JP2005323149A - Wireless communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a safe wireless communication system that protects secret information, which should not be wiretapped, before ciphered communication against a 3rd person. <P>SOLUTION: A wireless terminal 2 makes a communication range narrow (S12) to transmit authentication data (2nd secret information) to a wireless base station (S13), a wireless base station 1 makes a communication range narrow to transmit a cipher key (secret information) to the wireless terminal 2 (S17), and the secret information and 2nd secret information are exchanged at a short distance to protect the 1st secret information and 2nd secret information against a 3rd person. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a wireless communication system with enhanced security in wireless communication.

  An example of a conventional wireless system is IEEE802.11b used for wireless LAN. IEEE802.11b is a standard for wireless communication between a single base station and a plurality of terminals using 2.4 GHz band radio waves. In this IEEE802.11b, an encryption technique “WEP” is used for the purpose of improving security. In WEP, before the wireless terminal and the wireless base station establish wireless encryption communication, the challenge response method is used to confirm that the shared encryption keys held by the base station and the terminal match each other. At the same time, the wireless terminal is authenticated because the shared encryption key matches. Establish encrypted communication. The outline of the challenge response method is as follows. First, the radio base station transmits a plaintext composed of random numbers to the radio terminal, the radio terminal converts the received plaintext using the shared encryption key, and sends the result back to the radio base station. Next, the wireless base station that has received the converted portion compares the plaintext obtained by decrypting the converted text with the transmitted plaintext, and authenticates the partner terminal if they match.

As another conventional wireless system, there is a technique having the configuration shown in FIG. 9 (for example, Patent Document 1). The wireless communication unit 305 has a feature that communication can be performed only at a short distance. Here, the information processing apparatus 300 can recognize the certification processing apparatus using the security-related data 306 and communicate with the certification processing apparatus only when the certification apparatus having the access right approaches the vicinity.
JP 2000-222289 A

  However, in the “WEP”, when a packet used in the challenge-response method is wiretapped by a third party, the secret shared key may be decrypted from the wiretapped packet. As a result, the encrypted packet may be decrypted by using the decrypted secret shared key and wiretapped.

  Further, according to the technique shown in Patent Document 1, since the wireless communication unit 305 is limited to a short distance, there is a low possibility that the authentication information is wiretapped, but the wireless communication unit 305 cannot communicate with a certification processing apparatus at a long distance. was there.

  The present invention solves the above-described conventional problems, and it is possible to perform encrypted communication at a long distance after performing communication at a short distance so that data before the encrypted communication is established is not eavesdropped. An object of the present invention is to provide a wireless communication system.

  In order to solve the above-described problems, in the wireless communication system of the present invention, a communication range adjusting unit capable of adjusting a communication range is provided in one or both of a wireless terminal and a wireless base station, and secret information that is not desired to be wiretapped. When communicating between a wireless base station and a wireless terminal, after narrowing the range in which the transmission radio wave reaches by the communication range adjustment means, secret information is exchanged in the vicinity, and then the transmission radio wave arrives by the communication range adjustment means Widen the range.

  With this configuration, it is possible to prevent eavesdropping of secret information by transmitting and receiving secret information that is not desired to be known to a third party within a very narrow communication reach.

  According to the wireless communication system of the present invention, it is difficult to eavesdrop on the secret information because the range in which the transmission radio wave reaches when transmitting the secret information is narrowed, and the transmission radio wave expands the range after the secret information is transmitted and received. Since information (secret information) that is not desired to be known by a third party is transmitted, it is impossible to eavesdrop on information that is not desired to be known by the third party from a remote terminal. In addition, even if a remote wireless terminal (= a third party who is not subject to encrypted communication) requests the wireless base station to establish encrypted communication, the radio wave from the base station is weak and cannot be received when establishing encrypted communication. The three parties cannot establish cryptographic communication with the base station.

  In addition, according to the wireless communication system of the present invention, both terminals can reduce the reach of radio waves when the other terminal transmits secret information and widen the reach of radio waves after transmitting and receiving secret information. The secret information is sent and received between them without eavesdropping.

  Also, according to the wireless communication system of the present invention, secret information can be automatically transmitted / received only by the wireless terminal approaching the other terminal.

  Embodiments of the present invention will be described below with reference to the drawings.

