JP6933182B2 - Communication system and communication method - Google Patents

Description

The present invention relates to communication systems and communication methods.

There is a wireless communication system in which a plurality of wireless terminals are connected to a server and the wireless terminals transmit information to the server. As a means for realizing such a wireless communication system, there is a wireless communication technology that enables long-distance communication with low power consumption. This is generally called LPWA (Low Power Wide Area). The wireless terminal in LPWA uses a sub-giga band of 1 GHz or less such as 920 MHz or a wireless band of several GHz, and performs communication with a propagation distance of several km to several tens of km with power consumption of several tens of mA. Since a wireless terminal compatible with LPWA requires a small amount of power for communication, it can be operated for a long period of time even if it is battery-powered. Further, even when a large number of wireless terminals are arranged in a wide range, a relay station is unnecessary or a small number is required because long-distance communication is possible. Thereby, for example, when constructing a wireless communication system for the purpose of collecting sensor information over a wide area and a large number of sensors, the economic cost of the wireless communication system can be suppressed by adopting LPWA.

In a wireless communication system, it is required to provide security for communication so that communication from a wireless terminal to a server is not eavesdropped or tampered with. As a security technique, for example, there is Patent Document 1. Patent Document 1 describes an information processing system in which a client terminal connects to a server. In the information processing system, the client terminal holds a public key and the server holds a public key and a private key to encrypt communication. The public key cryptosystem is used. Further, in Patent Document 1, the server updates the public key and the private key, and the client terminal generates and transmits the information necessary for updating the private key and the public key on the server, and the public key updated on the server. Will be received from the server.

Patent Document 1 Japanese Unexamined Patent Publication No. 2015-106842

The public key cryptosystem as described in Patent Document 1 has a complicated encryption and decryption process, and therefore requires a large amount of power consumption and advanced hardware in both the server and the wireless terminal. Therefore, when the public key cryptosystem is adopted for the wireless communication system, the power consumption of the wireless terminal increases, the hardware of the wireless terminal becomes sophisticated, and the economic cost increases. Here, in the wireless communication system adopting LPWA, as described above, the wireless terminal is required to operate with low power consumption, and the economic cost of the wireless terminal is required to be low. Therefore, it is difficult to adopt the public key cryptosystem in the LPWA wireless communication system. For example, there is LoRaWAN (LoRa is a registered trademark) as one of the technical specifications of LPWA, but even in LoRaWAN, the encryption of communication between the wireless terminal and the server has lower power consumption and lower power consumption than the public key cryptosystem. A common key cryptosystem that can be realized with simple hardware is adopted.

Here, when a common key cryptosystem is adopted for the wireless communication system, it is necessary to hold the encryption key used for encryption in the wireless terminal when the wireless terminal is installed. However, since it is assumed that a large number of wireless terminals are installed in a wide range as described above, if the wireless terminals hold the encryption key, the encryption key may be leaked to a third party. If the encryption key that encrypts the communication between the wireless terminal and the server is leaked to a third party, the communication from the wireless terminal to the server will be decrypted by the third party.

Therefore, in order not to impair the low power consumption and low economic cost of the wireless terminal, which are the advantages of the LPWA wireless communication system, the communication system and communication can be encrypted by the common key encryption method in consideration of the leakage of the encryption key. A method is required.

The present invention has been made in consideration of such circumstances, and proposes a communication system and a communication method capable of encrypting communication by a common key cryptosystem in consideration of leakage of an encryption key.

The first invention is a communication system in which a communication terminal and a server perform encrypted communication using a common key, and the communication terminal uses the first communication means and the first information for communicating with the server. Through the first storage means for storing, the request information generating means for generating the first request information transmitted to the server and the second request information transmitted to the server, and the first communication means. The first connection processing means, the first connection processing means, which transmits the first request information to the server and receives the first response information to the first request information from the server via the first communication means. The first generation means for generating the second information using the first request information, the first response information, and the first information, and the first communication means to the server. With the second connection processing means, the second request information, which transmits the second request information and receives the second response information to the second request information from the server via the first communication means. , The second generation means for generating the first common key using the second response information and the second information, connected to the first communication means, and the first common key is used. First decryption means for encrypting data transmitted to the server, first decryption for decrypting data received from the server using the first common key, which is connected to the first communication means. The server comprises means, the second communication means for communicating with the communication terminal, the second storage means for storing the third information having the same value as the first information, and the communication terminal. The first response information transmitted from the communication terminal via the response information generating means for generating the first response information transmitted and the second response information transmitted to the communication terminal, and the second communication means. A third connection processing means for receiving the request information and transmitting the first response information to the communication terminal via the second communication means, the first request information, and the first response information. , The third generation means for generating the fourth information having the same value as the second information by using the third information, and the second from the communication terminal via the second communication means. The fourth connection processing means for receiving the request information of the above and transmitting the second response information to the communication terminal via the second communication means, the second request information, and the second response information. And the fourth information, the fourth generation means for generating the second common key having the same value as the first common key, the second communication means is connected to the second common key. A second cipher that encrypts the data transmitted to the communication terminal using the second common key. It is characterized by comprising a second decoding means which is connected to the second communication means and decodes the received data from the communication terminal by using the second common key.

The second invention includes a communication terminal including a first storage means for holding the first information, and a second storage means for holding the third information having the same value as the first information. A communication method in which a server and a server perform encrypted communication using a common key, the first step in which the communication terminal transmits the first request information to the server, and when the server receives the first request information. , The second step of transmitting the first response information to the communication terminal, the communication terminal uses the first request information, the first response information, and the first information to perform a second step. The third step of generating the information, the fourth, in which the server uses the first request information, the first response information, and the third information to have the same value as the second information. In the fourth step of generating the information of the above, the fifth step in which the communication terminal transmits the second request information to the server in response to the execution of the third step, the server causes the second request information. In the sixth step of transmitting the second response information to the communication terminal in response to the reception of the above, the communication terminal performs the second request information, the second response information, and the second information. In the seventh step of using the first common key to generate the first common key, the server uses the second request information, the second response information, and the fourth information to obtain the first common key. The eighth step of generating the second common key having the same value, the communication terminal encrypts the data transmitted to the server and decrypts the received data from the server using the first common key. The server comprises a ninth step of encrypting the transmitted data to the communication terminal and decrypting the received data from the communication terminal using the second common key.

According to the present invention, there is provided a communication system and a communication method capable of encrypting communication by a common key cryptosystem in consideration of leakage of an encryption key.

It is a block diagram which shows the whole structure of the wireless communication system 1A in 1st Embodiment. It is a block diagram which shows the internal structure of a wireless terminal 2. It is a block diagram which shows the internal structure of a network server 4. It is a figure which shows the basic mechanism of the encryption key generation in LoRaWAN. It is a sequence diagram which shows the flow of data transmission | transmission between a wireless terminal 2 and a network server 4. It is a figure which shows the transition of each information and an encryption key in a wireless terminal 2 and a network server 4. It is a flowchart which shows the operation of a wireless terminal 2. It is a flowchart which shows the operation of the network server 4. It is a block diagram which shows the whole structure of the wireless communication system 1B in 2nd Embodiment. FIG. 5 is a sequence diagram showing a flow of data transmission / reception in the wireless terminal 2-1 and the wireless terminal 2-2 and the network server 4. It is a figure which shows the transition of each information in a wireless terminal 2-1 and a wireless terminal 2-2 and a network server 4.

(1) First Embodiment The first embodiment of the present invention will be described with reference to FIGS. 1 to 8. In the first embodiment, an example of partially using the method specified in LoRaWAN (LoRa Wide Area Network: LoRa is a registered trademark), which is a technical specification of LPWA, will be described.

(A) Overall Configuration of Hardware (A-1) Wireless Communication System FIG. 1 is a configuration diagram showing an overall configuration of the wireless communication system 1A according to the first embodiment. In FIG. 1, the wireless communication system 1A includes a wireless terminal 2, a base station 3, a network server 4, and a host device 5. The number of wireless terminals 2 may be any n (n is an integer of 1 or more), but in the first embodiment, the embodiment in which the number of wireless terminals 2 is one (n = 1) will be described. The embodiment in which the number of wireless terminals 2 is 2 or more will be described in the second embodiment.

The wireless terminal 2 is installed indoors or outdoors, and collects detection information of various sensors mounted on or connected to the wireless terminal 2 and information collected from electrical devices connected to the wireless terminal 2 upstream of the wireless communication system 1A. It is transmitted to (upper device 5 side). The wireless terminal 4 is wirelessly connected to the base station 3. In the first embodiment, the wireless terminal 2 is connected to the base station 3 by the modulation method specified in LoRaWAN. The wireless terminal 2 participates in the wireless communication system 1A by executing the operation of the present invention described later.

