolen by the malicious third party and from leaking to a third party by lowering the possibility of the stealing and the leak. The user terminal adapter15and the measurement terminal adapter17hold the service key.

Note that the description of an aspect for secure sharing of the service key which is a key for encryption is to be described later, and thus the description is omitted here.

<Configuration of the Server13>

FIG. 2shows the configuration of the server according the embodiment of the present invention.

As shown inFIG. 2, the server13includes the service key holding unit131, the measured data holding unit132, the transmission/reception unit133and the measured data registration unit134.

The service key holding unit131holds the service key. Here, the service key takes values of, for example, 128 bits, 192 bits, or 256 bits, and is generated using random numbers when the server13is activated and in operation.

The measured data holding unit132holds the user's measured data. More specifically, multiple sets of user identifiers, user information, and, for example, biological measurement data which is measurement of biological data such as the body weight data measured in the measurement terminal16. The user identifier is, for example, a unique value of 128 bits, 192 bits, or 256 bits. The user information is information of the user such as name, gender, address, and telephone number. The biological measurement data is composed of a set of data including the date and time of measurement and the data measured in the measurement terminal16. For example, when the biological measurement data is body weight data, the biological measurement data is denoted as “2007/9/1: 70.1, 2007/9/2: 70.3 . . . 2007/9/20: 69.9.”

The transmission/reception unit133transmits/receives data (including message) to/from the user terminal adapter15inserted in the user terminal14.

Furthermore, the transmission/reception unit133includes the function of outputting, when specific data is received, the specific data to a suitable component. For example, when measured data encrypted using the service key from the user terminal adapter15is received, the transmission/reception unit133outputs the received measured data to the measured data registration unit134. When a message, from the measured data registration unit134, notifying the completion of registering the received measured data is received, the transmission/reception unit133transmits the message to the user terminal adapter15.

The measured data from the user terminal adapter15is inputted to the measured data registration unit134via the transmission/reception unit133. The measured data registration unit134obtains user identifier and encrypted biological measurement data from the inputted measured data.

Furthermore, the measured data registration unit134obtains the service key from the service key holding unit131. Then the measured data registration unit134decrypts the encrypted biological measurement data using the obtained service key, and obtains the biological measurement data. Here, the algorithm used for decryption is the same as the algorithm used for encrypting the biological measurement data in the user terminal adapter15. More specifically, the decryption algorithm of the Advanced Encryption Standard (AES) is used.

<Operations of the Server13>

The operations of the server13are described. Here, descriptions will be made for the following cases: (1) user registration; (2) measured data registration; and (3) display of measured data.

(1) User Registration

The transmission/reception unit133receives a message requesting user information registration including the user information from the user terminal adapter15, and transmits the message requesting the received user information registration to the measured data registration unit134.

The measured data registration unit134generates a new user identifier when receiving the message requesting user information registration. The measured data registration unit134associates the user information included in the message requesting user information registration and the generated user identifier, and stores the user information and the user identifier in the measured data holding unit132.

The measured data registration unit134obtains the service key from the service key holding unit131, and generates user information registration result data including the user identifier, the user information, and the service key. The measured data registration unit134outputs the generated user information registration result data to the transmission/reception unit133.

The transmission/reception unit133transmits the received user information registration result data to the user terminal adapter15, and terminates the operation.

As described above, the server13that provides the body weight data management service registers the user.

(2) Measured Data Registration

When the measured data from the user terminal adapter15is received, the transmission/reception unit133outputs the received measured data to the measured data registration unit134.

When the measured data is inputted, the measured data registration unit134obtains user identifier and encrypted biological measurement data from the inputted measured data.

Next, the measured data registration unit134obtains the service key from the service key holding unit131. Then the measured data registration unit134decrypts the encrypted biological measurement data using the obtained service key, and obtains the biological measurement data.

Next, the measured data registration unit134stores the user identifier and the decrypted biological measurement data in the measured data holding unit132. After the data is stored, the measured data registration unit134transmits a message indicating the completion of registration of the biological measurement data to the user terminal adapter15and terminates the operation.

As described above, the server13that provides the body weight data management service registers the measured data of the user.

(3) Displaying of Measured Data

The transmission/reception unit133receives a message indicating request of transmission of the measured data including the user identifier. The transmission/reception unit133outputs the received message indicating the request for transmission of measurement data to the measured data registration unit134.

The measured data registration unit134obtains user identifier from the inputted message indicating request of transmission of the measured data, and obtains the biological measurement data corresponding to the user identifier from the measured data holding unit132.

Next, the measured data registration unit134generates measured data transmission data including the user identifier and the biological measurement data, transmits the generated measured data transmission data to the user terminal adapter15, and terminates the operation.

As described above, the measured data of the user is obtained from the server13that provides the body weight data management service and the measured data is displayed.

Next, the configuration and operations of the user terminal14is hereafter described.

<Configuration of User Terminal14>

FIG. 3shows the configuration of the user terminal according to the embodiment of the present invention.

As shown inFIG. 3, the user terminal14includes the display unit141, the input unit142, the adapter access unit143, the user information registration unit144, the measured data collection unit145, the measured data registration unit146, and the measured data display processing unit147. However, when the user does not require input/output, the display unit141and the input unit142may not be loaded.

The display unit141includes a display, and is capable of displaying a screen according to requests from other components of the user terminal14.

The input unit142includes a keyboard or a mouse, and receives external input (by the user). When an external request for service activation is received, the input unit142accesses the adapter access unit143and confirms whether the user terminal adapter15is attached or not. When the user terminal adapter15is attached, the input unit142obtains the content of the service request from the user terminal adapter15via the adapter access unit143, and displays a menu screen corresponding to the content of service request in the display unit141. The input unit142outputs the content of the service request to the appropriate component according to the content of service request designated by the user, for example, the user registration.

The adapter access unit143exchanges data including messages and signals with the user terminal adapter15. For example, when the user terminal adapter15is a USB, the adapter access unit143may be a USB slot or a USB terminal host. Furthermore, when the user terminal adapter15is an SDIO card, the adapter access unit143may be an SDIO slot or an SDIO terminal host.

