JP2012038102A - Communication terminal - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication terminal capable of establishing connection with security ensured.SOLUTION: An authentication processing unit performs authentication with a partner device on the basis of a first authentication system according to a first security level or a second authentication system according to a second security level higher than the first security level. When a connection processing unit receives a request for establishing service connection and the authentication with the partner device is performed, the connection processing unit establishes the service connection. When receiving a request for establishing connection of service of which authentication has been already performed on the basis of the first authentication system and to which the second security level is set, a connection control unit establishes the connection of the service to which the second security level is set, without performing authentication when a predetermined condition is satisfied.

Description

  Embodiments described herein relate generally to a communication terminal.

  In recent years, for example, Bluetooth (registered trademark) is known as a wireless communication technology that can be applied to a communication terminal such as a mobile phone. The communication terminal can transfer audio data to the opposite device such as a headset or in-vehicle device without using an audio cable by using Bluetooth wireless communication technology, or data communication using the communication terminal as a modem Can be done.

  As a specification when a communication terminal authenticates (pairs) with an opposite device using Bluetooth wireless communication technology, Bluetooth Specification version 2.1 + EDR (see Non-Patent Document 1) defined by Bluetooth SIG is known.

Bluetooth Specification version 2.1 + EDR (Bluetooth SIG)

  In Bluetooth Specification version 2.1 + EDR, an authentication (pairing) method called Secure Simple Pairing (SSP) is defined.

  In SSP, a security level can be set for each service (profile) executed using Bluetooth. For example, when it is necessary to connect after specifying the opposite device in order to increase confidentiality (security level), an authentication method that involves confirmation of the connection partner is employed. Further, when it is desired to simplify the connection procedure without requiring confidentiality, an authentication method that does not require confirmation of the connection partner is adopted. The “confirmation” in these authentications is performed using input and display means. For this reason, the authentication method that can be adopted by each device, that is, the security level, depends on the input / output capability of the device.

  Here, Bluetooth wireless communication technology is widely installed from devices having no input and display means such as headsets to devices having input and display means such as personal computers, mobile phones, and in-vehicle devices. For this reason, in the case of a device that does not have input and display means, such as a headset, an authentication method that involves confirmation of the connection partner cannot be adopted. In addition, services that require confidentiality such as voice communication and data communication executed on a mobile phone and services that involve billing require high security. However, when a mobile phone uses voice communication, there is an input device such as a headset if there is a device that has input and display means such as an in-vehicle device and can support an authentication method that involves confirmation of the connection partner. There are also devices that do not have a display means and are not compatible with an authentication method that involves confirmation of a connection partner.

  For this reason, when an authentication method that attaches importance to security and involves confirmation of the connection partner is adopted, there may be a case where connection cannot be made due to the input / output capability of the connection partner. On the other hand, if emphasis is placed on simplifying the connection procedure or adopting an authentication method that does not require confirmation of the connection partner due to the input / output capabilities of the connection partner, the procedure may be simplified but sufficient security may not be ensured. There is a case.

  In SSP, the operation in actual operation for solving such a problem is not defined. For this reason, it is necessary to consider an authentication method in which the input / output capability of the device and the contents of the service used are considered as parameters.

  Also, in SSP, in principle, even if authentication using any of the authentication methods has already been performed between devices, this authentication is set for a service for which a new connection request has been made. The specification is such that a connection is not established when authentication is based on an authentication method corresponding to a security level lower than the security level. In this case, each device needs to authenticate again using an authentication method according to the security level of the service for which the connection request is made. This has reduced the simplicity of connection processing, which is a feature of SSP.

  The present invention has been made in view of such circumstances, and an object of the present invention is to provide a communication terminal capable of establishing a secure connection.

  The communication terminal in the embodiment includes a wireless communication unit, an authentication processing unit, a connection processing unit, and a connection control unit. The authentication processing unit authenticates with the opposite device based on the first authentication method corresponding to the first security level or the second authentication method corresponding to the second security level higher than the first security level. Do. The connection processing unit establishes a service connection when a request for establishing a service connection is received or when authentication is performed with an opposite device. When the connection control unit has already been authenticated based on the first authentication method and receives a request for establishing a connection for a service with the second security level, the connection control unit satisfies the predetermined condition. Causes the connection processing unit to establish a connection for a service with the second security level without performing authentication based on the second authentication method.

