JP2005303449A - Radio communication system, access point, terminal and radio communication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a radio communication system capable of achieving radio communication by the processing of an access point side and managing the radio communication. <P>SOLUTION: In a radio LAN environment established by an access point 20 and a plurality of terminals and ensuring predetermined security for radio communication between the access point 20 and each of the terminals, one terminal transmits a predetermined instruction signal indicating that an encryption key is delivered to the terminal and other terminals to the access point 20. The access point 20 generates an inter-terminal dedicated encryption key on the basis of the instruction signal, and transmits the encryption key data to the one terminal and the other terminals. As this result, the inter-terminal dedicated encryption key generated by the access point 20 is set in each of the terminals, so that security in radio communication is ensured in an ad hoc transition period and various statuses of the radio communication can be managed and monitored by the access point 20 side. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a wireless communication system, an access point, a terminal, and a wireless communication method.

  Conventionally, a so-called ad hoc mode communication technique is known as one of wireless communication techniques. The ad hoc mode is a technology that is performed between terminals constituting a wireless LAN, and a plurality of terminals perform wireless communication with each other without going through a wireless base station such as a wireless router or an access point. When performing wireless communication according to the ad hoc mode, security is necessary to prevent unauthorized entry by a third party into a network constructed between terminals and to prevent leakage of various types of data communicated wirelessly. Therefore, in the realization of the ad hoc mode, predetermined security settings (for example, setting of a WEP (Wired Equivalent Privacy) key as an encryption key for encrypting communication data) are performed in each terminal to ensure the security. It was.

In the above prior art, security settings are performed in individual terminals, and under the set security environment, each terminal constructs a closed network that does not go through a wireless router, an access point, or the like. Therefore, once the closed ad hoc mode network is constructed, there is a problem that a predetermined administrator outside the network cannot grasp the communication status in the network.
The present invention has been made in view of the above problems, and a wireless communication system capable of grasping a predetermined situation of the wireless communication other than the terminal while ensuring security in wireless communication between the terminals, An object is to provide an access point, a terminal, and a wireless communication method.

  In order to achieve the above object, the present invention is constructed by an access point which is a wireless LAN repeater and a plurality of terminals each having a wireless LAN connection device, and between the access point and each terminal during wireless communication. A wireless communication system for setting a predetermined encryption key for the terminal to be used when encrypting wireless communication data on a network in which the predetermined security is ensured. Encryption key data for transmitting an instruction signal for requesting distribution of encryption key data representing the contents of the encryption key dedicated to the terminal used when performing wireless communication between the predetermined terminals without passing through the access point to the access point Receiving the encryption key data transmitted from the request means and the access point, and using the encryption key data based on the encryption key data An encryption key setting means for setting, and the access point generates an encryption key generation means for generating the inter-terminal dedicated encryption key based on the instruction signal transmitted from the terminal; and An encryption key data transmission unit that transmits encryption key data representing the contents of the generated inter-terminal dedicated encryption key is provided.

In the present invention configured as described above, an access point that is a wireless LAN repeater and a plurality of terminals each including a wireless LAN connection device are constructed, and wireless communication is performed between the access point and each terminal. A predetermined encryption key used when encrypting wireless communication data on the network in which the predetermined security is ensured is set in the terminal.
In the encryption key data requesting means, the terminal transmits encryption key data representing the content of the encryption key dedicated to the terminal used when performing wireless communication between the predetermined access points without passing through the access point. An instruction signal requesting distribution is transmitted. On the other hand, the access point that has received the instruction signal generates an inter-terminal dedicated encryption key based on the instruction signal in the encryption key generation means.

When the access point generates the inter-terminal dedicated encryption key, the encryption key data transmitting means transmits the encryption key data representing the contents of the generated inter-terminal dedicated encryption key to the predetermined terminal. Then, each terminal that has received the same encryption key data sets the above-described inter-terminal dedicated encryption key to itself based on the encryption key data in the encryption key setting means.
As described above, according to the present invention, when performing wireless communication between a plurality of terminals belonging to the network or a predetermined number of terminals without using an access point, security is ensured during the wireless communication. The access point generates the necessary encryption key for each terminal and distributes it to each terminal. As a result, based on the processing on the access point side, it is possible to construct a network that prevents unauthorized intrusion and leakage of communication contents between the terminals, and to manage wireless communication in the network on the access point side.

  In addition, as compared with a case where each terminal performs wireless communication with each other via an access point, the number of paths required for transmitting wireless communication data is half. Therefore, when a plurality of terminals access the access point simultaneously, the inconvenience of reaching the limit of the data transfer capacity (bandwidth) of the access point and reducing the communication speed can be prevented. In the present application, since it is assumed that predetermined security is ensured for wireless communication between the access point and each terminal, the instruction signal transmitted by the terminal and the encryption key data transmitted by the access point Can be communicated while preventing leakage of information.

  According to a second aspect of the present invention, in the wireless communication system according to the first aspect, the encryption key data requesting unit wirelessly transmits the instruction signal without passing through the access point. The identification information unique to the other terminal that is scheduled to communicate is transmitted, and the encryption key data transmission means transmits the encryption key data to the terminal that transmitted the instruction signal and the other terminal specified by the identification information. It is as composition to do.

