JP2013009069A - Mobile communication system, mobile telephone terminal, data access point and method therefor, using usim proper information - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a mobile communication system, capable of preventing an illegal access from a malicious user, while saving a labor to register address information into the data communication access point side.SOLUTION: In a mobile telephone terminal, a data communication environment information report unit reads out USIM proper information, associated with a data access point identifier, from a USIM proper information readout unit, to report to a data access point. In the data access point, a USIM proper information collation unit collates the USIM proper information included in a communication frame. An address filtering unit performs address filtering by registering address information included in the successfully collated USIM proper information.

Description

  The present invention relates to a mobile communication system, a mobile phone terminal, a data communication access point, and their methods that simplify communication settings for short-range data communication using USIM specific information.

  With the recent enhancement of mobile phone terminals, the number of mobile phone terminals that have a short-range data communication function is increasing. In the future, the demand for replacement of mobile phone terminals is expected to increase rapidly.

  As the short-range data communication function, for example, there is a data communication function such as a non-contact IC card communication used for exchanging information of electronic money and a wireless LAN used for data communication within a specific area. The communication environment setting for these short-range data communication functions needs to be re-registered when a mobile phone terminal is replaced. For example, in the case of a wireless LAN, it is necessary to rewrite the MAC address (Media Access Control address) registered on the access point side to a new one. Since the operation of setting the communication environment is complicated, the communication environment information is conventionally stored in the SIM or USIM (Universal Subscriber Identity Module), and the setting is performed using the communication environment information stored in the SIM when the model is changed. There is an idea to automate the operation.

  In the non-contact communication using the interface of the non-contact IC card, the idea of simplifying the communication environment setting using the SIM or USIM is disclosed in Patent Document 1, for example. FIG. 10 is a diagram showing an outline of the communication system of Patent Document 1, and the idea will be briefly described.

  The communication system using the non-contact IC card interface disclosed in Patent Document 1 includes a mobile phone P and a reader / writer RW. In addition to the mobile phone function, the mobile phone P includes a non-contact function chip C, a control circuit 11, a non-contact communication antenna 12, a non-contact function chip socket 13, and the like. The reader / writer RW is an external device that performs wireless communication with the non-contact function chip C.

  The non-contact function chip C is realized by an IC card such as USIM or SIM, and when the mobile phone P is changed, it obtains device information from the new mobile phone P ′ and gives priority to the reader / writer RW. Set the communication protocol to be executed. By using the communication environment information stored in the SIM (USIM), it is possible to automatically set the priority order of a plurality of existing communication protocols to the optimum one.

JP 2006-33293 A

  By using the communication environment information stored in the SIM as in Patent Document 1, it is possible to select an optimal communication protocol and to increase the speed, efficiency, and optimization of communication. However, no contrivances have been made to the problems of individual identification of communication paths and encrypted communication. That is, the technique disclosed in Patent Document 1 is closed to the mobile phone P side, and nothing is applied to the reader / writer RW side. In the case of a wireless LAN, there is MAC address filtering for registering a MAC address on the access point side for personal identification of a communication path, which has a certain effect on unauthorized use. However, registration of the MAC address on the access point side is manual and complicated, and since it is technically possible to impersonate the MAC address, it is insufficient as a security measure.

  The present invention has been made in view of such a problem, and automates (simplifies) the communication path personal identification and encryption communication when changing the model of the mobile phone, and also for the personal identification of the communication path. Another object of the present invention is to provide a mobile communication system, a mobile phone terminal, a data communication access point using USIM specific information that can enhance safety, and a method thereof.

  The mobile communication system of the present invention comprises a mobile phone terminal connected to a mobile phone network and a data communication access point. The mobile phone terminal includes a data communication transmitting / receiving means for performing data communication with a data communication access point, a USIM card, a power-on detection unit, a USIM specific information reading unit, an identifier detection unit, and a data communication information notification unit. And. The power-on detection unit detects that the mobile phone terminal is turned on and outputs a power-on signal. The USIM specific information reading unit reads USIM specific information from the USIM card when a power-on signal is received. The identifier detection unit detects the identifier from the received signal received by the data communication transmitting / receiving means. The data communication information notification unit reads the USIM specific information corresponding to the identifier and the encrypted communication setting information from the USIM specific information reading unit, and notifies the data communication access point of the USIM specific information.

