JP2013207496A - Terminal device, receiving method, distribution device, distribution method, program, and distribution system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To distribute data to a plurality of terminal devices stably without using a wide transmission band.SOLUTION: In a distribution system which is a third aspect of the present disclosure, a distribution device comprises a transmission unit which encrypts data by using a group key for a group consisting of one or more terminal devices and transmits a packet including the encrypted data and having a group ID representing the group written therein to at least one of the terminal devices belonging to the group as the addressee. The terminal devices each include a holding unit which holds a group key corresponding to a group to which the terminal device concerned belongs, a receiving unit which receives a packet having a group ID written therein representing the group to which the terminal device concerned belongs and which was encrypted by the group key, irrespective of the addressee of the packet, and a decryption unit which decrypts the received encrypted data by using the group key which has already been acquired.

Description

  The present disclosure relates to a terminal device, a reception method, a distribution device, a distribution method, a program, and a distribution system, and in particular, a terminal device, a reception method, and a distribution device suitable for use when distributing the same data to a plurality of terminal devices. , A delivery method, a program, and a delivery system.

  Consider a system that distributes data such as content to a plurality of terminal devices by wireless communication. When a manufacturer's original wireless communication system is adopted for this system, it is expected that communication confidentiality can be enhanced and the transmission capacity can be widened. However, on the other hand, the cost becomes high, and in order to reduce the cost, a wireless communication technology such as IEEE802.11 that is widely used is often adopted.

  IEEE802.11 defines unicast communication in which data is transmitted from the transmission side to one reception side and multicast communication in which data is transmitted from the transmission side to a plurality of reception sides simultaneously (for example, , See Patent Document 1).

  In unicast communication, when the receiving side has received the packet correctly, ACK is notified to the transmitting side, so that the transmitting side can retransmit the packet when ACK is not notified. Thereby, in unicast communication, data loss can be suppressed. However, as the number of reception sides increases, the transmission band to be used increases, so the number of reception sides is substantially limited.

  On the other hand, in multicast communication, the same data can be simultaneously distributed to a plurality of receiving sides using a single transmission path, and the number of receiving sides is not limited. However, even if the receiving side cannot correctly receive the packet (data), the transmitting side cannot know the packet (data), so that a packet having a communication error as in unicast communication is not retransmitted. Therefore, when trying to suppress a communication error, the transmission side sets a lower modulation rate, so the data transmission rate cannot be increased.

JP 2006-129041 A

  As described above, unicast communication and multicast communication have their merits and demerits, and in any case, they are suitable for applications that stably distribute data to a large number of receiving sides without using a wide transmission band. Is hard to say.

  The present disclosure has been made in view of such a situation, and enables data to be stably distributed to a plurality of terminal devices without using a wide transmission band.

  The terminal device according to the first aspect of the present disclosure includes a holding unit that holds a group key corresponding to a group to which the terminal device belongs and a group that represents the group to which the terminal device belongs in the terminal device that receives data transmitted from the distribution device. Using the receiving unit that receives the packet encrypted with the group key, in which the ID is described, regardless of the destination of the packet, and the group key from which the received encrypted packet has been acquired A decoding unit for decoding.

  The terminal device according to the first aspect of the present disclosure may further include an acquisition unit that acquires a group key corresponding to the group to which the terminal device belongs and holds the group key in the holding unit.

  The receiving unit can send back an ACK only when the destination of the received packet is itself.

  The acquisition unit can acquire the group key by communicating with an external device.

  The acquisition unit can acquire the group key by communicating one-to-one with the distribution device as the external device.

  The acquisition unit can acquire the group key by communicating with an external device via NFC.

  The acquisition unit can acquire the group key unilaterally supplied from the outside.

  A reception method according to a first aspect of the present disclosure is a reception method of a terminal device that receives data transmitted from a distribution device, wherein the terminal device describes a group ID representing a group to which the terminal device belongs. A reception step of receiving a packet encrypted with a group key corresponding to a group to which the packet belongs, regardless of the destination of the packet, and decrypting the received encrypted packet using the acquired group key Decoding step.