  In the above configuration, when transmitting the instruction signal, the encryption key data requesting unit also transmits identification information unique to another terminal that is scheduled to perform wireless communication without going through the access point. Send. Then, the access point that has received the instruction signal and the identification information transmits the encryption key data to the terminal that has transmitted the instruction signal and the other terminal specified by the identification information in the encryption key data transmission unit. In an environment where wireless communication is performed via an access point, each terminal can basically recognize identification information of another terminal that performs communication via the access point. Therefore, it is assumed that a certain terminal notifies the access point side of identification information of another terminal that desires to construct a network that does not go through an access point. As a result, wireless communication using the inter-terminal dedicated encryption key can be realized only between a certain terminal and another terminal that desires to construct a network that does not go through an access point.

  According to a third aspect of the present invention, in the wireless communication system according to the first aspect, the encryption key data transmitting means has terminal-specific identification information registered in the terminal that has transmitted the instruction signal and the access point. The encryption key data is transmitted to another terminal.

  The terminal that has transmitted the instruction signal cannot always recognize the presence of another terminal that constructs the network via the access point. In addition, even if the presence of another terminal is recognized, there may be a case where a terminal that transmits the instruction signal must separately perform a predetermined process for recognizing the other terminal. Therefore, as in the above configuration, the encryption key data transmission means transmits the encryption key data to the terminal registered and recognized on the access point side without depending on the instruction of the terminal that transmits the instruction signal. Good.

  According to a fourth aspect of the present invention, in the wireless communication system according to any one of the first to third aspects, the encryption key generation means encrypts wireless communication data that can be adopted by the access point. Of these, a method that can be adopted in common by predetermined terminals that perform wireless communication with each other without using an access point is selected and the encryption method with the highest security level is selected. The inter-terminal dedicated encryption key is generated, and the encryption key data transmitting means transmits an encryption method instruction signal instructing the selected terminal to adopt the selected encryption method together with the encryption key data. It is as.

  In the invention of claim 4 configured as described above, the encryption key generation means mutually encrypts the wireless communication data that can be adopted by the access point without using the access point. An encryption method with the highest security level that can be adopted in common by predetermined terminals that perform wireless communication is selected. Then, an inter-terminal dedicated encryption key is generated by the selected encryption method. The encryption key data transmission means transmits an encryption method instruction signal instructing that the predetermined terminal adopts the selected encryption method together with the generated encryption key data representing the inter-terminal dedicated encryption key. As a result, the predetermined terminals perform wireless communication with each other using the generated inter-terminal dedicated encryption key based on the method specified by the encryption method instruction signal. In other words, when configuring a closed network with a smaller number of terminals than the number of terminals when performing wireless communication via an access point, it may be possible to select an encryption method with a higher security level by using the present configuration. is there. As a result, it is possible to further enhance security in wireless communication between predetermined terminals without using an access point.

  According to a fifth aspect of the present invention, in the wireless communication system according to any one of the first to fourth aspects, when the access point performs wireless communication without passing through an access point between predetermined terminals, the wireless communication is performed. The communication channel to be used is designated.

  As described above, by encrypting wireless communication data using the inter-terminal dedicated encryption key, it is possible to prevent unauthorized intrusion by third parties and leakage of communication contents at a certain security level. In addition to such network protection, in the configuration of claim 5, the access point side designates a communication channel used for wireless communication performed between terminals without going through the access point, thereby enabling a third party with a higher security level. Prevent unauthorized intrusion and leakage of communication contents.

  According to a sixth aspect of the present invention, in the wireless communication system according to any one of the first to fifth aspects, the access point is a terminal that is a transmission destination of at least the encryption key data by the encryption key data transmission unit Predetermined communication record related to the wireless communication performed with the access point when the predetermined terminal performs wireless communication not via the access point or when the wireless communication is terminated and the access point is accessed again, including unique identification information Is stored in a predetermined recording area.

  In the invention of claim 6 configured as described above, the access point is an access point when the predetermined terminal performs wireless communication not via the access point, or when the wireless communication is terminated and the access point is accessed again. A predetermined communication record related to the wireless communication performed is stored in a predetermined recording area. By recording such communication records on the access point side, wireless communication between the specified terminals without using the access point can be performed between the specific terminals, at what time, under what security level. You can see if it was done in

  The invention according to claim 7 is the wireless communication system according to any one of claims 1 to 6, wherein the access point performs wireless communication between the predetermined terminals without passing through the access point. In addition, a predetermined terminal-to-terminal communication record for the wireless communication is stored in a predetermined recording area.

  In the above configuration, when a predetermined terminal performs wireless communication using wireless communication data encrypted with a dedicated encryption key between terminals without going through the access point, the predetermined point related to the wireless communication The inter-communication record is stored in a predetermined recording area. The access point registers the identification information of each terminal to which the encryption key data is distributed, and also has an inter-terminal dedicated encryption key, so that wireless communication between the terminals can be received and stored. Therefore, if the communication time between the terminals and predetermined information indicating the contents of the communicated data are appropriately recorded in a predetermined recording area, each terminal can perform wireless communication without using an access point. The access point can manage and monitor various situations of the wireless communication.

  The terminal-to-terminal communication record may be saved as follows. According to an eighth aspect of the present invention, in the wireless communication system according to the seventh aspect, the terminal temporarily records the inter-terminal communication record in a predetermined recording area, and terminates the wireless communication to make an access point. In this case, the terminal-to-terminal communication record is wirelessly transmitted to the access point based on a request from the access point when the access is made again.

  Thus, at the time of wireless communication not via an access point, each terminal itself temporarily records the inter-terminal communication record in a predetermined recording area possessed by itself. When the wireless communication via the access point is resumed, the inter-terminal communication record is wirelessly transmitted to the access point based on a request from the access point. The access point stores the transmitted terminal-to-terminal communication record in a predetermined recording area such as a server of a connected host computer. As a result, it is possible to manage and investigate externally various situations in wireless communication that do not go through an access point by each terminal.