  The data communication access point includes an identifier output unit, a management table, a USIM specific information extraction unit, a USIM specific information matching unit, and an address filtering unit. The identifier output unit outputs its own identifier. The management table records USIM specific information and mobile phone terminals in association with each other. The USIM specific information extraction unit extracts USIM specific information from the reception information of data communication. The USIM unique information collating unit collates the USIM unique information with reference to the management table. The address filtering unit performs address filtering by registering address information included in the USIM specific information that has been verified.

  The mobile communication system of the present invention notifies the data communication access point of the USIM specific information written in the USIM card when the mobile phone terminal is turned on. The data communication access point collates the notified USIM specific information with known USIM specific information, registers address information included in the verified USIM specific information, and performs address filtering. That is, the mobile phone terminal and the data communication access point are paired with USIM specific information, and then address filtering is performed. As a result, when the user exchanges the model of the mobile phone terminal, the trouble of registering new address information on the data communication access point side can be saved, and pairing is performed using USIM specific information, so that unauthorized access from a malicious user can be avoided. Can be prevented.

The figure which shows the system structural example of the mobile communication system 1 using the USIM intrinsic | native information of this invention. The figure which shows the operation | movement sequence of the mobile communication system 1 using the USIM intrinsic | native information of this invention. The figure which shows the example of the data communication setting information table 1222. The figure which shows a MAC frame. The figure which shows the function structural example of the mobile telephone terminal 100,100 '. The figure which shows the operation | movement flow of the mobile telephone terminal 100. FIG. 2 is a diagram showing an example of a functional configuration of a data communication access point 200. FIG. The figure which shows the operation | movement flow of the data communication access point 200. The figure which shows the example of the management table 224. FIG. The figure which shows the outline | summary of the communication system of patent document 1. FIG.

  Embodiments of the present invention will be described below with reference to the drawings. The same reference numerals are given to the same components in a plurality of drawings, and the description will not be repeated.

  FIG. 1 shows a system configuration example of a mobile communication system 1 using USIM specific information of the present invention. The mobile communication system 1 includes a mobile phone terminal 100 and a data communication access point 200 connected to a mobile phone network. The mobile phone terminal 100 and the data communication access point 200 of the mobile communication system 1 are paired with USIM specific information. After pairing, the data communication access point 200 performs address filtering by registering address information included in the USIM specific information. As a result, it is not necessary to manually register the address information in the data communication access point 200, and the mobile phone terminal 100 is collated with the USIM specific information, so that unauthorized access from a malicious user can be prevented.

  Here, the USIM specific information is information such as a telephone number, an IMSI (International Mobile Subscriber Identity) number, a serial number, and address information. The IMSI number is a unique number all over the world. The address information is a physical address uniquely assigned to a hardware device that is set to identify each node on the network.

  FIG. 2 shows an operation sequence diagram of the mobile communication system 1 using the USIM specific information of the present invention. The operation sequence of the mobile communication system 1 will be described by taking as an example a case where the mobile phone terminal 100 and the data communication access point 200 are connected by a wireless LAN (IEEE802.11).

The cellular phone terminal 100 detects the power-on by using the power key pressing or the power supply voltage transient phenomenon when the power is turned on (step S121). When the cellular phone terminal 100 detects the power-on of itself, the cellular phone terminal 100 reads the USIM specific information and the setting information of the wireless LAN encrypted communication from the USIM card (step S122). The encrypted communication setting information is information on an encryption key and an encryption method associated with an SSID. The SSID (Service Set ID) is an ID for grouping wireless LAN connections. FIG. 3 shows setting information for encrypted communication.
In the case of a data communication access point that provides a public free connection service, the setting information is a user ID and password instead of the encryption key and encryption method information. That is, a plurality of data communication setting information is stored in a table format.