(Embodiment 1)
<Network configuration>
FIG. 1 is a network diagram of a wireless communication system according to the present embodiment. In FIG. 1, a wireless terminal 2 communicates with a terminal 3 via a wireless base station 1 and a network 4. Here, the wireless base station 1 is a wireless base station capable of wireless communication with the wireless terminal 2 and is connected to the network 4 by wire. The radio base station 1 can perform radio communication simultaneously with a plurality of radio terminals having functions equivalent to those of the radio terminal 2. In this embodiment, IEEE 802.11b will be described as a wireless communication method between the wireless terminal 2 and the wireless base station 1.

  The wireless communication method between the wireless terminal 2 and the wireless base station 1 is not particularly limited as long as it is a wireless communication method using radio waves. The wireless terminal 2 is a terminal that can wirelessly communicate with one wireless base station, such as a portable terminal (PDA) or a notebook computer (PC) having a wireless communication function. The terminal 3 is a terminal having a communication function, which is connected to the network 4 by a wired cable, and is, for example, a PC having an Ethernet (registered trademark) interface. The network 4 is a wired network and will be described as a public network such as the Internet in this embodiment.

<Configuration of radio base station>
Next, the configuration of radio base station 1 in the present embodiment will be described using FIG. The wireless base station 1 includes a first control unit 11, a first wireless communication unit 12, a wired communication unit 13, a first wireless range adjustment unit 14, a first encryption processing unit 15, and an authentication unit 16. .

  The first wireless communication unit 12 is a functional unit that communicates with a wireless terminal.

  The first communication range adjustment unit 14 is connected to the first wireless communication unit 12 and adjusts the transmission radio wave intensity of the first wireless communication unit 12 by adjusting the transmission power of the first wireless communication unit 12. It has a function.

  The wired communication unit 13 is a functional unit that is connected to the network 4 by, for example, an Ethernet (registered trademark) cable and performs wired communication with the terminal 3.

  The first encryption processing unit 15 holds an encryption key used for encrypted communication, and encrypts the data received from the first control unit 11 using this encryption key to the first control unit 11. It has a function of passing or decrypting data received from the first control unit 11 and passing it to the control unit. Here, in the present embodiment, description will be made using a shared encryption key as an example of an encryption key.

  The authentication unit 16 is a functional unit for authenticating a wireless terminal that has an authentication database 161 and permits communication with the wireless base station 1. Here, the configuration of the authentication database 161 will be described with reference to FIG. The authentication database 161 has a MAC address feed and an ID field for each entry. The MAC address is a MAC address assigned to the second wireless communication unit 22 included in the wireless terminal 2, and the ID is an identifier unique to the wireless terminal. The authentication database 161 stores, as one entry, a set of a MAC address and an ID of a wireless terminal permitted to communicate with the wireless base station 1.

  The first control unit 11 is connected to the first wireless communication unit 12, the wired communication unit 13, the first wireless range adjustment unit 14, the first encryption processing unit 15, and the authentication unit 16, and functions to control each unit. Part.

<Configuration of wireless terminal 2>
Next, the configuration of wireless terminal 2 in the present embodiment will be described using FIG. The wireless terminal 2 includes a second control unit 21, a second wireless communication unit 22, a second wireless range adjustment unit 23, an operation unit 24, a second encryption processing unit 25, and an authentication data holding unit 26. .

  The second radio communication unit 22 is a functional unit that communicates with the radio base station 1 by radio using the same radio scheme as the radio base station.

  The second communication range adjustment unit 23 is connected to the second wireless communication unit 22 and has a function of adjusting the radio field intensity by adjusting the transmission power.

  The operation unit 24 is a user interface held by the wireless terminal 2. For example, when the button is pressed, the operation unit 24 transmits a signal notifying the control unit 21 that the button has been pressed to the second control unit 21.

  In the present embodiment, the second encryption processing unit 25 receives an encryption key used for encrypted communication from the radio base station 1, encrypts the data received from the second control unit 21, and performs second control. It has a function of passing it to the unit 21 or decrypting the data received from the second control unit 21 and passing it to the second control unit 21.

  The authentication data holding unit 26 holds authentication data 261 (second secret information).

  The authentication data 261 is data used by the wireless base station 1 to authenticate whether the wireless terminal 2 is a communication partner.

