JP4581928B2 - Authentication system for power line communication and distribution method of authentication data for power line communication - Google Patents

Description

  The present invention relates to an authentication system for a power line communication modem using a power line in a house, a building or an apartment house, and a method for distributing the authentication data.

  Conventionally, power line communication modems used for power line communication have a certain level of secrecy in that they cannot be demodulated unless the same manufacturer's power line communication modems are used because the modulation method and access method differ for each manufacturer. However, in addition to this, the use of an authentication system used in a wireless LAN, etc., and the addition of a header (MAC address <Media Access Control address>) specific to the modem for power line communication enables security. It was common to improve the performance.

  By the way, in the power line communication, since the signal is propagated through the power line, there is no attenuation due to the shielding of the building as in the case of the wireless LAN. Therefore, there is a demand for measures to strengthen security beyond wireless communication.

In order to enhance security in power line communication, a method for transmitting a secret key for authentication to the power line communication modem and storing it in the power line communication modem after separating the power line communication modem from the circuit network is also provided. (Patent Document 1).
Special Table 2004-535703 (column (summary) column on the first page of the gazette)

  In the method disclosed in Patent Literature 1, since the power line communication modem is separated from the circuit network and the secret key is transmitted to the power line communication modem, the secret key is not propagated to the outside through the line network (power line). Although there is no secret key transmission itself by using power line communication, there are the following problems.

  That is, since power line communication is communication using an unbalanced power line, the power line serves as an antenna, and signals are propagated through the air. For this reason, a signal propagated in the air could be intercepted by a malicious person and the secret key could be decrypted using the same manufacturer's authentication system. Therefore, there is a risk that information is stolen by misuse of the decrypted secret key, and it cannot always be said that sufficient measures are taken for safety and confidentiality regarding information leakage.

  The present invention has been made in view of the above-described points, and the object of the present invention is to provide an authentication system for power line communication and authentication data for power line communication that can distribute authentication data without fear of being intercepted from the outside. Is to provide a distribution method.

In order to achieve the above object, in the power line communication authentication system according to claim 1, the power line communication authentication system distributes authentication data to a power line communication modem having a power line communication function connectable to the power line. The local communication unit for receiving authentication data in the power line communication modem, a storage unit, and a determination for the slave to store the authentication data in the storage unit when the authentication data is received by the local communication unit A slave-side modem configured to include an authentication unit , another local communication unit for receiving authentication data, another storage unit in which authentication data is stored in advance, and the slave in the other local communication unit When the local communication unit of the side modem is connected via a communication line, the authentication data stored in the another storage unit is transmitted from the other local communication unit to the communication And a master unit configured to include a determination unit for the master to be transmitted to the slave modem via the from the master unit via the communication line to the slave modem and distributes authentication data, wherein The slave modem transmits / receives data to / from a device connected via a power line using the authentication data stored in the storage unit .
According to the invention of the authentication system for power line communication of claim 2, in the invention of claim 1, the modem for power line communication includes a local communication unit, a storage unit for storing authentication data, and determinations for the slave and master. And a switching unit for selectively selecting a determination unit to be used and selecting the power line communication modem as either the master unit or the slave side modem, and the same network for power line communication. One of all power line communication modems used for the group is the master means, and the rest are slave side modems.

  In the invention of the authentication system for power line communication of claim 3, in the invention of claim 1 or 2, the local communication units of the plurality of slave modems and the other local communication unit of the master means include a concentrator. And are interconnected by communication lines.

  A power line communication authentication system according to a fourth aspect of the present invention is the authentication system according to any one of the first to third aspects, wherein the master means includes external data input means for acquiring authentication data from the outside. .

In the invention of the method for distributing authentication data for power line communication according to claim 5, a plurality of power line communication functions that can be connected to the power line are used to send and receive data to / from devices connected via the power line. In the method for distributing authentication data for power line communication that distributes the authentication data to the power line communication modem, a power line communication modem that stores authentication data in advance among the plurality of power line communication modems is used as a master modem. A first process of using another power line communication modem as a slave modem, a local communication unit for transmitting authentication data possessed by the master modem, and a local communication for transmitting authentication data possessed by the slave modem A second process of establishing a communication path for authentication data that does not use the power line communication function by interconnecting with each other by a communication line; And a third step of transmitting the authentication data to the slave modem via the communication line, and receiving the transmitted authentication data by the slave modem. .

  The power line communication authentication system and the power line communication authentication data distribution method of the present invention may be intercepted from the outside by sending authentication data to the power line communication modem using wired local communication without using power line communication. Authentication data can be distributed, and as a result, the confidentiality of the authentication data can be ensured and highly secure power line communication can be achieved.