The figure which shows the internal structure of the mobile telephone which is embodiment of the communication terminal which concerns on this invention. The sequence diagram explaining the registration process at the time of employ | adopting the authentication system by Numeric Comparison performed between a mobile telephone and an opposing apparatus. The sequence diagram explaining the registration process at the time of employ | adopting the authentication method by Just Works performed between a mobile telephone and an opposing apparatus. The flowchart explaining the 1st DUN connection establishment process performed with the mobile telephone in this embodiment. FIG. 5 is a sequence diagram for explaining processing between the mobile phone and the opposite device in the first DUN connection establishment processing of FIG. 4. 7 is a flowchart for explaining second DUN connection establishment processing executed by the mobile phone according to the present embodiment. FIG. 7 is a sequence diagram for explaining processing between the mobile phone and the opposite device in the second DUN connection establishment processing of FIG. 6. 10 is a flowchart for explaining third DUN connection establishment processing executed by the mobile phone according to the present embodiment. FIG. 9 is a sequence diagram for explaining processing between the mobile phone and the opposite device in the third DUN connection establishment processing of FIG. 8.

  An embodiment of a communication terminal according to the present invention will be described with reference to the accompanying drawings.

  FIG. 1 is a diagram showing an internal configuration of a mobile phone 1 which is an embodiment of a communication terminal according to the present invention.

  The transmission / reception antenna 11 transmits radio waves of the mobile communication system to which the mobile phone 1 corresponds, and receives radio waves of the mobile communication system to which the mobile phone 1 corresponds. The transmission / reception duplexer 12 includes a circulator, a duplexer, and the like, and transmits the radio wave received (received) by the transmission / reception antenna 11 to the wireless transmission / reception unit 13. In addition, the transmission / reception duplexer 12 sends the signal input from the wireless transmission / reception unit 13 to the transmission / reception antenna 11.

  The wireless transmission / reception unit 13 includes a band pass filter, a gain adjustment circuit, an A / D converter, and the like. The radio transmission / reception unit 13 receives a radio signal having a carrier frequency instructed from the control unit 21, mixes it with the local oscillation signal output from the frequency synthesizer, and converts the frequency into an intermediate frequency signal (down-conversion). The radio transmission / reception unit 13 orthogonally demodulates the down-converted intermediate frequency signal to generate a reception baseband signal.

  The signal processing unit 14 performs baseband processing on the reception baseband signal (reception baseband digital signal) output from the wireless transmission / reception unit 13. The data processing unit 15 includes, for example, a DSP (Digital Signal Processor) and converts the baseband signal that has been baseband processed by the signal processing unit 14 into data and voice. That is, the data processing unit 15 first separates the received packet data for each medium, and performs a decoding process on the separated data for each medium. Specifically, when the received packet data includes audio data, for example, the data processing unit 15 decodes the audio data using a speech codec. In addition, when the received packet data includes moving image data, the data processing unit 15 decodes the moving image data using a video codec. Furthermore, when the received packet data is download content, the data processing unit 15 expands the download content.

  The digital audio signal obtained by the decoding process is PCM decoded by the PCM codec 16, amplified by the reception amplifier 17, and output from the receiver 18. On the other hand, the digital moving image signal decoded by the video codec is supplied to the display unit 23 via the control unit 21 and displayed.

  The wireless transmission / reception unit 13 and the signal processing unit 14 perform a series of processing such as transmission baseband processing and wireless processing for transmitting communication data to a base station belonging to the mobile communication system.

  The Bluetooth communication unit 25 is an example of a wireless communication unit included in the mobile phone 1, and includes a module that performs wireless communication using Bluetooth (registered trademark). The Bluetooth communication unit 25 performs wireless communication with a counter device such as a headset or an in-vehicle device that exists in the vicinity of the mobile phone 1. The Bluetooth communication unit 25 operates based on the control of the control unit 21 when data is exchanged with the opposite device. The control unit 21 uses a communication protocol such as OBEX (Object Exchange), RFCOMM (RS232 Serial Cable Measurement Profile), SDP (Service Discovery Protocol), and A2DP (Advanced AudioD). , DUN (Dial-up Networking Profile) and other communications according to various profiles are comprehensively controlled. A2DP is a profile for transmitting sound to headphones. The HFP is a profile that realizes a hands-free call between the mobile phone 1 and the opposite device. DUN is a profile for dial-up connection to the Internet via a mobile phone or the like. Note that wireless communication other than Bluetooth (for example, infrared communication) may be used.

