DE202019103784U1 - communication system - Google Patents

Abstract

Communication system (10) for providing access to a security-protected network, preferably a wireless connection, in particular a WLAN connection comprising:
- at least one network key device (18) for storing and providing security data, in particular a password and a network specification, in particular a service set identifier (SSID), as access data to the network;
- At least one network router (16) as an access node to the network and to provide the secured by means of security data access to the network;
- at least one configuration device (12) for writing a network specification and the security data to the at least one network key device (18);
- At least one, in particular a plurality of read-out devices (14) for reading the network specification and the security data from the network key means (18) for establishing a secure access to the network.

Description

The present invention relates to a communication system for providing access to a security-protected network, preferably a wireless connection, in particular a WLAN connection.

STATE OF THE ART

Communication systems, in particular wireless communication systems are becoming increasingly widespread as product diversity increases. A radio connection of stationary and mobile terminals to the local network in a company or a publicly accessible area offers new freedom in the use of networks and their services. Using a wireless connection can be an efficient substitute for expensive laying of cables.

With the communication systems, in particular the wireless communication systems, a gain in comfort and mobility can be offered. Wireless means that information can be transmitted between communication partners by means of electromagnetic waves such as radio or infrared light.

Wireless connections, for example, Wi-Fi connections, especially Wi-Fi hotspots nowadays are indispensable in everyday life. The development of public and private WLAN facilities is growing rapidly and is subsidized and promoted by the public sector. Mobile connectivity and Internet availability on mobile communication devices have grown into a high asset at all social levels.

A disadvantage of the prior art is so far that in wireless communication systems physical protection of a medium is missing, which can be provided with a line such as a cable, wire or optical fiber. Thus, provision of secure encryption of the communication system is necessary to maintain the confidentiality of exchanged information.

Furthermore, inefficient and non-user-friendly processes occur when connecting to a Wi-Fi network due to rapid development and increased connectivity needs. As a result of being connected to the Wi-Fi network in public areas such as public areas. A service set identifier (SSID) and a password can be manually entered into bars, restaurants or offices can result in a security risk, as knowing the password and the SSID can create an unwanted access to the WLAN network at any time. Thus, an unauthorized download or upload of illegal data, such as copyrighted content, may be performed by a network operator, which could prosecute the network operator.

In addition, it is very cumbersome to find and select a proper SSID and manually enter the appropriate password. In this case, the user must know and enter the password when accessing the network. If the password is asked and there are typos when entering the password, it is time consuming to establish a network connection.

Based on the aforementioned disadvantages of the prior art, it is an object of the invention to overcome the disadvantages of the known communication systems.

This object is achieved by a communication system, a configuration device, a network key device and a read device according to the independent claims. Advantageous developments of the invention are the subject of the dependent claims.

DISCLOSURE OF THE INVENTION

A communication system is proposed for providing access to a security-protected network, preferably a wireless connection, in particular a WLAN connection. The Wi-Fi connection can primarily provide access to the free Internet or a local network with secured content.

The communication system comprises at least one network key device for storing and providing encrypted security data, namely access data, in particular a password and a network specification, in particular a service set identifier (SSID), of the network, at least one network router as an access node to the network and for providing the security data secure access to the network, at least one configuration device for writing a network specification and the security data on the at least one network key device and at least one, in particular a plurality of readout devices for reading the network specification and the security data from the network key device for establishing a secure access to the network.

The present invention relates to a radio frequency reading technique, and more particularly to a communication system using a Read-out device for reading out a network key device. When providing access to a security-protected network, the network key device is provided on which access data formed by a password and a network specification are written and stored by means of a configuration device. The access data are read by the read-out device for establishing a network connection for a user as security data, thereby enabling data transmission, preferably contactless data transmission.

It is advantageous that a manual selection or inquiries of the network and input of the passwords is unnecessary, since the necessary information of the network, ie the network specification and the password are already written in the network key device, so that a network connection can be made autonomously in a few seconds , By simplifying a connection process, the network connections can be used more often and very comfortably and mobile data volumes can be saved.

It is furthermore advantageous that the readout device can be connected to the network in a comfortable and trouble-free manner for the user. In addition, undesired access connections to the network can be reduced to a minimum, since the network key device necessary for establishing a connection is located in its own premises. Thus, an undesirable and uncontrollable network load is avoided.

In a secondary aspect, the invention relates to a configuration device for use in the communication system according to the invention.