  The configuration of authentication data 261 in the present embodiment is shown in FIG. The authentication data 261 includes a MAC address and unique information (ID) of the wireless terminal 2.

  The packet generation unit 27 is connected to the second control unit 21 and has a function of generating a plaintext packet and passing the generated packet to the second control unit 21.

  The second control unit 21 is connected to the wireless communication unit 22, the second wireless range adjustment unit 23, the operation unit 24, the second encryption processing unit 25, the authentication data holding unit 26, and the packet generation unit 27 to control each unit. It is a functional part to do.

<Message sequence>
Next, a sequence in the radio base station 1 and the radio terminal 2 will be described with reference to FIG.

  In the present embodiment, the wireless communication between the wireless base station 1 and the wireless terminal 2 includes Step 1 for exchanging information that is not desired to be intercepted and Step 2 for performing encrypted communication. Once Step 1 is successful, Step 2 is performed thereafter. In the present embodiment, information exchange that is not desired to be eavesdropped means that the authentication data (secret information) held by the wireless terminal 2 is transmitted to the wireless base station and the encryption key (secret information) held by the wireless base station 1 is wireless. Transmission to the terminal 2.

  In step 1, the wireless terminal 2 transmits authentication data 261 (secret information) to the wireless base station 1, and the wireless base station 1 matches the received authentication data 261 (secret information) with the data registered in the database. In this case, it is an exchange of information that is not desired to be wiretapped until the encryption key is transmitted to the wireless terminal 2 and the encryption key (secret information) is shared.

  Step 2 is encrypted communication between the wireless base station 1 and the wireless terminal 2 using the encryption key shared in Step 1.

  FIG. 4 is a message sequence diagram of messages exchanged between the radio base station 1 and the radio terminal 2 in the embodiment. The flow of processing will be described with reference to FIG.

  (S11) The operation unit 24 notifies the second control unit 21 that the button has been pressed.

  (S12) The second control unit 21 transmits a signal to the second communication range adjustment unit 23 so as to narrow the communication range, and the second communication range adjustment unit 23 decreases the transmission power.

  (S13) The second control unit 21 transmits the authentication data 261 (secret information) held by the authentication data holding unit 26 via the second wireless communication unit 22. At this time, the transmitted data is the radio wave weakened by the second communication range adjustment unit 23 earlier.

  FIG. 8 is a diagram illustrating a communication range between the radio base station 1 and the radio terminal 2 in the first embodiment.

  The base station short-range communication range 101 is a range where the transmission radio wave of the radio base station 1 reaches when the radio field intensity is weakened by the first communication range adjustment unit 14. Similarly, the base station long-range communication range 102 is a range in which the transmission radio wave of the radio base station 1 reaches when the radio wave intensity is increased by the first communication range adjustment unit 14. Furthermore, the terminal short-range communication range 103 is a range where the transmission radio wave of the wireless terminal 2 reaches when the radio field intensity is weakened by the second communication range control unit 23. The terminal short-range communication range 104 is a range in which the transmission radio wave of the wireless terminal 2 reaches when the radio wave intensity is increased by the second communication range adjustment unit 23. The wireless terminal X5 cannot wiretap radio waves transmitted in the base station short-range communication range 101 and the terminal short-range communication range 103.

  (S14) After transmitting the authentication data 261 (secret information) (S13), the second control unit 21 transmits a signal for expanding the communication range to the second communication range adjustment unit 23, and further the second communication range adjustment unit. 23 increases the transmission power.

  (S15) The first control unit 11 of the radio base station 1 passes the authentication data 261 (secret information) received from the first radio communication unit 12 to the authentication processing unit 16. The authentication unit 16 transmits a signal indicating successful authentication to the control unit when the authentication result is correct, or transmits a signal indicating authentication failure to the first control unit 11 when the authentication result is incorrect.

  Here, the authentication processing in (S15) will be described using the flowchart of FIG. 5 and the authentication database diagram of FIG.

<Authentication process>
(S151) The authentication unit 16 uses the first control unit 11 as confidential information. The authentication data 261 is received.

  (S152) Next, the authentication unit 16 searches the authentication database 161 from the received authentication data 261 (secret information), and searches for an entry that matches the MAC address field and ID field given in the authentication data 261. .

