JP2006121545A - Radio communication system, radio communication device and method therefor, and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a radio transmission path for keeping almost the same safety as a wire line network, by compensating vulnerability of WEP (Wired Equivalent Privacy) in which the key will be inferred if it is used for a long time. <P>SOLUTION: Encryption with a WEP key has vulnerability because the key will be guessed if the same key is used for a long time. But if it is said conversely, risk of decode can be easily avoidable by changing the WEP key at every fixed time interval. If unfair accesses are detected which exceed a number of prescribed threshold value, or if it goes over a lifetime set according to the setting of the WEP key, an access point drives a procedure for changing the WEP key automatically, or a warning is emitted for demanding the user to change the WEP key. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a wireless communication system, a wireless communication apparatus, a wireless communication method, and a computer for performing mutual communication between a plurality of wireless stations such as a wireless LAN (Local Area Network) or a PAN (Personal Area Network). In particular, the present invention relates to a wireless communication system, a wireless communication apparatus, a wireless communication method, and a computer program that perform communication operation on a wireless communication path that is almost as secure as a wired network.

  More specifically, the present invention relates to a wireless communication system, a wireless communication apparatus, and a wireless communication apparatus that perform wireless communication operation almost as secure as a wired network by encrypting a wireless transmission path using a WEP (Wired Equivalent Privacy) function. A wireless communication system that relates to a communication method and a computer program, and in particular, compensates for the WEP vulnerability that a key is guessed when used for a long time, and constructs a wireless transmission path that is almost as secure as a wired network, The present invention relates to a wireless communication apparatus, a wireless communication method, and a computer program.

  A wireless network has attracted attention as a communication system that releases users from cable wiring between devices in a wired manner. According to the wireless network, since most of the wired cables can be omitted in a work space such as an office, a communication terminal such as a personal computer (PC) can be moved relatively easily. In recent years, the demand for wireless LAN systems has increased remarkably with the increase in speed and cost. In addition, introduction of a personal area network (PAN) has been studied in order to construct a small-scale wireless network between a plurality of electronic devices existing around a person and perform information communication.

  Wireless networks have been dramatically improved in performance in conjunction with higher integration and lower power consumption of LSIs, and are widely used worldwide, and standardization is being promoted. In addition, wireless LAN devices have been reduced in price to the same extent as computer peripherals. Besides the traditional use of computer networks, connection of peripheral devices in offices and high stream quality between home information appliances in the home Utilization in various aspects such as video transmission is being attempted.

  Currently, different radio communication systems and radio communication apparatuses are defined using frequency bands that do not require a license from a supervisory government, such as 2.4 GHz band and 5 GHz band. As a standard for wireless networks, IEEE (The Institute of Electrical and Electronics Engineers) 802.11 (for example, refer to Non-Patent Document 1), HiperLAN / 2 (for example, Non-Patent Document 2 or Non-Patent Document) 3), IEEE802.15.3, Bluetooth communication, and the like. As for the IEEE802.11 standard, there are various wireless communication systems such as the IEEE802.11a standard, the IEEE802.11b standard, etc., depending on the wireless communication system and the frequency band to be used.

  Here, in a wired network, the security level is high because the cable is physically connected to a hub or the like, whereas in a wireless network, the transmission path is basically not directional, and if there is a wireless receiver, a third party can There is a problem that it is easily intercepted, and wireless communication cannot be used for transmission / reception of important data. For this reason, in the wireless LAN, security is achieved by using the following three mechanisms.

(1) Access control by MAC (Media Access Control) address (2) Access control by ESS-ID (Extended Service Set Identification) (3) Security using WEP (Wired Equivalent Privacy)

  The access control based on the MAC address is to register the MAC address of the wireless LAN terminal at the access point, and to eliminate access having other addresses (for example, refer to Patent Document 1). . However, since the MAC address flows through the wireless transmission path without being encrypted, once it is intercepted by a third party, “spoofing” is easily performed. In addition, ESS-ID enables communication only between a wireless LAN terminal and an access point having the same ESS-ID. However, if "ANY" is set in ESS-ID, communication with any access point is possible. As a result, security cannot be maintained.