The user information registration unit144waits until the signal indicating request of user registration from the input unit142is received. When a signal indicating request for user registration is received, the user information registration unit144transmits a message requesting registration of user information including the user information to the user terminal adapter15via the adapter access unit143. In addition, the user information registration unit144receives, from the user terminal adapter15and via the adapter access unit143, the signals indicating the completion of the user information registration at the server13. Here, the signal indicating the completion of the user information registration includes user identifier and user information.

In addition, the user information registration unit144instructs the user terminal adapter15via the adapter access unit143to transmit the service key from the user terminal adapter15to the measurement terminal adapter17. Here, the user terminal adapter15transmits the service key using a symmetric key generated from the unique information of the measurement terminal16obtained using a safe method without being stolen from the malicious third party. Note that the description is omitted here since the detail is described in detail later.

In addition, the user information registration unit144receives a service key distribution completion signal indicating the completion of transmission of the encrypted service key from the user terminal adapter15to the measurement terminal adapter17.

The measured data collection unit145waits until a signal indicating collection of measured data from the input unit142is received. When the signal indicating collection of measured data is received, the measured data collection unit145transmits a measured data collection request message, to the measurement terminal adapter17via the adapter access unit143and the user terminal adapter15, indicating that the biological measurement data, that is, the user's biological data measured in the measurement terminal16is collected.

The measured data collection unit145receives a measured data collection completion message indicating completion of reception of the biological measurement data collected in the measurement terminal adapter17from the user terminal adapter15via the adapter access unit143.

The measured data registration unit146waits until a signal indicating instruction for registering measured data from the input unit142is received. When a signal indicating instruction for registering the measured data is received, the measured data registration unit146causes, via the adapter access unit143, the user terminal adapter15to transmit the user information and the biological measurement data of the user encrypted using the service key to the server13. Here, the measured data registration unit146causes the user terminal adapter15to receive the biological measurement data measured in the measurement terminal16and encrypted in the measurement terminal adapter17using the service key, and to transmit the encrypted biological measurement data to the server13via the external network11.

The measured data registration unit146receives the message (or data) indicating the completion of registration of measured data in the server13from the user terminal adapter15via the adapter access unit143.

The measured data display processing unit147waits until a signal indicating display of measured data of the user is received from the input unit142. When the signal indicating display of measured data is received, the measured data display processing unit147transmits a message indicating request for transmission of measured data including the user identifier to the user terminal adapter15via the adapter access unit143.

Furthermore, the measured data display processing unit147receives measurement data transmission data that is decrypted in the encryption unit1507and includes the user identifier and the biological measurement data, and displays, for example, a measured data display screen as shown inFIG. 4in the display unit141.

Here,FIG. 4is an example screen of biological measurement data measured by the user.FIG. 4shows that the bodyweight data shifts between approximately 70 kg and 75 kg from January 2007 to May 2007. With this, the user (displayed as Yamada Taro inFIG. 4), can check the history of body weight data, and help managing his health by, for example, exercising when his body weight is around 75 kg.

<Operations of User Terminal14>

Next, the operations of the user terminal14are described. Here, descriptions will be made for the following cases: (1) user registration; (2) measured data collection; (3) measured data registration; and (4) display of measured data.

(1) User Registration

When the input unit142receives, from outside the user terminal14(for example, from the user), an activation request indicating that the user registration is performed, the input unit142accesses the adapter access unit143, and checks whether the user terminal adapter15is attached. When the user terminal adapter15is not attached, the input unit142waits until the user terminal adapter15is attached and a service activation request is received from outside the user terminal14again.

Next, the input unit142transmits a signal indicating a user registration request to the user information registration unit144.

When a signal indicating request for user registration is received, the user information registration unit144transmits a message requesting registration of user information including the user information to the user terminal adapter15via the adapter access unit143.

In addition, the user information registration unit144receives, from the user terminal adapter15via the adapter access unit143, the signals indicating the completion of the user information registration at the server13, including the user identifier and the user information.

The user information registration unit144displays a screen indicating completion of user registration in response to the received signal indicating the completion of the user information registration in the display unit141.

Note that, the user information may be inputted by the user when the input unit142transmits the signal indicating the request for user registration. The user information may also be inputted before the user information registration unit144transmits the message for requesting user information registration including the user information. Alternatively, although the number of steps in the procedure increases, the user information may be inputted and transmitted to the server13after the user information registration unit144transmits the message requesting the user information registration to the server13and before the server13needs the user information.

As described in the example above, the user is registered at the server13that is operated by the health care service vendor and provides a body weight data management service.

(2) Measured Data Collection

When the input unit142externally receives an activation request indicating that the measured data is to be collected externally, the input unit142accesses the adapter access unit143, and checks whether the user terminal adapter15is attached or not. When the user adapter15is not attached, the input unit142terminates the operation.

Next, the input unit142transmits a signal indicating that the measured data is collected to the measured data collection unit145.

When the signal indicating collection of measured data is received, the measured data collection unit145transmits a measured data collection request message, to the measurement terminal adapter17via the adapter access unit143and the user terminal adapter15, indicating that the biological measurement data, that is, the user's biological data measured in the measurement terminal16is collected.

Next, the measured data collection unit145receives a measured data collection completion message indicating completion of reception of the measured data collected in the measurement terminal adapter17from the user terminal adapter15via the adapter access unit143.

The measured data collection unit145causes the display unit141to display a screen indicating completion of collection of measured data based on the received message indicating completion of collection of measured data.

As described above, the collection of the measured data, that is, the body weight measured by the user is performed.

(3) Measured Data Registration

When the input unit142receives, from outside the user terminal14, a service activation request indicating that the measured data is to be registered, the input unit142accesses the adapter access unit143, and checks whether the user terminal adapter15is attached or not. When the user adapter15is not attached, the input unit142terminates the operation.

The input unit142then transmits signals indicating that the biological measurement data is registered to the measured data registration unit146.

