KR100492507B1 - Security method for wireless data transmission and apparatus of transmitting/receiving thereof - Google Patents

Abstract

The security method of the present invention includes encrypting a randomly generated key using identification information of a transmitting device and a receiving device, transmitting the encrypted key to a first data packet to be transmitted, and transmitting the key. Encrypting the data to be transmitted using the second data packet; wirelessly transmitting the encrypted data starting from the second data packet; and encrypting the encrypted key on the first data packet of the wirelessly transmitted data packet. And decrypting the data received from the second data packet by using the decrypted key.

An apparatus for transmitting a data packet via a wireless LAN includes a random number generator for randomly generating a key, a key encryption module for encrypting the key using identification information of a transmitter and a receiver, and the encrypted key for the first time. An encryption module which loads a data packet transmitted by the data packet, encrypts the data to be transmitted using the key and loads the second data packet, and encodes and wirelessly transmits the data packet output by the encryption module. Features,

An apparatus for receiving a data packet through a wireless LAN includes a wireless receiving and decoding unit for receiving and decoding a data packet transmitted wirelessly, and the first data of the received data packet using identification information of the transmitting apparatus and the receiving apparatus. And a decryption module for decrypting a key from the packet and decrypting data from the second data packet using the decrypted key.

Description

SECURITY METHOD FOR WIRELESS DATA TRANSMISSION AND APPARATUS OF TRANSMITTING / RECEIVING THEREOF}

The present invention relates to a wireless data transmission technology through a wireless LAN, and more particularly to a security method and apparatus for wireless data transmission.

Recently, as consumers' desire for wireless networking technology increases, data transmission technology using wireless LAN has been greatly improved. In particular, as wireless networking technology has advanced from IEEE 802.11b to IEEE802.11a, the data rate has also increased from 11Mbps to 54Mbps. As the data rate is improved, AV data can be transmitted and received through a wireless LAN.

In general, in order to transmit AV data through a wireless LAN, a wide data rate is required for real time broadcasting, and a quality of service (hereinafter referred to as QOS) must be guaranteed to prevent the sequence of video frames from being disconnected. In this case, security should be ensured because AV data generated from specific media should be transmitted only to the receiver.

For the wide data rate, the IEEE 802.11a of the 5.2 GHz band and the IEEE 802.11g of the 2.4 GHz band have been gradually standardized and put into practice, and the standards of the IEEE802.11e and the IEEE 802.11h have been advanced in terms of service quality and security. It is a trend.

1 is a block diagram of a general AV data transmission apparatus through a wireless RAM, and the CPU 100 of the transmission apparatus generally controls the transmission apparatus. The video format converter 102 converts video data of various formats, that is, video data of CVBS, RGB, YPbPr, into the ITU-R 656 format, which is an input format of the MPEG encoder 104, under the control of the CPU 100. The MPEG encoder 104 converts the video data of the ITU-R 656 format to MPEG encoding and converts the video data into MPEG TS (Transport Stream). Here, the MPEG encoder 104 provides an effect of compressing data by removing redundant data in space and time.

The output of the MPEG encoder 104 is provided to the MAC processor 106, the MAC processor 106 provides access to the wireless medium, join the network, authentication and security functions in the LAN environment, as well as the The MPEG TS is encoded into a MAC frame, and the MAC frame is transmitted through a network. The baseband processor 108 is called a PHY layer, and modulates the MAC frame output by the MAC processor 106 into a form suitable for wireless transmission, and performs modulation for actual transmission such as synchronization insertion for synchronization between transmission and reception. . The RF module 110 modulates the output of the baseband processor 108 into a radio signal and transmits it through the antenna 112.

2 shows a configuration diagram of the receiver, the RF module 202 of the receiver receives a radio signal transmitted by the transmitter through the antenna 200 and restores the baseband signal. Provide the reconstructed baseband signal to baseband processor 204. The baseband processor 204 restores the baseband signal to a MAC frame and provides it to the MAC processor 206. The MAC processor 206 restores the MAC frame to MPEG TS and provides the MPEG frame to the MPEG decoder 208. The MPEG decoder 208 converts the MPEG TS into video data of the ITU-R 656 format and provides the video to the video format converter 210.

The video format converter 210 converts the video data of the ITU-R 656 format into video data of any one of a format, for example, CVBS, RGB, and YPbPr, and outputs the video data. The CPU 212 generally controls the receiver.