According to the invention, it is proposed that the configuration device comprise at least one configuration password input unit, at least one interface unit, preferably a wireless interface unit, in particular an NFC interface unit and at least one coding unit, wherein a network specification selection element and a security data input element are provided in the coding unit, so that the access data with the coding unit is encryptable to a security data packet. The configuration device enables a configuration process for writing a network specification of a network and its access data, i. H. SSID and password on the at least one network key device as security data, the configuration process being an integral part for providing encrypted security data on a network key device for network connection setup. During the configuration process, an owner can use the network specification selector element to select the network specification or SSID of the network from the environment, or manually enter its SSID, then set an appropriate password and enter it in the security data entry element, thus the network specification and password can be used by the encoding unit Data packet of security data to be encrypted.

For example, the network with an SSID "Ottos WLAN" and a password "Schnitzel123456" referred to as access data. These access data can be encrypted with the configuration device to form a data packet of security data "239234jdsok1230lk123k121d0i12k13012320k1213m121kjij12312". The user may use the configuration password input unit to provide a configuration password, e.g. enter a PIN for a reconfiguration process with respect to the network key device, wherein the security data of the network stored on the network key device can be changed as required by entering the specified configuration password by means of the configuration-password input unit.

Near Field Communication (abbreviated to NFC) is an international standard based on RFID technology for the contactless exchange of data by electromagnetic induction using loosely coupled coils over a short distance of a few centimeters and a maximum data transfer rate of 424 kBit / s allows.

In a further independent aspect, the invention relates to a network key device for use in the communication system according to the invention.

According to the invention, at least one memory unit, in particular a plurality of memory units, for storing at least one encrypted data packet of the security data and at least one interface unit protectable by means of a configuration password, preferably a wireless interface unit, in particular an NFC interface unit, are included in the network key device. A passive NFC tag may be provided as an NFC interface unit that can detect a network and establish an NFC connection. Furthermore, the encrypted security data representing access data with a network specification (SSID) and a matching password can be obtained by the NFC connection from a configuration device to the Network key device transmitted and stored on the memory unit.

In an advantageous development, the network key device can be reconfigured by entering the configuration password by means of the configuration device. The configuration password serves to reconfigure the network key device already configured by means of a configuration process at a later time. This allows the periodic or time-controlled password or SSID to be changed dynamically. In this case, security data of a network, which are stored in the network key device, changeable, so that, if desired, the access data namely an SSID and a password can be changed to ensure high network security.

Furthermore, an "NFC Data Exchange Format (NDEF)" record and an NDEF message can be created from a systematically encrypted security data packet. The fact that the network key device is checked, it is determined whether it is writable and non-password protected and there is sufficient space for the security data packet, so that the NDEF message can be stored on the network key device. This further assumes that the configuration password is set, so that it can be ensured that not all available network key devices, but only those which can be written with the configuration password, can store the security data packet. This makes it possible to selectively describe one group of network key devices with identical configuration password, while leaving another group unchanged, so that, for example, network key devices for two or more network routers can be sequentially described without physically physically disconnecting the network key devices.

In addition, in a further subsidiary aspect of the invention, a read-out device for use in the communication system according to the invention is proposed. The read-out device comprises an interface unit, preferably a wireless interface unit, in particular an NFC interface unit, for reading at least one security data packet from the network key device, at least one decoding unit for decrypting the security data packet in access data, a network selection unit for selecting the network identified by the network specification from the available networks within range and a network connection unit for establishing the network connection using the security data (SSID and Password). Thus, a read-out process is provided as a functionality in which the security data packet stored on the network key device is read out by the read-out device, analyzed, decrypted and used for network connection setup. Advantageously, the readout device may be a wireless network radio link, e.g. automatically activate a WLAN function of a terminal on which the readout device is institutionalized as SoftwareAPP and deactivate it again when the network connection is terminated.

A network connection can be made automatically for the user by means of a data exchange between the previously configured network key device and the read device without explicit involvement of a WLAN function and without manual selection of a WLAN network and without manual entry of an associated password. As a result, an effort to establish the network connection is significantly reduced.

During the read-out process, the network key device is first read out by means of the interface unit. Thereafter, the security data packet is decrypted by the decoding unit, wherein the decrypted access data can be referred to as SSID and password. For example, the data packet may be referred to as "239234jdsok12301k123k121d0i12k13012320k1213m 121kjij12312". With the decoding unit, the security data packet can be stored in an SSID such as e.g. "Otto's WLAN" and a password "Schnitzel123456" are decoded as access data.

Subsequently, all available networks within range can be scanned by the network selection unit and compared with the decrypted access data of the network. If there is a match between the available networks and the network stored on the network key device, the network connection unit can establish a network connection to the network.

In an advantageous development, a connection established by the network connection unit can be permanently separable by the read-out device. After the network has been used by the read-out device, the user can permanently disconnect the network connection. This will ensure that no unwanted access to the network can be established at a different time.

