JP2006203480A - Network and network managing method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network where intrusion by a third person is hard to occur and to provide a managing method of the network. <P>SOLUTION: The network 10 is constituted of a plurality of communication terminals 100 to 102 which can communicate one another and one of communication terminal equipment becomes a management terminal 100. The management terminal 100 receives self-terminal information of the communication terminals 101 and 102 which participate in the network 10 by a first communication part of the management terminal 100. An information processing part of the management terminal 100 generates network structure information from self-terminal information. A coding/decoding part of the management terminal 100 codes network structure information. The first communication part of the management terminal 100 informs the communication terminals 101 and 102 participating in the network 10 of coded network structure information. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention includes a plurality of communication terminal devices (hereinafter referred to as “communication terminals”) that can communicate with each other, and one of the plurality of communication terminals is referred to as a management terminal device (hereinafter referred to as “management terminal”). In particular, the present invention relates to a network management method for preventing unauthorized intrusion into the network.

  In recent years, wireless networks are becoming popular not only in office environments but also in ordinary homes, taking advantage of the fact that wiring is not required and layout changes are easy, and in the future home networks using wireless Is also expected to be built. On the other hand, since radio uses radio waves as transmission paths, there are concerns about problems such as interception and tampering of information by third parties. In particular, when network information including network identification information or the like is intercepted, there is a risk of unauthorized entry into the network by a third party.

  As a countermeasure against eavesdropping and falsification of information in a wireless network, IEEE 802.11 defines data encryption. However, the communication data itself is encrypted, and the network configuration information such as the network identifier is not encrypted at present. Therefore, a third party can easily intercept the network configuration information, and the intercepted network configuration information has been used as a foothold for unauthorized intrusion and spoofing.

  Patent Document 1 describes a method of maintaining a network configuration by transmitting and receiving a network configuration terminal list when entering or leaving a wireless network.

JP 2000-307595 A

  However, in the conventional wireless network as described above, the object of encryption is the communication data body, and the network configuration information including the network identifier and the like is transmitted without being encrypted. There is a problem that it is easy to intercept the configuration information, and the intercepted network configuration information is used as a foothold for unauthorized intrusion into the network.

  Accordingly, the present invention has been made to solve the above-described problems of the prior art, and an object of the present invention is to provide a network and a network management method that are difficult to be illegally invaded by a third party.

  The network of the present invention is configured by a plurality of communication terminal devices that can communicate with each other, and one of the communication terminal devices is a management terminal device, and each of the communication terminal devices has its own terminal information. First communication means for transmitting and receiving, second communication means for transmitting and receiving a basic key, information storage means for holding the basic key, encryption / decryption means for performing encryption and decryption processing, and information processing means. Then, the management terminal device receives the own terminal information of the communication terminal device participating in the network by the first communication unit of the management terminal device, and the own terminal by the information processing unit of the management terminal device Network configuration information is generated from the information, the network configuration information is encrypted by the encryption / decryption means of the management terminal device, and the first communication unit of the management terminal device is encrypted. By and notifies the network configuration information the encrypted communication terminals participating in the network.

  The network management method according to the present invention includes a plurality of communication terminal devices that can communicate with each other, and one of the communication terminal devices serves as a management terminal device, and each of the communication terminal devices stores its own terminal information. A network having first communication means for transmitting / receiving, second communication means for transmitting / receiving a basic key, information storage means for holding a basic key, encryption / decryption means for performing encryption and decryption processing, and information processing means The management terminal device receives the own terminal information of the communication terminal device participating in the network by the first communication means of the management terminal device, and the management terminal device includes: A step of generating network configuration information from the terminal information by the information processing means of the management terminal device; and A step of encrypting the network configuration information by the encryption / decryption means of the management terminal device; and the management terminal device sends the network configuration information encrypted by the first communication means of the management terminal device to the network. And notifying a participating communication terminal device.

  According to the present invention, since the management terminal encrypts the network configuration information and notifies each communication terminal based on the basic key held by each communication terminal, even if a third party intercepts the network configuration information, Therefore, it is impossible to participate in the network because it cannot be performed, and there is an effect that it is possible to configure a safe network in which unauthorized intrusion by a third party hardly occurs.