The above-described wireless communication system can grasp not only the entire system including the access point and the terminal, but also each of the access point and the terminal, which are constituent elements, as the invention.
Accordingly, the invention according to claim 9 is a terminal that includes a wireless LAN connection device and connects to a network that secures predetermined security during wireless communication via an access point that is a wireless LAN repeater. An instruction signal for requesting distribution of encryption key data representing the contents of the encryption key dedicated to the terminal used when encrypting the wireless communication data between the predetermined terminals without passing through the access point is transmitted. And encryption key setting means for receiving the encryption key data transmitted by the access point and setting the dedicated encryption key between terminals based on the encryption key data.

  Similarly, the invention according to claim 10 is an access point that is a wireless LAN repeater for connecting a terminal equipped with a wireless LAN connection device to a network that secures predetermined security during wireless communication, An instruction signal for requesting distribution of encryption key data representing the contents of an encryption key dedicated to terminals used when encrypting wireless communication data between predetermined terminals without passing through an access point, And a cryptographic key data transmitting unit for transmitting the cryptographic key data representing the contents of the generated dedicated cryptographic key between terminals to the predetermined terminal. It is set as the structure provided with.

In addition, the present invention can be grasped from the aspect of the apparatus as a wireless communication system, and at the same time, the invention can be grasped as an execution procedure of the system.
Therefore, the invention according to claim 11 is constructed by an access point which is a wireless LAN repeater and a plurality of terminals each having a wireless LAN connection device, and between the access point and each terminal is in wireless communication. A wireless communication method for setting a predetermined encryption key to the terminal used when encrypting wireless communication data prior to communication on a network in which predetermined security is ensured, wherein the terminal An instruction signal requesting distribution of encryption key data representing the contents of the encryption key dedicated to the terminal used when performing wireless communication between the predetermined terminals without passing through the access point to the point, and the access point Generates the inter-terminal dedicated encryption key based on the instruction signal transmitted from the terminal, and sends it to the predetermined terminal. The encryption key data representing the content of the generated encryption key between terminals is transmitted, and the terminal receives the encryption key data transmitted from the access point, and uses the encryption key data to determine the encryption key dedicated to the terminal. The configuration is to be set.

  Of course, it is possible to capture the inventions dependent on the inventions of claims 9 to 11 by applying the same aspects as those of the inventions of claims 2 to 8 dependent on claim 1.

As described above, according to the first aspect of the present invention, each terminal can perform wireless communication with each other without using an access point in a state where predetermined security is ensured without reducing the communication speed. In addition, it is possible to provide a wireless communication system capable of realizing the wireless communication by processing on the access point side and managing the wireless communication.
According to the second aspect of the present invention, wireless communication with security can be performed between terminals desiring to perform wireless communication without using an access point.
Further, according to the invention of claim 3, wireless communication with security is performed between the terminals without designating another terminal to perform wireless communication without using an access point on the terminal side. be able to.
Furthermore, according to the invention concerning Claim 4 and Claim 5, a security level can be raised more.
Further, according to the inventions according to claims 6, 7, and 8, various statuses of wireless communication when each terminal is shifted to the ad hoc mode are accurately managed and monitored on the access point side. be able to.

Furthermore, the invention according to claim 9 provides a terminal capable of performing wireless communication with each other without using an access point in a state in which predetermined security is ensured without reducing the communication speed. be able to.
Furthermore, according to the invention according to claim 10, each terminal is allowed to perform wireless communication with each other without using an access point in a state in which predetermined security is ensured without reducing the communication speed, An access point capable of managing the wireless communication can be provided.
According to the eleventh aspect of the present invention, the terminals can perform wireless communication with each other without going through the access point in a state where predetermined security is ensured without reducing the communication speed, and It is possible to provide a wireless communication method capable of realizing communication by processing on the access point side and managing the wireless communication.

Embodiments of the present invention will be described in the following order.
1. 1. Schematic configuration for realizing a wireless communication system Specific contents of wireless communication system 2-1. Example 1
2-2. Example 2
2-3. Example 3
3. Summary

1. Schematic configuration for realizing a wireless communication system
FIG. 1 is an explanatory diagram showing a hardware configuration for realizing a wireless communication system according to an embodiment of the present invention. As shown in the figure, an access point 20 and terminals 50, 60, 70, 80 are installed in the wireless communication area 10.

  FIG. 2 is an explanatory diagram showing a configuration of an access point (wireless base station) 20 that is a wireless LAN repeater. As shown in FIG. 1, the access point 20 includes a CPU 11, a ROM 12, a RAM 13, a nonvolatile storage device 14 such as a hard disk, a WAN port 16 as a network interface, and a wired LAN. Each unit includes a LAN port 21 for connection, a wireless communication interface 17, a display controller 15, and the like.

  The ROM 12 stores various programs related to communication with the terminals 50, 60, 70, and 80 in the wireless communication area 10 and connection to the Internet IN and data necessary for executing the programs. The display controller 15 is connected to various display lamps 22 that display the connection state and communication state of the wireless LAN by lighting and blinking. A transmitter 18 that transmits radio waves and a receiver 19 that receives radio waves are connected to the wireless communication interface 17. The transmitter 18 and the receiver 19 are built in the access point 20 in a state where transmission of radio waves to the outside and reception of radio waves from the outside are possible.