The base station 3 relays various information wirelessly received from the wireless terminal 2 to the network server 4. The base station 3 is connected to the wireless terminal 2 by a modulation method defined in LoRaWAN. Further, the base station 3 is connected to the network server 4. The connection between the base station 3 and the network server 4 is, for example, a cable according to an existing Ethernet standard (Ethernet is a registered trademark). When connecting by wire, the standard and method used for connection are not limited. Further, the base station 3 and the network server 4 may be connected wirelessly, and the standard and method used for the wireless connection are not limited. The base station 3 is not limited to a specific device as long as it has the ability of wireless / wired conversion and information relay between the wireless terminal 2 and the network server 4, but for example, the wireless terminal 2 can be used for the purpose of the base station 3. It may be realized by using it. In the following description, the internal configuration of the base station 3 is not shown, and the description thereof will be omitted.

The network server 4 relays various information from the wireless terminal 2 received by wire from the base station 3 to the host device 5. Further, the network server 4 controls the participation of the wireless terminal 2 in the wireless communication system 1A by executing the operation of the present invention described later. The connection between the network server 4 and the host device 5 is, for example, connected by a cable according to the existing Ethernet standard, and the standard and method used for the connection are not limited. The network server 4 and the host device 5 may be connected wirelessly, and the standard and method used for the wireless connection are not limited.

The host device 5 executes various processes based on various information from the wireless terminal 2 received by wire from the network server 4. The host device 5 is, for example, an application server. For example, the application server accumulates and processes the detection information of various sensors transmitted from the wireless terminal 2 and provides a monitoring service to the user of the wireless communication system 1A. As another example, the application server accumulates and processes information collected from an electric device or the like transmitted from the wireless terminal 2 to provide energy management and remote meter reading service to the user of the wireless communication system 1A.

In FIG. 1, the solid line connecting each device indicates a wired connection, and the dotted line connecting each device indicates a wireless connection. As described above, the wireless terminal 2 and the base station 3 are wirelessly connected, and the network server 4 and the base station 3, and the host device 5 and the network server 4 are connected by wire. Here, the network server 4 and the base station 3, and the host device 5 and the network server 4 may be connected not only by wire but also by wireless as described above.

(A-2) Configuration of Wireless Terminal 2 and Network Server 4 (A-2-1) Wireless Terminal 2
FIG. 2 is a block diagram showing an internal configuration of the wireless terminal 2. In FIG. 2, the wireless terminal 2 has a control unit 21, a storage unit 22, a transmission unit 23, a reception unit 24, an encryption unit 25, a decryption unit 26, an external interface 27, and an antenna 28.

The control unit 21 controls the operation of the wireless terminal 2 and is realized by a CPU (Central Processing Unit) or the like. The control unit 21 further includes a connection processing unit 211, a temporary holding unit 212, a random number generation unit 213, and an encryption key generation unit 214. Although the encryption unit 25 and the decryption unit 26 are provided outside the control unit 21 for the following description in FIG. 2, the control unit 21 may have the encryption unit 25 and the decryption unit 26. In FIG. 2, the control unit 21 is connected to the storage unit 22, the encryption unit 25, the decryption unit 26, and the external interface 27.

The connection processing unit 211 executes connection processing between the wireless terminal 2 and the network server 4. The temporary holding unit 212 temporarily holds information used for connection processing by the connection processing unit 211, and is realized by, for example, a small-capacity cache memory in the CPU. The random number generation unit 213 generates a random number used for connection processing by the connection processing unit 211. The encryption key generation unit 214 receives the connection processing by the connection processing unit 211 and generates an encryption key common to the network server 4. By the operations of the connection processing unit 211, the temporary holding unit 212, the random number generation unit 213, and the encryption key generation unit 214, the connection processing with the network server 4 is executed, and the encryption common to the network server 4 in the wireless terminal 2 is executed. A key is generated. The details of the operation of the control unit 21 will be described later.

The storage unit 22 is a main storage device that stores an operation program for operating the wireless terminal 2, and a primary storage device for the operation of the wireless terminal 2. The storage unit 22 is realized by a non-volatile memory such as an EEPROM (Electrically Erasable and Programmable Read Only Memory) or a flash memory as a main storage device, and is realized by a memory such as a RAM (Random Access Memory) as a primary storage device. In the operation program stored in the storage unit 22, a provisional AppKey, which will be described later, is defined in advance. This will be described later together with the details of the operation of the wireless terminal 2.

The transmission unit 23 performs transmission processing for various information to be transmitted from the wireless terminal 2 to the base station 3 for wireless communication. The transmission process of the transmission unit 23 includes modulation processing of various information according to the LoRa modulation method defined in LoRaWAN. In FIG. 2, the transmission unit 23 is connected to the encryption unit 25 and the antenna 23.

The receiving unit 24 receives and processes various information from the base station 3 so that the wireless terminal 2 can process the various information. The reception process of the receiving unit 24 includes demodulation processing of various information according to the LoRa modulation method defined in LoRaWAN. In FIG. 2, the receiving unit 24 is connected to the decoding unit 26 and the antenna 23.

The encryption unit 25 encrypts various information transmitted from the wireless terminal 2 to the base station 3 prior to the transmission process of the transmission unit 23. The encryption unit 25 encrypts various information using the encryption key common to the network server 4 generated by the encryption key generation unit 214. The encryption method used by the encryption unit 25 is not limited.

The decryption unit 26 decrypts and decrypts various information from the base station 3 received and processed by the reception unit 24. The decryption unit 26 decrypts various information by using the encryption key common to the network server 4 generated by the encryption key generation unit 214, in other words, the same encryption key used by the encryption unit 25. The encryption method used by the decryption unit 26 is the same as that of the encryption unit 25.

The external interface 27 is an interface for connecting the wireless terminal 2 and the external device. Here, the external device is, for example, various sensors, electric devices, and the like. The external interface may conform to an existing standard, for example, an adapter conforming to a USB (Universal Serial Bus) standard or an Ethernet standard.

The antenna 28 is connected to the transmitting unit 23 and the receiving unit 24, and transmits and receives radio waves to and from the base station 3.

In the correspondence relationship with the claims, the wireless terminal 2 corresponds to the communication terminal. The correspondence between each functional unit and the claim in the wireless terminal 2 is as follows. The connection processing unit 211 corresponds to the first connection processing means and the second connection processing means. The encryption key generation unit 214 corresponds to the first generation means and the second generation means. The random number generation unit 213 corresponds to the first random number generation means. The storage unit 22 corresponds to the first storage means. The transmitting unit 23 and the receiving unit 24 correspond to the first communication means. The encryption unit 25 corresponds to the first encryption means. The decoding unit 26 corresponds to the first decoding means.

(A-2-2) Configuration of Network Server 4 FIG. 3 is a block diagram showing an internal configuration of the network server 4. In FIG. 3, the network server 4 has a control unit 41, a storage unit 42, a transmission unit 43, a reception unit 44, an encryption unit 45, a decryption unit 46, an external interface 47, and an interface 48.

The control unit 41 controls the operation of the network server 4 and is realized by a CPU or the like. The control unit 41 further includes a connection processing unit 411, a temporary holding unit 412, a random number generation unit 413, and an encryption key generation unit 414. Although the encryption unit 45 and the decryption unit 46 are provided outside the control unit 41 in FIG. 3 for the following description, the control unit 41 may have the encryption unit 45 and the decryption unit 46. In FIG. 3, the control unit 41 is connected to the storage unit 42, the encryption unit 45, the decryption unit 46, and the external interface 47.

The connection processing unit 411 executes connection processing performed with the wireless terminal 2 in order to allow the wireless terminal 2 to participate in the wireless communication system 1A. The temporary holding unit 412 temporarily holds information used for connection processing by the connection processing unit 411, and is realized by, for example, a small-capacity cache memory in the CPU. The random number generation unit 413 generates a random number used for connection processing by the connection processing unit 411. The encryption key generation unit 414 receives the connection processing by the connection processing unit 411 and generates an encryption key common to the wireless terminal 2. By the operations of the connection processing unit 411, the temporary holding unit 412, the random number generation unit 413, and the encryption key generation unit 414, the connection processing with the wireless terminal 2 is executed, and the encryption common to the wireless terminal 2 in the network server 4 is executed. A key is generated. The details of the operation of the control unit 41 will be described later.

The storage unit 42 is a main storage device that stores an operation program for operating the network server 4, and a primary storage device for the operation of the network server 4. The storage unit 42 is realized by an HDD (Hard Disk Drive), an SSD (Solid State Drive) or the like as a main storage device, and is realized by a memory such as a RAM as a primary storage device. In the operation program stored in the storage unit 42, a provisional AppKey, which will be described later, is defined in advance. This will be described later together with the details of the operation of the control unit 41.

The transmission unit 43 transmits and processes various information from the network server 4 to the base station 3. The transmission process of the transmission unit 23 is, for example, packetization of information. In FIG. 3, the transmission unit 43 is connected to the encryption unit 45 and the interface 48.

The receiving unit 44 receives and processes various information from the base station 3 so that the network server 4 can process the various information. The reception process of the receiving unit 44 is, for example, information extraction from a packet. In FIG. 3, the receiving unit 44 is connected to the decoding unit 46 and the interface 48.

The encryption unit 45 encrypts various information transmitted from the network server 4 to the base station 3 prior to the transmission process of the transmission unit 43. The encryption unit 45 encrypts various information using the encryption key common to the wireless terminal 2 generated by the encryption key generation unit 414. The encryption method used by the encryption unit 45 is not limited.