  In addition, according to the present invention, a newly participating communication terminal obtains a basic key through a wired connection that allows the user to be surely safe against unauthorized access from a third party. Since the network configuration information is encrypted using the basic key without being leaked to a third party, a secure network can be constructed without the network configuration information being decrypted by a third party who does not hold the basic key. There is an effect that can be done.

  Furthermore, according to the present invention, since a communication terminal to participate in the network can be specified by the user's own judgment, there is an effect that it is possible to prevent an unauthorized device unintended by the third party or the user from entering the network.

Embodiment 1 FIG.
FIG. 1 is a diagram showing a configuration of a network according to Embodiment 1 of the present invention (that is, a network in which the network management method according to Embodiment 1 is implemented).

  As shown in FIG. 1, the network 10 includes communication terminals 100 to 102 that can communicate with each other. The network 10 is a wireless network that performs communication between communication terminals using radio waves or infrared rays. Although FIG. 1 shows the case where the network 10 is configured by three communication terminals, the number of communication terminals constituting the network 10 may be two, or four or more. There may be. The communication terminal may be, for example, a plurality of mobile phone devices, a plurality of personal computers (PCs), a combination of a PC and its peripheral devices, or a plurality of video devices (broadcast receivers, video recording devices, video displays). A plurality of communication devices having a wireless communication function. Furthermore, the communication terminals are configured to be able to directly communicate with each other without using an access point, for example.

  One of the communication terminals constituting the network 10 operates as a management terminal that manages the network configuration. In FIG. 1, the communication terminal 100 operates as a management terminal. The management terminal 100 manages participation of communication terminals in the network 10, exclusion of communication terminals from the network 10, and the like.

  The communication terminals 101 and 102 periodically transmit their own terminal information to the management terminal 100 based on network configuration information (details will be described later) periodically transmitted from the management terminal 100. In the first embodiment, the own terminal information periodically transmitted to the management terminal 100 includes an IP (Internet Protocol) address, a MAC (Media Access Control) address, a connection status with other communication terminals, and the like. It is. As shown in FIG. 1, each of the communication terminals 100 to 102 participating in the wireless network 10 holds a basic key 1 that is an encryption / decryption key. In transmitting the network configuration information in the first embodiment, the network configuration information is encrypted using the basic key 1 and then transmitted over the wireless network 10.

  In FIG. 1, a communication terminal 104 is a communication terminal that currently does not participate in the wireless network 10 but holds the basic key 1 for participating in the wireless network 10. Since the communication terminal 104 holds the basic key 1, it can receive and decrypt the encrypted network configuration information broadcast from the management terminal 100. Therefore, the communication terminal 104 can participate in the wireless network 10 with reference to the network configuration information.

  In FIG. 1, a communication terminal 105 is a communication terminal that does not hold the basic key 1 for participating in the wireless network 10. Since the communication terminal 105 does not hold the basic key 1, even if it receives the encrypted network configuration information broadcast from the management terminal 100, it cannot be decrypted. Therefore, the communication terminal 105 cannot refer to the network configuration information, and therefore cannot participate in the wireless network 10.

  The operation of the network according to the first embodiment (that is, the network management method according to the first embodiment) will be described below. The management terminal 100 receives the local terminal information broadcast from the communication terminals 101 and 102, and creates network configuration information of the wireless network 10 based on the received local terminal information. In the first embodiment, the own terminal information broadcast from the communication terminals 101 and 102 includes the own terminal MAC address, the own terminal IP address, the MAC address of the communication terminal with which the user can directly communicate, It is composed of information (communication destination MAC address and IP address) of the communication terminal in communication and other information. The network configuration information broadcast from the management terminal 100 includes a management version (management number information updated every time the network configuration information changes), a network ID, and management terminal information (the MAC address and the management terminal 100). IP address), communication terminal information participating in the wireless network (MAC address and IP address of the communication terminal), and other information.

  In FIG. 1, the management terminal 100 broadcasts the created network configuration information periodically (for example, once per second). At that time, the management terminal 100 encrypts the network configuration information using the basic key 1 and transmits the same by broadcast. For this reason, the communication terminal 105 that does not have the basic key 1 cannot decrypt the network configuration information even if it receives the encrypted network configuration information, and cannot participate in the wireless network 10. On the other hand, the communication terminal 104 that intends to newly join the network 10 has the basic key 1, and when joining the wireless network 10, the encrypted network configuration information that is broadcast from the management terminal 100. And can participate in the wireless network 10 by transmitting a request for participation in the wireless network 10 to the management terminal 100 based on the decrypted network configuration information (details will be described later). ).