  As shown in the figure, a router 30 with a built-in modem is connected to the WAN port 16 of the access point 20 via a cable. The router 30 includes a plurality of terminals 50, 60, and 70 in the wireless LAN based on MAC (Media Access Control) addresses that are unique identification information assigned to the wireless LAN adapters 51, 61, 71, and 81, respectively. , 80 can be identified and distinguished from each other. The modem in the router 30 is connected to the Internet IN via a broadband communication line CL such as a CATV line or an xDSL line, or a dedicated line of the provider PV. That is, the router 30 functions as a gateway that connects the wireless LAN to the Internet IN.

  On the other hand, the terminals 50, 60, 70, 80 have wireless LAN adapters 51, 61, 71, 81 as wireless LAN connection devices that can transmit and receive radio waves to and from the access point 20. It is installed. By incorporating the device drivers of the wireless LAN adapters 51, 61, 71, 81 into the terminals 50, 60, 70, 80, the terminals 50, 60, 70, 80 are connected to the attached wireless LAN adapters 51, 61, 71. , 81 and the wireless LAN adapters 51, 61, 71, 81 can be controlled. In FIG. 1, when the output of the transmitter 18 and the reception sensitivity of the receiver 19 are set to predetermined set values, the radio waves transmitted from the transmitter 18 reach the terminals 50, 60, 70, and 80, and the receiver A range in which 19 can receive radio waves from the terminals 50, 60, 70, and 80 is represented as a wireless communication area 10. By installing the access point 20 and the terminals 50, 60, 70, and 80, a wireless LAN having a communication range within the wireless communication area 10 is established.

  That is, the terminals 50, 60, 70, and 80 in the wireless communication area 10 communicate with the access point 20 by transmitting and receiving radio waves between the wireless LAN adapters 51, 61, 71, and 81 and the access point 20. Is performed wirelessly. The access point 20 and the wireless LAN adapters 51, 61, 71, 81 can convert the exchanged data into a format suitable for communication, so-called packets, and thereby access the terminals 50, 60, 70, 80. It is possible to exchange data with the point 20 offline (in a state where it is not connected to the Internet).

  In the present embodiment, an environment in which a wireless LAN (hereinafter referred to as infrastructure mode) is performed between the access point 20 and each terminal 50, 60, 70, 80 as described above in a state in which predetermined security is ensured. The explanation is based on the assumption that The state where the predetermined security is ensured is, for example, that each MAC address of the wireless LAN adapter 51, 61, 71, 81 attached to each terminal 50, 60, 70, 80 is registered in the access point 20. And a common encryption key is set for each combination of the terminals 50, 60, 70, 80 and the access point. In the following description, the expression “terminal MAC address” also indicates the MAC address of the wireless LAN adapter attached to the terminal.

  When there is an access from a certain terminal, the access point 20 authenticates the MAC address of the terminal, and permits connection to the wireless LAN only when it is recognized as the registered MAC address. Conversely, if the MAC address is other than the registered one, the connection request from the terminal is rejected. In addition, when data is transmitted / received between the terminal having the registered MAC address and the access point 20, the data is encrypted with the encryption key set between the terminal and the encrypted data is received. To the device on the side (access point 20 or terminal). Then, the receiving apparatus decrypts the received encrypted data using a common encryption key, and obtains the data.

  Here, a WEP key can be used as the encryption key. The WEP key is an encryption technique of a secret key encryption method (a method in which the same encryption key is used for both data encryption and decryption of encrypted data) used in IEEE 802.11. There is a method using a 64-bit WEP key (WEP64) or a method using a 128-bit WEP key (WEP128) as an encryption key. The encryption using the WEP key makes it difficult to analyze the data when a radio wave carrying predetermined data is intercepted in the wireless communication area 10 and prevents leakage of communication contents to a third party. The In addition to the encryption method using the WEP key, an encryption method such as TKIP (Temporal Key Integrity Protocol) or AES (Advanced Encryption Standard) having a higher security level may be used. These WEP64, WEP128, TKIP, and AES have higher security levels as they follow the latter.

  In an environment in which security is ensured between the access point 20 and each terminal 50, 60, 70, 80, the wireless communication system according to the present application is accessed by all or a part of each terminal 50, 60, 70, 80. An inter-terminal dedicated encryption key required in a mode in which direct wireless communication is performed without going through the point 20 (hereinafter, ad hoc mode) is set in the corresponding terminal.

In FIG. 1, terminals 50, 60, 70, and 80 are well-known notebook personal computers, including a control device including a CPU, ROM, RAM, and the like, a hard disk as a storage device, a CD-ROM drive, and the like. Is provided. However, the terminal according to the present application need not be limited to a personal computer, and may be another terminal such as a personal digital assistant (Personal Digital Assistant). Alternatively, a DVD player and a digital television may be used as the terminal. With this configuration, in the above-described ad hoc mode, data related to the content to be played is wirelessly transmitted from a DVD player, which is one terminal, to a digital television, which is the other terminal. The same content can be played on the side.
.

2. Specific Contents of Wireless Communication System The ROM 12 of the access point 20 is requested to distribute data representing the contents of the inter-terminal dedicated encryption key (hereinafter referred to as encryption key data) by any of the terminals 50, 60, 70, and 80. Sometimes, a program (encryption key data distribution program) for generating an inter-terminal dedicated encryption key and distributing encryption key data to a predetermined terminal is stored in advance. On the other hand, the utility program installed in the terminals 50, 60, 70, 80 when using the wireless LAN includes a program related to the setting of the encryption key for terminals (dedicated encryption key setting program for terminals). Further, in the ROM 12 of the access point 20 and the utility program, as will be described later, a predetermined program for recording and transmitting / receiving a predetermined communication record before and after each terminal shifts to the ad hoc mode and during the shift. Is stored.