  WEP is a function that encrypts a wireless transmission path using a common key encryption method and realizes security almost equivalent to that of a wired transmission path (see, for example, Patent Document 2). Established as an optional standard. Specifically, the lower 40 bits of a 64-bit sequence generated for each packet using a pseudo random number bit string generation function WEP PRNG (Pseudo-Random Number Generator) of RC (Rivet Cipher) 4 is used as an encryption key. There are also products that use 104-bit keys to increase security.

  However, with regard to the security of WEP, a vulnerability has been pointed out that it is relatively easy to guess the key used to encrypt consecutive packets. That is, in the encryption using the WEP key, the key can be decrypted if the same key is used for a long time.

  Since it takes some time to decrypt the WEP key, it is possible to prevent the decryption by changing the WEP key within a certain period of time. Even if the WEP key is decrypted, the WEP key is periodically changed. Therefore, the decrypted key cannot be decrypted and is safe.

  However, the change of the WEP key is left to the user management, and most users do not change the WEP key once set. For this reason, the WEP key is easily decrypted due to interception of the wireless transmission path.

  Further, a wireless communication system capable of performing data communication with high secrecy has been proposed (see, for example, Patent Document 3). However, since the secret key is changed every time transmission is performed, transmission is performed. There is a problem that the efficiency and the processing load of the transmission / reception device increase.

JP 2001-320373 A JP 2001-345819 A JP 2003-283480 A International Standard ISO / IEC 8802-11: 1999 (E) ANSI / IEEE Std 802.11, 1999 Edition, Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layers (PH) ETSI Standard ETSI TS 101 761-1 V1.3.1 Broadband Radio Access Networks (BRAN); HIPERLAN Type 2; Data Link Control (DLC) Layer; Part1: BasicControl ETSI TS 101 761-2 V1.3.1 Broadband Radio Access Networks (BRAN); HIPERLAN Type 2; Data Link Control (DLC) Layer; Part2: Radio Link Control (LC)

  An object of the present invention is to provide an excellent wireless communication system, wireless communication apparatus and wireless communication method, and computer program capable of performing communication operation on a wireless communication path almost as secure as a wired network. .

  A further object of the present invention is to provide an excellent radio communication system, radio communication apparatus, and radio that can perform a radio communication operation almost as secure as a wired network by encrypting the radio transmission path using the WEP function. It is to provide a communication method and a computer program.

  A further object of the present invention is to provide an excellent wireless communication system that can compensate for the weakness of WEP that a key is inferred if it is used for a long time and can construct a wireless transmission path almost as secure as a wired network. A wireless communication apparatus, a wireless communication method, and a computer program;

  The present invention has been made in consideration of the above-mentioned problems, and a first aspect thereof is a wireless communication system in which one or more communication stations perform communication operations on a wireless transmission path, and each communication station has a predetermined The wireless communication system is characterized in that encrypted data transmission using a secret key is performed, and a predetermined event on the wireless transmission path is monitored to manage a secret key change timing.

  However, “system” here refers to a logical collection of a plurality of devices (or functional modules that realize specific functions), and each device or functional module is in a single housing. It does not matter whether or not.

  In the wireless communication system according to the present invention, the change timing of the secret key is detected in response to the occurrence frequency or frequency of unauthorized access exceeding the predetermined value on the wireless transmission path. Alternatively, the change timing of the secret key is detected in response to the elapse of a predetermined period since the secret key used on the wireless transmission path was changed last time.

  In response to detecting the change timing of the secret key, the secret key is automatically changed, or in response to detecting the change timing of the secret key, the user is notified that the secret key should be changed. To be notified.

  According to the wireless network, most of the wired cables can be omitted in a work space such as an office, but if there is a wireless receiver, there is a problem that it is easily intercepted by a third party. It cannot be used for sending and receiving.

  In addition, the WEP function that encrypts the wireless transmission path using the common key encryption method and realizes almost the same security as the wired transmission path has been introduced, but the keys used for the encryption of consecutive packets are compared. Vulnerability that can be easily guessed is pointed out.