  The USIM card is an IC card that stores an IMSI number, which is a unique ID number for specifying a telephone number. When changing the model of a mobile phone terminal, the USIM card is attached to a new mobile phone terminal, thereby making it possible to move contractor information such as a phone number. The initial value of the setting information for encrypted communication is written from the mobile phone terminal 100 to the USIM card when the user manually inputs it to the mobile phone terminal 100 (step S1100).

  The cellular phone terminal 100 reads the USIM specific information and the setting information of the wireless LAN encrypted communication from the USIM card (step S122). The read encrypted communication setting information is stored in the RAM of the mobile phone terminal 100 or the like. Further, the information may not be lost even when the power is turned off, and the information may be stored in the data communication information storage unit in the mobile phone terminal 100 (step S1221). Even when the user changes the model of the mobile phone terminal, when the power is turned on for the first time after the USIM card 110 is mounted on the mobile phone terminal 100, the encrypted communication setting information is transferred from the USIM card to the mobile phone terminal 100 side. Is read out.

  Next, the cellular phone terminal 100 detects the SSID of the wireless LAN (step S123). When the SSID is detected, the encrypted information corresponding to the detected SSID is read, communication with the data communication access point 200 is started, and USIM specific information is notified to the data communication access point 200 (step S124). The USIM specific information is notified to the data communication access point 200 by a communication frame. A communication frame in the case of a wireless LAN is referred to as a MAC frame. FIG. 4 shows a MAC frame. The MAC frame is composed of a MAC header, Body, and FCS (Frame Check Sequence), and a MAC address that is address information is included in the MAC header. USIM specific information is added in the body of the MAC frame and transmitted.

  The data communication access point 200 checks whether or not the USIM specific information transmitted from the mobile phone terminal 100 is the same as the known USIM specific information. Register the MAC address in the MAC header of the frame. The data communication access point 200 performs address filtering (step S224) using the registered MAC address, and communicates with the mobile phone terminal 100 via a wireless LAN. Address filtering refers to communication only with a device having specific address information.

  As described above, whether or not the mobile phone terminal is a known mobile phone terminal is collated with the USIM specific information, and the data communication access point 200 registers the address information included in the MAC frame only when it is known. Therefore, it is possible to prevent malicious users from “spoofing” and to automate registration of address information to the data communication access point 200.

  Next, each apparatus which comprises the mobile communication system 1 of this invention is demonstrated.

[Mobile phone terminal]
FIG. 5 shows a functional configuration example of the mobile phone terminal 100 of the present invention. The mobile phone terminal 100 includes a USIM card 110, a function block 120, a control unit 130, a data communication transmitting / receiving unit 140, and a communication interface 150. The cellular phone terminal 100 includes a ROM (Read Only Memory) in which a program is stored, a storage device that stores the program and data, a CPU that executes the program, and a RAM that stores data used by the CPU. The means 130 realizes the function by controlling the operation procedure and operation timing of each function unit constituting the function block 120.

  The mobile phone terminal 100 is connected to the mobile phone network 5 via a mobile phone communication interface 150 and performs short-range data communication with the data communication access point 200 via the data communication transmitting / receiving means 140. The short-range data communication function is, for example, a wireless LAN, contactless IC card communication, or the like.

  The functional block 120 includes a power-on detection unit 121, a USIM specific information reading unit 122, an identifier detection unit 123, a data communication information notification unit 124, and a USIM writing unit 125. FIG. 6 shows an operation flow of these functional units. In the functional block 130, a display unit, an input unit, a voice processing unit, and the like included in a general mobile phone terminal are omitted. Further, the USIM writing unit 125 writes the information to the USIM card 110 when the user manually inputs the setting information of the encrypted communication, and the function that all the mobile phone terminals equipped with the conventional USIM card have. It is a block.