When the signal indicating that the measured data is to be registered is received, the measured data registration unit146transmits, via the adapter access unit143, a measured data registration request message indicating that the measured data held in the user terminal adapter15is registered at the server. Subsequently, the measured data registration unit146causes the user terminal adapter15to transmit the user's biological measurement data that includes the user information and is encrypted using the service key to the server13.

Then the measured data registration unit146receives a message indicating the completion of registering the measurement at the server13from the user terminal adapter15via the adapter access unit143.

After that, the measured data registration unit146causes the display unit141to display a screen indicating the completion of registration of measured data based on the received message indicating the completion of registration of measured data.

As described in the example above, the measured data is registered at the server13operated by the vender that offers health care service and provides the body weight management service.

(4) Display of Measured Data

When the input unit142receives, from outside the user terminal14, an activation request indicating that the measured data is to be displayed, the input unit142accesses the adapter access unit143, and checks whether the user terminal adapter15is attached or not. When the user terminal adapter15is not attached, the operation is terminated.

Next, the input unit142transmits a signal indicating that the measured data is to be displayed to the measured data display processing unit147.

When the signal indicating display of measured data is received, the measured data display processing unit147transmits a message requesting transmission of measured data including the user identifier to the user terminal adapter15via the adapter access unit143.

Then, the measured data display processing unit147receives, via the adapter access unit143, the measured data transmission data including the user identifier and the biological measurement data decrypted in the encryption unit1507, and displays the measured data display screen as shown inFIG. 4in the display unit141.

As described in the example above, the measured data of the user is obtained from the server13that provides the body weight data management service and the measured data is displayed.

Next, the configuration and operations of the user terminal adapter15are hereafter described.

<Configuration of the User Terminal Adapter15>

FIG. 5shows the configuration of the user terminal adapter according to the embodiment of the present invention.

As shown inFIG. 5, the user terminal adapter15includes the terminal access unit1501, the encrypted measurement data holding unit1502, the temporary information holding unit1503, the first transmission/reception unit1504, the second transmission/reception unit1505, the symmetric key generating unit1506, and the encryption unit1507.

The terminal access unit1501exchanges data with the user terminal14or the measurement terminal16to which the user terminal adapter15is inserted. For example, when the user terminal adapter15is a USB, the terminal access unit1501is a USB terminal or a host of USB device. Alternatively, when the user terminal adapter15is an SDIO card, the terminal access unit1501is an SDIO terminal or an SDIO card host.

The terminal access unit1501transmits attached device inquiry signal, and checks either the user terminal adapter15or the user terminal14to see if the user terminal adapter15is attached or not.

The terminal access unit1501checks, via the second transmission/reception unit1505, if the user terminal adapter15can communicate with the measurement terminal adapter17attached to the measurement terminal16when it is confirmed that the user terminal adapter15is attached to the user terminal14. The terminal access unit1501also checks whether the user terminal adapter15can communicate with the server13via the first transmission/reception unit1504. The terminal access unit1501transmits, for example, the check result to the encryption unit1507that has sent an inquiry in response to the inquiry.

The encrypted measurement data holding unit1502holds encrypted measurement data.

The temporary information holding unit1503holds temporary data. More specifically, the temporary information holding unit1503holds the service key received from the server13and the symmetric key inputted from the symmetric key generating unit1506.

The first transmission/reception unit1504transmits/receives data or message with the transmission/reception unit133in the server13via the external network11.

When a specific data or message is received, the first transmission/reception unit1504can output the received specific data or message to a suitable component.

For example, when a message requesting registration of the user information from the user information registration unit144in the user terminal14is received, the first transmission/reception unit1504transmits the message to the server13. When the user information registration result data is received, the first transmission/reception unit1504obtains a user identifier, user information, and a service key from the user information registration result data. The first transmission/reception unit1504stored the obtained user identifier and the user information in the encrypted measurement data holding unit1502, and stores the obtained service key in the temporary information holding unit1503.

In addition, when the user information registration result data is received from the server13, the first transmission/reception unit1504outputs a signal indicating that the user information registration of the user identifier and the user information except the service key is completed to the user information registration unit144in the user terminal14.

The second transmission/reception unit1505exchanges data with the second transmission/reception unit173in the measurement terminal adapter17via the internal network12. Here, the internal network12that transmits/receives data is implemented by, for example, Bluetooth™.

The symmetric key generating unit1506generates a symmetric key from unique information such as the measurement terminal identifier of the measurement terminal16.

The symmetric key generating unit1506obtains the measurement terminal identifier from the measurement terminal16via the terminal access unit1501when the user terminal adapter15is inserted to the slot in the measurement terminal16by hand-carry. The symmetric key generating unit1506then generates a symmetric key by performing computations based on the obtained measurement terminal identifier, and stores the generated symmetric key in the temporary information holding unit1503.

Note that the computation method in the symmetric key generating unit1506for generating the symmetric key is same as the computation method used by the measurement terminal adapter17for generating a symmetric key from the unique information of the measurement terminal16(here, a measurement terminal identifier). The computation method uses, for example, the AES cryptographic algorithm or a one-way hash function algorithm such as the Message Digest Algorithm 5 (MD5).

The user terminal adapter15and the measurement terminal adapter17generate symmetric keys from the unique information of the same measurement terminal16using the same computation method; identical symmetric keys are generated although the user terminal adapter15and the measurement terminal adapter17generate symmetric keys independently.

The encryption unit1507checks the terminal access unit1501to see whether the user terminal adapter15is attached to the user terminal14, and whether the user terminal adapter15can communicate with the measurement terminal adapter17attached to the measurement terminal16.

When the user terminal adapter15is attached to the user terminal14and the user terminal adapter15can communicate with the measurement terminal adapter17attached to the measurement terminal16, the encryption unit1507obtains the service key and the symmetric key stored in the temporary information holding unit1503. The encryption unit1507encrypts the service key using the symmetric key. The encryption unit1507transmits the encrypted service key encrypted with the symmetric key to the measurement terminal adapter17attached to the measurement terminal16. After the encrypted service key is transmitted to the measurement terminal adapter17, the encryption unit1507outputs, to the user information registration unit144in the user terminal14, a service key distribution completion signal indicating that the user terminal adapter15finished transmitting the encrypted service key to the measurement terminal adapter17.