The decryption unit 46 decrypts and decrypts various information from the base station 3 received and processed by the reception unit 44. The decryption unit 46 decrypts various information by using the encryption key common to the wireless terminal 2 generated by the encryption key generation unit 414, in other words, the same encryption key used by the encryption unit 45. The encryption method used by the decryption unit 46 is the same as that of the encryption unit 45.

The external interface 47 is an interface for connecting the network server 4 and the host device 5. Here, the host device 5 is, for example, an application server as described above. The external interface 47 may be appropriately selected according to the mode of the host device 5, and if the host device 5 is an application server as described above, the external interface 47 may be an adapter according to, for example, an Ethernet standard.

The interface 48 is an adapter according to, for example, an Ethernet standard, which is connected to the transmitting unit 43 and the receiving unit 44 and connects the network server 4 and the base station 3.

In the correspondence relationship with the claims, the network server 4 corresponds to the server. The correspondence between each functional unit and the claim in the network server 4 is as follows. The connection processing unit 411 corresponds to the third connection processing means and the fourth connection processing means. The encryption key generation unit 414 corresponds to the third generation means and the fourth generation means. The random number generation unit 413 corresponds to the second random number generation means. The storage unit 42 corresponds to the second storage means. The transmitting unit 43 and the receiving unit 44 correspond to the second communication means. The encryption unit 45 corresponds to the second encryption means. The decoding unit 46 corresponds to the second decoding means.

The correspondence between each functional unit in the network server 4 and the second invention is as follows. The connection processing unit 411 and the encryption key generation unit 414 correspond to the first processing unit and the second processing unit. The temporary holding unit 412 corresponds to the storage unit. The transmission unit 43 corresponds to the transmission unit. The receiving unit 44 corresponds to the receiving unit. The encryption unit 45 corresponds to the encryption unit. The decoding unit 46 corresponds to the decoding unit.

(B) Operation With reference to FIG. 4, the method specified in LoRaWAN used in the operation of the first embodiment will be described. The flow of information exchange and encryption key generation between the wireless terminal 2 and the network server 4 will be described with reference to FIGS. 5 and 6. The details of the operation of the wireless terminal 2 and the network server 4 will be described with reference to FIGS. 7 and 8.

(B-1) Mechanism of key generation in LoRaWAN FIG. 4 is a diagram showing a basic mechanism of encryption key generation in LoRaWAN. In the first embodiment, among the mechanisms shown in FIG. 4, a mechanism for generating an AppSK KEY (Application session key), which is a common encryption key between the end device and the network server, is used. In the first embodiment, the wireless terminal 2 corresponds to an end device, and the network server 4 corresponds to a network server. In FIG. 4, of the information in each of the end device and the network server, the information surrounded by the dotted line is the information not related to the present embodiment, and the description thereof will be omitted. Further, the NwkSKay (Network session key) surrounded by the alternate long and short dash line in each of the end device and the network server is not involved in the present embodiment, and thus the description thereof will be omitted.

An AppKey (Application key) 90, which is common information, is preset for the end device and the network server. The Apkey is set by the operator who operates the end device and the network server, and the ApKey is the information that becomes the basis (seed, root) for generating the ApKey. On the other hand, the ApSKey is generated by each of the end device and the network server based on the AppKey, and is used for encryption and decryption of user data that communicates between the end device and the network server. AppSKay is valid until the connection between the end device and the network server is lost, and when the connection between the end device and the network server is lost, a new connection between the end device and the network server is established. AppSKay is generated.

When the end device joins the network, it sends a JoinRequest to the network server. This JoinRequest includes at least a DevEUI (End-device identifier) 94, which is an identifier (address) unique to the end device, and a DevNonce 92, which is a random number generated by the end device.

When the network server receives the JoinRequest from the end device, it extracts DevEUI94 and DevNonce92 included in the JoinRequest. Then, the end device is identified based on the DevEUI94, and the NetID (Network identifier) 96 corresponding to the end device that is the source of the JoinRequest is specified. NetID is an identifier (address) assigned when an end device joins the network. Further, the network server generates a random number and sets this as AppNonce98. The network server sends a JoinAcpt containing at least NetID96 and AppNonce98 to the end device.

When the end device receives the JoinAcpt from the network server, it extracts NetID96 and AppNonce98 contained in the JoinAccept. Then, the end device gives the computer AppKey90, which is common to the network server, DevNonce92 transmitted to the network server, NetID96 and AppNance98 received from the network server, and generates ApSKey910. The computer uses an arithmetic expression common to that of the network server to generate an ApSKey.

On the other hand, when the network server transmits JoinAcpt, it generates an AppSkey like the end device. That is, the network server gives the computer AppKey90, which is common to the end device, DevNonce92 received from the end device, NetID96 and AppNonce98 transmitted to the end device, and generates ApSKey910.

When the end device and the network server generate AppSKay respectively, the end device is in a state of joining the network. After that, the end device and the network server encrypt and decrypt the user data to be transmitted and received using the ApSkey, and perform communication.

As described above, in LoRaWAN, the end device and the network server acquire DevNonce, NetID, and AppNonce by transmitting and receiving JoinRequest and JoinAcpt, and generate an ApSkey. This mechanism is used in the first embodiment. However, in the first embodiment, the handling of AppKey is different.

(B-2) Information exchange and encryption key generation between the wireless terminal and the network server Next, information exchange and encryption key generation between the wireless terminal 2 and the network server 4 with reference to FIGS. 5 and 6 Explain the flow. FIG. 5 is a sequence diagram showing a flow of data transmission / reception between the wireless terminal 2 and the network server 4. FIG. 6 is a diagram showing transitions of each information and encryption key in the wireless terminal 2 and the network server 4. Note that the base station 3 is omitted in FIG. The alphabets A to F attached to the right side in FIG. 5 correspond to (A) to (F) in FIG. 6, respectively.

Unlike the premise of the basic mechanism of LoRaWAN described above, the wireless terminal 2 in the first embodiment does not have an AppKey set in advance by an operator who operates the wireless communication system 1A. The wireless terminal 2 is activated in a state where the ApKey is not set in advance (S51). At this time, the wireless terminal 2 reads the temporary AppKey defined in its own program from the program and sets it in itself. This temporary AppKey is not set by the operator, and the program of the wireless terminal 2 is not subject to the interference of the operator. Further, in the network server 4, a temporary AppKey is associated with the wireless terminal 2 which has not been registered to participate in the wireless communication system 1A and is stored in advance in the same manner as the wireless terminal 2.

Next, the wireless terminal 2 generates a random number to generate a DevNonce, and transmits a JoinRequest including the DveNonce and the DveEUI to the network server 4 (S52). The state up to S52 in FIG. 5 is shown in FIG. 6 (A). In FIG. 6A, the temporary AppKey: α1 is held in both the wireless terminal 2 and the network server 4, and the DevNonce: ε1 is held in the wireless terminal 2.

When the network server 4 receives the JoinRequest from the wireless terminal 2, it extracts the DveEUI and DevNone included in the JoinRequest. The network server 4 identifies the NetID corresponding to the wireless terminal 2 based on the DevEUI, and also generates a random number to obtain an AppNonce. The network server 4 transmits a JoinAccess including NetID and AppNonce to the wireless terminal 2 (S53). The state up to S53 in FIG. 5 is shown in FIG. 6 (B). In FIG. 6B, the network server 4 holds DevNonce: ε1 included in the JoinRequest, and further holds NetID: σ1 and AppNonce: ζ1 specified from DevEUI.

When the wireless terminal 2 receives the JoinAccess from the network server 4, the wireless terminal 2 extracts the NetID and the AppNonce included in the JoinAccept. The wireless terminal 2 generates an encryption key using the temporary AppKey, the DveNonce transmitted to the network server 4, the NetID received from the network server 4, and the AppNonce, and uses this as the official AppKey (S55). On the other hand, the network server 4 generates an encryption key using the temporary AppKey, the DveNonce received from the wireless terminal 2, the NetID and the AppNance transmitted to the wireless terminal 2, and uses this as the official AppKey (S56). The states up to S54 and S55 in FIG. 5 are shown in FIG. 6 (C). In FIG. 6C, the wireless terminal 2 holds NetID: σ1 and AppNonce: ζ1 included in JoinAcpt. Further, both the wireless terminal 2 and the network server 4 hold an AppKey: β1 generated by using the temporary AppKey: α1, NetID: σ1, DevNonce: ε1 and AppNonce: ζ1.

Next, the wireless terminal 2 is restarted while holding the official AppKey (β1 in FIG. 6C) generated in S55 (S56). In the restart of S56, the wireless terminal 2 does not read the temporary AppKey from its own program and starts while holding the official AppKey, unlike the time of starting S51 described above. By restarting the wireless terminal 2, the connection between the wireless terminal 2 and the network server 4 is canceled. At this time, the network server 4 holds the official AppKey (β1 in FIG. 6C) generated in S54 corresponding to the wireless terminal 2, and deletes other information as the connection is canceled.