  The power-on detection unit 121 detects that the mobile phone terminal 100 has been powered on, and outputs a power-on signal to the USIM specific information reading unit 122 (step S121). The power-on is detected, for example, by pressing a power key (not shown).

  In response to the input of the power-on signal, the USIM specific information reading unit 122 reads the USIM specific information and the encrypted information from the USIM card 110 and stores them in the RAM (not shown) (step S122). The USIM specific information and the encryption information may be stored in the data communication information storage unit 1221 configured with a nonvolatile memory.

  The USIM unique information and the encryption information are stored in the RAM of the mobile phone terminal 100 as the data communication setting information table 1222 in association with the SSID in a table format in association with the SSID (FIG. 3).

  Next, the identifier detection unit 123 of the mobile phone terminal 100 detects the identifier of the short-range data communication from the received signal received by the data communication transmission / reception unit 140 and outputs the identifier to the data communication information notification unit 124 (step S123). ). In response to the input of the identifier, the data communication information notifying unit 124 searches the data communication setting information table 1222 read and stored by the USIM specific information reading unit 122 using the identifier, and the encryption method corresponding to the identifier Communication with the data communication access point 200 is started with the encryption key, and the address information included in the communication header of the communication frame is notified to the data communication access point 200 (step S124). At this time, the IMSI number of the USIM specific information is given to the Body part of the communication frame and notified.

  In addition, it is determined from the encrypted communication setting information stored in the data communication setting information table 1222 whether or not the data communication access point corresponding to the SSID is an access point providing a public free connection service. I can do it. The data communication information notifying unit 124 communicates with the data communication access point providing the public free connection service by replacing the user ID and password stored in the data communication setting information table with the IMSI number of the USIM specific information. This is given to the Body part of the frame and notified. In this way, the cellular phone terminal 100 can perform short-range data communication seamlessly with a plurality of data communication access points.

[Modification 1]
FIG. 5 shows an example of a functional configuration of the cellular phone terminal 100 ′ in which the power consumption of the data communication transmitting / receiving unit 140 is reduced by a broken line. The cellular phone terminal 100 ′ is different from the cellular phone terminal 100 in that the functional block 120 includes a GPS reception function unit 126 and an area detection unit 127.

  The GPS reception function unit 126 constantly receives positioning radio waves from GPS satellites and outputs the coordinate data of the mobile phone terminal 100 ′ to the area detection unit 127. The area detection unit 127 detects that the coordinate data has entered the service area of the data communication access point registered in advance, and starts the transmission / reception operation of the data communication transmission / reception means 140. Information on the service area of the data communication access point is stored in advance in, for example, the data communication setting information table 1222 in association with the identifier of the data communication access point.

  In the cellular phone terminal 100 ′, the data communication transmitting / receiving unit 140 operates only within the service area of the data communication access point, so that the power consumption of the data communication transmitting / receiving unit 140 can be reduced.

[Data communication access point]
FIG. 7 shows a functional configuration example of the data communication access point 200 of the present invention. The data communication access point 200 includes a functional block 220, a control unit 230, a data communication transmission / reception unit 240, and a communication interface 250. The data communication access point 200 includes a ROM (Read Only Memory) in which programs are stored, a storage device that stores programs and data, a CPU that executes these programs, and a RAM that stores data used by the CPUs. The control unit 230 controls the operation procedure and operation timing of each function unit constituting the function block 220 to realize the function.

  The data communication access point 200 is connected to the Internet 10 via the communication interface 250 and performs short-range data communication with the mobile phone terminal 100 via the data communication transmitting / receiving means 240. The short-range data communication function is, for example, a wireless LAN, contactless IC card communication, or the like.

  The functional block 220 includes an identifier output unit 221, a USIM specific information extraction unit 222, a USIM specific information matching unit 223, a management table 224, and an address filtering unit 225. The operation flow is shown in FIG. The identifier output unit 221 broadcasts its own identifier, for example, the SSID in the case of a wireless LAN, into the service area via the data transmission / reception means 240 (step S221). The USIM specific information extraction unit 222 receives the communication frame transmitted from the mobile phone terminal 100 via the data transmission / reception means 240 and extracts the USIM specific information from the communication frame (step S222).