Note that, after the encrypted service key is transmitted, the encryption unit1507deletes the service key and the symmetric key stored in the temporary information holding unit1503. This is suitable for minimizing a possibility that an encryption key for encrypting biological data exchanged between a measurement terminal and a server is stolen by a malicious third party or a leak of the biological data. The encryption unit1507may not have to delete the service key and the symmetric key stored in the temporary information holding unit1503after the encrypted service key is transmitted.

<Operations of the User Terminal Adapter15>

The operations of the user terminal adapter15are described.

FIG. 6is a flowchart showing the outline of the operation of the user terminal adapter according to the embodiment of the present invention.

Here, the user terminal adapter15is not attached to the user terminal14or the measurement terminal16in its initial state (Status flag=0). Furthermore, the user terminal adapter15has a status flag and the operation is determined according to the value of the status flag.

First, the user terminal adapter15is attached to the user terminal14or the measurement terminal16(S1000).

The user terminal adapter15transmits an attached device inquiry signal to check whether the user terminal adapter15is attached to the user terminal14or the measurement terminal16(S1001).

The user terminal adapter15receives a response to the attached device inquiry signal from the user terminal14or the measurement terminal16(S1002).

The user terminal adapter15checks the received response and sees if the user terminal adapter15is attached to the user terminal14or the measurement terminal16(S1003).

Then, the user terminal adapter15checks the value of the status flag.

When the user terminal adapter15confirms that the user terminal adapter15is attached to the user terminal14and the value of the status flag is 0 (0 in S1004), the user terminal adapter15judges that the service key is not shared between the user terminal adapter15and the measurement terminal adapter17yet. When a message requesting registration of user information is received from the user of the user terminal14, the user terminal adapter15obtains (downloads) the service key from the server13(S1005), and holds the obtained service key in the temporary information holding unit1503(S1006).

Then, the user terminal adapter15updates the value of the status flag to 1 (S1007), and terminates the operation.

Here, the user detaches the user terminal adapter15from the user terminal14and attaches the user terminal adapter15to the measurement terminal16(S1000). The user terminal adapter15performs the steps S1001to S1003as described above.

When the user terminal adapter15confirms that the user terminal adapter15is attached to the measurement terminal16and the value of the status flag is 1 (1 in S1014), receives the unique information of the measurement terminal16such as the measurement terminal identifier from the measurement terminal16(S1015).

Note that, when the user does not detach the user terminal adapter15from the user terminal14or the user mistakenly attaches the user terminal adapter15to the user terminal14, the user terminal adapter15confirms that the user terminal adapter15is attached to the user terminal14and that the value of the status flag is 1, and then terminates the operation. Similarly, when the user terminal adapter15confirms that the user terminal adapter15is attached to the measurement terminal16and the value of the status flag is 0, 2, or 3, the user terminal adapter15terminates the operation.

Next, the user terminal adapter15performs a predetermined calculation based on the measurement terminal identifier obtained in the symmetric key generating unit1506, and generates a symmetric key (S1016).

The user terminal adapter15stores the symmetric key generated in the symmetric key generating unit1506in the temporary information holding unit1503(S1017).

Then, the user terminal adapter15updates the value of the status flag to 2 (S1018), and terminates the operation.

Here, the user detaches the user terminal adapter15from the user terminal16and attaches the user terminal adapter15to the measurement terminal14again (S1000). The user terminal adapter15performs the steps S1001to S1004as described above.

When the user terminal adapter15confirms that the user terminal adapter15is attached to the user terminal14and it is confirmed that the value of the status flag is 2, obtains the service key and the symmetric key stored in the temporary information holding unit1503after it is confirmed that the user terminal adapter15can communicate with the measurement terminal adapter17attached to the measurement terminal16. The user terminal adapter15encrypts, in the encryption unit1507, the service key using the symmetric key (S1008).

The user terminal adapter15then transmits the encrypted service key encrypted in the encryption unit1507to the measurement terminal adapter17attached to the measurement terminal16(S1009).

After the encrypted service key is transmitted, the user terminal adapter15deletes the symmetric key stored in the temporary information holding unit1503(S1010). As described above, the service key stored in the temporary information holding unit1503is also deleted here.

Then, the user terminal adapter15updates the value of the status flag to 3 (S1011), and terminates the operation.

When the user terminal adapter15confirms that the user terminal adapter15is attached to the user terminal14and that the value of the status flag is 3, the user terminal adapter15receives a measured data collection request message showing that the measured data, that is, the user's biological data measured in the measurement terminal16is collected. After the user terminal adapter15checks that the user terminal adapter15can communicate with the measurement terminal adapter17attached to the measurement terminal16, transmits the measured data collection request message to the measurement terminal adapter17via the internal network12.

The user terminal adapter15checks if the encrypted measurement data encrypted using the service key is received in the second transmission/reception unit1505(S1012).

When it is confirmed that the encrypted measurement data is received (Yes in S1012), the user terminal adapter15stores the received encrypted measurement data in the encrypted measurement data holding unit1502. Note that when the encrypted measurement data is not received in the second transmission/reception unit1505(No in S1012); the user terminal adapter15repeats S1012until it is confirmed that the encrypted measurement data is received in the second transmission/reception unit1505.

After the message, from the user terminal14, indicating that the collected measurement data is registered at the server is received, the user terminal adapter15transmits, by the first transmission/reception unit1504, the encrypted measurement data to the server13via the external network11(S1013).

As described above, the user terminal adapter15can generate the symmetric key securely from the measurement terminal identifier which is the unique information of the measurement terminal16through hand-carry by the user. Since the symmetric key is generated securely, the service key can be securely shared between the user terminal adapter15and the measurement terminal adapter17. This enables secure exchange of the biological measurement data between the measurement terminal and the server. In other words, it is possible to achieve a secure communication that prevents the biological measurement data from being stolen by the malicious third party or the leak of the biological measurement data to the third party.