Next, the wireless terminal 2 generates a random number to generate a DevNonce, and transmits a JoinRequest including the DveNonce and the DveEUI to the network server 4 (S57). The state up to S57 in FIG. 5 is shown in FIG. 6 (D). In FIG. 6D, ApKey: β1 is held in both the wireless terminal 2 and the network server 4, and DevNonce: ε2 is held in the wireless terminal 2. Note that the temporary AppKey: α1 held in FIG. 6 (A) is deleted in FIG. 6 (D) due to the restart of the wireless terminal 2 and the disconnection of the connection, and since DevNonce is a random number, FIG. 6 (D) ) DevNonce: ε2 is a value different from that of FIG. 6 (A) DevNonce: ε1.

When the network server 4 receives the JoinRequest from the wireless terminal 2, it extracts the DveEUI and DevNone included in the JoinRequest. The network server 4 identifies the NetID corresponding to the wireless terminal 2 based on the DevEUI, generates a random number, and sets it as an AppNonce. The network server 4 transmits a JoinAccess including NetID and AppNonce to the wireless terminal 2 (S58). The state up to S58 in FIG. 5 is shown in FIG. 6 (E). In FIG. 6E, the network server 4 holds DevNonce: ε2 included in the JoinRequest, and further holds NetID: σ1 and AppNonce: ζ2 specified from DevEUI. Since the NetID is an identifier unique to the wireless terminal 2, the NetID: σ1 is the same as in FIG. 6 (B), and since the AppNance is a random number, the AppNonce: ζ2 in FIG. 6 (E) is shown in FIG. 6 (B). AppNonce: ζ1 is a different value.

When the wireless terminal 2 receives the JoinAccess from the network server 4, the wireless terminal 2 extracts the NetID and the AppNonce included in the JoinAccept. The wireless terminal 2 generates an encryption key using the ApKey, the DveNonce transmitted to the network server 4, the NetID received from the network server 4, and the AppNonce, and uses this as the AppSKkey (S510). On the other hand, the network server 4 generates an encryption key using the AppKey, the DveNonce received from the wireless terminal 2, the NetID and the AppNance transmitted to the wireless terminal 2, and uses this as the ApSKey (S59). The states up to S59 and S510 in FIG. 5 are shown in FIG. 6 (F). In FIG. 6F, the wireless terminal 2 holds NetID: σ1 and AppNonce: ζ2 included in JoinAcpt. Further, both the wireless terminal 2 and the network server 4 hold AppSKey: γ1 generated by using AppKey: β1, NetID: σ1, DevNonce: ε2 and AppNonce: ζ2. Since DevNonce: ε2 and ApNonce: ζ2 are random numbers, they are different values from DevNonce: ε1 and AppNonce: ζ1 in FIG. 6C, respectively. Therefore, the ApSKey: γ1 generated by using DevNonce: ε2 and AppNonce: ζ2 are different values from ApKey: β1.

When the ApSkey (γ1 in FIG. 6F) is generated in each of the wireless terminal 2 and the network server 4, the wireless terminal 2 and the network server 4 proceed to the normal operation of encrypting and decrypting the user data using the ApSkey (S511). Since AppSKay is valid until the connection between the wireless terminal 2 and the network server 4 is disconnected, the operations S51 to S510 are executed when the connection between the wireless terminal 2 and the network server 4 is disconnected, and S52. To S55 (FIGS. 6 (A) to (C)), a new AppKey is generated, and from S56 to S510 (FIGS. 6 (D) to (F)), a new AppKey is generated.

In the correspondence between the first invention and the second invention, the above-mentioned provisional AppKey corresponds to the first information, the formal AppKey corresponds to the second information, and the ApPKey corresponds to the encryption key.

(B-3) Operation Flow of Wireless Terminal Regarding information exchange and encryption key generation between the wireless terminal and the network server described with reference to FIGS. 5 and 6, the details of the operation will be described with a focus on the wireless terminal 2. .. FIG. 7 is a flowchart showing the operation of the wireless terminal 2.

When the wireless terminal 2 is activated, the control unit 21 attempts to read the ApKey from the storage unit 22 (S700). Then, it is determined whether or not the ApKey is held in the storage unit 22 (S702). As described above, since the wireless terminal 2 is activated in a state where the ApKey is not set in advance, the ApKey is not held in the storage unit 22. Therefore, the determination is denied (S702: No).

When the determination of S702 is denied, the control unit 21 reads the temporary AppKey (α1 in FIG. 6A) defined in the operation program stored in the storage unit 22 from the operation program and holds it in the temporary holding unit 212. (S704). Since this temporary AppKey is defined by the operation program, the worker who operates the wireless communication system 1A cannot interfere with it, and therefore the worker cannot know the temporary AppKey.

The control unit 21 reads the DevEUI from the storage unit 22 (not shown) and holds it in the temporary holding unit 212 (S708). Further, the control unit 21 generates a random number in the random number generation unit 213, sets this as DevNonce (ε1 in FIG. 6A), and holds it in the temporary holding unit 212 (S710).

The control unit 21 causes the connection processing unit 211 to create a JoinRequest command including DevEUI and DevNone (S712). For the creation of the JoinRequest command, for example, the method specified by LoRaWAN may be used. When the JoinRequest command is created by the connection processing unit 211, the control unit 21 transmits the JoinRequest to the network server 4 via the transmission unit 23 (S714). The JoinRequest may be encrypted by the encryption unit 25. When the JoinRequest is encrypted by the encryption unit 25, it may be encrypted using, for example, a temporary AppKey.

When the JoinRequest is transmitted to the network server 4 via the transmission unit 23, the wireless terminal 2 waits for the reception of the JoinAccess from the network server (S716).

When the wireless terminal 2 receives the JoinAccess from the network server 4 (S716: Yes), the control unit 21 inputs the NetID (δ1 in FIG. 6C) and the ExtractNonce (ζ1 in FIG. 6C) included in the received JoinAccept. It is extracted and held in the temporary holding unit 212 (S718).

Next, the control unit 21 causes the encryption key generation unit 214 to hold the temporary AppKey (α1 in FIG. 6 (C)), DevNonce (ε1 in FIG. 6 (C)), and NetID (FIG. 6 (C)) held in the temporary holding unit 212. ) Δ1) and AppNance (ζ1 in FIG. 6C) are used to generate an encryption key (S720).

When the encryption key is generated, the control unit 21 again determines whether the AppKey is held in the storage unit 22 (S722). The determination of S722 is the same as the determination of S702 described above. Here, since the ApKey is held in the storage unit 22, the determination is denied (S722: No).

If the determination in S722 is denied, the control unit 21 holds the encryption key generated in S720 in the storage unit 22 as a formal AppKey (β1 in FIG. 6C) (S724).

Next, the control unit 21 restarts the wireless terminal 2 while holding the ApKey in the storage unit 22 (S726). This restart may be a hard reset in which the power of the wireless terminal 2 is temporarily shut off and then turned on again, or a soft reset in which the software is restarted while maintaining the power of the wireless terminal 2. When the wireless terminal 2 is restarted, the process returns to the beginning of the flowchart shown in FIG. 7 (shown by circled A in FIG. 7).

When the wireless terminal 2 is restarted, the control unit 21 attempts to read the ApKey from the storage unit 22 (S700). Then, it is determined whether or not the ApKey is held in the storage unit 22 (S702). Here, since the storage unit 22 holds the ApKey (β1 in FIG. 6D), the determination is affirmed (S702: Yes).

If the determination in S702 is affirmed, the control unit 21 holds the ApKey (β1 in FIG. 6D) held in the storage unit 22 in the temporary holding unit 212 (S706).

After that, the operations of the control unit 21, the random number generation unit 213, and the encryption key generation unit 214 are the same as the operations in S708 to S720 described above. However, in the second week of the flow of FIG. 7, the random number generated by the random number generator 213 is DevNoncce: ε2 in FIG. 6 (D), and the JoinAcpt received from the network server 4 has the NetID: NetID in FIG. δ1 and AppNonce: ζ2 are included, and the encryption key generation unit 214 generates an encryption key using AppKey; β1, DevNonce: ε2, NetID: δ1 and AppNonce: ζ2 in FIG. 6 (F).

When the encryption key is generated, the control unit 21 again determines whether the AppKey is held in the storage unit 22 (S722). The determination of S722 is the same as the determination of S702 described above. Here, since ApKey: β1 is held in the storage unit 22, the determination is affirmed (S722: Yes).

If the determination in S722 is affirmed, the control unit 21 holds the encryption key generated in S720 in the storage unit 22 as an AppSKay (γ1 in FIG. 6F) (S728).

After that, the wireless terminal 2 shifts to a general operation for communicating with the network server 4 by using the ApSKay (γ1 in FIG. 6F) held in the storage unit 22 as the encryption key (S730). In normal operation, the data transmitted from the wireless terminal 2 to the network server 4 is encrypted by the encryption unit 25 using ApSKEY. Further, in normal operation, the data received from the network server 4 is decoded by the decoding unit 26 using the ApSKay.

(B-4) Operation Flow of Network Server Regarding the information transfer and encryption key generation between the wireless terminal and the network server described with reference to FIGS. 5 and 6, the details of the operation will be described with a focus on the network server 4. .. FIG. 8 is a flowchart showing the operation of the network server 4.