The security method at the time of data transmission and reception via the WLAN is briefly described with reference to FIG.

When a client requesting authentication requests authentication to an access point (1), the access point provides a random challenge text for authentication to the client (2). The client encrypts the random challenge text and provides it back to the access point (③).

Here, the encryption is based on the RC4 encryption algorithm, and the data required for RC4 encryption is generated by combining a predetermined authentication key and an IV (Initial Vector). In addition, the encryption key and the IV (Initial Vector) are shared by the AP and all clients provided with the service belonging to the AP.

The access point decrypts the encrypted challenge text to determine whether it is the same as the random challenge text sent in advance, and transmits the authentication result according to the client to the client (④).

A process of encoding and protecting the random challenge text will be further described with reference to FIGS. 4 and 5. 4 and 5 are concepts of a WEP (Wired Equivalent Privacy) algorithm, and the WEP algorithm is a security algorithm used in IEEE 802.11, which is a wireless LAN standard.

First, the process of encrypting the random challenge text by the client will be described with reference to FIG. 4.

The concatenation operator 300 of the client generates a seed by performing an adjacent operation on the IV and the encryption key. Here, the IV and the encryption key are shared by the transmitting and receiving side. The seed is input to a pseudo random number generator 302, and the pseudo random number generator 302 generates a key sequence using the seed.

The CRC algorithm 306 of the client generates an ICV (Integrity Check Value) by performing CRC processing on the random challenge text.

The ICV, random challenge text, and key sequence are input to an XOR 304, and the XOR 304 XORs the ICV and random challenge text and key sequence and outputs the encrypted random challenge text.

The process of the AP decrypting the encrypted random challenge text provided by the client will now be described with reference to FIG. 5.

The adjacent operator 400 of the access point generates a seed by performing an adjacent operation on the IV and the encryption key.

The seed is input to a pseudo random number generator 402, which generates a key sequence using the seed. The generated key sequence is the same data as the key sequence of FIG.

The key sequence and the encrypted text are input to an XOR 404, where the XOR 404 further XORs the key sequence to the encrypted text, whereby the encrypted text is decrypted into ICV and random challenge text.

The random challenge text is input to the CRC algorithm unit 406, and the CRC algorithm unit 406 generates an ICV by performing CRC processing on the random challenge text. Authentication of the client is completed by comparing the ICV output from the CRC algorithm unit 406 with the ICV decrypted from the encrypted text.

The above WEP algorithm is not intended to secure the transmission data itself, but is a security algorithm for determining whether to allow each client access. Accordingly, there is a problem that security is not guaranteed for data transmission between clients belonging to the same access point.

Accordingly, an object of the present invention is to provide a security method and a transmission / reception apparatus for wireless data transmission and reception that can guarantee security for data transmitted between a plurality of clients belonging to one access point.

In accordance with another aspect of the present invention, there is provided a security method including encrypting a randomly generated key using identification information of a transmitting device and a receiving device, and transmitting the encrypted key to a data packet to be transmitted for the first time. Encrypting the data to be transmitted using the key, wirelessly transmitting the encrypted data starting from the second data packet, and encrypting the encrypted key contained in the first data packet of the wirelessly transmitted data packet. And decrypting the data received from the second data packet using the decrypted key by using the identification information of the transmitter and the receiver.

An apparatus for transmitting a data packet via a wireless LAN includes a random number generator for randomly generating a key, a key encryption module for encrypting the key using identification information of a transmitter and a receiver, and the encrypted key for the first time. An encryption module which loads a data packet transmitted by the data packet, encrypts the data to be transmitted using the key and loads the second data packet, and encodes and wirelessly transmits the data packet output by the encryption module. Features,

An apparatus for receiving a data packet through a wireless LAN includes a wireless receiving and decoding unit for receiving and decoding a data packet transmitted wirelessly, and the first data of the received data packet using identification information of the transmitting apparatus and the receiving apparatus. And a decryption module for decrypting a key from the packet and decrypting data from the second data packet using the decrypted key.

A transmission apparatus according to a preferred embodiment of the present invention will be described with reference to FIG.

The CPU 500 of the transmitter generally controls the transmitter.

The format converter 502 converts the AV data of various formats into AV data of a specific format for MPEG encoding and provides the same to the encryption module 504. The AV data is transmitted while the CPU 500 provides a transmission start signal. It does not provide to the encryption module 504.