  The receiver 18 outputs the reception voice signal amplified by the reception amplifier 17 in a loud sound. The microphone 20 inputs a transmission voice signal and supplies it to the transmission amplifier 19. The operation unit 22 receives an instruction from the user. The display unit 23 displays an image based on the received data. In addition, the cellular phone 1 generates a predetermined operating power supply voltage Vcc based on the output of the battery and supplies it to each circuit unit, and a clock circuit (timer) for measuring the current time (both not shown) Is provided.

  The control unit 21 includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like. The CPU of the control unit 21 executes various processes in accordance with programs stored in the ROM or various application programs and control programs including the operating system (OS) loaded from the storage unit 27 into the RAM. Moreover, the control part 21 controls the mobile telephone 1 centrally by producing | generating various control signals and supplying it to each part. The RAM appropriately stores data necessary for the CPU to execute various processes.

  When performing communication control, the control unit 21 transmits / receives an antenna 11, a radio transmission / reception unit 13, a signal processing unit 14, a data processing unit 15, a PCM codec 16, a reception amplifier 17, a receiver 18, a transmission amplifier 19, a microphone 20, and the like. Controls communication processing using. On the other hand, the control unit 21 controls the UI processing using the operation unit 22, the display unit 23, the storage unit 27, a clock circuit (not shown), and the like.

  In the present embodiment, the control unit 21 particularly includes an authentication processing unit 31, a security level holding unit 32, a connection processing unit 33, and a connection control unit 34.

  The authentication processing unit 31 performs authentication (pairing) based on an authentication method corresponding to a predetermined security level.

  In the present embodiment, the authentication processing unit 31 performs pairing according to SSP (Secure Simple Pairing) conforming to Bluetooth Specification version 2.1 + EDR. The SSP has four types of authentication methods consisting of Numeric Comparison, Just Works, Out Of Band (OOB), and Passkey Entry. These authentication methods are selected according to the presence / absence of input / output means of the pairing device (in this case, the mobile phone 1 and the opposite device), or selected according to the security level of the service for which connection establishment is attempted.

  In the present embodiment, an example in which Just Works is applied as an example of the first authentication method corresponding to the first security level will be described. An example in which Numeric Comparison is applied as an example of a second authentication method corresponding to a second security level higher than the first security level will be described. In other words, Numeric Comparison is an authentication method with a higher security level than Just Works. Note that the authentication method in the present embodiment is an example, and for example, OOB or Passkey Entry may be applied to the second authentication method. Also, two or more security levels may be provided, and an authentication method corresponding to the security level may be used.

  The security level holding unit 32 holds security levels respectively set for a plurality of services executed using Bluetooth communication. The security level is set according to the contents of the service. For example, DUN is a profile for dial-up connection to the Internet via a mobile phone or PHS, and is a service that involves charging. The HFP is a profile for performing a hands-free call using a mobile communication system or the like, and is generally a service with charging. For this reason, it is preferable that high security is set for DUN and HFP. On the other hand, the security of A2DP is set lower than that of DUN or HFP due to the nature of service when compared with DUN or HFP. Note that the service (profile) described here is merely an example, and the security level of other services may be arbitrarily set by the contents of the service or the user.

  Further, the security level is determined in consideration of not only the nature of the service but also the input / output capability of the opposite device that uses the service. For example, there is a headset as an opposite device that performs a hands-free call by HFP with the mobile phone 1. This headset may not have input / output means. In such a case, the mobile phone 1 and the headset cannot perform authentication using an authentication method corresponding to a high security level. As a result, the security level of the authentication method used for establishing the HFP connection with the headset is inevitably low.

  The connection processing unit 33 receives a request for establishing a service connection from the opposing device, and establishes a Bluetooth communication connection with the opposing device when authentication is performed with the opposing device. Specifically, the connection processing unit 33 is opposed when the authentication processing unit 31 authenticates with the opposite device based on an authentication method corresponding to a security level higher than the security level set for the service. A service connection with the device is established.

  When the connection control unit 34 receives a request for establishing a connection of a service for which a second security level has already been set and the second security level has been authenticated based on the first authentication method. When the predetermined condition is satisfied, the authentication processing unit 31 causes the connection processing unit 33 to establish a service connection without performing authentication based on the second authentication method. The process performed by the connection control unit 34 is an exception to the process performed by the connection processing unit 33 described above. A plurality of predetermined conditions are prepared, and these conditions can be appropriately selected depending on the type of the opposite device and the service. Details of the predetermined condition will be described later.