The network server 4 waits for the reception of the JoinRequest from the wireless terminal 2 (S800).

When the control unit 41 (FIG. 3) of the network server 4 receives the JoinRequest from the wireless terminal 2 (S800: Yes), is the AppKey corresponding to the wireless terminal 2 that is the source of the JoinRequest held in the storage unit 42? Judgment (S802). Here, since the ApKey corresponding to the wireless terminal 2 is not held in the storage unit 42 (FIG. 6 (A)), the determination is denied (S802: No). The wireless terminal 2 is specified by using DevEUI included in JoinRequest.

When the determination of S802 is denied, the control unit 41 reads the temporary AppKey (α1 in FIG. 6A) defined in the operation program stored in the storage unit 42 from the operation program and holds it in the temporary holding unit 412. (S804). This temporary AppKey is defined by an operation program in the same manner as the wireless terminal 2.

Next, the control unit 41 identifies the wireless terminal 2 based on the DevEUI (not shown) included in the received JoinRequest, and reads the NetID (δ1 in FIG. 6B) corresponding to the wireless terminal 2 from the storage unit 42. , It is held in the temporary holding unit 412 (S808). Further, the control unit 41 generates a random number in the random number generation unit 413, sets it as an AppNonce (ζ1 in FIG. 6B), and holds it in the temporary holding unit 212 (S810).

The control unit 41 causes the connection processing unit 411 to create a JoinAcpt command including NetID and AppNonce (S812). For the creation of the JoinAcpt command, for example, the method specified by LoRaWAN may be used. When the JoinAccept command is created by the connection processing unit 411, the control unit 41 transmits the JoinAccept to the wireless terminal 2 via the transmission unit 43 (S814). The JoinAcpt may be encrypted by the encryption unit 45. When the JoinAccess is encrypted by the encryption unit 45, it may be encrypted using, for example, a temporary AppKey.

Next, the control unit 41 extracts the DevNonce (ε1 in FIG. 6B) contained in the JoinRequest received from the wireless terminal 2 and holds it in the 100 million units 412 for a period of time (S816). The process of S816 may be performed at an arbitrary timing from the time when the JoinRequest is received from the wireless terminal 2 (S800: Yes) to the time when the JoinAccess is transmitted to the wireless terminal 2 (S814). In FIG. 8, for convenience of explanation, the processing of S816 is after the processing of S814.

Next, the control unit 41 tells the encryption key generation unit 414 that the temporary AppKey (α1 in FIG. 6 (C)), DevNonce (ε1 in FIG. 6 (C)), and NetID (FIG. 6 (C)) held in the temporary holding unit 412. ) Δ1) and AppNance (ζ1 in FIG. 6C) are used to generate an encryption key (S818).

When the encryption key is generated, the control unit 41 again determines whether the storage unit 42 holds the AppKey corresponding to the wireless terminal 2 (S820). The determination of S820 is the same as the determination of S802 described above. Here, since the ApKey corresponding to the wireless terminal 2 is held in the storage unit 42, the determination is denied (S820: No).

If the determination of S820 is denied, the control unit 41 holds the encryption key generated in S818 as a formal AppKey (β1 in FIG. 6C) in the storage unit 42 (S822).

Next, the process of the network server 4 returns to the beginning of the flowchart shown in FIG. 8 (shown by A in a circle in FIG. 8), and the network server 4 waits for the reception of the Join Request from the wireless terminal 2 (S800).

When the control unit 41 receives the JoinRequest from the wireless terminal 2 (S800: Yes), the control unit 41 determines whether the AppKey corresponding to the wireless terminal 2 which is the transmission source of the JoinRequest is held in the storage unit 42 (S802). Here, since the storage unit 42 holds the AppKey: β1 corresponding to the wireless terminal 2 (FIG. 6 (D)), the determination is affirmed (S802: Yes). The wireless terminal 2 is specified by using DevEUI included in JoinRequest.

When the determination of S802 is affirmed, the control unit 41 holds the ApKey (β1 in FIG. 6D) held in the storage unit 42 in the temporary holding unit 412 (S806).

After that, the operations of the control unit 41, the random number generation unit 413, and the encryption key generation unit 414 are the same as the operations in S808 to S818 described above. However, in the second week of the flow of FIG. 8, the JoinAccess transmitted from the network server 4 to the wireless terminal 2 includes AppNoncce: ζ2 of FIG. 6 (E) as a random number generated by the random number generator 413. NetID: δ1 (FIG. 6 (E)) corresponding to the wireless terminal 2 is included. Further, the Join Request received from the wireless terminal 2 includes DevNonce: ε2 shown in FIG. 6 (E). Then, the encryption key generation unit 414 generates an encryption key using AppKey; β1, DevNonce: ε2, NetID: δ1 and AppNonce: ζ2 in FIG. 6 (F).

When the encryption key is generated, the control unit 41 again determines whether the AppKey is held in the storage unit 42 (S820). The determination of S820 is the same as the determination of S802 described above. Here, since ApKey: β1 is held in the storage unit 42, the determination is affirmed (S820: Yes).

When the determination of S820 is affirmed, the control unit 41 holds the encryption key generated in S818 as an AppSKay (γ1 in FIG. 6F) in the storage unit 42 (S824).

After that, the network server 4 shifts to a general operation for communicating with the wireless terminal 2 by using the ApSKay (γ1 in FIG. 6F) held in the storage unit 42 as the encryption key (S826). In normal operation, the data transmitted from the network server 4 is encrypted by the encryption unit 45 using ApSKEY. The data received from the wireless terminal 2 is decoded by the decoding unit 46 using the ApSKay.

(C) Effect in the First Embodiment According to the first embodiment described above, it is not necessary for the wireless terminal 2 to hold the AppKey in advance. In the past, when the worker installed the wireless terminal 2, it was necessary for the wireless terminal 2 to hold the AppKey, so that there was a risk that the ApKey would leak from the worker. On the other hand, in the first embodiment, as described above, the wireless terminal 2 is activated in a state where the ApKey is not set, and the wireless terminal 2 uses the provisional ApKey (α1 in FIG. 6) defined in its own program. Read from and set to yourself. Since the program of the wireless terminal 2 is not interfered with by the worker who installs the wireless terminal 2, it is unlikely that the provisional AppKey will be leaked to a third party including the worker in the first embodiment. The first embodiment has improved security in terms of AppKey management as compared with the conventional case.

Further, in the first embodiment, both the wireless terminal 2 and the network server 4 generate a formal AppKey (β1 in FIG. 6) inside the apparatus by using a temporary AppKey (α1 in FIG. 6), and further form a formal AppKey. (Β1 in FIG. 6) is used to generate an AppSKay (γ1 in FIG. 6) inside the device, and the AppSKkey (γ1 in FIG. 6) is used to encrypt the communication. As described above, since the provisional ApKey is less likely to be leaked to a third party, the formal AppKey and AppSKY are more difficult to be leaked and analyzed, and the first embodiment is more secure in terms of ApSKY management than before. It is improving.

Further, in the first embodiment, security is improved in terms of AppKey management and ApSKkey management as described above, but the encryption method used in the wireless communication system 1A is a common key cryptosystem. The first embodiment does not use the public key cryptosystem that causes an increase in power consumption and hardware sophistication of the wireless terminal 2. Therefore, in the first embodiment, a common key cryptosystem is used, and wireless communication with improved security as compared with the conventional one without impairing the low power consumption and low economic cost of the wireless terminal 2, which are the advantages of the LPWA wireless communication system. System 1A is realized.

(2) Second Embodiment A second embodiment of the present invention will be described with reference to FIGS. 9 to 11. In the first embodiment, the configuration and operation when one wireless terminal 2 is connected to the network server 4 have been described, but in the second embodiment, when a plurality of wireless terminals 2 are connected to the network server 4. The configuration and operation will be described. Further, also in the second embodiment, the mechanism of ApSkey generation defined in LoRaWAN shown in FIG. 4 is used. In the following description, the same configuration and operation as in the first embodiment may be described with reference to each of FIGS. 1 to 8 as appropriate, or a part of the description may be omitted.

(D) Overall Configuration of Hardware (D-1) Wireless Communication System FIG. 9 is a configuration diagram showing an overall configuration of the wireless communication system 1B according to the second embodiment. In FIG. 9, the wireless communication system 1B includes a plurality of wireless terminals 2-1 to 2-n (n is an integer of 2 or more), a base station 3, a network server 4, and a host device 5.

The functions and roles of the wireless terminals 2-1 to 2-n, the base station 3, the network server 4, and the host device 5 are the same as those described in the first embodiment. Regarding the connection relationship in FIG. 9, each of the wireless terminals 2-1 to 2-n is wirelessly connected to the base station 3 by the modulation method specified in LoRaWAN. That is, in the second embodiment, the base station 3 and the wireless terminals 2-1 to 2-n are connected in a one-to-n manner.

(D-2) Configuration of Wireless Terminals 2-1 to 2-n, Network Server 4 (D-2-1) Wireless Terminals 2-1 to 2-n
The internal configuration of the wireless terminals 2-1 to 2-n in the second embodiment is the same as the internal configuration of the wireless terminal 2 in the first embodiment (FIG. 2).