  (S153) As a result of the search, it is determined whether the authentication data 261 matches or does not match.

  (S154) If there is a matching entry as a result of the search, a signal indicating successful authentication is notified to the first control unit 11. In this embodiment, since the authentication data 261 and the second entry 1612 of the authentication database 161 match the MAC address and the ID, a signal indicating successful authentication is transmitted to the first control unit 11.

  (S155) As a result of the search, the authentication unit 16 discards the authentication data 261 (secret information) if the authentication database 161 and the authentication data 261 (secret information) do not match. Discard authentication data.

  (S156) After discarding the authentication data 261, the first control unit 11 is notified that the authentication has failed.

  As described above, the authentication process is performed.

  Now, the process flow will be described with reference to FIG.

  Here, the processing flow will be described with reference to FIG.

  (S16) When the first control unit 11 receives a signal of successful authentication from the authentication unit 16, the first control unit 11 transmits a signal to the first communication range adjustment unit 14 to narrow the communication range. The first communication range adjustment unit 14 weakens the transmission power of the first wireless communication unit 12.

  (S17) The first control unit 11 transmits the encryption key / cryptographic algorithm (secret information) held by the first encryption processing unit 15 to the first wireless communication unit 12, and the first wireless communication unit 12 The encryption key and encryption algorithm (secret information) held by the first encryption processing unit 15 are transmitted. At this time, since the data to be transmitted is a radio wave weakened by the first communication range adjustment unit 14 in S15, the radio wave reaches only the base station short-range communication range 101.

  If the wireless terminal 2 is far from the base station short-range communication range 101, the encryption key / cryptographic algorithm (secret information) does not reach the wireless terminal 2. Therefore, encrypted wireless communication between the wireless base station 1 and the wireless terminal 2 is not established. Again, step 1 must be repeated if encrypted communication is to be established.

  (S18) After transmitting the encryption key / cryptographic algorithm (S17), the first control unit 11 transmits a command signal for expanding the communication range to the first communication range adjustment unit 14, and the first communication range adjustment unit 14 The transmission power of the first wireless communication unit 12 is increased.

  (S19) The second control unit 21 of the wireless terminal 2 sets the encryption key / cryptographic algorithm (secret information) received from the second wireless communication unit 22 in the encryption processing unit.

  As described above, S11 to S19 is the information exchange in step 1 described above. When step 1 is completed, the wireless base station 1 and the wireless terminal 2 share the encryption key / cryptographic algorithm (secret information). Therefore, in step 2, encrypted communication can be performed using an encryption key and an algorithm.

  In addition, although S14 which expands a communication range is implemented after authentication data transmission (S13), as long as it implements before step 1, it may be implemented at any timing.

  Moreover, although S16 which narrows a communication range is implemented after an authentication process (S15), if it is implemented once before sending secret information, it may be any timing.

  In addition, the first communication range adjustment unit 14 and the second communication range adjustment unit 24 adjust the communication range by adjusting the transmission power of the wireless communication unit, but the transmission radio wave used by the wireless communication unit is modulated. The communication range may be adjusted by adjusting the degree.

  The secret information was an encryption key / encryption algorithm and authentication information. The plaintext composed of random numbers used in the challenge-response method, and the plaintext converted using the encryption key held by the wireless terminal You can also use sentences.

  Further, although the first secret information and the second secret information in Step 1 in Embodiment 1 are transmitted once, different secret information may be transmitted a plurality of times.

  Further, only secret information is exchanged in step 1, but information that may be intercepted other than secret information may be exchanged in step 1.

  One is a wireless terminal and the other is a wireless base station, but both may be wireless terminals.

  Further, when the user presses a button that is an operation unit, the communication terminal 2 narrows the communication range and transmits the authentication data 261 (secret information). Needless to say, the button is not particularly limited as long as it can accept the input.

  Further, the first radio communication unit 12 or the second radio communication unit 22 has a function of detecting that the received radio wave intensity from the counterpart terminal or the radio base station exceeds a certain threshold, and the received radio wave intensity is The operation of step 1 may be started when a certain threshold value is exceeded.

  The first wireless terminal according to the present invention has a communication range adjusting means and is useful as a wireless LAN access point or a wireless network card that communicates therewith. It can also be applied to applications such as a home network wireless authentication server or wireless control terminal for home appliances.