The specific operations of the user terminal adapter15are described for the following cases: (1) user registration; (2) measured data collection; (3) measured data registration; and (4) display of measured data.

(1) User Registration

When a message requesting registration of the user information from the user information registration unit144in the user terminal14is received, the first transmission/reception unit1504transmits the received message to the server13via the external network11.

The first transmission/reception unit1504then receives, from the server13and via the external network11, the user information registration result data including the user identifier, the user information, and the service key. When the user information registration result data is received, the first transmission/reception unit1504obtains the user identifier, the user information, and the service key from the user information registration result data. The first transmission/reception unit1504stores the obtained user identifier and the user information to the encrypted measurement data holding unit1502, and stores the obtained service key in the temporary information holding unit1503.

The first transmission/reception unit1504outputs a signal including the user identifier and the user information and indicating that the user information registration of the user identifier and the user information is completed at the server13to the user information registration unit144in the user terminal14.

As described in the example above, the user is registered at the server13operated by the vender that offers health care service and provides the body weight management service.

(2) Measured Data Collection

The second transmission/reception unit1505receives, from the measured data collection unit145in the user terminal14via the adapter access unit143, a measured data collection request message requesting collection of the measured data, that is, the user's biological data measured in the measurement terminal16.

The second transmission/reception unit1505checks the terminal access unit1501to see if the user terminal adapter15is attached to the user terminal14, and whether the user terminal adapter15can communicate with the measurement terminal adapter17attached to the measurement terminal16.

When the user terminal adapter15is attached to the user terminal14and the user terminal adapter15can communicate with the measurement terminal adapter17attached to the measurement terminal16, the second transmission/reception unit1505transmits the message requesting the measured data collection to the measurement terminal adapter17via the internal network12.

The second transmission/reception unit1505then receives the encrypted measurement data which is the measured data collected by the measurement terminal adapter17encrypted with the service key, from the measurement terminal adapter17attached to the measurement terminal16. The second transmission/reception unit1505then stores the received encrypted measurement data in the encrypted measured data holding unit1502.

The second transmission/reception unit1505outputs a measured data collection completion message, to the user terminal adapter15, indicating that the measured data collected by the measurement terminal adapter17is received by the user terminal adapter15, and terminates the operation.

As described above, the measured data that is the body weight measured by the user is collected.

(3) Measured Data Registration

The first transmission/reception unit1504receives, from the measured data registration unit146in the user terminal14via the adapter access unit143, a measured data registration request message requesting registration of the collected measured data including the user identifier.

The first transmission/reception unit1504then checks the terminal access unit1501whether the user terminal adapter15can communicate with the server13.

When it is confirmed that the user terminal adapter15can communicate with the server13, the first transmission/reception unit1504obtains the user identifier from the received measured data registration request message, and obtains the encrypted measurement data which is the user's biological measurement data encrypted with the service key, from the encrypted measurement data holding unit1502. The first transmission/reception unit1504transmits the measured data including the encrypted measurement data and the user identifier to the server13via the external network11.

The first transmission/reception unit1504receives the message (or data) indicating the completion of registration of biological measurement data in the server13. The first transmission/reception unit1504transmits a message (or data) indicating the completion of registration of the biological measurement data at the server13, to the user terminal14via the adapter access unit143.

As described above, the measured data that is the body weight data measured by the user is registered at the server13.

(4) Display of Measured Data

First, the first transmission/reception unit1504receives, from the measured data display processing unit147in the user terminal14via the adapter access unit143, a measured data transmission request message. Here, the user identifier is included in the measured data transmission request message.

The first transmission/reception unit1504then transmits the received measured data transmission request message to the server13via the external network11.

The first transmission/reception unit1504receives the measured data transmission data including the user identifier and the biological measurement data from the server13via the external network11. The first transmission/reception unit1504stores the received measured data transmission data in the encrypted measurement data holding unit1502.

The encryption unit1507obtains the user identifier from the received measured data transmission request message. The encryption unit1507then obtains the encrypted measurement data stored in the encrypted measurement data holding unit1502and decrypts the encrypted measurement data using the service key.

The encryption unit1507then transmits the decrypted measured data to the measured data display processing unit147via the terminal access unit1501and terminates the operation. Here, the service key may be stored in the temporary information holding unit1503, or may be obtained from the server13again.

As described in the example above, display of the measured data is achieved by decrypting the user's measurement data obtained from the server13that offers the body weight management service and sending the decrypted data to the user terminal14.

<Configuration of the Measurement Terminal16>

FIG. 7shows the configuration of the measurement terminal according to the embodiment of the present invention.

The measurement terminal16includes, as shown inFIG. 7, the measured data holding unit161, the measurement unit162, the measurement terminal identifier holding unit163, and the adapter access unit164.

The measured data holding unit161stores the data measured in the measurement unit162. The measured data is composed of a set of data including the date and time of measurement and the data measured in the measurement terminal16. For example, when the measured data is body weight data, the measured data is denoted as “2007/9/1: 70.1, 2007/9/2: 70.3 . . . 2007/9/20: 69.9.”

The measurement unit162includes a sensor and obtains the user's biological data such as the user's body weight through measurement. Note that the measured biological data is included in the measured data and is stored in the measured data holding unit161.

The measurement terminal identifier holding unit163includes, for example, a measurement terminal identifier for identifying the measurement terminal16as the unique information of the measurement terminal16. The measurement terminal identifier is an identifier that has already been held upon shipment of the measurement terminal16. The measurement terminal identifier may be a different value for each measurement terminal16when there are more than one measurement terminals16, or may differ according to the models of the measurement terminals16. Alternatively, the measurement terminal identifier may differ for each manufacturer, or for each measurable biological measurement data (body weight, blood pressure, blood glucose level, or body fat rate).

Descriptions of the adapter access unit164are omitted since the configuration of the adapter access unit164is identical to the adapter access unit143in the user terminal14.

<Operations of the Measurement Terminal16>

Next, operations of the measurement terminal16are described. Here, (1) data measurement is described as a specific example.