  In the above description, the case where the self-terminal information broadcast from the communication terminals 101 and 102 is not encrypted has been described. However, the self-terminal information using the basic key 1 is the same as the network configuration information. May be configured to be encrypted and transmitted by broadcast.

  Next, the configuration of each communication terminal 100 to 102, 104, 105 in the first embodiment will be described. FIG. 2 is a diagram illustrating a configuration example of a communication terminal according to the present invention. As shown in FIG. 2, the communication terminal 120 includes a control unit 200, a first communication unit 210, a second communication unit 220, and an encryption / decryption unit 230. A communication terminal 120 in FIG. 2 corresponds to the communication terminals 100 to 102, 104, and 105 in FIG.

  As shown in FIG. 2, the control unit 200 includes an information processing unit 201 and an information storage unit 202.

  When the communication terminal 120 operates as the management terminal 100, the information processing unit 201 performs analysis processing of own terminal information transmitted from another communication terminal, creation of network configuration information, setting of an encryption / decryption key, and the like. Do. When the communication terminal 120 operates as the management terminal 100, the information storage unit 202 includes a program for operating as the management terminal, own terminal information, received own terminal information, generated network configuration information, and encryption / Stores and holds the decryption key and the like.

  When the communication terminal 120 operates as the communication terminals 101 and 102 other than the management terminal, the information processing unit 201 analyzes the network configuration information transmitted from the management terminal 100, creates its own terminal information, and encrypts / decrypts. Set the key. When the communication terminal 120 operates as the communication terminals 101 and 102 other than the management terminal, the information storage unit 202 includes a program for operating as a communication terminal other than the management terminal, received network configuration information, own terminal information, and Stores and holds encryption / decryption keys and the like.

  As shown in FIG. 2, the first communication unit 210 includes a first transmission unit 211 and a first reception unit 212. The first communication unit 210 is a communication interface for performing wireless communication with other communication terminals participating in the wireless network 10 in the wireless network 10. The first transmission unit 211 transmits network configuration information, own terminal information, and various data, and the first reception unit 212 receives network configuration information, own terminal information, and various data.

  As shown in FIG. 2, the second communication unit 220 includes a second transmission unit 221 and a second reception unit 222.

  When the communication terminal 120 is a communication terminal 104 that newly joins the wireless network 10, the second communication unit 220 allows the communication terminal that newly joins the wireless network 10 to share (acquire) the basic key 1. A communication interface connected to any of the communication terminals 100 to 102 already participating in the wireless network 10.

  When the communication terminal 120 is the communication terminals 100 to 102 that have already joined the wireless network 10, the second communication unit 220 causes the communication terminal 104 that newly joins the wireless network 10 to share the basic key 1 ( The communication interface is connected to the communication terminal 104 newly participating in the wireless network 10.

  In the first embodiment, a wired circuit (for example, wired Ethernet) is used as the second communication unit 220. This is due to the following reason.

  When the basic key 1 is shared in a wireless network, there is a risk of eavesdropping by a third party, and the basic key 1 may be leaked to the outside. When the basic key 1 is leaked to a third party, the third party can freely participate in the wireless network 10 and problems such as privacy leaks and information leaks occur. Therefore, in the first embodiment, the user can specify a communication terminal to participate in the wireless network 10 by his / her own determination using a wired Ethernet or the like (for example, by wired connection using an Ethernet cable). It is possible to prevent intervention by a person and wiretapping of the basic key 1.

  Note that the second communication unit 220, which is a communication interface for sharing the basic key 1, is not limited to the above-described interface circuit, and the user allows the communication terminal to participate in the wireless network 10 according to his / her own judgment. Other interfaces such as an IEEE 1394 interface for AV equipment may be used as long as the communication interface is difficult to leak the basic key 1 to the user.

  As shown in FIG. 2, the encryption / decryption unit 230 includes an encryption unit 231 and a decryption unit 232. The encryption unit 231 encrypts data communicated in the wireless network 10 shown in FIG. 1, and the decryption unit 232 decrypts encrypted data communicated in the wireless network 10 shown in FIG. The basic key 1 used for encryption and decryption is stored in the information storage unit 202 in the control unit 200 and set by the information processing unit 201.

  The operation of each communication terminal in the network according to Embodiment 1 will be described below.