(D-2-2) Configuration of network server 4

The internal configuration of the network server 4 in the second embodiment is the same as the internal configuration of the network server 4 in the first embodiment (FIG. 3). However, the storage unit 42 of the network server 4 is provided with a logical structure so that various information can be stored in each of the plurality of wireless terminals 2-1 to 2-n (not shown).

(E) Operation With reference to FIGS. 10 and 11, the flow of information exchange and encryption key generation between the plurality of wireless terminals 2-1 to 2-n and the network server 4 will be described. Also in the second embodiment, the encryption key generation method specified in LoRaWAN described with reference to FIG. 4 is used between the network server 4 and one wireless terminal 2. Further, in the following description, of the plurality of wireless terminals 2-1 to 2-n, two wireless terminals 2-1 and wireless terminal 2-2 will be described as representatives.

(E-1) Information exchange and encryption key generation between a plurality of wireless terminals and a network server FIG. 10 is a sequence diagram showing a flow of data transmission / reception between the wireless terminals 2-1 and the wireless terminals 2-2 and the network server 4. FIG. 11 is a diagram showing transitions of each information in the wireless terminal 2-1 and the wireless terminal 2-2 and the network server 4. Note that the base station 3 is omitted in FIG. The alphabets A to F attached to the right side in FIG. 10 correspond to (A) to (F) in FIG. 11, respectively.

In the second embodiment, the wireless terminal 2-1 and the wireless terminal 2-2 do not operate in synchronization. Therefore, the communication between each wireless terminal 2 and the network server 4 is performed at an appropriate timing, and the internal processing of the wireless terminal 2-1 and the wireless terminal 2-2 and the network server 4 is also performed at an appropriate timing. In FIG. 10, for convenience of explanation, a context is provided between the communication timing and the processing timing of the wireless terminal 2-1 and the wireless terminal 2-2, but the context of the timing of each process is limited to FIG. It's not something.

In FIG. 10, the flow of information exchange and encryption key generation with and from the network server 4 for each of the wireless terminal 2-1 and the wireless terminal 2-2 is shown in FIGS. 5 and 6 in the first embodiment. Is the same as that described using. However, the network server 4 generates and manages AppKey, AppSKay, NetID, DevNonce, and AppNonce for each of the wireless terminal 2-1 and the wireless terminal 2-2.

In the wireless terminal 2-1 and the wireless terminal 2-2, the ApKey is not set in advance by the operator who operates the wireless communication system 1B. The wireless terminal 2-1 and the wireless terminal 2-2 are activated in a state where the ApKey is not set in advance (S100, S102). At this time, the wireless terminal 2-1 and the wireless terminal 2-2 read the temporary AppKey defined in their own program from the program and set it in themselves. The same provisional AppKey is defined in the programs mounted on the wireless terminal 2-1 and the wireless terminal 2-2. Similarly, even if the number of wireless terminals 2 is 2 or more, the same provisional AppKey is defined in the programs of the wireless terminals 2-1 to 2-n. On the other hand, the network server 4 uniformly stores the same temporary AppKey for each of the wireless terminal 2-1 and the wireless terminal 2-2 that have not been registered to participate in the wireless communication system 1B.

Next, the wireless terminal 2-1 and the wireless terminal 2-2 generate random numbers to obtain DevNonce, and transmit a JoinRequest including DevNonceEUI to the network server 4 (S104, S106). The state up to S106 of FIG. 10 is shown in FIG. 11 (A). In FIG. 11A, the temporary AppKey: α1 is held in both the wireless terminal 2-1 and the network server 4, and the temporary AppKey: α1 is held in both the wireless terminal 2-2 and the network server 4. .. Further, the wireless terminal 2-1 holds DevNonce: ε1, and the wireless terminal 2-2 holds DevNonce: ε2. Since DevNonce is a random number, ε1 and ε2 are unrelated and different values.

When the network server 4 receives the JoinRequest from the wireless terminal 2-1 and receives the JoinRequest, the network server 4 extracts the DveEUI and DevNonce included in the JoinRequest. The network server 4 identifies the NetID corresponding to the wireless terminal 2-1 based on the DevEUI, generates a random number, and sets it as an AppNonce. The network server 4 transmits a JoinAccess including NetID and AppNonce to the wireless terminal 2-1 (S108). Similarly, for the wireless terminal 2-2, the network server 4 identifies the NetID corresponding to the wireless terminal 2-2 based on the DevEUI, generates a random number to obtain an AppNance, and sets the JoinAccept including the NetID and the ApNonce to the wireless terminal. It is transmitted to 2-2 (S1010). The state up to S1010 in FIG. 10 is shown in FIG. 11 (B). In FIG. 11B, the network server 4 holds DevNonce: ε1 in association with the wireless terminal 2-1 and further holds NetID: σ1 and AppNonce: ζ1 specified from DevEUI. Further, the network server 4 holds DevNonce: ε2 in association with the wireless terminal 2-2, and further holds NetID: σ2 and AppNonce: ζ2 specified from DevEUI. Since ApNonce is a random number here, ζ1 and ζ2 are irrelevant and different values.

When the wireless terminal 2-1 receives the JoinAccess from the network server 4, the wireless terminal 2-1 extracts the NetID and the AppNonce included in the JoinAccess. The wireless terminal 2-1 generates an encryption key using the temporary AppKey, the DveNonce transmitted to the network server 4, the NetID received from the network server 4, and the AppNonce, and uses this as the official AppKey (S1014). On the other hand, the network server 4 generates an encryption key using the temporary AppKey, the DveNonce received from the wireless terminal 2-1 and the NetID and AppNance transmitted to the wireless terminal 2-1 and sets this as the official AppKey (S1012).

When the wireless terminal 2-2 receives the JoinAccess from the network server 4, the wireless terminal 2-2 extracts the NetID and the AppNonce included in the JoinAccess. The wireless terminal 2-2 generates an encryption key using the temporary AppKey, the DveNonce transmitted to the network server 4, the NetID received from the network server 4, and the AppNonce, and uses this as the official AppKey (S1018). On the other hand, the network server 4 generates an encryption key using the temporary AppKey, the DveNonce received from the wireless terminal 2-2, the NetID and the AppNance transmitted to the wireless terminal 2-2, and sets this as the official AppKey (S1016).

The states from S1012 to S1018 in FIG. 10 are shown in FIG. 11 (C). In FIG. 11C, the wireless terminal 2-1 holds NetID: σ1 and AppNance: ζ1 included in JoinAcpt, and both the wireless terminal 2-1 and the network server 4 have temporary AppKey: α1, NetID: AppKey: β1 generated using σ1, DevNonce: ε1 and AppNonce: ζ1 is retained. Further, in FIG. 11C, NetID: σ2 and AppNonce: ζ2 included in JoinAcpt are held in the wireless terminal 2-2, and provisional AppKey: α1 and NetID are held in both the wireless terminal 2-2 and the network server 4. AppKey: β2 generated using: σ2, DevNonce: ε2 and AppNonce: ζ2 are retained. Here, since ApKey: β1 for the wireless terminal 2-1 and AppKey: β2 for the wireless terminal 2-2 are generated based on different NetIDs and random values (DevNonce, AppNonce), β1 and β2 are irrelevant and different. The value.

Next, the wireless terminal 2-1 is restarted while holding the official AppKey (β1 in FIG. 11C) generated in S1014 (S1020). In this restart, the wireless terminal 2 does not read the temporary AppKey from its own program and starts while holding the official AppKey, unlike the above-mentioned startup of S100. By restarting the wireless terminal 2-1 the connection between the wireless terminal 2-1 and the network server 4 is canceled. At this time, the network server 4 holds the official AppKey (β1 in FIG. 11C) generated in S1012 corresponding to the wireless terminal 2-1 and deletes other information as the connection is canceled.

Similarly, the wireless terminal 2-2 is restarted while holding the official AppKey (β2 in FIG. 11C) generated in S1018 (S1022). In this restart, the wireless terminal 2-2 does not read the temporary AppKey from its own program and starts while holding the official AppKey, unlike the above-mentioned startup of S102. By restarting the wireless terminal 2-2, the connection between the wireless terminal 2-2 and the network server 4 is canceled. At this time, the network server 4 holds the official AppKey (β2 in FIG. 11C) generated in S1016 corresponding to the wireless terminal 2-2, and deletes other information as the connection is canceled.

Next, the wireless terminal 2-1 and the wireless terminal 2-2 generate random numbers to obtain DevNonce, and transmit a JoinRequest including DevNonceEUI to the network server 4 (S1024, S1026). The state up to S1026 of FIG. 10 is shown in FIG. 11 (D). In FIG. 11D, ApKey: β1 is held in both the wireless terminal 2-1 and the network server 4, and DevNonce: ε3 is held in the wireless terminal 2-1. The temporary AppKey: α1 held in FIG. 11 (A) is deleted in FIG. 11 (D) due to the restart of the wireless terminal 2-1 and the disconnection of the connection. Further, in FIG. 11D, ApKey: β2 is held in both the wireless terminal 2-2 and the network server 4, and DevNonce: ε4 is held in the wireless terminal 2-2. The temporary AppKey: α1 held in FIG. 11 (A) is deleted in FIG. 11 (D) due to the restart of the wireless terminal 2-2 and the disconnection of the connection. Since DevNonce is a random number, ε3 and ε4 are unrelated and different values.