2-1. Example 1
A case will be described in which the inter-terminal dedicated encryption key is set in the terminals 50, 60, 70, and 80 to perform communication in the ad hoc mode.
The contents of the inter-terminal dedicated encryption key setting program are executed by the CPUs of the terminals 50, 60, 70, and 80, and the contents of the encryption key data distribution program are transferred to the access point as the inter-terminal dedicated encryption key setting program is executed. 20 CPUs 11 execute. As a result, as shown in FIGS. 3 and 4, an inter-terminal dedicated encryption key common to the terminals 50, 60, 70 and 80 is set.

FIG. 3 is a flowchart showing the setting process of the inter-terminal dedicated encryption key.
The routine A1 is a routine relating to one terminal among the terminals 50, 60, 70, and 80 that has requested distribution of encryption key data to itself and other terminals. In the present embodiment, the routine A1 is the terminal 50. Assume. On the other hand, the routine B1 is a routine on the access point 20 side.
First, the user confirms that the terminal 50 and other terminals 60, 70, 80 for which the inter-terminal-dedicated encryption key is to be set are in the wireless communication area 10, and sets the wireless LAN adapter 51 of the terminal 50. A provided registration button (not shown) is pressed down (step S100). When the terminal 50 detects that the registration button is pressed, the terminal 50 executes the inter-terminal dedicated encryption key setting program, and performs the processes in and after step S110.

  The terminal 50 adds a distribution destination instruction signal in which data related to the MAC addresses of the terminals 60, 70, and 80 designated as distribution destinations of encryption key data other than itself is added to the distribution request signal for requesting distribution of the encryption key data. And transmitted to the access point 20 (step 110). The access point 20 that has received the distribution destination instruction signal performs a process of generating an inter-terminal dedicated encryption key based on the instruction signal (steps 200 and 210). As described above, the encryption key in the infrastructure mode is already set between the access point 20 and each terminal 50, 60, 70, 80. Therefore, each data to be wirelessly communicated between the access point 20 and each of the terminals 50, 60, 70, 80, including Example 2 and later described later, is transmitted after being encrypted with the same encryption key. On the receiving side, each data is obtained by decrypting with a common encryption key.

The method by which the access point 20 generates the inter-terminal dedicated encryption key is not limited. For example, a result value obtained by substituting the value of the reception time of the packet into a predetermined arithmetic expression may be used as the inter-terminal dedicated encryption key. As the arithmetic expression, a multidimensional function having numbers constituting the reception time value as elements can be considered.
When the inter-terminal dedicated encryption key is generated in this way, the access point 20 transmits the encryption key data to the designated terminal (step S220). As described above, the terminal 50 notifies the access point 20 of the MAC addresses of the terminals 60, 70, and 80 as distribution destinations of encryption key data other than itself. Therefore, the access point 20 transmits the encryption key data to the terminal 50 that transmitted the instruction signal and the terminals 60, 70, and 80 associated with the notified MAC address.

  The terminal 50 receives the transmission of the encryption key data (step S120), and performs a process of setting the terminal-specific encryption key to itself based on the encryption key data (step S130). Also, the terminals 60, 70, 80 designated as the distribution destination of the encryption key data by the terminal 50 receive the encryption key data transmitted from the access point 20 as shown in the routine C1 of FIG. S300). Then, based on the encryption key data, a process for setting the terminal-specific encryption key to itself is performed (step S310).

  Through the above processing, the inter-terminal dedicated encryption key common to the terminals 50, 60, 70, 80 is set. As a result, when performing wireless communication in the ad hoc mode without the access point 20 between the terminals 50, 60, 70, and 80, various data to be transmitted are encrypted with the inter-terminal dedicated encryption key. The data can be decrypted using a dedicated encryption key. Therefore, even in the ad hoc mode, it is possible to prevent unauthorized intrusion into a third party network and leakage of communication contents. In addition, since wireless communication is performed directly between the terminals 50, 60, 70, and 80 without using the access point 20, the number of paths required for data transmission is half. Therefore, the inconvenience that a plurality of terminals simultaneously access the access point 20 reaches the upper limit of the bandwidth of the access point 20 and the communication speed decreases.

  In the above description, all terminals in the wireless communication area 10 are designated as terminals for which the terminal 50 sets an inter-terminal dedicated encryption key other than itself. However, it is naturally considered that only some terminals in the wireless communication area 10 are designated, and a common inter-terminal encryption key is set between some terminals in the wireless communication area 10 to set the ad hoc mode. It is also possible to realize wireless communication using

2-2. Example 2
When performing wireless communication in the ad hoc mode between some terminals in the wireless communication area 10, as described below, the access point 20 is capable of handling itself and between terminals that are about to shift to the ad hoc mode. Among the encryption methods that can be commonly used, the encryption method with the highest security level may be adopted to generate and distribute the inter-terminal dedicated encryption key.

  FIG. 5 is a flowchart illustrating processing for setting a dedicated encryption key between terminals in the second embodiment. In the figure, only the terminals 50 and 60 shift to the ad hoc mode. Here, the access point 20 supports WEP64, WEP128, and TKIP among the encryption methods, and the wireless LAN adapter 51 of the terminal 50 supports WEP64, WEP128, and TKIP, and the wireless LAN of the terminal 60 The adapter 61 is assumed to be compatible with WEP64 and WEP128.