  The USIM unique information matching unit 223 refers to the management table 224 with the IMSI number of the extracted USIM unique information, and checks whether there is a corresponding IMSI number (step S223). FIG. 9 shows a management table. The MAC addresses of the B terminal, C terminal, and D terminal shown in FIG. 9 are manually registered by the user in the data communication access point. The MAC address is address information in the case of a wireless LAN.

  The address filtering unit 225 registers address information extracted from the communication frame transmitted from the mobile phone terminal collated with the IMSI number in the management table 224, performs address filtering, and performs short-range data communication with the mobile phone terminal 100. (Step S225).

  If the mobile communication system 1 is configured using the mobile phone terminal 100 and the data communication access point 200 described above, the mobile phone terminal and the data communication access point are paired with the USIM specific information, and then address filtering is performed. Is done. Therefore, the trouble of registering address information on the data communication access point side can be saved, and unauthorized access from a malicious user can also be prevented.

[Modification 2]
FIG. 7 shows an example of a functional configuration of the data communication access point 200 ′ with further improved security against unauthorized access by a broken line. The data communication access point 200 ′ is different from the data access point 200 in that a communication end determination unit 226 is provided.

  The communication end determination unit 226 constantly monitors transmission / reception packets with the mobile phone terminal 100 and detects the end of the communication (see step S226, FIG. 8). The end of communication may be detected by a timer, for example. For example, the end of communication is detected by detecting that there is no exchange of communication packets on the communication path for 30 minutes. When the communication end is detected, the communication end determination unit 226 deletes the address information (MAC address) of the mobile phone terminal 100 from the management table 224 (step S227).

  Thus, by deleting the address information at the end of communication, it becomes possible to completely prevent unauthorized access from a malicious user thereafter, and further improve the safety of the mobile communication system.

In the above-described embodiment, the case where the data communication transmitting / receiving means is configured by a wireless LAN has been described. However, the technical idea of the present invention can also be applied when the data communication transmitting / receiving means is contactless IC card communication. .
When the processing means in each device described above is realized by a computer, the processing contents of the functions that each device should have are described by a program. Then, by executing this program on the computer, the processing means in each apparatus is realized on the computer.

  The program describing the processing contents can be recorded on a computer-readable recording medium. As the computer-readable recording medium, for example, any recording medium such as a magnetic recording device, an optical disk, a magneto-optical recording medium, and a semiconductor memory may be used. Specifically, for example, as a magnetic recording device, a hard disk device, a flexible disk, a magnetic tape or the like, and as an optical disk, a DVD (Digital Versatile Disc), a DVD-RAM (Random Access Memory), a CD-ROM (Compact Disc Read Only) Memory), CD-R (Recordable) / RW (ReWritable), etc., magneto-optical recording media, MO (Magneto Optical disc), etc., semiconductor memory, EEP-ROM (Electronically Erasable and Programmable-Read Only Memory), etc. Can be used.

  This program is distributed by selling, transferring, or lending a portable recording medium such as a DVD or CD-ROM in which the program is recorded. Further, the program may be distributed by storing the program in a recording device of a server computer and transferring the program from the server computer to another computer via a network.

  Each means may be configured by executing a predetermined program on a computer, or at least a part of these processing contents may be realized by hardware.