When the network server 4 receives the JoinRequest from the wireless terminal 2-1 and receives the JoinRequest, the network server 4 extracts the DveEUI and DevNonce included in the JoinRequest. The network server 4 identifies the NetID corresponding to the wireless terminal 2-1 based on the DevEUI, generates a random number, and sets it as an AppNonce. The network server 4 transmits a JoinAccess including NetID and AppNonce to the wireless terminal 2-1 (S1028). Similarly, for the wireless terminal 2-2, the network server 4 identifies the NetID corresponding to the wireless terminal 2-2 based on the DevEUI, generates a random number to obtain an AppNance, and sets the JoinAccept including the NetID and the ApNonce to the wireless terminal. It is transmitted to 2-2 (S1030). The state up to S1030 in FIG. 10 is shown in FIG. 11 (E). In FIG. 11 (E), the network server 4 holds DevNonce: ε3 in association with the wireless terminal 2-1 and further holds NetID: σ1 and AppNonce: ζ3 specified from DevEUI. Since the NetID is an identifier unique to the wireless terminal 2-1 and therefore, the NetID: σ1 is the same as in FIG. 11B. Further, the network server 4 holds DevNonce: ε4 in association with the wireless terminal 2-2, and further holds NetID: σ2 and AppNonce: ζ4 specified from DevEUI. Since NetID is an identifier unique to the wireless terminal 2-2, NetID: σ2 is the same as in FIG. 11B. Since ApNonce is a random number here, ζ3 and ζ4 are irrelevant and different values.

When the wireless terminal 2-1 receives the JoinAccess from the network server 4, the wireless terminal 2-1 extracts the NetID and the AppNonce included in the JoinAccess. The wireless terminal 2-1 generates an encryption key using the AppKey, the DveNonce transmitted to the network server 4, the NetID received from the network server 4, and the AppNonce, and this is referred to as the ApSKey (S1034). On the other hand, the network server 4 generates an encryption key using the ApKey, the DveNonce received from the wireless terminal 2-1 and the NetID and the ApNonce transmitted to the wireless terminal 2-1 and sets this as the ApSKey (S1032).

When the wireless terminal 2-2 receives the JoinAccess from the network server 4, the wireless terminal 2-2 extracts the NetID and the AppNonce included in the JoinAccess. The wireless terminal 2-2 generates an encryption key using the ApKey, the DveNonce transmitted to the network server 4, the NetID received from the network server 4, and the AppNonce, and this is designated as the AppSKkey (S1038). On the other hand, the network server 4 generates an encryption key using the AppKey, the DveNonce received from the wireless terminal 2-2, the NetID and the AppNonce transmitted to the wireless terminal 2-2, and sets this as the ApSKey (S1036).

The states from S1032 to S1038 in FIG. 10 are shown in FIG. 11 (F). In FIG. 11 (F), NetID: σ1 and AppNonce: ζ3 included in JoinAcpt are held in the wireless terminal 2-1 and AppKey: β1 and NetID: σ1 are held in both the wireless terminal 2-1 and the network server 4. , DevNonce: ε3 and AppNonce: ζ3 are used to generate AppSKay: γ1. Further, in FIG. 11C, NetID: σ2 and AppNonce: ζ4 included in JoinAcpt are held in the wireless terminal 2-2, and AppKey: β2, NetID: in both the wireless terminal 2-2 and the network server 4. The AppSKay: γ2 generated using σ2, DevNonce: ε4 and AppNonce: ζ4 are retained. Here, since the AppSKkey: γ1 for the wireless terminal 2-1 and the AppSKkey: γ2 for the wireless terminal 2-2 are generated based on different AppKey, NetID and random number values (DevNonce, AppNonce), γ1 and γ2 are related. There are no different values.

When the wireless terminal 2-1 and the network server 4 generate an ApSKey (γ1 in FIG. 11 (F)), the wireless terminal 2-1 and the network server 4 shift to a normal operation of encrypting and decrypting user data using the ApSKkey (S1040). .. Further, when the wireless terminal 2-2 and the network server 4 generate an ApSKey (γ2 in FIG. 11 (F)), the wireless terminal 2-2 and the network server 4 shift to a normal operation of encrypting and decrypting user data using the ApSKkey (S1042). ). Here, since AppSKay: γ1 and γ2 are valid until the connection between the wireless terminal 2-1 and the wireless terminal 2-2 and the network server 4 is canceled, the wireless terminal 2-1 or the wireless terminal 2- When the connection between 2 and the network server 4 is canceled, the connection operation between the wireless terminal 2 and the network server 4 which has been disconnected is executed, and a new phase 1 of FIGS. 6A to 6C is performed. An Apkey is generated, and a new AppKey is generated in Phase 2 of FIGS. 6 (D) to 6 (F).

(E-2) Operation Flow of Wireless Terminal The operation of each of the wireless terminal 2-1 and the wireless terminal 2-2 in the second embodiment is the same as the operation of the wireless terminal 2 described in the first embodiment. .. That is, the operation of each of the wireless terminal 2-1 and the wireless terminal 2-2 in the second embodiment is described by the flowchart of FIG.

(E-3) Operation Flow of Network Server The operation of the network server 4 in the second embodiment for each of the wireless terminal 2-1 and the wireless terminal 2-2 is the network server 4 described in the first embodiment. It is the same as the operation of. That is, the operation of the network server 4 in the second embodiment is described by the flowchart of FIG. As described above, since the wireless terminal 2-1 and the wireless terminal 2-2 do not operate in synchronization with each other, the network server 4 appropriately performs the operation shown in the flowchart of FIG. 8 with respect to the wireless terminal 2-1. , The operation shown in the flowchart of FIG. 8 is appropriately performed for the wireless terminal 2-2 as well.

(F) Effect in the Second Embodiment According to the second embodiment described above, the same effect as in the first embodiment can be obtained. That is, it is not necessary to hold the ApKey in each of the wireless terminal 2-1 and the wireless terminal 2-2 in advance, and each of the wireless terminal 2-1 and the wireless terminal 2-2 has the provisional AppKey defined in its own program. Since it is read from the program and set to itself, the security of the second embodiment is improved in terms of AppKey management as compared with the conventional case, as in the first embodiment. Further, in the second embodiment, as in the first embodiment, the security is improved in terms of ApSKay management as compared with the conventional case. In the second embodiment, a common key cryptosystem is used, and wireless communication with improved security as compared with the conventional one without impairing the low power consumption and low economic cost of the wireless terminal 2, which are the advantages of the LPWA wireless communication system. System 1B is realized.

A point peculiar to the second embodiment is that each of the wireless terminal 2-1 and the wireless terminal 2-2 is a network server 4 without having the wireless terminal 2-1 and the wireless terminal 2-2 hold the AppKey in advance. The point is that the AppKey is generated without relying on human hands. As described above, when the common key cryptosystem is adopted for the wireless communication system, it is necessary to hold the encryption key (AppKey) in the wireless terminal 2 when the wireless terminal 2 is installed. That is, conventionally, a person who constructs a wireless communication system has a large number of wireless terminals 2 each hold a different encryption key (AppKey), and the network server 4 also has a different encryption key (AppKey) corresponding to the wireless terminal 2. It was necessary to register the device, which required a lot of time and effort.

On the other hand, in the second embodiment, it is not necessary for each of the wireless terminal 2-1 and the wireless terminal 2-2 to hold the AppKey in advance, and it is defined in each program of the wireless terminal 2-1 and the wireless terminal 2-2. The provisional AppKey to be used may have the same value regardless of the number of wireless terminals 2 (α1 in FIG. 11). Then, in the second embodiment, in the process in which the wireless terminal 2-1 and the wireless terminal 2-2 communicate with the network server 4, a formal AppKey different for each wireless terminal 2 is generated in the wireless terminal 2 and the network server 4. (Β1 and β2 in FIG. 11). That is, in the second embodiment, it is possible to reduce the time and effort required for the plurality of wireless terminals 2 to hold different AppKeys and the network server 4 to hold the AppKeys as compared with the conventional case. This effect becomes more remarkable as the number of wireless terminals 2 participating in the wireless communication system 1B increases.

(3) Other Modified Examples The following modified examples may be applied to the first embodiment and the second embodiment.

(G-1) As described above, when the connection between the wireless terminal 2 and the network server 4 is canceled after the ApSKay is generated in each of the wireless terminal 2 and the network server 4, the wireless terminal 2 and the network server 4 In each case, the generation of the formal AppKey based on the provisional AppKey and the generation of the AppSkey based on the formal AppKey are performed again. Here, each of the wireless terminal 2 and the network server 4 is made to hold the AppSKey value (referred to as the old AppSkey value) that was used until immediately before the connection was disconnected, and in the reconnection after the connection is disconnected, An AppKey may be generated based on the old AppKey value, and a new AppKey may be generated based on the AppKey.