  The storage unit 27 includes, for example, a flash memory element which is an electrically rewritable and erasable nonvolatile memory, an HDD (Hard Disc Drive), and the like, and various application programs executed by the CPU of the control unit 21 and various types And a control program and control data of the mobile phone 1 are stored. In the present embodiment, the storage unit 27 particularly includes a service history storage unit 35.

  The service history storage unit 35 stores services that have been established (authenticated) in the past with the counterpart device. Here, the connection is established. After the authentication process (SSP) in the lower layer on the Bluetooth side, the service connection (after L2CAP (RFCOMM) connection) in the upper layer on the host side (application, service side) is established. State. In the present embodiment, hereinafter, the fact that the authentication process is performed between the mobile phone 1 and the opposite device and the connection of the service is established is referred to as “service registration”.

  The mobile phone 1 according to the present embodiment has a service (profile) in which registration (authentication and service connection establishment) has been performed in advance, and is a service other than the registered service, which is more secure than an already registered service. Connection establishment processing when a connection request for a service with a high level is received is suitably performed. For example, a car navigation system as an opposite device uses services such as A2DP, HFP, and DUN using Bluetooth communication with the mobile phone 1. At this time, it is assumed that the mobile phone 1 and the opposite device have registered in advance to use A2DP and HFP, and have not yet performed registration to use DUN. For example, when the car navigation system issues a DUN connection request to the mobile phone 1, the mobile phone 1 needs to newly authenticate with the opposite device in order to use the DUN. In addition, as described above, when a connection with a service (here DUN) with a high security level is requested for the service currently connected (here A2DP, HFP), authentication based on an authentication method corresponding to the security level is performed. It needs to be done anew.

  Based on the above premise, when the mobile phone 1 in the present embodiment receives a service connection request from the opposite device, the requested service can be connected without performing new authentication under a predetermined condition. .

  In the following description, an example in which registered services are HFP, which is a profile for realizing a hands-free call between the mobile phone 1 and the opposite device, and A2DP, which is a profile for transmitting audio to headphones. To do. An example in which the service for which a connection request is made is a DUN that is a profile for dial-up connection to the Internet via a mobile phone or the like will be described.

  Further, it is assumed that the mobile phone 1 and the opposite device have services of HFP, A2DP, and DUN, respectively, and can use each service after a predetermined connection procedure based on a connection request.

  Note that the registration process and the various processes for connecting services described below are based on Bluetooth Specification version 2.1 + EDR (Bluetooth SIG), and thus detailed description thereof is omitted here.

  First, an authentication process using the second authentication method, Numeric Comparison, and the first authentication method, Just Works, and the subsequent connection establishment process for each service will be described.

  FIG. 2 is a sequence diagram for explaining a registration process in a case where an authentication method by Numeric Comparison executed between the mobile phone 1 and the opposite device is adopted.

  The authentication method by Numeric Comparison can be used when the opposite device has means for displaying a six-digit number and means for inputting “Yes” or “NO”. For example, an in-vehicle device such as a car navigation system or a personal computer is applicable.

  When registration processing occurs in the mobile phone 1, a counter device search request is generated. In step S1, the connection processing unit 33 searches the counter device using the Bluetooth communication unit 25. Here, registration processing for establishing a connection of A2DP and HFP with the opposite device has occurred. When one device is selected from the opposite devices searched based on the search result and a device registration request is made, the connection processing unit 33 requests connection to the opposite device selected by the Bluetooth communication unit 25 in step S2. I do.

  In step S <b> 3, the connection processing unit 33 confirms the presence or absence of a link key that has already been generated with the opposite device that has made the connection request. In the case of initial registration, since the link key has not been generated, it is determined that the link key has not been generated. In step S4, the connection processing unit 33 requests information regarding the presence / absence of input / output means of the opposing device (IO (Input / Output) Capability Req). On the other hand, in step S5, the opposite device notifies the mobile phone 1 of information regarding the presence or absence of input / output means of the opposite device (IO Capability Res). When using the authentication method by Numeric Comarison, it is necessary to have an output unit and an input unit. In this example, it is assumed that information indicating that the input / output means is present is notified to the mobile phone 1 from the opposite device.