Also in this figure, as in FIG. 3, the terminal 50 makes a distribution request for encryption key data. In the following, the description will be focused on the points different from FIG.
In the distribution destination instruction signal transmitted by the terminal 50 in step S410 of the routine A2, in addition to the distribution request signal and the data related to the MAC address of the terminal 60 designated as the distribution destination of encryption key data other than the self, the terminal 50 Data indicating encryption methods that can be supported (encryption method list data) is added. That is, when the terminal 50 also sends out its own encryption method list data, the access point 20 recognizes the three encryption methods that the terminal 50 can handle.

The access point 20 identifies the terminal (in this case, the terminal 60) designated by the terminal 50 as the distribution destination of the encryption key data based on the notified MAC address, and the encryption method list data for the identified terminal 60 A list data request signal for requesting is transmitted (step S510).
The terminal 60 that has received the list data request signal (step S600) transmits, to the access point 20, encryption method list data indicating an encryption method that the terminal 60 can handle according to the request signal (step S610). By receiving the encryption method list data (step S520), the access point 20 acquires the encryption method list data of all the terminals 50 and 60 to which the encryption key data is to be distributed.

  Next, the access point 20 performs a process of generating an inter-terminal dedicated encryption key (step 530). The access point 20 refers to the encryption method list data transmitted from the terminals 50 and 60, respectively, and has the highest security level among the encryption methods that the terminal 50 and 60 can support. Select a high encryption method. In this case, the encryption method that satisfies the above condition is WEP128. Therefore, the access point 20 adopts WEP128 as an encryption method and generates a terminal-to-terminal encryption key. Then, for the terminal 50 that transmitted the distribution destination instruction signal and the terminal 60 associated with the notified MAC address, the generated encryption key data of the inter-terminal dedicated encryption key is transmitted to the selected encryption method (WEP128). Is transmitted together with an encryption method instruction signal for instructing to adopt (step S540).

  Receiving the encryption key data and the encryption method instruction signal (steps S420 and S620), the terminals 50 and 60 set the inter-terminal dedicated encryption key to itself (steps S430 and S630), and thereafter encrypting in the ad hoc mode. WEP128 is adopted as a method, and data is encrypted and decrypted with a dedicated encryption key between the terminals.

  As described above, general wireless LAN devices do not support all encryption methods. Therefore, the encryption methods that can be commonly used between devices connected to a network are reduced as the number of devices connected to the network increases, and the available methods are also lower in security level. Tend to. Therefore, as explained in the figure, if you select an encryption method that can be adopted for each group of terminals that shift to the ad hoc mode, the number of devices participating in the network can be reduced, so the infrastructure mode has been configured. It is easy to adopt an encryption method with a higher security level than the encryption method that can be adopted by all terminals that have been used. That is, if the said structure is used, the security of the radio | wireless communication by ad hoc mode can be strengthened more.

  Naturally, a case where a plurality of terminal groups try to shift to the ad hoc mode separately is also conceivable. For example, the terminals 50 and 60 form the terminal group 1 in the ad hoc mode, and the terminals 70 and 80 form the terminal group 2 in the ad hoc mode that is not connected to the terminal group 1. In this case, for the terminal group 1, the access point 20 adopts the highest security level encryption method that can be handled in common by itself and the terminal group 1, and generates an inter-terminal dedicated encryption key. Data is distributed to the terminals 50 and 60. Similarly, for the terminal group 2, an encryption method of the highest security level that can be handled in common by itself and the terminal group 2 is adopted to generate an inter-terminal dedicated encryption key, and the encryption key data is transferred to the terminal 70, Distribute to 80. In this case, the encryption method employed in each terminal group may naturally be different. Also, even when the encryption methods match, by making the contents of the inter-terminal dedicated encryption key different, it is possible to safely perform closed wireless communication in each terminal group, and the wireless communication data in one group Leaks to other groups are prevented.

  From the viewpoint of strengthening the security of wireless communication in the ad hoc mode, the access point 20 may designate a communication channel in a frequency band used for the wireless communication in the ad hoc mode when transmitting the encryption key data to a predetermined terminal. . If a communication channel used during the ad hoc mode transition period is designated on the access point 20 side and wireless communication is performed with a predetermined terminal using only the communication channel, the difficulty of intrusion from the outside increases, and the ad hoc mode transition period Can be made more secure. Here, when a plurality of terminal groups shift to the ad hoc mode separately, a different communication channel is designated for each terminal group. Furthermore, in order to strengthen the security, the access point 20 may designate the port number as the lower layer address of the IP address used by each terminal during the ad hoc mode transition period. Such designation also increases the difficulty of intrusion from the outside and enhances security.

  A significant advantage of the present invention is that wireless communication between terminals in the ad hoc mode can be managed on the access point 20 side. In other words, in the present application, instead of generating and setting a common inter-terminal dedicated encryption key on the side of each terminal performing wireless communication not via the access point 20, the inter-terminal dedicated encryption key is generated by the access point 20. Do. This means that the ad-hoc mode wireless communication in which the security is ensured is realized by an action on the access point 20 side, and at the same time, a network in which the access point 20 cannot grasp the communication status is between each terminal. It is prevented from being built.

The management of the ad hoc mode by the access point 20 mainly includes: a) recording and management of wireless communication with the access point 20 performed before and after each terminal is in the ad hoc mode transition period; and b) each terminal is in the ad hoc mode transition period. Recording and management of wireless communication between terminals performed in the middle.
First, a) will be described by taking the process in FIG. 5 as an example.