(1) Data Measurement

The measurement unit162includes, for example, a body weight sensor and a timer. When weighing the user's body weight, the measurement terminal16generates the measured data that is a combination of the date of the measurement and the body weight data, stores the generated measured data in the measured data holding unit161, and terminates the operation.

The configuration and operations of the measurement terminal adapter17are described next.

FIG. 8shows the configuration of the user terminal adapter according to the embodiment of the present invention.

<Configuration of the Measurement Terminal Adapter17>

As shown inFIG. 8, the measurement terminal adapter17includes the terminal access unit171, the service key holding unit172, the second transmission/reception unit173, the service key decryption unit174, the symmetric key generating unit175, and the biological measured data encryption unit176.

The description for the terminal access unit171is omitted since the configuration is identical to the terminal access unit1501in the user terminal adapter15.

The service key holding unit172holds the service key.

The second transmission/reception unit173exchanges data with the second transmission/reception unit1505in the user terminal adapter15via the internal network12. Here, the internal network12that transmits/receives data is implemented by, for example, Bluetooth™.

The service key decryption unit174checks, via the terminal access unit171, whether the measurement terminal adapter17can communicate with the user terminal adapter15attached to the user terminal14. When the service key decryption unit174can communicate with the user terminal adapter15, the service key decryption unit174receives the encrypted service key from the user terminal adapter15. The service key decryption unit174then obtains the symmetric key stored in the service key holding unit172.

The service key decryption unit174decrypts the received encrypted service key using the obtained symmetric key. The service key decryption unit174stores the service key, that is, the decrypted encrypted service key in the service key holding unit172.

Note that the service key decryption unit174deletes the service key stored in the service key holding unit172after the service key is stored in the service key holding unit172. This is suitable for minimizing a possibility that an encryption key for encrypting biological data exchanged between the measurement terminal and the server is stolen by a malicious third party, or the leak of the biological data. Note that the service key decryption unit174may not delete the service key stored in the service key holding unit172after the service key is stored in the service key holding unit172.

The symmetric key generating unit175generates a symmetric key from the unique information of the measurement terminal16such as the measurement terminal identifier.

The symmetric key generating unit175obtains the measurement terminal identifier from the measurement terminal16via the terminal access unit171. The symmetric key generating unit175then generates a symmetric key by performing computations based on the obtained measurement terminal identifier, and stores the generated symmetric key in the service key holding unit172.

Note that the computation method in the symmetric key generating unit175for generating the symmetric key is same as the computation method used by the user terminal adapter15for generating a symmetric key from the unique information of the measurement terminal16(here, a measurement terminal identifier). The computation method includes, for example, the AES cryptographic algorithm or a one-way hash function algorithm such as MD5.

The biological measurement data encryption unit176waits, until a measured data collection request message indicating that the measured data, that is, the user's biological data measured in the measurement terminal16is collected, is received from the second transmission/reception unit1505in the user terminal adapter15.

When the measured data collection request message is received, the biological measurement data encryption unit176obtains the service key from the service key holding unit172. The biological measurement data encryption unit176accesses the measured data holding unit161in the measurement terminal16and obtains the measured data. The biological measurement data encryption unit176then encrypts the measured data using the service key to generate the encrypted measurement data. Here, cryptographic algorithm such as the AES algorithm is used for encrypting the measured data. The biological measurement data encryption unit176transmits the encrypted measurement data to the second transmission/reception unit1505in the user terminal adapter15.

<Operations of Measurement Terminal Adapter17>

Next, operations of the measurement terminal adapter17are described.

FIG. 9is a flowchart showing the outline of the operations of the measurement terminal adapter according to the embodiment of the present invention.

First, the measurement terminal adapter17is not attached to the measurement terminal. The user terminal adapter17is then attached to the user terminal14or the measurement terminal16(S2000).

The measurement terminal adapter17then checks if the measurement terminal adapter17is attached to the measurement terminal16. When it is confirmed that the measurement terminal adapter17is attached to the measurement terminal16, the measurement terminal adapter17obtains the unique information of the measurement terminal16such as the measurement terminal identifier from the measurement terminal16(S2001).

The measurement terminal adapter17generates a symmetric key from the measurement terminal identifier in the symmetric key generating unit175(S2002), and stores the generated symmetric key in the service key holding unit172.

The measurement terminal adapter17receives the encrypted service key from the user terminal adapter15(S2003).

The measurement terminal adapter17obtains the symmetric key stored in the service key holding unit172, and decrypts, in the service key-decryption unit174, the received encrypted service key using the obtained symmetric key (S2004).

Next, the measurement terminal adapter17stores the service key decrypted in the service key decryption unit174in the service key holding unit172(S2005). Here, the measurement terminal adapter17deletes the symmetric key from the service key holding unit172after the obtained service key is stored in the service key holding unit172.

The measurement terminal adapter17receives, from the user terminal adapter15, the measured data collection request message indicating that the measured data, that is, the user's biological data measured in the measurement terminal16is collected (Yes in S2006). In this case, the measurement terminal adapter17encrypts the biological measurement data obtained from the measurement terminal16using the service key stored in the service key holding unit172(S2007).

After that, the measurement terminal adapter17transmits the biological measurement data encrypted using the service key to the user terminal adapter15(S2008).

As described above, the service key can be securely shared in the user terminal adapter15and the measurement terminal adapter17using the symmetric key generated that is obtained through hand-carry by the user, that is, the symmetric key is generated from the measurement terminal identifier. This enables secure exchange of the biological measurement data between the measurement terminal and the server. In other words, it is possible to achieve a secure communication that prevents the data from being stolen by the malicious third party or the leak to the third party.

The specific operations of the measurement terminal adapter17are described for the following cases: (1) user registration; and (2) measured data collection.

(1) User Registration

First, the measurement terminal adapter17detects that the measurement terminal adapter17is attached to the measurement terminal16via the terminal access unit171.