In a further advantageous embodiment, a time control unit for time-limited access and / or in the read-out device be provided limited time access attempt to the network. Advantageously, a time interval such as. eg be set by ten minutes. If, within the set time interval, the user is in an area not covered by the network, the access connection to the network will not be disconnected, so that no additional access attempt must be made to the network when the user returns to an area accessible to the network.

In a further advantageous development, the read-out device can be designed for wireless readout of the network key device within a spatial distance of not more than 4 cm, in particular between 2 and 3 cm. The readout device can be arranged in the vicinity of the network key device, wherein the distance to the network key device can preferably be 2 to 3 cm in order to transmit the security data contactlessly.

With the communication system, the security data packet of the network encrypted using the configuration password can be written to the network key device including password protection against an unwanted change and thus stored. With the communication system, it is also possible to analyze the security data packet and to decrypt it again in the access data consisting of the SSID and the password. This allows the secure network connection to be established with the network connection through the readout device, e.g. is permanently separable in a loss of connection connectivity and the temporarily stored access data are deleted in the readout device, so that at a later time an unsolicited access with the stored security data can no longer occur, if the currently existing connection is interrupted at least for an imagined time. This significantly improves the user experience.

list of figures

• 1 eine schematische Darstellung eines Kommunikationssystems;
• 2 eine schematische Darstellung einer Konfigurationsvorrichtung;
• 3 eine schematische Darstellung einer Auslesevorrichtung;
• 4 eine schematische Darstellung einer Netzwerkschlüsseleinrichtung;
• 5 eine Arbeitsablaufdarstellung eines Konfigurationsvorgangs;
• 6 eine Arbeitsablaufdarstellung einer Auslesevorgangs.

Further advantages emerge from the drawing and the associated description of the drawing. In the drawings, embodiments of the invention are shown. The drawing, the description and the claims contain numerous features in combination. The person skilled in the art will expediently also consider these features individually and combine them into meaningful further combinations. Show it:

• 1 a schematic representation of a communication system;
• 2 a schematic representation of a configuration device;
• 3 a schematic representation of a read-out device;
• 4 a schematic representation of a network key device;
• 5 a workflow representation of a configuration process;
• 6 a workflow representation of a readout process.

In the figures, the same or similar components are numbered with the same reference numerals.

1 represents a communication system 10 for providing access to a WLAN connection in which a configuration device 12 , a readout device 14 , a network router 16 and a network key device eighteen are included.

The network router 16 can be provided as an access node to a WLAN network, for example as a gateway to the Internet, so that a secured by means of security data access to the WLAN network can be provided. With the configuration device 12 For example, a network specification or a WLAN name and a password may be used as access data to the network key device eighteen are written as encrypted security data and stored there non-volatile, with the security data with the read-out device 14 can be read again and thus a secure access to the wireless network can be made.

In 2 is the in 1 shown configuration device 12 schematically illustrated, the one coding 20 , a configuration password input unit 30 and an NFC interface unit 26 includes. The coding unit 20 can with a network specification selector 22 and a security data entry element 24 be provided. The network specification selector 22 allows to select the network specification or WLAN name of the WLAN network from a local environment or to manually enter its SSID. The matching password can be entered in the security data entry element 24 can then be entered into the configuration password input unit by setting and entering the configuration password 30 this access data by means of the coding unit 20 are encrypted to a security data packet, wherein the security data of the WLAN network can be changed if necessary by entering the specified configuration password. As an NFC interface unit 26 can be a passive NFC tag in the communication system 10 be arranged, with which an NFC connection between the configuration device 12 and the network key device eighteen can be made, thereby the encrypted security data of the WLAN network on the network key device eighteen be stored. With the configuration device 12 becomes a configuration process 38 for writing the security data to the network key device eighteen allowing the configuration process 38 a prepending process is to store, modify, and provide user-accessible provision of the encrypted security data on a network key device eighteen serves for network connection setup.

In 3 is the in 1 illustrated readout device 14 shown a read-out 40 can perform. With an NFC interface unit 26 This can be done by means of the configuration device 12 generated security data packet from the network key device eighteen be read out. The read out safety data packet can by means of a decoding unit 32 be decrypted in access data of the WLAN network, so that the WLAN network according to its network specification or its WLAN name (SSID) by means of a network selection unit 36 can be selected from the available networks in range. This allows a network connection through a network connection unit 34 using the decrypted password of the Wi-Fi network.

In the 4 illustrated network key device eighteen includes a storage unit 28 and an NFC interface unit 26 , As an NFC interface unit 26 can be provided within a passive NFC tag that can be used to establish the NFC connection. During the configuration process 38 This can be done by means of the configuration device 12 encrypted security data packet using the NFC interface unit 26 detected and continue on the storage unit 28 be stored. During the read-out process 40 can remove the safety data packet from the storage unit 28 extracted and continue through the NFC connection to the readout device 14 be transferred.