  The program according to the first aspect of the present disclosure includes a computer that receives data transmitted from a distribution device, a holding unit that holds a group key corresponding to a group to which the computer belongs, and a group ID that represents the group to which the computer belongs. The described receiving unit that receives the packet encrypted with the group key regardless of the destination of the packet, and decrypts the received encrypted packet using the acquired group key It functions as a decryption unit.

  In the first aspect of the present disclosure, a packet in which a group ID representing a group to which the self belongs is described and encrypted with a group key corresponding to the group to which the self belongs is received regardless of the destination of the packet, The received encrypted packet is decrypted using the acquired group key.

  The distribution device according to the second aspect of the present disclosure is a distribution device that distributes data for a group of one or more terminal devices, and encrypts the data using a group key corresponding to the group, A transmission unit configured to transmit, to the destination, at least one of the terminal devices belonging to the group, the packet including the encrypted data and describing a group ID representing the group;

  The distribution device according to the second aspect of the present disclosure may further include a distribution unit that distributes the group key to the terminal device by performing one-to-one communication with the terminal device belonging to the group.

  The transmission unit can dynamically change the destination of the packet to another terminal device belonging to the group.

  The transmission unit can dynamically change the destination to another terminal device belonging to the group based on an ACK or a connection release request from the terminal device that is the destination of the packet.

  The transmitting unit dynamically changes the group key used for encrypting the data, and the distributing unit receives the changed group key before the change of the group key by the transmitting unit. Can be distributed to devices.

  A distribution method according to a second aspect of the present disclosure is a distribution method of a distribution apparatus that distributes data to a group of one or more terminal apparatuses as a distribution target, wherein a group key corresponding to the group by the distribution apparatus is obtained. Transmitting the packet using the encrypted data and transmitting the packet including the encrypted data and describing a group ID representing the group, with at least one of the terminal devices belonging to the group as a destination; Including.

  A program according to a second aspect of the present disclosure includes a computer that distributes data to a group of one or more terminal devices as a distribution target, encrypts the data using a group key corresponding to the group, and encrypts the data The packet including the data and describing the group ID representing the group is caused to function as a transmission unit that transmits at least one of the terminal devices belonging to the group as a destination.

  In the second aspect of the present disclosure, data is encrypted using a group key corresponding to a group, and the packet including the encrypted data and describing a group ID representing the group is included in the group. It is transmitted to at least one of the terminal devices to which it belongs.

  A distribution system according to a third aspect of the present disclosure is a distribution system including a distribution device and a terminal device, wherein the distribution device encrypts data using a group key corresponding to a group including one or more terminal devices. And a transmission unit that transmits the packet including the encrypted data and describing the group ID representing the group, with at least one of the terminal devices belonging to the group as a destination. On the other hand, the terminal device includes a holding unit that holds a group key corresponding to a group to which the terminal device belongs, and a group ID that represents the group to which the terminal device belongs. A reception unit that receives the packet regardless of the destination; and a decryption unit that decrypts the received encrypted packet using the acquired group key.

  In the third aspect of the present disclosure, the distribution device encrypts data using a group key corresponding to a group, and includes a packet including the encrypted data and describing a group ID representing the group. And at least one of the terminal devices belonging to the group is transmitted as a destination. On the other hand, a packet encrypted with a group key corresponding to a group to which the terminal belongs is described by the terminal device, in which a group ID representing the group to which the terminal belongs is received, regardless of the destination of the packet. The encrypted packet is decrypted using the acquired group key.

  According to the first aspect of the present disclosure, it is possible to receive a packet in which a group ID representing a group to which the self belongs is described regardless of the destination.

  According to the second aspect of the present disclosure, data can be distributed to one or more terminal devices.

  According to the third aspect of the present disclosure, it is possible to stably distribute data to a plurality of terminal devices without using a wide transmission band.