The service key decryption unit174checks, via the terminal access unit171, whether the measurement terminal adapter17can communicate with the user terminal adapter15attached to the user terminal14. When the measurement terminal adapter17cannot communicate with the user terminal adapter15, the service key decryption unit174periodically checks whether the measurement terminal adapter17can communicate with the user terminal adapter15.

The service key decryption unit174receives the encrypted service key from the user terminal adapter15.

Here, the symmetric key generating unit175obtains the measurement terminal identifier from the measurement terminal16via the terminal access unit171, and performs computations based on the obtained measurement terminal identifier to generate a symmetric key. The symmetric key generating unit175stores the generated symmetric key in the service key holding unit172.

The service key decryption unit174then obtains the symmetric key stored in the service key holding unit172.

The service key decryption unit174decrypts the received encrypted service key using the obtained symmetric key.

The service key decryption unit174stores the service key which is the decrypted encrypted service key in the service key holding unit172and terminates the operation.

As described above, the measurement terminal adapter17securely obtains the service key when registering the user.

(2) Measured Data Collection

The biological measurement data encryption unit176receives a measured data collection request message indicating that the measured data, that is, the user's biological data measured in the measurement terminal16is collected, from the second transmission/reception unit1505in the user terminal adapter15.

When the message requesting collection of measured data is received, the biological measurement data encryption unit176obtains the service key from the service key holding unit172.

The biological measurement data encryption unit176accesses the measured data holding unit161in the measurement terminal16and obtains the biological measurement data.

The biological measurement data encryption unit176then encrypts the biological measurement data using the service key to generate the encrypted measurement data.

The biological measurement data encryption unit176transmits the encrypted measurement data to the second transmission/reception unit1505in the user terminal adapter15and terminates the operation.

As described above, the measurement terminal adapter17transmits the encrypted measurement data encrypted using the service key when collecting the measured data by the user.

Next, the service key distribution method of the telemedical system according to the embodiment of the present invention is described. More specifically, the description for the operation of the user terminal adapter15and the measurement terminal adapter17for securely sharing the service key is made with reference the drawings.

FIGS. 10 and 11are diagrams for describing the service key distribution method of the telemedical system according to the embodiment of the present invention.FIG. 12is a diagram for describing the regular operation of the telemedical system according to the embodiment of the present invention.FIG. 13is a sequence diagram for describing the operations in the telemedical system according to the embodiment of the present invention. Hereafter, the description is basically made with reference toFIG. 13.

First, the user terminal adapter15is attached to the user terminal14by the user (S3001). The user terminal adapter15transmits an attached device inquiry signal to check whether the user terminal adapter15is attached to the user terminal14or the measurement terminal16, and receives the response.

After that, as shown in STEP1inFIG. 10, when the user terminal adapter15confirms that the user terminal adapter15is attached to the user terminal14, the user terminal adapter15requests the service key to the server13, and obtains the service key from the server13. The user terminal adapter15holds the obtained service key (S3002).

Note that the steps S3001to S3002correspond to S1000to S1007inFIG. 6.

After that, as shown in STEP2inFIG. 10, the user detaches the user terminal adapter15from the user terminal14(S3003), and attaches the user terminal adapter15to the measurement terminal16(S3004). The user terminal adapter15transmits an attached device inquiry to check whether the user terminal adapter15is attached to the user terminal14or the measurement terminal16, and receives the response.

After that, as shown in STEP3inFIG. 10, when the user terminal adapter15confirms that the user terminal adapter15is attached to the measurement terminal16, the user terminal adapter15obtains the measurement terminal identifier from the measurement terminal16. The user terminal adapter15generates a symmetric key from the measurement terminal identifier (S3005), and holds the generated symmetric key (S3006).

After that, as shown in STEP4inFIG. 11, the user detaches the user terminal adapter15from the measurement terminal16(S3007) and attaches the user terminal adapter15to the user terminal14(S3008). The user terminal adapter15transmits an attached device inquiry to check whether the user terminal adapter15is attached to the user terminal14or the measurement terminal16, and receives the response.

Here, as shown in STEP5inFIG. 11, the measurement terminal adapter17is attached to the measurement terminal16(S3009). The measurement terminal adapter17transmits an attached device inquiry to check whether the measurement terminal adapter17is attached to the user terminal14or the measurement terminal16, and receives the response. After that, when the measurement terminal adapter17confirms that the measurement terminal adapter17is attached to the measurement terminal16, the measurement terminal adapter17obtains the measurement terminal identifier from the measurement terminal16. The measurement terminal adapter17generates a symmetric key from the measurement terminal identifier (S3010), and holds the generated symmetric key (S3011).

After that, as shown in STEP6inFIG. 11, the user terminal adapter15encrypts the service key being held using the symmetric key being held (S3012). The user terminal adapter15transmits the service key encrypted by the symmetric key to the measurement terminal adapter17, and deletes the symmetric key and the service key being held after the transmission (S3013). The measurement terminal adapter17receives the encrypted service key from the user terminal adapter15. The measurement terminal adapter17decrypts the received encrypted service key using the symmetric key being held, and obtains the service key (S3014). When the obtained service key is held (S3015), the measurement terminal adapter17deletes the symmetric key being held.

After that, as shown inFIG. 8, the measurement terminal adapter17obtains the biological measurement data from the measurement terminal16, and encrypts the obtained biological measurement data using the service key (S3016). The measurement terminal adapter17transmits the biological measurement data encrypted using the service key to the user terminal adapter15. When the encrypted biological measurement data from the measurement terminal adapter17is received, the user terminal adapter15transmits the received encrypted biological measurement data to the server13. When the encrypted biological measurement data is received, the server13decrypts the encrypted biological measurement data using the service key being held, obtains the biological measurement data, and records the obtained biological measurement data (S3017).

As described above, the service key is distributed in the telemedical system1, and biological measurement data is exchanged between the measurement terminal and the server.