  FIG. 3 is a network configuration diagram when the communication terminal 104 that does not participate in the network 10 and does not hold the basic key 1 acquires the basic key 1. In FIG. 3, as in the case of FIG. 1, the wireless network 10 includes communication terminals 100 to 102, and the communication terminal 100 operates as a management terminal. Each communication terminal 100 to 102 holds the basic key 1. In FIG. 3, when the communication terminal 104 acquires the basic key 1, it communicates with any second communication unit (second communication unit 220 shown in FIG. 2) of any communication terminal already participating in the wireless network 10. A second communication unit (second communication unit 220 shown in FIG. 2) of the terminal 104 is connected. In FIG. 3, the second communication unit of the management terminal 100 and the second communication unit of the communication terminal 104 are connected.

  FIG. 4 is a diagram illustrating a flow of operations for acquiring the basic key 1 and joining the wireless network 10 in the communication terminal 104 newly joining the wireless network 10. As shown in FIG. 4, first, the second communication unit 220 of the new communication terminal 104 is connected to the second communication unit 220 of the communication terminal 100 that has already joined the wireless network 10 (step S401). Next, the communication terminal 104 determines whether or not the basic key 1 can be acquired from the connected partner communication terminal 100 (step S402), and if it can be acquired, acquires the basic key 1 (step S403). If the basic key 1 cannot be acquired in step S402, the communication terminal 104 ends the new participation process with an error (step S411). The reason why it is determined that acquisition of the basic key 1 is impossible is that the connected partner communication terminal 100 does not participate in the wireless network 10 or the connected device has a function equivalent to that of the own communication terminal. For example (for example, a general communication device that is not a communication terminal).

  As a specific operation flow of key sharing, when the communication terminals are connected by the second communication unit 220, the terminal information of each other is exchanged. The terminal information includes basic information such as a MAC address and an IP address, and status information such as a participation status in a wireless network. If the terminal information cannot be exchanged, it is determined that the connected device is a general communication device that is not a communication terminal. If the terminal information can be exchanged, it is determined that the connected device is a communication terminal, and the status information included in the terminal information is referred to. As a result of referring to the status information, if the connected communication terminal has already participated in the wireless network 10, the basic key 1 is acquired, and if it has not participated in the wireless network 10, the process ends in error. In addition, as a result of referring to the status information, if the different basic keys are owned or the basic keys are not owned, the process ends in error.

  Next, the communication terminal 104 which acquired the basic key 1 in step S403 disconnects the connection with the other party communication terminal 100 by the 2nd communication part 220 (step S404). The communication terminal 104 receives the network configuration information periodically broadcast from the management terminal 100 in the wireless network 10 after disconnecting the connection with the counterpart communication terminal 100 (step S405). Next, the communication terminal 104 decrypts the received network configuration information using the basic key 1 acquired in step S403 (step S406). Next, the communication terminal 104 analyzes the decrypted network configuration information (step S407), and requests the management terminal 100 to participate in the network (step S408).

  3 shows an example in which the communication terminal 104 is connected to the management terminal 100 and the basic key 1 is acquired. However, if the communication terminal participates in the wireless network 10, for example, the communication terminal 101, The basic key 1 may be acquired by connecting to any one of 102.

  Next, the communication terminal 104 that has requested to join the network in step S408 receives a notice of permission to join the wireless network 10 from the management terminal 100 in the wireless network 10 (step S409). When the management terminal 100 recognizes participation in the wireless network 10, the communication terminal 104 operates as a communication terminal participating in the wireless network 10 (operation similar to the communication terminals 101 and 102). If the participation in the wireless network 10 is not permitted, the communication terminal 104 returns the process to step S405 and receives the network configuration information again. Note that the reason why the participation in the wireless network 10 is not permitted includes the reason that the communication status with other communication terminals in the wireless network 10 is poor.

  As a specific operation flow for determining whether to participate in the wireless network 10, the communication terminal 104 refers to the network configuration information periodically transmitted from the management terminal 100, and has already joined all the wireless networks 10. A test is performed to determine whether direct communication with the communication terminal is possible, and the result is transmitted to the management terminal 100. If the management terminal 100 determines that the communication terminal 104 can directly communicate with all the communication terminals already participating in the wireless network 10 based on the test result, the management terminal 100 permits participation in the wireless network 10. When there is at least one communication terminal that cannot communicate directly with the communication terminal 104 among the communication terminals participating in the wireless network 10, the management terminal 100 allows the communication terminal 104 to participate in the wireless network 10. Absent.