In 5 is an embodiment of a configuration process 38 shown. A mobile communication device, eg notebook, smartphone, tablet or smartwatch can be used as a readout device 14 be used. First, the mobile communication device can scan all available WLAN networks in the field and an owner can select a network specification corresponding to the WLAN network. After that, the owner can set and enter a password of the Wi-Fi network and a configuration password as a PIN. The configuration password can be used to encrypt the network specification and the password to form a security data packet and to write to a network key device eighteen be provided. For this purpose, the mobile communication device can connect to a network key device eighteen This enables the encrypted security data packet to be sent to the network key device eighteen be transferred and thus stored.

In 6 is the readout process 40 shown, wherein a mobile communication device as a read-out device 14 can be trained. A user can use the mobile communication device a network key device eighteen scan and read a security data packet from access data of a WLAN network. By means of an interface unit 26 of the mobile communication device, the security data packet can be read out and analyzed. Subsequently, the safety data packet with a decoding unit 32 of the mobile communication device are decrypted in an SSID and a password as access data. The mobile communication device can scan all available wireless networks within range, then compare the available wireless networks with the decrypted SSID. With the same SSID, you can connect to the Wi-Fi network using a network connection unit 34 The connection can be made temporarily and permanently disconnected upon loss of network connectivity or after a predeterminable timeout. The loss of network connectivity can occur when the mobile communication device is physically removed from a reception range of the WLAN network, in which case the access data can be deleted immediately or after a predeterminable period of time, which can be stored in the security data. Also, a maximum online time can be coded as predeterminable time duration in the security data. Advantageously, a maximum period of network connectivity in the security data may be up to an automatic termination of the network connectivity, as well as a maximum period of interruption of the network connectivity due to leaving the reception area of the WLAN network until deletion of the access data in the security data of the network key device eighteen be deposited.

LIST OF REFERENCE NUMBERS

10

communication system

12

configuration device

14

readout device

16

Network router

18

Network key device

20

coding

22

Network Specification Selector

24

Safety data entry element

26

NFC interface unit, interface unit

28

storage unit

30

Configuration password input unit

32

decoding

34

Network connection unit

36

Network selection unit

38

configuration process

40

reading process

42

Timing unit

Claims (8)

Communication system (10) for providing access to a security-protected network, preferably a wireless connection, in particular a WLAN connection comprising: - at least one network key device (18) for storing and providing security data, in particular a password and a network specification, in particular a service set identifier (SSID), as access data to the network; - At least one network router (16) as an access node to the network and to provide the secured by means of security data access to the network; - at least one configuration device (12) for writing a network specification and the security data to the at least one network key device (18); - At least one, in particular a plurality of read-out devices (14) for reading the network specification and the security data from the network key means (18) for establishing a secure access to the network. A configuration device (12) for use in a communication system (10) Claim 1 characterized in that the configuration device (12) comprises at least one configuration password input unit (30), at least one interface unit (26), preferably a wireless interface unit, in particular an NFC interface unit and at least one coding unit (20), wherein in the coding unit (20) a network specification selection element (22) and a security data input element (24) are provided, so that the access data with the coding unit (20) can be encrypted into a security data packet. Network key means (18) for use in a communication system (10) Claim 1 , characterized in that in the network key means (18) at least one memory unit (28), in particular a plurality of memory units (28) for storing at least one encrypted security data packet of the access data and at least one protectable by means of a configuration password interface unit (26), preferably a wireless interface unit , in particular an NFC interface unit, are included. Configuration device (12) and network key device (18) according to Claim 2 and 3 , characterized in that the network key device (18) is reconfigurable by entering the configuration password by means of the configuration device (12). Readout device (14) for use in a communication system (10) Claim 1 , characterized in that the read-out device (14) has an interface unit (26), preferably a wireless interface unit, in particular an NFC interface unit, for reading at least one security data packet from the network key device (18), at least one decoding unit (32) for decrypting the security data packet Access data, a network selection unit (36) for selecting the network specified by the network specification from the available networks in range and a network connection unit (34) for establishing the network connection by means of the security data. Read-out device (14) according to Claim 5 , characterized in that a connection established by the network connection unit (34) is permanently separable by the read-out device (14). Read-out device (14) according to Claim 6 , characterized in that in the read-out device (14) is provided a time control unit (42) for time-limited access and / or time-limited access attempt to the network. Readout device (14) according to one of Claims 5 to 7 , characterized in that the read-out device (14) for wireless readout of the network key device (18) within a spatial distance of up to 4 cm, in particular between at most 2 to 3 cm, is formed.

Images