As described above, in the telemedical system1according to the embodiment, the symmetric key is generated from the unique information of the measurement terminal16obtained by the user terminal adapter15through hand-carry by the user without a possibility of the leak of data to the malicious third party, and is transmitted to the measurement terminal adapter17after the service key is encrypted using the symmetric key generated by the user terminal adapter15. With this, the measurement terminal adapter17can securely obtain the service key which is an encryption key, and thus the exchange of biological measurement data can be securely performed between the measurement terminal and the server. In other words, it is possible to achieve a secure communication that prevents the data from being stolen by the malicious third party or the leak of the data to the third party.

In addition, in the telemedical system1according to the present embodiment, the service key is held in the adapters, namely, the user terminal adapter15and the measurement terminal adapter17, not in the user terminal14and the measurement terminal16in order to prevent the leak to the malicious third party.

Furthermore, the possibility of leak of the data to the malicious third party is eliminated by deleting, from the user terminal adapter15and the measurement terminal adapter17, the symmetric key used for obtaining the service key after the measurement terminal adapter17obtained the service key, and by further deleting the service key held by the user terminal adapter15.

Note that, the embodiment describes an example in which the encryption unit1507in the user terminal adapter15performs decryption of the encrypted measurement data stored in the user terminal adapter15when the measured data is displayed in the user terminal14and encryption of the service key received from the server13when the user terminal14transmits the service key to the measurement terminal adapter17. This is preferable to suppress the increase in cost of the terminal device and to improve versatility of the terminal device since communication function and cryptographic functions are not incorporated in the terminal device side of the user terminal14and the measurement terminal16.

However, the embodiment is not limited to the example, and the user terminal14may perform, among the computations performed by the user terminal adapter15, only cryptographic computations. Similarly, the measurement terminal16may perform, among the computations performed by the measurement terminal adapter17, only the cryptographic computation of the measurement terminal adapter17. With this, reduction of the computation amount on the user terminal adapter15and the measurement terminal adapter17can be achieved.

In addition, the communication function, the cryptographic function, or a part of the cryptographic function of the user terminal adapter15or the measurement terminal adapter17may be incorporated in the user terminal14or the measurement terminal16.

Furthermore, in the embodiment, the configuration where the user terminal14stores the encrypted measurement data in the user terminal adapter15without holding the measured data is described. However, the present invention is not limited to the embodiment. The encrypted measurement data may be stored in the user terminal14.

The embodiment described above is an example of implementation of the present invention. The present invention is not limited to the embodiment, and may be implemented without departing from the scope of the invention. For example, the present invention includes the following cases.

(1) There may be multiple servers13, user terminals14, and user terminal adapters15.

(2) The measurement performed in the measurement terminal16may not be limited to body weight data. Body temperature, blood pressure, body fat rate, or blood glucose level may be measured.

(3) Different service keys may be given to each user.

(4) Secure communication path may be established between the server13and the user terminal14, using Secure Socket Layer (SSL), for example.

(5) Communication function may be incorporated into the user terminal14or the measurement terminal16in advance.

(6) The process divided between the user terminal14and the user terminal adapter15may be divided differently from the embodiment. In addition, the process divided between the measurement terminal16and the measurement terminal adapter17may be divided differently from the embodiment.

(7) Although Bluetooth™ was listed as an example of the internal network12, the internal network12may be implemented with other communication method such as IEEE 802.11a/b/g/n or Zig bee.

(8) Although AES was listed as an example of the cryptographic algorithm, other cryptographic algorithms such as 3DES may also be used.

(9) Although MD5 was listed as an example of the hash function algorithm which computes a symmetric key from the measurement terminal identifier in the symmetric key generating unit1506in the user terminal adapter15and in the symmetric key generating unit175in the measurement terminal adapter17, other hash function algorithm such as Secure Hash Algorithm 1 (SHA-1) may also be used.

Each of the above-described devices is a computer system including a microprocessor, a ROM, a RAM, a hard disc unit, a display unit, a keyboard, and a mouse. A computer program is recorded on the RAM or the hard disc unit. Functions of each device are achieved through the operation of the microprocessor according to the computer program. The computer program is configured of a combination of command codes indicating instructions to the computer for achieving the predetermined functions.

Furthermore, a part of, or all of the components of each of the devices may be configured of a system Large Scale Integration (LSI). The system LSI is an ultra multi-function LSI having multiple components integrated into one chip, and more specifically, is a computer system that includes a microprocessor, a ROM, and a RAM and others. A computer program is recorded on the RAM. Functions of the system LSI are achieved through the operation of the microprocessor according to the computer program.

Furthermore, a part of, or all of the components of each of the devices may be configured of an IC card or a single module that is detachable/attachable to each device. The IC card or the module is a computer system configured of a microprocessor, a ROM, and a RAM and others. The IC card and the module may include the ultra multi-function LSI. Functions of the IC card or the module are achieved through the operation of the microprocessor according to the computer program. The IC card or the module may be tampering-resistant.

The present invention may be implemented as the method described above. Furthermore, the present invention may be implemented as a computer program for implementing the method on a computer, and the computer program may also be expressed as digital signals.

Furthermore, the present invention may be implemented as a computer-readable recording medium on which the computer program and the digital signals are recorded, such as a flexible disc, a hard disc, a CD-ROM, an MO, a DVD, a DVD-ROM, a DVD-RAM, a Blu-ray Disc (BD), and a semiconductor memory. Alternatively, the present invention may be implemented as the digital signals recorded on the recording media.

In the present invention, the computer program or the digital signals may be transmitted via a telecommunication line, wireless or wired line, a network such as the Internet, or a data broadcast.

The present invention is a computer system including a microprocessor and a memory, and the memory stores the computer program, and the microprocessor may operate according to the computer program.

Furthermore, the program or the digital signals may be implemented in another independent computer system through recording the program and the digital signals on the recording medium and transferring the program and digital signals.

Although only an exemplary embodiment of the telemedical system according to this invention has been described in detail above, those skilled in the art will readily appreciate that many modifications are possible in the exemplary embodiment without materially departing from the novel teachings and advantages of this invention. Accordingly, all such modifications are intended to be included within the scope of this invention.

Industrial Applicability

The present invention may be used for a telemedical system, and may also be used for various services including logistics, transportation, education using sensors and IC tags.