The random number generator 516 generates a key (KEY) necessary for encryption and decryption and provides the key encryption module 518 and the encryption module 504. The key encryption module 518 receives a combination of the source ID and the destination ID from the key sequence output from the random number generator 516, generates an encoded key sequence, and provides the encoded key sequence to the encryption module 504. Wherein the source ID is the transmitting side identification information, the destination ID is the receiving side identification information.

The key encryption module 518 receives a source ID and a destination ID and generates a sequence by performing an adjacent operation, and generates an encrypted key by XORing the sequence and the key. The encrypted key is input to the encryption module 504.

Here, the configuration of the key encryption module 518 will be described in more detail with reference to FIG. 7. The key encryption module 518 is composed of a neighbor operator 520 and an XOR 522.

The neighbor operator 520 performs a neighbor operation on the source ID and the destination ID to provide an XOR 522. The XOR 522 XORs the neighbor operation result and the key and outputs the encrypted key.

The encryption module 504 outputs the encrypted key during one data packet transmitter when the CPU 500 provides a transmission start signal, and then is provided by the format converter 502 using the key. The AV data is encrypted and output. That is, the encryption module 504 loads the encrypted key for decrypting the encrypted AV data in the first data packet, and then encrypts and outputs the AV data.

Here, the configuration of the encryption module 504 will be described in more detail with reference to FIG. 8.

The encryption module 504 is composed of an XOR 524, a MUX 526, and a packet timer 528. The packet timer 528 provides a set signal "1" to the MUX 526 during one data packet transmitter according to the transmission start signal provided by the CPU 500. The XOR 524 XORs the AV data and the key, and the AV data encrypted by the XOR is provided to the MUX 526. The MUX 526 outputs an encrypted key while the packet timer 528 provides a set signal, and outputs encrypted AV data while the set signal is not provided.

The output of the encryption module 504 is input to the MPEG encoder 506, and the MPEG encoder 506 converts the output of the encryption module 504 into MPEG TS by MPEG encoding. The MPEG TS is wirelessly transmitted through the MAC processor 508, the baseband processor 510, the RF module 512, and the antenna 514, which are wireless LAN cards. Since the operations of the MAC processor 508, the baseband processor 510, the RF module 512, and the antenna 514 are the same as in the related art, a detailed description thereof will be omitted.

Now, a method of receiving and restoring encrypted AV data provided by the transmitter will be described in detail.

First, a receiving apparatus according to a preferred embodiment of the present invention will be described with reference to FIG.

The antenna 600, the RF module 602, the baseband processor 604, and the MAC processor 606 of the receiver receive the MPEG TS transmitted by the transmitter and provide the MPEG TS to the MPEG decoder 608. Since the operation of the antenna 600, the RF module 602, the baseband processor 604, and the MAC processor 606 is the same as in the related art, a detailed description thereof will be omitted.

The MPEG decoder 608 MPEG-decodes the MPEG TS and provides the decoding module 610. The decryption module 610 decrypts the encrypted key provided by the MPEG decoder 608, and decrypts and outputs the encrypted AV data using the decrypted key.

Here, the configuration of the decoding module 610 will be described with reference to FIG. 10.

The decoding module 610 is composed of a neighbor operator 616, a MUX 618, a packet timer 602, a D flip-flop 626, and an XOR 628.

The neighbor operator 616 neighbors the source ID and the destination ID and provides the result to the MUX 618. Here, the output of the neighbor operator 616 is the same as the output of the neighbor operator 520 of the transmitter.

When the reception start signal of the CPU 614 is generated, the packet timer 620 provides a set signal "1" for setting the MUX 618 during one data packet transmission period. The set signal is inverted by the inverter 624 and provided to the MUX 618 as a clear signal and a clock signal of the D flip-flop 626.

Accordingly, the MUX 618 provides the output of the neighbor operator 520 to the XOR 628 while the first data packet is received. The XOR 628 XORs the output of the neighbor operator 520 and the first data packet received via the MUX 618, and the result of the XOR is a key since the first data packet is an encrypted key. The key is provided to the D flip-flop 626, and the D flip-flop 626 provides the key to the MUX 618 in accordance with a clock signal.

That is, the key is decrypted from the first received data packet, and the decrypted key is input to the MUX 618. When the first data packet receiver is completed and cleared, the MUX 618 outputs the decrypted key instead of the output of the neighbor operator 616.