  In step S <b> 6, the authentication processing unit 31 exchanges a public key generated at a predetermined timing by the Bluetooth communication unit 25. In step S7, the authentication processing unit 31 performs the authentication stage 1. This authentication stage 1 is a different phase depending on the authentication method. In the authentication stage 1 when the authentication method by Numeric Comparison is used, the authentication processing unit 31 displays a 6-digit number (from “000000” to “999999” on the display unit 23 of the mobile phone 1 and the display unit of the opposite device. ) To display to the user. Also, the authentication processing unit 31 asks the user whether the numbers displayed on both devices are the same. The authentication processing unit 31 causes both users of the mobile phone 1 and the opposite device to input “Yes” if the numbers displayed on both devices are the same, and “No” if they are different. In the mobile phone 1, an input is received via the operation unit 22. If “Yes” is input to both devices, the authentication processing unit 31 proceeds to the subsequent authentication processing, and if “No” is input to both devices or any of the devices, the authentication processing unit 31 fails authentication. .

  The authentication processing unit 31 performs the authentication stage 2 in step S8. The authentication stage 2 is a phase in which the authentication value newly calculated in the mobile phone 1 and the opposite device is confirmed. In addition, the authentication processing unit 31 calculates and encrypts the link key in step S9, thereby completing the authentication between the mobile phone 1 and the opposite device (step S10). Thereafter, the mobile phone 1 disconnects from the opposite device and enters a standby state.

  After the authentication processing by the authentication processing unit 31, the connection processing unit 33 proceeds to a registration (authentication) process for executing an HFP and A2DP service (profile) between the mobile phone 1 and the opposite device. When the service is activated in step S11, the connection processing unit 33 issues a connection request to the opposite device in step S12. In step S13, the connection processing unit 33 searches for an executable service of the opposite device. Here, it is assumed that the opposing device can execute at least HFP and A2DP services, and these services are active in the opposing device when the mobile phone 1 makes a connection request.

  The connection processing unit 33 connects HFP and A2DP in steps S14 and S15. Here, when services such as HFP are connected, the service history storage unit 35 stores these services as registered services.

  FIG. 3 is a sequence diagram illustrating a registration process when an authentication method by Just Works executed between the mobile phone 1 and the opposite device is adopted.

  The authentication method by Just Works can be used even when the opposite device does not have a means for displaying a 6-digit number and a means for inputting “Yes” or “NO”. For example, a device having no input / output means such as a headset is applicable.

  The authentication method by Just Works is different in only the authentication stage 1 in step S27 corresponding to the authentication stage 1 in step S7 in the authentication method by Numeric Comparison in FIG. Description of is omitted.

  In step S27, the authentication processing unit 31 performs the authentication stage 1. In the authentication stage 1 when the authentication method by Just Works is used, the authentication processing unit 31 performs the authentication stage 1 without making the user visually recognize a 6-digit number, unlike the authentication method by Numeric Comparison.

  Next, a DUN connection establishment process that is a process on the mobile phone 1 side when a DUN connection request is made from the opposite device after the registration process of FIG. 2 or FIG. 3 will be described. Here, DUN is a service that is not registered with the opposite device, and is a service that has a higher security level than HFP and A2DP, which are registered services. In other words, even if the HFP and A2DP have been registered, the mobile phone 1 generally requires authentication using the second authentication method according to the DUN security level in order to connect the DUN. And

  The mobile phone 1 has first to third DUN connection establishment processes. Each DUN connection establishment process has different conditions for determining whether or not a new authentication is required to establish a DUN connection when the DUN connection establishment process is performed. Hereinafter, description will be made sequentially with reference to flowcharts and sequence diagrams.

  FIG. 4 is a flowchart for explaining a first DUN connection establishment process executed by the mobile phone 1 in the present embodiment.

  FIG. 5 is a sequence diagram for explaining processing between the mobile phone 1 and the opposite device in the first DUN connection establishment processing of FIG.

  At the start of the first DUN connection establishment process, the cellular phone 1 is in a state of waiting for a service (for example, HFP, A2DP, DUN) connection request from the opposite device (step S51 in FIG. 5). Here, the opposite device performs a service search for the mobile phone 1 (step S52 in FIG. 5).