Claims (10)

A mobile communication system comprising a mobile phone terminal connected to a mobile phone network and a data communication access point,
The mobile phone terminal detects that the data communication transmitting / receiving means for performing data communication with the data communication access point, the USIM card, and the mobile phone terminal are turned on, and outputs a power-on signal. A power-on detection unit, a USIM specific information reading unit that reads USIM specific information from the USIM card when the power-on signal is received, an identifier detection unit that detects an identifier from a received signal received by the data communication transmitting / receiving unit, A data communication information notifying unit for reading USIM specific information corresponding to the identifier and setting information of encrypted communication from the USIM specific information reading unit, and notifying the USIM specific information to the data communication access point;
The data communication access point extracts an USIM specific information from an identifier output unit that outputs its own identifier, a management table that records USIM specific information and a mobile phone terminal in association with each other, and data communication reception information. A unique information extraction unit; a USIM specific information matching unit that matches the USIM specific information with reference to the management table; and an address filtering unit that performs address filtering by registering address information included in the USIM specific information that has been verified. And comprising
A mobile communication system. The mobile communication system according to claim 1.
The data communication access point further includes a communication end determination unit,
The communication end determination unit constantly monitors transmission / reception packets with the mobile phone terminal, and deletes the address information of the mobile phone terminal from the management table when the end of communication is detected. Communications system. The mobile communication system according to claim 1 or 2,
The data communication transmitting / receiving means is a wireless LAN transmitting / receiving means,
The mobile communication system, wherein the USIM unique information includes an IMSI unique number and a MAC address. The mobile communication system according to any one of claims 1 to 3,
The data communication information notifying unit determines from the encrypted communication setting information that the data communication access point provides a public free connection service, and notifies the data communication access point of a user ID and a password. A mobile communication system. The mobile communication system according to any one of claims 1 to 4,
The mobile phone terminal further includes a GPS reception function unit and an area detection unit, and the area detection unit is configured to read the coordinate information output by the GPS reception function unit and the data communication access read by the USIM specific information reading unit. A mobile communication system, wherein the data communication transmitting / receiving means is operated when it is detected that the mobile phone terminal has entered the service area of the data communication access point by comparing with the coordinate information of the point.   A data communication transmitting / receiving means for performing data communication with a data communication access point, a USIM card, a power-on detection unit for detecting that power is applied to the mobile phone terminal and outputting a power-on signal; A USIM specific information reading unit that reads USIM specific information from the USIM card when a power-on signal is received, an identifier detection unit that detects an identifier from a received signal received by the data communication transmitting / receiving means, and a USIM specific corresponding to the identifier A data communication information notifying unit for reading information and setting information for encrypted communication from the USIM specific information reading unit and notifying the USIM specific information to the data communication access point; Phone terminal.   An identifier output unit that outputs its own identifier, a management table that records USIM specific information and a mobile phone terminal in association with each other, a USIM specific information extraction unit that extracts the USIM specific information from received information of data communication, Data communication comprising: a USIM unique information collating unit that collates USIM specific information with reference to the management table; and an address filtering unit that performs address filtering by registering address information included in the USIM specific information that has been verified. access point. In the data communication access point according to claim 7,
A communication end determination unit that constantly monitors transmission / reception packets with the mobile phone terminal and deletes address information of the mobile phone terminal from the management table when the end of communication is detected is further provided. Data communication access point. A mobile communication method comprising a mobile phone terminal connected to a mobile phone network and a data communication access point,
The mobile phone terminal detects a power-on detection process in which the mobile phone terminal is turned on and outputs a power-on signal, and reads out USIM specific information from the USIM card when the power-on signal is received. The unique information reading process, the identifier detecting process for detecting the identifier of the data communication access point, the USIM specific information corresponding to the identifier and the setting information of the encrypted communication are read from the USIM specific information reading unit, and the USIM specific A data communication information notifying process for notifying information to the data communication access point,
The data communication access point associates an identifier output process for outputting its own identifier, a USIM specific information extraction process for extracting the USIM specific information from received information of data communication, and the USIM specific information and a mobile phone terminal. A USIM unique information collating process for collating with reference to the management table recorded, and an address filtering process for registering address information included in the USIM specific information that can be collated and performing address filtering.
A method for a mobile communication system. The method of mobile communication system according to claim 9,
The data communication access point is
It further comprises a communication end determination process of constantly monitoring transmission / reception packets with the mobile phone terminal and deleting the address information of the mobile phone terminal from the management table when the end of communication is detected. Mobile communication system method.

Images