  The access point 20 includes the MAC address of the terminals 50 and 60 to which the encryption key data is transmitted, the time when the encryption key data is transmitted, the content of the transmitted encryption key data, and the inter-terminal dedicated encryption key. The encryption method employed at the time of generation and the communication channel designated for ad-hoc mode wireless communication are stored in the storage device 14 as communication records. In addition, the time when the terminals 50 and 60 access the access point 20 to end the ad hoc mode and return to the infrastructure mode is recorded and stored. If such storage is performed, it is objectively proved that the terminals 50 and 60 were performing the ad-hoc mode wireless communication in a state where predetermined security was ensured for a certain period of time. As a result, for example, even if information such as a trade secret is leaked from another terminal or another terminal 70 or 80 from the terminal 50 or 60, if the communication record is examined, the ad hoc mode transition period may occur. Can objectively prove that no such information leakage has occurred.

The process b) will be described.
The access point 20 registers the MAC address of each terminal and also has an inter-terminal dedicated encryption key. Therefore, the access point 20 can receive data wirelessly communicated between the terminals. However, since the terminals exchange data directly during the ad hoc mode transition period, the access point 20 intercepts data wirelessly communicated between the terminals. When the access point 20 intercepts wireless communication data between terminals during the ad hoc mode transition period, the CPU 11 extracts a predetermined communication record (inter-terminal communication record) from the wireless communication data according to a predetermined program.

As the terminal-to-terminal communication record, for example, the data size, file attribute, and part of the data content of the wireless communication data exchanged by each terminal can be considered, and the terminal-to-terminal communication record is recorded / saved in the storage device 14 or the like.
Alternatively, the inter-terminal communication record may be temporarily recorded on each terminal side and transmitted to the access point 20 at a predetermined timing. For example, each terminal temporarily records the inter-terminal communication record related to the wireless communication data transmitted during the ad hoc mode transition period in a predetermined recording area of each terminal. On the other hand, on the access point 20 side, when it is detected that a certain terminal ends the ad hoc mode and returns to the infrastructure mode, the inter-terminal communication record recorded during the ad hoc mode transition period is transmitted to the terminal. A predetermined request signal for requesting is transmitted.

The terminal that returns to the infrastructure mode and receives the request signal transmits the inter-terminal communication record to the access point 20 in accordance with the request signal. The access point 20 records / stores the received inter-terminal communication record in the storage device 14 or the like. Thus, by storing the communication record between terminals, the status of wireless communication performed between terminals during the ad hoc mode transition period is managed and monitored. For example, by investigating the communication record, it is possible to investigate afterwards whether or not illegal data that infringes copyright is exchanged between terminals.
Note that the various communication records acquired by the access point 20 in the above a) and b) may be stored not in the storage device 14 but in a predetermined server SV on the Internet IN to which the access point 20 is connected.

2-3. Example 3
In the above description, the terminal 50 that requests the access point 20 to distribute the encryption key data designates a terminal to which the encryption key data is distributed in addition to itself, but the present invention needs to be limited to such a structure. There is no.
FIG. 6 is a flowchart illustrating the setting process of the inter-terminal dedicated encryption key in the third embodiment. In FIG. 9, step S710 of routine A3 and step S820 of routine B3 are different from step S110 and step S220 of FIG. 3 according to the first embodiment.

  That is, in step S710 of FIG. 6, the terminal 50 does not designate a distribution destination of encryption key data other than itself to the access point 20, but a distribution request signal for requesting distribution of encryption key data. Only send. When it can not be said that the terminal 50 always recognizes another terminal forming the wireless LAN via the access point 20 via the MAC address or the like when attempting to shift from the infrastructure mode to the ad hoc mode. There is also. Even if the terminal 50 can recognize the MAC address of another terminal, a predetermined process for the recognition may be required. On the other hand, on the access point 20 side, the MAC addresses of the terminals 50, 60, 70, 80 connected to the wireless LAN are securely registered.

  Therefore, in step S820 of the routine B3, the access point 20 transmits the encryption key data generated in step S810 to each end 50, 60, 70, 80 in which the MAC address is registered. At this time, data related to the MAC addresses of other terminals may be transmitted to each terminal. That is, also in the configuration shown in the figure, a terminal-to-terminal dedicated encryption key common to the terminals 50, 60, 70, and 80 can be set.

3. Summary
In this way, one terminal is connected to the access point 20 in a wireless LAN environment that is constructed by the access point 20 and a plurality of terminals, and for which wireless communication between the access point 20 and each terminal is ensured. On the other hand, a predetermined instruction signal for distributing the encryption key data is transmitted to the terminal and other terminals, and the access point 20 generates an inter-terminal dedicated encryption key based on the instruction signal, and The encryption key data is transmitted to the terminal and other terminals. As a result, the terminal-specific encryption key generated by the access point 20 is set in each terminal, ensuring the security of wireless communication during the ad hoc mode transition period, and the various conditions of the wireless communication in the access point 20. Can be managed and monitored on the side.

It is explanatory drawing which shows the hardware constitutions concerning embodiment of this invention. It is explanatory drawing which shows the structure of an access point. 4 is a flowchart illustrating processing for setting a terminal-to-terminal dedicated encryption key according to the first exemplary embodiment. 6 is a flowchart illustrating a part of the inter-terminal dedicated encryption key setting process according to the first embodiment. 10 is a flowchart illustrating processing for setting a dedicated encryption key between terminals according to the second embodiment. 12 is a flowchart illustrating processing for setting a dedicated encryption key between terminals according to the third embodiment.