  On the other hand, in the wireless communication system according to the present invention, when the number of unauthorized accesses exceeding a predetermined threshold is detected in view of the fact that the risk of decryption can be easily avoided by changing the WEP key at regular intervals. Or, when the validity period set in accordance with the setting of the WEP key is exceeded, the access point automatically starts a procedure for changing the WEP key, or a warning is issued to the user. The change was urged.

  Therefore, according to the present invention, it is possible to compensate for the weakness of WEP that a key is guessed if it is used for a long time, and to construct a wireless transmission path that is almost as secure as a wired network.

According to a second aspect of the present invention, there is provided a computer program written in a computer-readable format so that a process for performing a communication operation on a wireless transmission path is executed on a computer system.
A data processing step of encrypting and decrypting transmission data to be transmitted and received using a secret key;
A secret key management step of monitoring a predetermined event on the wireless transmission path and managing a change timing of the secret key;
A computer program characterized by comprising:

  The computer program according to the second aspect of the present invention defines a computer program described in a computer-readable format so as to realize predetermined processing on a computer system. In other words, by installing the computer program according to the second aspect of the present invention in the computer system, a cooperative action is exhibited on the computer system, and it operates as a wireless communication device. By activating a plurality of such wireless communication devices to construct a wireless network, it is possible to obtain the same effects as the wireless communication system according to the first aspect of the present invention.

  According to the present invention, it is possible to provide an excellent wireless communication system, wireless communication apparatus and wireless communication method, and computer program capable of performing communication operation on a wireless communication path almost as secure as a wired network. .

  In addition, according to the present invention, an excellent wireless communication system, wireless communication device, and wireless communication operation that can perform a secure wireless communication operation almost equivalent to a wired network by encrypting the wireless transmission path using the WEP function, and A wireless communication method and a computer program can be provided.

  In addition, according to the present invention, excellent wireless communication that can compensate for the weakness of WEP that a key is guessed if it is used for a long time, and can construct a wireless transmission path almost as secure as a wired network. A system, a wireless communication apparatus, a wireless communication method, and a computer program can be provided.

  Other objects, features, and advantages of the present invention will become apparent from more detailed description based on embodiments of the present invention described later and the accompanying drawings.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  The communication propagation path assumed in the present invention is wireless, and a network is constructed between a plurality of communication stations. The communication assumed in the present invention is a storage and exchange type traffic, and information is transferred in units of packets.

  In the wireless network according to the present invention, in order to form a local area network, one device serving as a control station called “access point” or “coordinator” is provided in the area, and the control station is integrated. A method for forming a network under various control is used.

  FIG. 1 schematically shows a configuration example of a communication system to which the present invention is applied.

  The illustrated communication system includes a wireless network. In the example shown in the figure, the wireless network is operated by one access point, and one or more communication stations are placed under the communication range. In a wireless network where access points are arranged, when information is transmitted from a certain communication station, a bandwidth necessary for the information transmission is first reserved in the access point so that there is no collision with information transmission in other communication stations. In this way, an access control method based on bandwidth reservation that uses a transmission line is widely adopted. That is, by arranging access points, synchronous wireless communication is performed in which communication stations in a wireless network are synchronized with each other.

  For example, in networking in IEEE802.11, it is defined in an infrastructure mode in which an access point exists based on the concept of BSS (Basic Service Set).

  The access point collects a range where radio waves reach around its own station as a BSS, and constitutes a so-called “cell” in a so-called cellular system. A communication station existing in the vicinity of the access point is accommodated in the access point and enters the network as a member of the BSS. That is, the access point transmits a control signal called a beacon at an appropriate time interval, and a communication station capable of receiving this beacon recognizes that the AP exists in the vicinity, and further establishes a connection with the AP. Do.

  The communication stations around the access point can recognize the next beacon transmission time by receiving the beacon from the access point, so in some cases (when reception is not necessary), Alternatively, the receiver may be turned off to enter a sleep state until the beacon reception timing multiple times ahead.

  In the example shown in FIG. 1, the communication system includes a wired network. That is, the access point has a wired network interface and is interconnected with a communication device on an IP network (LAN) constructed by IEEE802.3 (Ethernet (registered trademark)) or the like.