  In step S41 in FIG. 4, the mobile phone 1 activates HFP, A2DP, and DUN services (step S53 in FIG. 5). In addition, the cellular phone 1 receives a connection request for connecting the Bluetooth communication in the Bluetooth communication unit 25 (step S54 in FIG. 5). In step S <b> 42, the connection processing unit 33 determines whether or not it has a link key generated with the opposite device that has made the connection request. If it is determined that the connection processing unit 33 does not have a link key, the registration of FIG. 2 or FIG. 3 is required and the first DUN connection establishment process is terminated. That is, the mobile phone 1 establishes a connection with the opposite device according to a normal registration (authentication) procedure.

  When it is determined that the connection processing unit 33 has a link key (step S55 in FIG. 5), in step S43, the authentication processing unit 31 uses the link key to perform authentication processing with the opposite device according to a predetermined procedure. . In step S44, the mobile phone 1 accepts the DUN connection request transmitted from the opposite device in the Bluetooth communication unit 25 (step S67 in FIG. 5). Note that FIG. 5 shows processing when accepting connection requests for HFP, A2DP, and DUN, but the type of service that makes these connection requests and the processing based on the connection request are executed as necessary. is there.

  In step S45, when the connection control unit 34 receives a DUN connection request from the opposite device, the connection control unit 34 determines whether another service is connected to the requesting opposite device (FIG. 5). Step S68). Here, when other services are connected, for example, when the HFP is connected through the processing shown in steps S57 to 59 of FIG. 5, the A2DP is connected through the processing shown in steps S62 to S64. This is the case.

  Specifically, when an HFP connection request is made from the opposite device in step S57 in FIG. 5, the connection processing unit 33 of the mobile phone 1 refers to the service history storage unit 35 and the HFP has been registered in step S58. It is determined whether or not there is. That is, the connection processing unit 33 determines whether or not the registration process illustrated in FIG. 2 or 3 has been performed on the HFP. If it is determined that the HFP has been registered, the connection processing unit 33 sends an HFP connection establishment response to the opposing device in step S59, and the mobile phone 1 and the opposing device are in an HFP connection. On the other hand, if the connection processing unit 33 determines that the HFP has not been registered, the connection processing unit 33 sends an HFP connection rejection response to the opposite device in step S60. Thereafter, the opposite device disconnects from the cellular phone 1 (step S61).

  In addition, when an A2DP connection request is made from the opposite device in step S62 of FIG. 5, the connection processing unit 33 of the mobile phone 1 refers to the service history storage unit 35 in step S63 to determine whether or not A2DP has been registered. Judgment is made. If the connection processing unit 33 determines that A2DP has been registered, it sends an A2DP connection establishment response to the opposite device in step S64, and the mobile phone 1 and the opposite device are in the A2DP connection state. On the other hand, if the connection processing unit 33 determines that the A2DP has not been registered, the connection processing unit 33 sends an A2DP connection rejection response to the opposite device in step S65. Thereafter, the opposite device disconnects from the cellular phone 1 (step S66).

  If the connection control unit 34 determines that there is no other service being connected to the opposite device that has made the request in step S45 of FIG. 4, the process ends. In this case, since the mobile phone 1 establishes the DUN connection, it is necessary to perform authentication based on the authentication method corresponding to the DUN security level again as described above.

  On the other hand, if the connection control unit 34 determines that there is a service being connected to the opposite device that has made the request, in step S46, the connection processing unit 33 establishes a DUN connection. Specifically, the connection processing unit 33 sends a DUN connection establishment response to the opposite device in step S69 of FIG. 5, and the mobile phone 1 and the opposite device are in DUN connection. On the other hand, if the connection processing unit 33 determines that there is no service being connected, it sends a DUN connection rejection response to the opposite device in step S70. Thereafter, the opposite device disconnects from the cellular phone 1 (step S71). That is, the connection processing unit 33 establishes a DUN connection after performing authentication by an authentication method corresponding to the security level of the DUN as usual.

  The mobile phone 1 that executes the first DUN connection establishment processing can detect the opposite device when there is a service being connected even when a connection request is made from the opposite device for a service that requires authentication processing. Considered as a reliable device. As a result, the cellular phone 1 is connected to a service set with a higher security level (second security level) than that of the connected service during connection of a service set with a low security level (first security level), for example. When a connection request is accepted, it is possible to connect to the opposite device with a simple operation without requiring authentication according to the security level. Since the mobile phone 1 regards the opposite device as a reliable device due to the presence of the connected service, it is possible to ensure a certain level of security.