  FIG. 5 is a diagram illustrating an operation flow of the management terminal 100. As shown in FIG. 5, the management terminal 100 receives its own terminal information periodically transmitted from each of the communication terminals 101 and 102 participating in the wireless network 10 (step S501). Next, the management terminal 100 creates network configuration information based on the received own terminal information (step S502). Next, the management terminal 100 encrypts the created network configuration information using the basic key 1 (step S503). Next, the management terminal 100 broadcasts the encrypted network configuration information (step S504). The management terminal 100 repeats the above operation flow periodically (for example, once per second).

  FIG. 6 is a diagram illustrating an operation flow of the communication terminals 101 and 102 other than the management terminal. As shown in FIG. 6, communication terminals 101 and 102 other than the management terminal create their own terminal information (step S601), and broadcast the created own terminal information (step S602). Thereafter, the communication terminals 101 and 102 other than the management terminal receive the encrypted network configuration information periodically transmitted from the management terminal 100 (step S603), and use the received network configuration information using the basic key 1. To decrypt (step S604). The communication terminals 101 and 102 other than the management terminal analyze the decrypted network configuration information (step S605), and determine whether it is possible to continue to participate in the wireless network 10 (step S606). As a determination method, whether or not the own terminal information is included in the network configuration information can be cited. If it is determined that the communication terminals 101 and 102 other than the management terminal can continue to participate in the wireless network 10 (step S606), the process returns to step S601 to create own terminal information again.

  A specific operation flow for determining whether or not to continuously participate in the wireless network 10 includes the following flow. First, the communication terminals 101 and 102 refer to whether their own terminal information is included in the network configuration information periodically transmitted from the management terminal 100. The communication terminals 101 and 102 determine that continuous participation in the wireless network 10 is permitted by the management terminal 100 when the own terminal information is included. The communication terminals 101 and 102 determine that they are excluded from the wireless network 10 by the management terminal 100 when their own terminal information is not included in the network information, and the communication terminals 104 newly joining the wireless network 10 Similarly, the following operation is performed.

  When it is determined that the communication terminals 101 and 102 cannot continuously participate in the wireless network 10 (step S606), the communication terminals 101 and 102 request the management terminal 100 to participate in the wireless network 10 (step S607). As a result of the participation request, the communication terminals 101 and 102 receive a participation permission notification from the management terminal 100 to the wireless network 10 (step S608). If the communication terminals 101 and 102 are permitted to participate in the wireless network 10, the process returns to step S601 and creates own terminal information again. If the communication terminals 101 and 102 are not allowed to participate in the wireless network 10 in step S608, the communication terminals 101 and 102 receive network configuration information again (step S609). The communication terminals 101 and 102 decrypt the received network configuration information using the basic key 1 (step S610), and analyze the network configuration information (step S611). After analyzing the network configuration information, the communication terminals 101 and 102 return the process to step S607 and request the management terminal 100 to participate in the wireless network 10 again.

  When the wireless network 10 operates as the communication terminals 101 and 102 other than the management terminal, the above flow is periodically repeated.

  Next, the operation of the communication terminal 105 that does not hold the basic key 1 in FIG. 1 will be described. Since the communication terminal 105 does not share (hold) the basic key 1, even if it receives encrypted network configuration information periodically broadcast from the management terminal 100, the network configuration information cannot be decrypted. . Therefore, since the destination to which the request for participation in the wireless network 10 is transmitted is unknown, participation in the wireless network 10 is impossible. As an operation of the communication terminal 105, the user is notified that the basic key is not owned, for example, by blinking an LED.

  As described above, according to the network or the network management method according to the first embodiment of the present invention, the basic is based on the wired connection that allows the user to be surely safe against unauthorized access from a third party. Since the key 1 can be shared and the network configuration information is encrypted using the basic key 1, a secure network can be created without being decrypted by a third party who does not have the basic key 1. There is an effect that can be built.

  In addition, since a communication terminal to be newly joined to the wireless network 10 can be specified by the user's own judgment, there is an effect that it is possible to prevent a third party's intervention or unauthorized equipment unintended by the user from entering the network.