  In the communication system according to the present embodiment, in order to avoid the problem of being easily intercepted by a third party in the wireless network and to realize a transmission path that is as secure as a wired network, security using the WEP function is provided. Applicable. Of course, access control (described above) using a MAC address or ESS-ID may be used in combination for improving the security of the wireless network.

  Network connection in a wired network corresponds to the work of physical connection of cables to the hub. On the other hand, in a wireless network, the association procedure between the access point and the communication station is replaced with a cable connection to the hub. Then, before the association, security is ensured by performing an optional authentication procedure.

  For example, in IEEE 802.11, this authentication procedure is defined as a shared key authentication procedure, and the access point and the communication station have a shared secret key (Shared Secret Key) that is a secret key in advance. A mechanism is realized in which the access point permits authentication and association to a specific communication station. The access point arbitrarily determines an initialization vector (Initialization Vector) and a secret key (Secret Key) at every authentication procedure. Then, the access point and the communication station respectively perform numerical operations for cryptographic processing using the initialization vector and the secret key as parameters according to the WEP algorithm.

  WEP encrypts the wireless transmission path using a common key encryption method and can realize almost the same security as the priority transmission path, but the key used for the encryption of consecutive packets is relatively easy. A vulnerability that can be speculated has been pointed out. That is, in the encryption using the WEP key, the key can be decrypted if the same key is used for a long time.

  Therefore, in the present embodiment, the access point (or communication station) changes the WEP key at a predetermined timing, thereby improving the security in the wireless network. For example, the following conditions can be set as the timing for changing the WEP key.

(1) When a connection log is taken at the access point and the number of unauthorized accesses exceeding the predetermined threshold is detected. (2) When the valid period is set when the WEP key is set and the valid period is exceeded.

  When any of the above conditions is met, the wireless network access point automatically initiates a procedure for automatically changing the WEP key, or issues a warning to prompt the user to change the WEP key. To do.

  FIG. 2 schematically shows a configuration example of a wireless communication apparatus that can enter a wireless network as an access point in the communication system according to the present embodiment.

  The illustrated wireless communication apparatus 10 includes a wired LAN processing unit 20, a wireless LAN processing unit 30, and a WEB server processing unit 40.

  The wired LAN processing unit 20 includes an Ethernet (registered trademark) controller 21 that controls a communication operation on a predetermined wired LAN protocol such as Ethernet (registered trademark).

  On the other hand, the wireless LAN processing unit 30 includes a wireless communication control unit 31, a MAC address / filter unit 32, and a WEP key management unit 33.

  The wireless communication control unit 31 controls the operation as an access point on the wireless network, for example, according to a communication protocol specified by IEEE 802.11. Specifically, the range in which radio waves reach around the local station is summarized as BSS, a control signal called a beacon is transmitted at an appropriate time interval, and a connection is established with a communication station that can receive this beacon. .

  In addition, the wireless communication control unit 31 sets a WEP key in the BSS, encrypts a wireless transmission path with a peripheral station that has established a connection by a common key encryption method, and realizes almost the same security as a wired transmission path. . Specifically, the lower 40 bits of a 64-bit sequence generated for each packet using a pseudo random number bit string generation function WEP PRNG (Pseudo-Random Number Generator) of RC (Rivet Cipher) 4 is used as an encryption key.

  The MAC address / filter unit 32 registers the MAC addresses of peripheral communication stations that have permitted the connection, and excludes access with other addresses, thereby ensuring security within the BSS.

  The WEP key management unit 33 manages the validity of the WEP key used in the wireless communication control unit 31. Regarding the security of WEP, a vulnerability has been pointed out that it is relatively easy to guess the key used for encrypting consecutive packets. That is, in the encryption using the WEP key, the key can be decrypted if the same key is used for a long time. Therefore, in the present embodiment, in view of the fact that the risk of decryption can be easily avoided by changing the WEP key at regular intervals, the WEP key management unit 33 has detected a number of unauthorized accesses exceeding a predetermined threshold. Or when the validity period set in accordance with the setting of the WEP key is exceeded, the access point automatically starts the procedure of changing the WEP key, or issues a warning to the user. To encourage changes.

  Protocol conversion is realized between the wired LAN processing unit 20 and the wireless LAN processing unit 30 by the Ethernet (registered trademark) / wireless bridge 50, and data can be exchanged between the wired LAN and the wireless LAN.