Network diagram of radio communication system according to Embodiment 1 of the present invention Configuration diagram of radio base station 1 of the radio communication system in Embodiment 1 of the present invention Configuration diagram of radio terminal 2 of the radio communication system in Embodiment 1 of the present invention The figure which shows the message sequence between the radio | wireless terminal 2 and the radio base station 1 of the radio | wireless communications system in Embodiment 1 of this invention. The flowchart in the authentication part 16 of the radio | wireless communications system in Embodiment 1 of this invention. The figure which clarified authentication database 161 of the radio | wireless communications system in Embodiment 1 of this invention The figure which clarified the authentication data 261 of the radio | wireless communications system in Embodiment 1 of this invention The figure which shows the communication range of the radio base station 1 and the radio | wireless terminal 2 of the radio | wireless communications system in Example 1 of this invention. 1 is a block diagram showing a configuration of a conventional information processing apparatus and an electronic circuit of a mobile computer of a storage medium storing a program used in the information processing apparatus

Explanation of symbols

1 wireless base station 2 wireless terminal 3 terminal 4 network 5 wireless terminal X
DESCRIPTION OF SYMBOLS 11 1st control part 12 1st wireless communication part 13 Wired communication part 14 1st communication range adjustment part 15 1st encryption process part 16 Authentication part 21 2nd control part 22 2nd wireless communication part 23 1st Second communication range adjustment unit 24 Operation unit 25 Second encryption processing unit 26 Authentication data holding unit 27 Packet generation unit 161 Authentication database 261 Authentication data 101 Base station short range communication range 102 Base station long range communication range 103 Terminal short range communication Range 104 Terminal telecommunications range 1611 First entry 1612 Second entry 1613 Third entry

Claims (8)

A wireless communication system in which a first wireless terminal and a second wireless terminal transmit and receive data wirelessly,
The first wireless terminal is
A first wireless communication unit for wirelessly communicating data;
A first communication range adjustment unit for adjusting a wireless communication range by the first wireless communication unit,
When communicating secret information with the second wireless terminal After adjusting the communication range of the first wireless communication unit by the first communication range adjustment unit, the secret information is transferred to the second wireless terminal. A wireless communication system characterized by transmitting. The second wireless terminal that communicates with the first wireless terminal; a second wireless communication unit that wirelessly communicates data; and
A second communication range adjustment unit for adjusting a wireless communication range by the second wireless communication unit,
The second wireless terminal is
When receiving the secret information from the first wireless terminal, the second communication range adjustment unit adjusts the communication range of the second wireless communication unit and transmits the secret information to the first wireless terminal. To do,
The wireless communication system according to claim 1. The first communication range adjustment unit or the second communication range adjustment unit adjusts a communication range by changing a transmission radio wave intensity of the first wireless communication unit or the second wireless communication unit;
The wireless communication system according to claim 1 or 2, wherein The first communication range adjustment unit or the second communication range adjustment unit adjusts the communication range by changing a modulation degree of a transmission radio wave of the first wireless communication unit or the second wireless communication unit. about,
The wireless communication system according to claim 1, wherein the wireless communication system is a wireless communication system. The first wireless terminal further accepts input from a user;
Having an operation unit that causes the first communication range adjustment unit to communicate secret information with the second wireless terminal;
The wireless communication system according to claim 1. The second wireless terminal further has a radio field intensity detecting means for detecting a transmission radio field intensity of the first wireless terminal,
2. The wireless communication system according to claim 1, wherein secret information is communicated with the second wireless terminal when the transmission radio wave intensity is equal to or less than a certain threshold value. The confidential information is
An authentication key for performing device authentication of the first wireless terminal and the second wireless terminal, an encryption key for performing encrypted communication between the first wireless terminal and the second wireless terminal, or Including both an authentication key and the encryption key;
The wireless communication system according to claim 1 or 2, characterized by the above. A wireless communication unit that communicates wirelessly;
A communication range adjustment unit for adjusting a wireless communication range by the wireless communication unit,
When communicating secret information with another wireless terminal, the communication range adjusting unit adjusts the communication range of the wireless communication unit, and then transmits the secret information to the other wireless terminal. .

Images