  FIG. 1A shows a configuration of a power line communication modem 1 used in the present invention, and the power line communication modem 1 connects a coupler 3 and a power supply circuit 4 via a power line connection unit 2. ing. The coupler 3 includes a filter for attenuating the power frequency and extracting / superimposing a signal in a high frequency band including the communication frequency. The power circuit 4 supplies a commercial power source to each part in the modem as a DC voltage + V It is to convert to.

  An interface 5 including a PHY chip (physical layer device) and a MAC chip (MAC layer device device) that defines a connection / transmission method for a power line communication network is connected to the subsequent stage of the coupler 3. Is connected to a modulation / demodulation circuit 6 having a modulation function for modulating a data signal and carrying it as a communication signal and a demodulation function for demodulating the data signal from the communication signal extracted from the power line L.

  Connected to the subsequent stage of the modulation / demodulation circuit 6 is a data transmission / reception unit 7 having a function for transmitting / receiving modulated power line communication data and demodulated power line communication data between the transmission port 13 and the reception port 15. is doing. The transmission port 13 and the reception port 15 are connected to an Ethernet (registered trademark) interface 12 composed of a chip for determining a MAC address (device number) and a PHY (physical layer). The interface 12 constitutes a local communication unit, and the connector 16 of the local communication unit is connected to a signal line 15 from a network terminal such as a personal computer that performs power line communication using the power line communication modem 1, When the authentication system is constructed, the local communication unit of the master means or the slave modem is connected via the communication line 15. As described above, Ethernet (registered trademark) is used as a communication standard for the local communication unit. However, other wired communication standards such as USB (Universal Serial Bus), IEEE1394 <serial SCSI>, etc. You may use the local communication part of other standards which do not have a possibility that a signal may propagate in the air.

  The above circuit configuration is a basic configuration as a power line communication modem. The power line communication modem 1 used in the present invention has the following configuration necessary for constructing an authentication system.

  That is, a storage unit 8 for storing authentication data, a master side determination unit <hereinafter referred to as a first determination unit> 10 for the power line communication modem 1 to function as a master side modem as a master unit of the authentication system, a slave A slave-side determination unit <hereinafter referred to as a second determination unit> 11 for functioning as a side modem, and the first determination unit 10 to use the power line communication modem 1 as a master-side modem, or a second determination unit 11 And a switching unit 9 composed of a dip switch or the like for selectively selecting whether to use as a slave-side modem.

Next, an embodiment of the present invention in which authentication data is distributed using the power line communication modem 1 configured as described above will be described.
(Embodiment 1)
This embodiment is a system that distributes authentication data by one-to-one opposing communication for home use, and encryption key data, which is special authentication data at the time of factory shipment, is previously stored in one of the two power line communication modems 1. It is stored in the storage unit 8, and the master side modem 1 a that uses the first determination unit 10 by switching the switching unit 9 is used, and the second determination unit 11 is used by switching the switching unit 9 on the other side. The slave modem 1b to be set is first prepared (first process).

  Next, as shown in FIG. 1A, the user connects the power line connection unit 2 of the master side modem 1a and the slave side modem 1b to the power line L, and the interface 12 constituting the local communication unit of both modems 1a and 1b. They are connected by the communication line 15 (second process). At this stage, the network group to which the slave modem 1b belongs is not determined.

  When the establishment of the communication path between the modems 1a and 1b by the communication line 15 is completed, the power switch SW1 is turned on in the order of the slave modem 1b and the master modem 1a to turn on the power. The first determination unit 10 of the master-side modem 1a that has detected the establishment of the communication path by the local communication unit by starting up the power supply has a special indication for explicitly indicating that it is the master-side modem to the slave-side modem 1b. The signal is sent to the communication line 15 via the data transmitter / receiver 7, the transmission port 13, and the interface 12.

  On the other hand, the slave modem 1b receives the signal transmitted from the master modem 1a via the communication line 15 by the interface 12, and sends it to the second determination unit 11 via the reception port 14 and the data transmission / reception unit 7. The second determination unit 11 recognizes that the modem plays the role of the slave modem by the received signal.

  Thereafter, the first determination unit 10 of the master-side modem 1a randomly generates an encryption key from the encryption key data stored in advance in the storage unit 8, and the generated encryption key is used as the data transmission / reception unit 7, the transmission port 13, and the interface. 12 is sent to the communication line 15 via 12, and the encryption key is distributed to the slave modem 1b.