  The first DUN connection establishment process is particularly effective when the mobile phone 1 uses a simultaneous operation (Multi-Profile) of a plurality of services. For example, the mobile phone 1 and the in-vehicle device as the opposite device are generally HFP connected or A2DP connected while traveling. At this time, since it is a service that involves billing, when a DUN connection that is supposed to have a higher security level than HFP or A2DP is requested, new authentication processing is required in principle. At this time, an authentication method (second authentication method) corresponding to a high security level, for example, the Numeric Comparison shown in FIG. 2 that requires confirmation of a 6-digit number and input of the confirmation result is used for DUN. For this reason, there is a concern that authentication with an emphasis on security may be an adverse effect of safe driving for a traveling user. However, since the mobile phone 1 that performs the first DUN connection establishment process establishes the connection with the presence of the connected service, the connection can be established by a simplified method while ensuring security.

  Next, the second DUN connection establishment process will be described.

  FIG. 6 is a flowchart for explaining a second DUN connection establishment process executed by the mobile phone 1 in the present embodiment.

  FIG. 7 is a sequence diagram illustrating a process between the mobile phone 1 and the opposite device in the second DUN connection establishment process of FIG.

  Steps S81 to S84 (steps S91 to S97 in FIG. 7) in the second DUN connection establishment process of FIG. 6 are respectively steps S41 to S44 (steps S51 to S56 of FIG. 5) of the first DUN connection establishment process of FIG. , S67), the detailed description is omitted.

  In step S85 in FIG. 6, the connection control unit 34 determines whether or not there is at least one registered service with the opposing device that has made the connection request (step S98 in FIG. 7). Specifically, the connection control unit 34 determines whether any service is stored in the service history storage unit 35.

  Here, the service for which the presence / absence of registration is determined may be any service without particularly limiting the type of service. For example, if at least one service (HFP, A2DP, etc.) has been registered, it is determined in step S85 that a registered service exists. The types of services for which the presence / absence of registration is determined may be limited in advance. For example, when a predetermined service (for example, HFP) determined in advance has been registered, it is determined in step S85 that a registered service exists. Furthermore, the service for which the presence / absence of registration is determined may be a service associated with the service that has received the connection request. For example, if the HFP, which is a service associated with this DUN, has already been registered when determining whether or not a DUN can be connected, it is determined in step S85 that a registered service exists.

  If the connection control unit 34 determines that a registered service exists, the connection processing unit 33 establishes a DUN connection in step S86 (step S99 in FIG. 7). On the other hand, if the connection processing unit 33 determines that there is no service being connected, it sends a DUN connection rejection response to the opposite device (step S100 in FIG. 7). Thereafter, the opposite device disconnects from the cellular phone 1 (step S101).

  The mobile phone 1 that executes the second DUN connection establishment process, even when a connection request is made from the opposite device for a service that requires authentication processing, indicates that the opposite device is present because the registered service exists. Considered as a reliable device. Thereby, like the first DUN connection establishment process, the mobile phone 1 can connect to the opposite device with a simple operation without requiring authentication according to the security level.

  Next, the third DUN connection establishment process will be described.

  FIG. 8 is a flowchart for explaining a third DUN connection establishment process executed by the mobile phone 1 in the present embodiment.

  FIG. 9 is a sequence diagram illustrating a process between the mobile phone 1 and the opposite device in the third DUN connection establishment process of FIG.

  Steps S111 to S114 (steps S121 to S127 of FIG. 9) in the third DUN connection establishment process of FIG. 8 are respectively steps S41 to S44 (steps S51 to S56 of FIG. 5) of the first DUN connection establishment process of FIG. , S67), the detailed description is omitted.

  In step S115, the connection control unit 34 has been authenticated based on the request made from the mobile phone 1 to the opposite device with the opposite device that has made the connection request. It is determined whether or not (that is, authentication processing has been performed under the initiative of the mobile phone 1) (step S128 in FIG. 9). Specifically, the connection control unit 34 determines whether processing such as the connection request step S2 in FIG. 2 and the connection request step S22 in FIG.