Embodiment 2. FIG.
FIG. 7 is a diagram showing a configuration of a network according to Embodiment 2 of the present invention (that is, a network in which the network management method according to Embodiment 2 is implemented).

  As shown in FIG. 7, the network 70 includes communication terminals 700, 701, and 702 that can communicate with each other. The network 70 is a wireless network that performs communication between communication terminals using radio waves or infrared rays. Although FIG. 7 shows a case where the network 10 is configured by three communication terminals, the number of communication terminals constituting the network 70 may be two, or four or more. There may be.

  One of the communication terminals constituting the network 70 operates as a management terminal that manages the network configuration. In FIG. 7, the communication terminal 700 operates as a management terminal. The management terminal 700 manages participation of communication terminals in the network 70, exclusion of communication terminals from the network 70, and the like.

  The communication terminals 701 and 702 periodically transmit own terminal information to the management terminal 700 based on the network configuration information periodically transmitted from the management terminal 700. In the second embodiment, the own terminal information periodically transmitted to the management terminal 700 includes an IP address, a MAC address, a connection status with other communication terminals, and the like. Further, as shown in FIG. 7, each of the communication terminals 700, 701, 702 participating in the wireless network 70 holds a basic key 7. When transmitting the network configuration information in the second embodiment, the network configuration information is encrypted using the basic key 7 and then transmitted over the wireless network 70.

  In FIG. 7, the communication terminal 703 is a communication terminal that does not currently participate in the wireless network 70 but holds the basic key 7 for participating in the wireless network 70. Since the communication terminal 703 holds the basic key 7, it can receive and decrypt the encrypted network configuration information broadcast from the management terminal 700. Accordingly, the communication terminal 703 can participate in the wireless network 70 with reference to the network configuration information.

  FIG. 8 is a diagram illustrating a communication flow between the management terminal 700 and the communication terminal 703 when the communication terminal 703 participates in the wireless network 70. In FIG. 8, the communication terminal 700 encrypts the network configuration information using the basic key 7 (step S800), and periodically broadcasts the encrypted network configuration information (step S801). The communication terminal 703 receives the network configuration information transmitted from the management terminal 700 (step S802), and decrypts the network configuration information using the basic key 7 (step S803). Next, the communication terminal 703 analyzes the decrypted network configuration information (step S804), and requests the management terminal 700 to participate in the wireless network 70 (step S805).

  When receiving the network participation request from the communication terminal 703 (step S806), the management terminal 700 generates a random number S and transmits it to the communication terminal 703 (step S807). Upon receiving the random number S (step S808), the communication terminal 703 generates a random number C obtained by encrypting the received random number S using the basic key 7 (step S809). Then, the communication terminal 703 transmits the random number C to the management terminal 700 (Step S810). The management terminal 700 receives the random number C (step S811), and decrypts the received random number C using the basic key 7 (step S812). Then, the management terminal 700 compares the decrypted random number C with the transmitted random number S (step S813). When the random number C and the random number S are equal to each other as a result of comparing the random number C and the random number S, the management terminal 700 determines that the basic key 7 is shared and transmits a participation permission notification (step S814). ). The communication terminal 703 receives the participation permission notification (step S815), and when permission to participate in the wireless network 70 is obtained, the wireless network 70 can communicate with other communication terminals thereafter.

  As described above, according to the network or the network management method according to the second embodiment of the present invention, the basic key 7 can be used as authentication information for the wireless network 70, and the basic key 7 is owned. Can prevent unauthorized third party intrusion. In addition, since entry of communication terminals having different basic keys can be eliminated, there is an effect that communication terminals can be grouped by basic keys.

  Further, according to the network or the network management method according to the second embodiment of the present invention, since complicated functions such as an authentication server for device authentication and a certificate authority for managing certificate issuance are not required, an application is also available. Since the CPU becomes simpler and a cheaper CPU can be used, and the program size is reduced, the capacity of the memory and the like can be reduced.

  In the second embodiment, points other than those described above are the same as those in the first embodiment.

Embodiment 3 FIG.
FIG. 9 is a diagram showing a communication flow in the network according to Embodiment 3 of the present invention. Hereinafter, a communication flow for newly generating an encryption key for data communication by using a basic key as key generation information will be described with reference to FIG. In FIG. 9, communication terminals 900 and 901 have already configured a network, and the communication terminal 900 operates as a management terminal. The communication terminals 900 and 901 share (hold) the basic key 9.