  In the slave modem 1b, the encryption key transmitted from the master modem 1a via the signal line 15 is received by the interface 12, and the received encryption key is received via the reception port 14, the data transmission / reception unit 7, and the switching unit 9. And sent to the second determination unit 11. The second determination unit 11 stores the sent encryption key in the storage unit 18. As a result, the power line communication modem constituting the modem 1b and the power line communication modem constituting the master side modem 1a belong to the same network group (third process).

  Thus, after the distribution of the encryption key from the master modem 1a to the slave modem 1b is completed and the network group is determined, the interface 12 which is a local communication unit of each modem 1a, 1b is composed of a personal computer or the like. If the local communication unit of the net terminal is connected by a signal line, a network for performing data communication by power line communication is constructed.

  The power communication modem 1 in this network configuration has no relationship between the master side and the slave side, and becomes a modem belonging to the same network group. When data transmission / reception by power line communication is performed between the network terminals connected to the power line communication modem 1 belonging to the same network group, the first negotiation between the power line communication modems 1 and 1 is performed as the first negotiation. The encryption key stored in the storage unit 8 is exchanged. In other words, the data transmission / reception unit 7 reads out the encryption key stored in the storage unit 8 and sends it to the other side by power line communication so that the power line communication modems 1 and 1 belong to the same net group by exchanging the encryption keys with each other Check if it is.

  After such negotiation is completed, when transmitting from the network terminal connected to one power line communication modem 1 to the network terminal connected to the other power line communication modem 1 in the network group, In the power communication modem 1, the transmission data from the network terminal is transmitted to the modulation / demodulation circuit 6 via the interface 12, the reception port 14, and the data transmission / reception unit 7, and then modulated as a power line signal via the interface 5 and the coupler 3. Send out on power line L.

  The power line signal transmitted on the power line L is received via the coupler 3 and the interface 5 of the power line communication modem 1 on the receiving side, and data is demodulated by the modem circuit 6. The demodulated data is sent to the network terminal via the data transmitter / receiver 7, the transmission port 13, and the interface 12.

  After exchanging the encryption key (authentication data) as the first negotiation in this way, data can be exchanged between the network terminals via the power line communication modems 1 and 1 belonging to the same network group. .

  By the way, when the encryption key exchange failure in the negotiation or the encryption key needs to be distributed again, the encryption once stored in the storage unit 8 of the power line communication modem 1 on the slave side. The key needs to be erased.

  In this case, reset is performed by using a loop pack function (the transmission MAC address and the reception MAC address are in the same state).

  The procedure for implementing this loopback function will now be described. First, the power line communication modem 1 to be erased from the encryption key is connected to the power line L, and the power switch SW1 is turned on. Thereafter, when a reset switch (not shown) provided in the modem 1 is pressed, the data transmission / reception unit 7 uses the transmission port 13 that is logically divided to erase data having its own MAC address as the destination. Send. The transmitted data is transmitted to the reception port 14 in the power line communication modem 1, and this data is further sent to the second determination unit 11 via the data transmission / reception unit 7, and the second determination unit 11 includes the storage unit 8. Delete the encryption key that is the authentication data stored in. As a result, the state before the password is distributed is restored. By operating the loopback function in this way, it is possible to redistribute the encryption key by constructing an authentication system composed of the master modem 1a and the slave modem 1b as described above.

Thus, according to the present embodiment, since the personal identification key as the authentication data is distributed by local communication using the wired communication line 15, there is no possibility of leakage to the outside as in the case of power line communication. Therefore, the danger of being intercepted by others can be physically eliminated, and the security can be improved.
(Embodiment 2)
In the first embodiment described above, authentication data is distributed by one-to-one opposing communication between the master modem 1a and the slave modem 1b for home use, but in this embodiment, an apartment house, a building, or the like In this case, the user uses a power line connection unit 2 of the slave modems 1b... Set in advance by switching of the switching unit 9 to the power line L. In addition to the connection, each interface 12 is connected to the line concentrator 17 via the communication line 15 (see FIG. 1C). At this time, it is not determined to which network group the slave modems 1b.

  Next, the encryption key data is stored in the storage unit 8 in advance at the time of shipment from the factory, and the power line connection unit 2 of the master modem 1a set by the switching unit 9 is connected to the power line L, and the interface 12 is connected to the concentrator 17 16, connected via the communication line 15.