  When the connection control unit 34 determines that the authentication is performed based on a request made from the mobile phone 1 to the opposite device, in step S116, the connection processing unit 33 establishes a DUN connection ( Step S129 in FIG. On the other hand, if the connection processing unit 33 determines that there is no service being connected, it sends a DUN connection rejection response to the opposite device (step S130 in FIG. 9). Thereafter, the opposite device disconnects from the mobile phone 1 (step S131).

  The mobile phone 1 that executes the third DUN connection establishment process has already performed the registration process under the initiative of the mobile phone 1 even when a connection request is made from the opposite device for a service that requires an authentication process. With what has been done, the opposing device was considered a reliable device. The registration caused by the connection request from the mobile phone 1 is made according to the intention of the user of the mobile phone 1. For this reason, it is unlikely that the opposite device that requested the connection is an opposite device that the user of the mobile phone 1 does not want to connect to, and it is possible to ensure a certain level of security and at the same time easily connect to the opposite device. it can.

  The mobile phone 1 that performs the first to third DUN connection establishment processes can simplify authentication (pairing) as much as possible in consideration of the security level of the service that has accepted the connection request.

  Further, depending on the presence / absence of the input / output means of the opposite device, authentication using an authentication method that ensures high security cannot be performed. For example, a device such as a headset that does not have an input / output unit cannot support the above-described Numeric Comparison and Passkey Entry. However, since the headset uses a service with a high security level such as HPF, ensuring a certain level of security is essential. On the other hand, the mobile phone 1 according to the present embodiment provides a certain level of security by applying the first to third DUN connection establishment processes described above even if the input / output capability is a counterpart device that does not support the authentication method. A secured connection can be established.

  Although several embodiments of the present invention have been described, these embodiments are presented by way of example and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, replacements, and changes can be made without departing from the scope of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalents thereof.

DESCRIPTION OF SYMBOLS 1 Mobile telephone 11 Transmission / reception antenna 12 Transmission / reception duplexer 13 Wireless transmission / reception part 14 Signal processing part 15 Data processing part 16 PCM codec 17 Reception amplifier 18 Receiver 19 Transmission amplifier 20 Microphone 21 Control part 22 Operation part 23 Display part 25 Bluetooth communication part 27 Storage unit 31 Authentication processing unit 32 Security level holding unit 33 Connection processing unit 34 Connection control unit 35 Service history storage unit

Claims (6)

A wireless communication unit that performs wireless communication with an opposite device and establishes connection of a plurality of services;
Authentication processing for performing authentication with the opposing device based on a first authentication method corresponding to a first security level or a second authentication method corresponding to a second security level higher than the first security level And
A connection processing unit that establishes connection of the service with the opposing device when the authentication processing unit authenticates with the opposing device when a request for establishing a service connection is received from the opposing device. When,
When a request for establishing a connection of a service for which authentication has already been performed with the opposite device based on the first authentication method and the second security level is set is received, a predetermined condition is satisfied. A connection control unit that establishes a connection of a service with the second security level set in the connection processing unit without performing authentication based on the second authentication method by the authentication processing unit when satisfying A communication terminal characterized by that. The connection control unit receives a request for establishing a connection of a service for which the second security level is set from the opposite device, and another service is currently connected to the opposite device that has made the request. 2. The communication according to claim 1, wherein, when the authentication processing unit does not perform authentication based on the second authentication method, the connection processing unit establishes connection of the service in which the second security level is set. Terminal. A service history storage unit for storing the service authenticated with the opposite device;
The authentication control unit connects the service to the connection processing unit without performing authentication based on the second authentication method by the authentication processing unit when at least one service is stored in the service history storage unit. The communication terminal according to claim 1, wherein the communication terminal is established. A service history storage unit for storing the service authenticated with the opposite device;
The authentication control unit, when a predetermined service is stored in the service history storage unit, connects the service to the connection processing unit without performing authentication based on the second authentication method by the authentication processing unit. The communication terminal according to claim 1 to be established. A service history storage unit for storing the service authenticated with the opposite device;
The authentication control unit performs authentication based on the second authentication method by the authentication processing unit when a service associated with the service that has received a request for establishing a connection is stored in the service history storage unit. The communication terminal according to claim 1, wherein the connection processing unit establishes the connection of the service without any connection. The connection control unit, when authentication based on a first authentication method performed with the opposite device is performed based on a request made from the communication terminal to the opposite device, the authentication The communication terminal according to claim 1, wherein the connection processing unit is allowed to establish connection of the service without performing authentication based on the second authentication method by the processing unit.

Images