  As shown in FIG. 9, the management terminal 900 transmits a key generation start notification to the communication terminal 901 (step S1000), and the communication terminal 901 receives the key generation start notification (step S1001). Thereafter, the management terminal 900 generates a random number S (step S1002). In parallel with this, the communication terminal 901 generates a random number C (step S1003). Next, the management terminal 900 transmits the generated random number S to the communication terminal 901 (step S1004), and the communication terminal 901 receives the random number S (step S1005). The communication terminal 901 transmits the generated random number C to the management terminal 900 (step S1006), and the management terminal 900 receives the random number C (step S1007). Each of the communication terminals 900 and 901 generates the encryption key K using the shared random number S, random number C, and basic key 9 (step S1008).

  Next, the management terminal 900 generates a random number X and transmits it to the communication terminal 901 (step S1009). The communication terminal 901 receives the random number X (step S1010), and generates a random number Y obtained by encrypting the received random number X with the encryption key K (step S1011). Next, the communication terminal 901 transmits the random number Y to the management terminal 900 (step S1012). The management terminal 900 receives the random number Y (step S1013), and decrypts the random number Y using the encryption key K (step S1014). Then, the management terminal 900 compares the random number X and the random number Y (step S1015), and if the random number X and the random number Y are equal, transmits a key generation end notification to the communication terminal 901 (step S1016). The communication terminal 901 receives the key generation end notification (step S1017). Thereafter, the management terminal 900 and the communication terminal 901 can perform data encryption communication using the encryption key K.

  As described above, according to the network or the network management method according to Embodiment 3 of the present invention, the encryption key for data communication can be generated by using the basic key as the key generation information. Therefore, there is an effect that it is possible to prevent decryption of communication data other than the network configuration information for a communication terminal that owns the basic key but does not participate in the network.

  In addition, by properly using the encryption key for data communication and the basic key depending on the application, the same key is not used for a long time, so that the encryption key is hardly deciphered and the data confidentiality is improved. Further, the confidentiality can be further improved by periodically updating the data communication key.

  In FIG. 9, the random number S and the random number C are transmitted without being encrypted, but may be transmitted after being encrypted using the basic key 9.

  In the third embodiment, points other than those described above are the same as in the first embodiment.

  Furthermore, in the first to third embodiments, the case where wireless (IEEE802.11, UWB (ultra-wide band wireless), Bluetooth (infrared), infrared, optical wireless, etc.) is used as the network has been described. However, the present invention is not limited to this. However, the same effect can be obtained when applied to a network for connecting a wired network device (high-speed PLC (power line communication), C-Link (coaxial cable high-speed communication), etc.) using an electric light line or an RF line. Play.

It is a figure which shows the structure of the network which concerns on Embodiment 1 of this invention (network in which the network management method which concerns on Embodiment 1 is implemented). It is a figure which shows the structural example of the communication terminal in this invention. FIG. 3 is a network configuration diagram when a communication terminal that does not participate in a network and does not hold a basic key in Embodiment 1 acquires a basic key. In Embodiment 1, it is a figure which shows the flow of acquisition operation of the basic key in the communication terminal which newly participates in a wireless network, and participation operation to a wireless network. In Embodiment 1, it is a figure which shows the operation | movement flow of a management terminal. In Embodiment 1, it is a figure which shows the operation | movement flow of a communication terminal. It is a figure which shows the structure of the network (The network in which the network management method which concerns on Embodiment 2 is implemented) concerning Embodiment 2 of this invention. FIG. 10 is a diagram showing a communication flow in a network according to the second embodiment. It is a figure which shows the communication flow in the network which concerns on Embodiment 3 of this invention.

Explanation of symbols

1, 7, 9 Basic key, 10, 70 Network, 100, 700, 900 Management terminal, 101, 102, 701, 702, 901 Communication terminal, 104, 703 Newly participating communication terminal, 105 Basic key No communication terminal, 120 communication terminal, 200 control unit, 201 information processing unit, 202 information storage unit, 210 first communication unit, 211 first transmission unit, 212 first reception unit, 220 second communication unit, 221 second transmission , 222 second receiving unit, 230 encryption / decryption unit, 231 encryption unit, 232 decryption unit.