  Thereafter, after the power switch SW1 of the slave modem 1b is turned on, the power of the concentrator 17 is turned on, and when the power switch SW1 of the master modem 1a is turned on, the master side is turned on similarly to the first embodiment by turning on the power. A signal that explicitly indicates that the modem is the master modem is transmitted to each slave modem 1b through the concentrator 17 by the operation of the first determination unit 10 of the modem 1a, and the second of each slave modem 1b. The determination unit 11 is made to recognize that it plays the role of the slave modem.

  After this recognition, in the master modem 1a, the first determination unit 10 randomly generates an encryption key from the encryption key data stored and held in the storage unit 8, and the generated encryption key is used as the data transmission / reception unit 7, the transmission port. 13, by sending it to the signal line 15 via the interface 12, it is distributed to each slave modem 1 b. The second determination unit 11 of each slave modem 1b... Performs processing for storing the received encryption key in the storage unit 8 as in the first embodiment. As a result, the modem 1b is subsequently authenticated as belonging to the same network group as the master modem 1a.

  In this embodiment as well, the encryption key can be erased using the loopback function as in the first embodiment.

  Thus, according to the present embodiment, as in the first embodiment, since the secret key as authentication data is distributed by local communication using a wired communication line, it is leaked to the outside as in the case of power line communication. Therefore, the danger of being intercepted by another person can be physically eliminated, and the security can be improved.

In addition, since the switching can be freely switched from the master side modem to the slave side modem and from the slave side modem to the master side modem by switching the switching unit 9, the network group can be freely rearranged or reintegrated.
(Embodiment 3)
In the second embodiment, at the time of shipment from the factory, one of the power line communication modems 1 is used as a master modem, and the encryption key is stored in the storage unit 8 in advance. However, in this embodiment, the power line communication modem 1 used is the slave side. It is characterized in that a computer PC having a local communication unit such as a personal computer functions as a master means for distributing recognition data by executing an application. Therefore, the switching unit 9 and the first determination unit 10 are not necessary for the power line communication modem 1 in the configuration shown in FIG.

  First, as shown in FIG. 1 (d), the user connects the power line connection portions 2 of all the slave modems 1 b... To be used to the power line L, and connects each interface 12 via the connector 16 and the communication line 15. Connected to the concentrator 17. In addition, a local communication unit (not shown) of the computer PC constituting the virtual master modem is connected to the line concentrator 17 via the communication line 15 and the power of the computer PC is obtained from an appropriate power outlet. After this connection, the slave modem 1b, the concentrator 17 and the computer PC are turned on.

  The computer PC is provided with a drive device (not shown) which is an external data input unit attached to the computer PC, and application software and encryption key data for virtual master side modem construction provided by a manufacturer such as a CD-ROM. It is assumed that the user has installed in advance.

  Now, after the computer PC is turned on as described above, when the above-mentioned application software is executed under the OS <Operating System>, the computer PC functions as a virtual master-side modem and is connected to each slave side through the concentrator 17. A special signal for explicitly indicating that it is a master side modem is transmitted to the modems 1b. As a result, as in the first and second embodiments, each slave modem 1b... Recognizes that it plays the role of a slave modem.

  Thereafter, the computer PC executes software that randomly generates an encryption key from the encryption key data, and distributes the encryption key to each slave modem 1b through the line concentrator 17 to each slave modem. In 1b..., The encryption key is written into the storage unit 8.

  As described above, the encryption key, which is authentication data stored and stored in the power line communication modem 1 connected to the line concentrator 17 and serving as the slave modem 1b, becomes a common key, and the power line communication modems 1 are in the same network group. You will be authenticated.

  For the power line communication modem 1 constituting another network group, the computer PC repeats the process of randomly generating the encryption key and the process of distributing the generated encryption key as described above. In this case, the encryption key generated corresponding to the previous distribution is replaced with the newly generated encryption key unless it is stored. Therefore, considering the case of redistributing the same encryption key, it is necessary to save the encryption key in a storage device of the computer PC.

  Thus, according to the present embodiment, since all of the power line communication modems 1 to be used are the slave modems 1b, the configuration for setting the master / slave is not required, and the authentication data is distributed. By installing and executing an application for constructing the virtual master modem on the computer PC, the encryption key can be easily and securely distributed to the slave modem 1b via the line concentrator 17.

  Further, since the power line L is not used during authentication, the authentication data cannot be intercepted due to signal leakage, and high security can be obtained.

  In the second and third embodiments, three power line communication modems 1 are described. Of course, four or more modems may be used. In the third embodiment, the computer PC is used as the master unit. However, the encryption key data is temporarily transmitted from the computer PC to the power line communication modem 1 serving as the master modem, and then stored in the same manner as in the second embodiment. May be distributed.