Explanation of symbols

10 ... Wireless communication area 11 ... CPU
12 ... ROM
13 ... RAM
14 ... Storage device 16 ... WAN port 17 ... Wireless communication interface 18 ... Transmitter 19 ... Receiver 20 ... Access point 50, 60, 70, 80 ... Terminals 51, 61, 71, 81 ... Wireless LAN adapter

Claims (11)

An access point that is a repeater for a wireless LAN and a plurality of terminals each having a wireless LAN connection device are constructed on a network in which predetermined security during wireless communication is ensured between the access point and each terminal. A wireless communication system in which a predetermined encryption key used when encrypting wireless communication data prior to communication is set in the terminal,
The terminal sends an instruction signal for requesting the access point to distribute encryption key data representing the contents of the inter-terminal dedicated encryption key used when performing wireless communication between the predetermined terminals without passing through the access point. An encryption key data request means for transmitting, and an encryption key setting means for receiving the encryption key data transmitted from the access point and setting the dedicated encryption key between terminals based on the encryption key data,
The access point, based on the instruction signal transmitted from the terminal, generates encryption key generation means for generating the inter-terminal dedicated encryption key, and the content of the generated inter-terminal dedicated encryption key to the predetermined terminal. A wireless communication system comprising: encryption key data transmission means for transmitting encryption key data to be represented. The wireless communication system according to claim 1,
When transmitting the instruction signal, the encryption key data requesting unit also transmits identification information specific to another terminal that is scheduled to perform wireless communication without going through the access point.
The wireless communication system, wherein the encryption key data transmission means transmits encryption key data to a terminal that has transmitted the instruction signal and another terminal specified by the identification information. The wireless communication system according to claim 1,
The wireless communication system, wherein the encryption key data transmission means transmits encryption key data to a terminal that has transmitted the instruction signal and another terminal in which identification information unique to the terminal is registered in the access point. The wireless communication system according to any one of claims 1 to 3,
The encryption key generation means can be commonly used by predetermined terminals that perform wireless communication with each other without using an access point, among encryption methods used when encrypting wireless communication data that can be adopted by an access point. And the encryption method with the highest security level is selected, and the inter-terminal dedicated encryption key is generated by the selected encryption method,
The wireless communication system, wherein the encryption key data transmission means transmits an encryption method instruction signal instructing that the predetermined terminal adopts the selected encryption method together with the encryption key data. The wireless communication system according to any one of claims 1 to 4,
The wireless communication system, wherein the access point designates a communication channel used for wireless communication between predetermined terminals when wireless communication is not performed via the access point. The wireless communication system according to any one of claims 1 to 5,
The access point includes at least the identification information specific to the terminal that is the transmission destination of the encryption key data by the encryption key data transmission means, when the predetermined terminal performs wireless communication not via the access point, or performs the wireless communication. A wireless communication system, wherein a predetermined communication record relating to wireless communication performed with an access point when the access point is terminated and accessed again is stored in a predetermined recording area. The wireless communication system according to any one of claims 1 to 6,
The access point stores a predetermined inter-terminal communication record for the radio communication in a predetermined recording area when performing radio communication between the predetermined terminals without going through the access point. Communications system. The wireless communication system according to claim 7, wherein
The terminal temporarily records the inter-terminal communication record in a predetermined recording area, and the inter-terminal communication recorded based on a request from the access point when the wireless communication is terminated and the access point is accessed again A wireless communication system, wherein a record is wirelessly transmitted to an access point. A terminal that includes a wireless LAN connection device and connects to a network that secures predetermined security during wireless communication via an access point that is a relay for wireless LAN,
An instruction signal for requesting distribution of encryption key data representing the contents of a dedicated encryption key between terminals used when encrypting wireless communication data between predetermined terminals without passing through the access point is transmitted. An encryption key data requesting means;
A terminal comprising: encryption key setting means for receiving encryption key data transmitted by the access point and setting the inter-terminal dedicated encryption key based on the encryption key data. An access point that is a wireless LAN repeater for connecting a terminal equipped with a wireless LAN connection device to a network that secures predetermined security during wireless communication,
An instruction signal for requesting distribution of encryption key data representing the contents of an encryption key dedicated to terminals used when encrypting wireless communication data between predetermined terminals without passing through an access point, An encryption key generating means for generating an encryption key dedicated to the same terminal when received from
An access point comprising: encryption key data transmitting means for transmitting encryption key data representing the contents of the generated inter-terminal dedicated encryption key to the predetermined terminal. An access point that is a repeater for a wireless LAN and a plurality of terminals each having a wireless LAN connection device are constructed on a network in which predetermined security during wireless communication is ensured between the access point and each terminal. A wireless communication method for setting a predetermined encryption key used for encrypting wireless communication data prior to communication in the terminal,
The terminal sends an instruction signal for requesting the access point to distribute encryption key data representing the contents of the inter-terminal dedicated encryption key used when performing wireless communication between the predetermined terminals without passing through the access point. Send
The access point generates the inter-terminal dedicated encryption key based on the instruction signal transmitted from the terminal, and encrypts key data representing the content of the generated inter-terminal dedicated encryption key in the predetermined terminal Send
The wireless communication method, wherein the terminal receives encryption key data transmitted from the access point, and sets the inter-terminal dedicated encryption key based on the encryption key data.

Images