  The WEB server processing unit 40 sets and changes various parameters when operating as a WEB server. However, since the WEB server function itself is not directly related to the gist of the present invention, it will not be described further here.

  FIG. 3 is a flowchart showing an operation procedure for a wireless communication apparatus operating as an access point to perform connection processing with a peripheral communication station.

  First, it is checked whether the WEP key is correct (step S1). If the WEP key is correct, then it is checked whether or not the communication station has a registered MAC address (step S2). And if it is a registered MAC address, a connection process will be performed (step S3).

  On the other hand, if the WEP key is not correct (step S1), or if the MAC address has not been registered (step S2), an unauthorized access process defined separately is started (step S4).

  FIG. 4 shows the operation procedure of the unauthorized access process in step S4 in the form of a flowchart.

  Information regarding the detected unauthorized access is recorded as a log (step S11). If the number of unauthorized accesses exceeds a predetermined threshold value n (step S12), it is subsequently determined whether or not the WEP key should be automatically updated (step S13).

  When the WEP key should be automatically updated, a separately defined WEP key automatic update process is started (step S14). If the WEP key is not automatically updated, the user is notified that unauthorized access has occurred (step S15).

  FIG. 5 shows the operation procedure of the WEP key automatic update process in the form of a flowchart.

  First, it is checked whether all clients registered in the MAC filter are connected (step S21).

  If all clients are connected, the current WEP key is saved (step S22), a new WEP key is generated (step S23), and the generated key is notified to each client (step S24). Then, a separately defined WEP key registration process is started (step S25).

  On the other hand, if all after the client is not connected, a client that cannot be connected appears due to the update of the WEP key, but it is still determined whether or not the automatic update is performed (step S26). If it is determined that the WEP key should be automatically updated, the process proceeds to step S22, and a new WEP key is generated and registered as described above. If automatic updating of the WEP key is not performed, the subsequent processing is skipped and the entire processing routine is terminated.

  FIG. 6 shows the operation procedure of the WEP key registration process in the form of a flowchart.

  First, the expiration date of the WEP key is calculated based on the current time (step S31). Then, the WEP key is associated with the calculated expiration date and stored in the WEP key management unit 33 (step S32).

  FIG. 7 shows an operation procedure for checking the expiration date of the WEP key in the WEP key management unit 33 in the form of a flowchart.

  First, it is checked whether or not the expiration date of the WEP key has passed (step S41). Here, when the expiration date of the WEP key has elapsed, a separately defined WEP key expiration process is started (step S42).

  Then, the timer is started, and the function (thread) for checking the expiration date of the WEP key is set to sleep (or stopped) until the next check time is reached (step S43). If there is no request for termination of the expiration date check (step S44), the process returns to step S41 and the above-described processing is repeatedly executed.

  FIG. 8 shows an operation procedure for performing the WEP key expiration process in the form of a flowchart.

  First, it is checked whether or not the WEP key is automatically updated (step S51).

  When automatic updating of the WEP key is performed, a WEP key automatic updating process defined separately is started (step S52). Since the automatic update process of the WEP key is as described with reference to FIG. 5, the description is omitted here.

  If automatic updating of the WEP key is not performed, the user is notified that the effective prayer for the WEP key has already expired (step S53), and the entire processing routine ends.

  The present invention has been described in detail above with reference to specific embodiments. However, it is obvious that those skilled in the art can make modifications and substitutions of the embodiment without departing from the gist of the present invention.

  In the present specification, the embodiment in which the present invention is applied to a wireless network operated under the control of an access point has been mainly described, but the gist of the present invention is not limited to this. For example, the present invention can be similarly applied to an ad hoc, that is, an autonomous distributed wireless communication system having no relationship between a control station and a controlled station. Further, the present invention can be applied not only to a wireless network but also to a wired network.

  In short, the present invention has been disclosed in the form of exemplification, and the description of the present specification should not be interpreted in a limited manner. In order to determine the gist of the present invention, the claims should be taken into consideration.