  By the way, by using a device-embedded network technology called EMIT (Embedded Micro Internetworking Technology) (a network technology having a function of easily incorporating middleware into a device and connecting to the network, hereinafter referred to as EMIT technology). Various equipment (illumination equipment, air conditioning equipment, power equipment, sensors) from external terminals (not shown) such as mobile phones, PCs (Personal Computers), PDAs (Personal Digital Assistants), PHSs (Personal Handy phone Systems) An electric lock, a web camera, and the like are hereinafter referred to as an EMIT terminal.) There is a system that can access <not shown> to remotely monitor and control the EMIT terminal.

  The EMIT terminal is a built-in device equipped with a microcomputer, and is a built-in type middleware for connecting to the network, and is equipped with EMIT software that realizes the EMIT technology.

  As a system to which the above-mentioned EMIT technology is applied (hereinafter referred to as an EMIT system), an external terminal remotely monitors and controls an EMIT terminal via a center server (not shown) provided on the Internet. For example, a configuration in which an EMIT terminal is directly accessed from an external terminal equipped with EMIT software to remotely monitor and control the EMIT terminal without using a center server.

  The EMIT system can be used to remotely monitor the status of the EMIT terminals from an external terminal, for example, by distributing the above-mentioned EMIT terminals in a building (for detached houses, condominiums, buildings, factories, etc.) <not shown>. By doing so, it becomes possible to perform energy management of the entire building and remote meter reading of gas, water, and electricity in the building.

  Therefore, the power line communication modem 1 that distributes authentication data by the authentication system according to the first to third embodiments of the present invention described above is installed in an electrical room of a building, particularly an apartment house, a building, etc., and each dwelling unit (each floor) When constructing a system that performs power line communication by installing in a building or the like, the building may of course constitute the above-mentioned EMIT system.

(A) is the circuit block diagram of the modem used for this invention, (b) is the system block diagram of Embodiment 1, (c) is the system block diagram of Embodiment 2, (c) is the system block diagram of Embodiment 3. is there.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Power line communication modem 1a Master side modem 1b Slave side modem 2 Power line connection part 3 Coupler 4 Power supply circuit 5 Communication part 6 Modulation / demodulation circuit 7 Data transmission / reception part 8 Storage part 9 Switching part 10 1st judgment part 11 2nd judgment part 12 Interface 13 Transmission port 14 Reception port 15 Communication line 16 Connector L Power line SW1 Power switch

Claims (5)

In an authentication system for power line communication that distributes authentication data to a power line communication modem having a power line communication function connectable to a power line,
The local communication unit for receiving authentication data in the power line communication modem, a storage unit, and a determination for the slave to store the authentication data in the storage unit when the authentication data is received by the local communication unit A slave-side modem configured to include:
Another local communication unit for transmitting authentication data, another storage unit for storing authentication data in advance, and the local communication unit of the slave modem connected to the other local communication unit via a communication line A master determination unit configured to transmit the authentication data stored in the another storage unit from the other local communication unit to the slave modem via the communication line. Master means,
Distributing authentication data from the master means to the slave modem via the communication line ,
The slave-side modem uses the authentication data stored in the storage unit to transmit / receive data to / from a device connected via a power line. The power line communication modem includes a local communication unit, a storage unit that stores authentication data, and determination units for the slave and master, and the determination unit to be used can be switched selectively to be used for the power line communication. A switching unit for selecting a modem to be freely selected from either the master unit or the slave modem;
2. The authentication system for power line communication according to claim 1, wherein one of all power line communication modems used in the same network group for power line communication is the master unit, and the rest is a slave modem.   3. The power line communication according to claim 1, wherein a plurality of local communication units of the slave modem and another local communication unit of the master unit are interconnected by a communication line including a concentrator. Authentication system.   4. The power line communication authentication system according to claim 1, wherein the master unit includes an external data input unit that acquires authentication data from outside. Authentication data for power line communication that has a power line communication function that can be connected to the power line and distributes the authentication data to a plurality of power line communication modems that transmit and receive data to and from devices connected via the power line. In the distribution method of
Among the plurality of power line communication modems, one power line communication modem in which authentication data is stored in advance is used as a master modem, and the other power line communication modem is used as a slave modem.
The local communication unit for transmitting the authentication data possessed by the master side modem and the local communication unit for receiving the authentication data possessed by the slave side modem are interconnected by a communication line to use the power line communication function. A second process of establishing a communication path for unauthenticated data;
A third process in which the master modem transmits the authentication data to the slave modem via the communication line, and the transmitted authentication data is received by the slave modem. To distribute authentication data for power line communication.

Images