As described in the first embodiment and the second embodiment, the old AppSKay values used until just before the connection is disconnected are the provisional AppKey and the disorder defined in the program of the wireless terminal 2 or the network server 4. It is generated inside the wireless terminal 2 and the network server 4 using numerical values. Therefore, it is unlikely that the old AppSKkey value will be grasped by a third party, or the old AppSKkey value will be derived by calculation by a third party. Therefore, if the old AppKey value is used in the reconnection between the wireless terminal 2 and the network server 4, the AppKey and the AppKey generated based on the old AppKey value will be more confidential to a third party.

(G-2) In the first embodiment and the second embodiment, the NwkSKay surrounded by the alternate long and short dash line in FIG. 4 was not involved. Here, the NwkSKay is used for encrypting and decrypting the standard command data communicated between the end device and the network server in FIG. 4, and the NwkSKay is generated based on the ApPKey like the AppKey. .. As a modification, AppSKKey may be generated by the above-mentioned procedure, and NwkSKay may be generated by the same procedure. In this case, in the generation of the ApSKey, the ApSKey is generated based on five values obtained by adding the first fixed value X1 to the above-mentioned four formal AppKey, NetID, DevNonce and AppNonce. Further, in the generation of NwkSKay, NwkSKay is generated based on five values obtained by adding a second fixed value X2 to the above-mentioned four formal AppKey, NetID, DevNonce and AppNonce. According to this modification, in addition to the first embodiment and the second embodiment, security can be improved in terms of NwkSKay management.

(G-3) In the first embodiment and the second embodiment, a mode in which the encryption key generation mechanism defined by LoRaWAN is used has been described. However, the present invention is also applicable to wireless protocols other than the LoRaWAN protocol. That is, a common key encryption method is adopted in the communication between the upstream server and the downstream terminal of the communication system, and the downstream terminal is registered in the upstream server by the communication between the upstream server and the downstream terminal, and the communication is performed. The configuration and operation of the present invention can be applied to any communication system in which the encryption key to be used is generated.

1A, 1B ... wireless communication system, 2 (2-1-2-n) ... wireless terminal, 3 ... base station,
4 ... Network (NW) server, 5 ... Higher level device,
21 ... Control unit, 212 ... Connection processing unit, 212 ... Temporary holding unit, 213 ... Random number generation unit,
214 ... Encryption key generation unit, 22 ... Storage unit, 23 ... Transmission unit, 24 ... Receiver unit,
25 ... encryption part, 26 ... decryption part,
27 ... external interface, 28 ... antenna,
41 ... Control unit, 412 ... Connection processing unit, 412 ... Temporary holding unit, 413 ... Random number generation unit,
414 ... Encryption key generation unit, 42 ... Storage unit, 43 ... Transmission unit, 44 ... Receiver unit,
45 ... encryption unit, 46 ... decryption unit, 47 ... external interface, 48 ... interface,
90 ... AppKey, 92 ... DevNonce, 94 ... DevEUI,
96 ... AppNonce, 98 ... NetID, 910 ... AppSKay

Claims (7)

A communication system in which a communication terminal and a server perform encrypted communication using a common key.
The communication terminal is
The first means of communication that communicates with the server,
The first storage means for storing the first information,
A request information generating means for generating a first request information transmitted to the server and a second request information transmitted to the server.
The first request information is transmitted to the server via the first communication means, and the first response information to the first request information is received from the server via the first communication means. First connection processing means,
A first generation means for generating a second information using the first request information, the first response information, and the first information.
The second request information is transmitted to the server via the first communication means, and the second response information for the second request information is received from the server via the first communication means. Second connection processing means,
A second generation means for generating a first common key using the second request information, the second response information, and the second information.
A first encryption means that is connected to the first communication means and encrypts data transmitted to the server using the first common key.
A first decoding means that is connected to the first communication means and decodes received data from the server using the first common key.
With
The server
A second communication means for communicating with the communication terminal,
A second storage means for storing a third information having the same value as the first information,
A response information generating means for generating the first response information transmitted to the communication terminal and the second response information transmitted to the communication terminal.
A third connection process in which the first request information is received from the communication terminal via the second communication means, and the first response information is transmitted to the communication terminal via the second communication means. means,
A third generation means for generating a fourth information having the same value as the second information by using the first request information, the first response information, and the third information.
A fourth connection process in which the second request information is received from the communication terminal via the second communication means, and the second response information is transmitted to the communication terminal via the second communication means. means,
A fourth generation that uses the second request information, the second response information, and the fourth information to generate a second common key having the same value as the first common key. means,
A second encryption means, which is connected to the second communication means and encrypts data transmitted to the communication terminal using the second common key.
A second decoding means, which is connected to the second communication means and decodes the received data from the communication terminal using the second common key.
A communication system characterized by comprising. The first storage means holds an operation program of the communication terminal and holds the operation program.
The communication system according to claim 1, wherein the communication terminal includes a derivation means for deriving the first information from the operation program. The communication terminal receives the generation of the second information by the first generation means, maintains the state in which the second information is held in the first storage means, and restarts the communication terminal. A restart means for canceling the connection between the communication terminal and the server is provided.
The second connection processing means receives the restart of the communication terminal and transmits the second request information to the server via the first communication means.
The communication system according to claim 1 or 2. The first storage means and the second storage means store arithmetic expressions, respectively.
The first generation means sets the first request information, the first response information, and the first information in the calculation formula to generate the second information.
The third generation means sets the first request information, the first response information, and the third information in the calculation formula to generate the fourth information.
The second generation means sets the second request information, the second response information, and the second information in the calculation formula to generate the first common key, and the fourth generation means. Is generated by setting the second request information, the second response information, and the fourth information in the arithmetic expression to generate the second common key.
The communication system according to any one of claims 1 to 3, wherein the communication system is characterized by the above. The communication terminal includes a first random number generation means for generating random numbers.
The first storage means stores terminal identification information unique to the communication terminal, and stores the terminal identification information.
The first request information includes the terminal identification information and the first random number value by the first random number generation means.
The second request information includes the terminal identification information and the second random number value by the first random number generation means.
The server is provided with a second random number generating means for generating random numbers.
The second storage means stores a communication identifier for each terminal identification information, and stores the communication identifier.
The first response information includes the communication identifier and a third random number value by the second random number generation means.
The second response information includes the communication identifier and a fourth random number value by the second random number generation means.
The communication system according to any one of claims 1 to 4, wherein the communication system is characterized by the above. There are a plurality of the communication terminals,
The first generation means of the plurality of communication terminals includes the first information, the first request information including a random number value different for each of the plurality of communication terminals, and a disorder different for each of the plurality of communication terminals. Using the first response information including numerical values, the second information different for each of the plurality of communication terminals is generated.
Each of the third generation means of the server includes the third information, the first request information including a random number value different for each of the plurality of communication terminals, and a random number value different for each of the plurality of communication terminals. Using the first response information including the above, the fourth information different for each of the plurality of the communication terminals is generated.
The second generation means of the plurality of communication terminals includes the second information different for each of the plurality of communication terminals, the second request information including a random number value different for each of the plurality of communication terminals, and a plurality of the second information. Using the second response information including a random number value different for each of the communication terminals, the first common key that is different for each of the plurality of communication terminals is generated.
Each of the fourth generation means of the server includes the fourth information different for each of the plurality of communication terminals, the second request information including a random number value different for each of the plurality of communication terminals, and a plurality of the second request information. Using the second response information including a random number value different for each communication terminal, the second common key different for each of the plurality of communication terminals is generated.
The first encryption means and the first decryption means in the plurality of communication terminals each use the first common key generated for each of the plurality of communication terminals to encrypt data transmitted to the server. And decrypt the data received from the server.
The second encryption means and the second decryption means of the server each use the second common key generated for each communication terminal as a communication destination to transmit data to the communication terminal. Encryption and decryption of data received from the communication terminal.
The communication system according to claim 5. A communication terminal having a first storage means for holding the first information and a server having a second storage means for holding a third information having the same value as the first information use a common key. It is a communication method that performs encrypted communication.
The first step, in which the communication terminal transmits the first request information to the server,
When the server receives the first request information, a second step of transmitting the first response information to the communication terminal,
A third step in which the communication terminal uses the first request information, the first response information, and the first information to generate a second information.
A fourth step in which the server uses the first request information, the first response information, and the third information to generate a fourth information having the same value as the second information. ,
In response to the execution of the third step, the fifth step, in which the communication terminal transmits the second request information to the server,
The sixth step, in which the server receives the second request information and transmits the second response information to the communication terminal.
A seventh step in which the communication terminal uses the second request information, the second response information, and the second information to generate a first common key.
An eighth in which the server uses the second request information, the second response information, and the fourth information to generate a second common key having the same value as the first common key. Steps,
The communication terminal uses the first common key to encrypt data transmitted to the server and decrypts data received from the server, and the server uses the second common key to encrypt the communication terminal. Ninth step of encrypting the data transmitted to the server and decrypting the data received from the communication terminal.
Communication methods including.

Images