FIG. 1 is a diagram schematically showing a configuration example of a communication system to which the present invention is applied. FIG. 2 is a diagram schematically illustrating a configuration example of a wireless communication apparatus that can enter a wireless network as an access point in the communication system according to the present invention. FIG. 3 is a flowchart showing an operation procedure for a wireless communication apparatus operating as an access point to perform connection processing with a peripheral communication station. FIG. 4 is a flowchart showing an operation procedure of unauthorized access processing. FIG. 5 is a flowchart showing an operation procedure of WEP key automatic update processing. FIG. 6 is a flowchart showing an operation procedure of WEP key registration processing. FIG. 7 is a flowchart showing an operation procedure for checking the expiration date of the WEP key. FIG. 8 is a flowchart showing an operation procedure for performing the WEP key expiration process.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Wireless communication apparatus 20 ... Wired LAN process part 21 ... Ethernet (trademark) controller 30 ... Wireless LAN process part 31 ... Wireless communication control part 32 ... MAC address filter part 33 ... WEP key management part 40 ... WEB server process 50: Ethernet (registered trademark) / wireless bridge

Claims (16)

A wireless communication system in which one or more communication stations perform a communication operation on a wireless transmission path,
Each communication station performs encrypted data transmission using a predetermined secret key,
Monitoring a predetermined event on the wireless transmission path to manage a secret key change timing;
A wireless communication system. Detecting the change timing of the secret key in response to the frequency or frequency of unauthorized access exceeding a predetermined value on the wireless transmission path;
The wireless communication system according to claim 1. Detecting the secret key change timing in response to the elapse of a predetermined period since the secret key used on the wireless transmission path was changed last time;
The wireless communication system according to claim 1. In response to detecting the change timing of the secret key, the secret key is automatically changed.
The wireless communication system according to claim 1. In response to detecting the change timing of the secret key, the user is notified that the secret key should be changed.
The wireless communication system according to claim 1. A wireless communication device that performs a communication operation on a wireless transmission path,
Wireless communication means for transmitting and receiving transmission data on the wireless transmission path;
Data processing means for encrypting and decrypting transmission data to be transmitted and received using a secret key;
A secret key management means for monitoring a predetermined event on the wireless transmission path and managing a change timing of the secret key;
A wireless communication apparatus comprising: The secret key management means detects the change timing of the secret key in response to the occurrence frequency or frequency of unauthorized access exceeding a predetermined value on the wireless transmission path;
The wireless communication apparatus according to claim 6. The secret key management means detects a change timing of the secret key in response to a lapse of a predetermined period since the secret key used on the wireless transmission path was changed last time;
The wireless communication apparatus according to claim 6. The secret key management means automatically changes the secret key in response to detecting the change timing of the secret key.
The wireless communication apparatus according to claim 6. In response to the fact that the secret key management means detects the change timing of the secret key, it further comprises notification means for notifying the user that the secret key should be changed,
The wireless communication apparatus according to claim 6. A wireless communication method for performing a communication operation on a wireless transmission path,
A wireless communication step of transmitting and receiving transmission data on the wireless transmission path;
A data processing step of encrypting and decrypting transmission data to be transmitted and received using a secret key;
A secret key management step of monitoring a predetermined event on the wireless transmission path and managing a change timing of the secret key;
A wireless communication method comprising: In the secret key management step, detecting the change timing of the secret key in response to the occurrence frequency or frequency of unauthorized access exceeding the predetermined value on the wireless transmission path,
The wireless communication method according to claim 11. In the secret key management step, a secret key change timing is detected in response to elapse of a predetermined period since the secret key used on the wireless transmission path was changed last time.
The wireless communication method according to claim 11. In the secret key management step, in response to detecting the change timing of the secret key, the secret key is automatically changed.
The wireless communication method according to claim 11. In response to detecting the change timing of the secret key in the secret key management step, further comprising notification means for notifying the user that the secret key should be changed,
The wireless communication method according to claim 11. A computer program described in a computer-readable format so as to execute processing for performing a communication operation on a wireless transmission path on a computer system,
A data processing step of encrypting and decrypting transmission data to be transmitted and received using a secret key;
A secret key management step of monitoring a predetermined event on the wireless transmission path and managing a change timing of the secret key;
A computer program comprising:

Images