The key output from the receivers of the second data packet by the MUX 618 is input to the XOR 628. The XOR 628 decodes the key and the received AV data from the second data packet and decodes the original AV data.

The decoded AV data is provided to a format converter 612, and the format converter 612 converts and outputs the AV data in a format corresponding to a user's request.

In addition, the CPU 614 controls the reception apparatus as a whole, and provides the reception start signal, the source ID, and the destination ID to each unit according to the preferred embodiment of the present invention.

As described above, the present invention encrypts a key through IDs of a receiving apparatus and a transmitting apparatus and provides the first data packet to decrypt data transmitted thereafter. As a result, the present invention has the advantage that it is not possible to decrypt the data other than the designated transmission device and the reception device, thereby ensuring the security of the data transmitted and received between the two devices.

1 is a block diagram of a wireless data transmission apparatus.

2 is a block diagram of a wireless data receiving apparatus.

3 is a conceptual diagram of a conventional encryption method.

4 and 5 are conceptual diagrams of the WEP algorithm.

6 is a block diagram of a transmitter according to a preferred embodiment of the present invention.

7 is a configuration diagram of a key encoding module of FIG. 6.

8 is a configuration diagram of an encoding module of FIG. 6.

9 is a block diagram of a receiver according to a preferred embodiment of the present invention.

10 is a block diagram of a decoding module of FIG.

Explanation of symbols on main parts of drawing

500: CPU

502: Format Converter

504: encryption module

506: MPEG Encoder

508: MAC processor

510: baseband processor

512 RF module

514: antenna

516: random number generator

600: antenna

602: RF Module

604: Baseband Processor

606; MAC processor

608: MPEG Decoder

610: decryption module

612: Format Converter

Claims (8)

In the method for transmitting and receiving data packets via a wireless LAN, Encrypting a randomly generated key using identification information of a transmitting device and a receiving device; Transmitting the encrypted key in a data packet to be transmitted for the first time; Encrypting data to be transmitted using the key; Wirelessly transmitting the encrypted data starting from a second data packet; Decrypting the encrypted key carried in the first data packet of the wirelessly transmitted data packet using identification information of the transmitting apparatus and the receiving apparatus; And decrypting data received from a second data packet by using the decrypted key. The method of claim 1, Encryption of the key is made by XORing the key and the identification information, And encrypting the data comprises XORing the data and the key. The method of claim 2, Decryption of the encrypted key is made by XOR the encrypted key and the identification information, And decrypting the encrypted data by XORing the encrypted data and the key. An apparatus for transmitting a data packet through a wireless LAN, A random number generator for randomly generating keys, A key encryption module for encrypting the key using identification information of a transmitter and a receiver; An encryption module which loads the encrypted key in a first data packet to be transmitted, encrypts data to be transmitted using the key, and loads the second data packet from the second data packet; And an encoding and a wireless transmitter for encoding and transmitting the data packet output by the encryption module. The method of claim 4, wherein the key encryption module, A neighbor calculation unit configured to perform neighbor operation on identification information of the transmitter and the receiver; And an encryption unit configured to encrypt the output of the adjacent operation unit and the key by XOR. The method of claim 4, wherein the encryption module, An encryption unit for encrypting XOR of the key and the transmitted data; A packet timer for generating a set signal for one data packet transmission period from the transmission start of the data; And a MUX receiving the encrypted key and the encrypted data and outputting the encrypted key while the set signal is generated, and outputting the encrypted data. An apparatus for receiving a data packet through a wireless LAN, A wireless receiving and decoding unit for receiving and decoding data packets transmitted wirelessly; And a decryption module for decrypting a key from the first data packet among the received data packets using identification information of the transmitter and the receiver, and decrypting the data from the second data packet using the decrypted key. Wireless data receiving device. The method of claim 7, wherein the decoding module, A packet timer for generating a set signal for one data packet transmission period from the reception of the data; A neighbor calculation unit configured to perform neighbor operation on identification information of the transmitter and the receiver; A decryption unit configured to decrypt the key by XORing the output of the neighbor operation unit and the first data packet, and decrypting the data by XORing the decrypted key and the received data packet from the second data packet; And wirelessly configured to receive the decrypted key and the output of the neighbor operation unit, and provide the output of the neighbor operation unit to the decryption unit while the set signal is generated, and otherwise output the key. Receiver.