Claims (14)

In a network composed of a plurality of communication terminal devices that can communicate with each other, and one of the communication terminal devices is a management terminal device,
Each of the communication terminal devices includes a first communication unit that transmits and receives its own terminal information, a second communication unit that transmits and receives a basic key, an information storage unit that stores a basic key, and an encryption that performs encryption and decryption processing. / Decoding means and information processing means,
The management terminal device
Receiving the own terminal information of the communication terminal device participating in the network by the first communication means of the management terminal device;
Network configuration information is generated from the terminal information by the information processing means of the management terminal device,
The network configuration information is encrypted by the encryption / decryption means of the management terminal device,
The network characterized by notifying the encrypted network configuration information to the communication terminal devices participating in the network by the first communication means of the management terminal device. A communication terminal device newly participating in the network has the first communication means, the second communication means, the storage means, the encryption / decryption means, and the information processing means,
Communication by wired connection between the second communication means of the communication terminal apparatus that has already joined the network and the second communication means of the communication terminal apparatus to which the new participation is participating The network according to claim 1, wherein the basic key is acquired from a communication terminal device already participating in the network.   The own terminal information transmitted from the first communication means of the communication terminal apparatus holding the basic key is encrypted using the basic key by the encryption / decryption means of the communication terminal apparatus holding the basic key. 3. The network according to claim 1, wherein the network is self-terminal information. The communication terminal device other than the management terminal device is:
Receiving the encrypted network configuration information transmitted from the management terminal device by the first communication means;
Decrypting the network configuration information using the basic key by the encryption / decryption means;
Create new terminal information using the network configuration information decrypted by the information processing means,
The network according to any one of claims 1 to 3, wherein the new own terminal information is periodically transmitted to the management terminal device by the first communication unit.   The network according to any one of claims 1 to 4, wherein the notification of the encrypted network configuration information by the management terminal device is executed by periodic broadcast transmission.   The network according to any one of claims 1 to 5, wherein the communication terminal device already participating in the network uses the basic key as authentication information when newly joining the network. .   7. The communication terminal device according to claim 1, wherein the communication terminal device uses the basic key as key generation information for generating a data encryption key for encrypting communication data in the network. The network described in. A plurality of communication terminal devices that can communicate with each other, one of the communication terminal devices serves as a management terminal device, and each of the communication terminal devices transmits and receives its own terminal information, and a basic key A network management method in a network having second communication means for transmitting and receiving, information storage means for holding a basic key, encryption / decryption means for encryption and decryption processing, and information processing means,
The management terminal device receiving own terminal information of a communication terminal device participating in the network by the first communication means of the management terminal device;
The management terminal device generating network configuration information from the terminal information by the information processing means of the management terminal device;
The management terminal device encrypting the network configuration information by the encryption / decryption means of the management terminal device;
The management terminal device has a step of notifying the communication terminal device participating in the network of the encrypted network configuration information by the first communication means of the management terminal device. Method. A communication terminal device newly participating in the network has the first communication means, the second communication means, the storage means, the encryption / decryption means, and the information processing means,
Communication by wired connection between the second communication means of the communication terminal apparatus that has already joined the network and the second communication means of the communication terminal apparatus to which the new participation is participating The network management method according to claim 8, further comprising: acquiring the basic key from a communication terminal device already participating in the network.   The own terminal information transmitted from the first communication means of the communication terminal apparatus holding the basic key is encrypted using the basic key by the encryption / decryption means of the communication terminal apparatus holding the basic key. 10. The network management method according to claim 8, wherein the network management method is self-terminal information. The communication terminal device other than the management terminal device receiving the encrypted network configuration information transmitted from the management terminal device by the first communication means;
The communication terminal device other than the management terminal device decrypts the network configuration information using the basic key by the encryption / decryption means;
The communication terminal device other than the management terminal device creates new own terminal information using the network configuration information decrypted by the information processing means;
The communication terminal device other than the management terminal device includes a step of periodically transmitting the new own terminal information to the management terminal device by the first communication means. The network management method according to any one of the above.   12. The network management method according to claim 8, wherein the step of notifying the encrypted network configuration information by the management terminal device is executed by periodic broadcast transmission.   The network according to any one of claims 8 to 12, wherein the communication terminal device already participating in the network uses the basic key as authentication information when newly joining the network. Management method.   The communication terminal device uses the basic key as key generation information when generating a data encryption key for encrypting communication data in the network. The network management method described in 1.

Images