It is a block diagram showing an example of composition of a data distribution system to which this indication is applied. It is a block diagram which shows the structural example of an access point apparatus. It is a block diagram which shows the structural example of a terminal device. It is a figure which shows the structural example of a key holding | maintenance area | region. Generation of the group key K _GP, is a timing chart for explaining the supply. It is a figure which shows the state by which various keys are recorded on a key holding | maintenance area | region. Is a timing chart for explaining the change of the group key K _GP. It is a timing chart when an AP device changes a terminal device as a packet destination. It is a flowchart explaining the reception process of a terminal device. It is a timing chart when the terminal device made into the packet destination cancels | releases a connection with AP apparatus. It is a flowchart explaining the connection cancellation | release process of a terminal device. It is a figure which shows the data structure of an 802.11MAC header. It is a figure which shows the data structure of an RTP header. It is a figure which shows the data structure of an 802.11iCCMP header. It is a block diagram which shows the structural example of a computer.

  Hereinafter, the best mode for carrying out the present disclosure (hereinafter referred to as an embodiment) will be described in detail with reference to the drawings.

[Configuration example of data distribution system]
FIG. 1 illustrates a configuration example of a data distribution system according to an embodiment of the present disclosure. This data distribution system 1 is composed of an access point device 10 and a plurality of (in the case of FIG. 4, four) terminal devices 20, and distributes the same data simultaneously to a plurality of terminal devices 20 belonging to the same group. It is. Note that the terminal device 20 is assumed to be built in, for example, a mobile phone, a smartphone, a tablet PC, or a portable game machine.

An access point device (hereinafter also referred to as an AP device) 10 transmits data A to any one of a plurality of terminal devices 20 by unicast communication. The packet in which the data A is stored describes a group ID for identifying a group to which a plurality of terminal devices 20 belong, and the data A is a group supplied only to the terminal devices 20 belonging to the group. It is encrypted with the key K _GP .

  On the other hand, the terminal device 20 receives a packet in which a group ID representing a group to which the terminal device belongs is described, and operates as a unicast communication mode when the packet is addressed to the terminal device. Operates in (sniffer mode).

  In FIG. 1, since the AP device 10 transmits a packet addressed to the terminal device 20-1 by unicast communication, the terminal device 20-1 operates in the unicast communication mode, and the terminal devices 20-2 to 20- 4 operates in the sniffer mode.

Terminal 20-1 operating in unicast communication mode, AP 10 receives a packet addressed to itself which has transmitted the unicast communication, and decrypted using the encrypted by that group the packet key K _GP Use. In addition, when the terminal device 20-1 operating in the unicast communication mode can normally receive a packet, the terminal device 20-1 transmits an ACK indicating that fact to the AP device 10. This ACK is used in the AP device 10 to determine the transmission rate and determine whether packet retransmission is necessary.

The terminal devices 20-2 to 20-4 operating in the sniffer mode intercept the packets addressed to the terminal device 20-1 belonging to the group to which the terminal devices 20-2 to 20-4 belong to the AP device 10 by unicast communication. Terminals 20-2 through 20-4 operates in sniffer mode decodes use with intercepted encrypted by which the packet group key K _GP.

  In the case of FIG. 1, the same data is simultaneously transmitted to four terminal apparatuses 20 by using only the transmission band of unicast communication for one terminal apparatus 20 (in the case of FIG. 1, terminal apparatus 20-1). Can be delivered. Here, if the terminal device 20 in the unicast communication mode (the terminal device 20-1 in the figure) is placed in a place where the communication environment is the worst from the AP device 10, it matches the terminal device 20 in the unicast communication mode. Since the transmission rate is set or the packet is retransmitted, as a result, all the terminal devices 20 can receive the same data.

  In FIG. 1, unicast communication is performed using only one terminal device 20 as a packet destination. For example, unicast communication is performed using terminal devices 20-1 and 20-2 as packet destinations. You may do it. In this case, the remaining terminal devices 20-3 and 20-4 operate in the sniffer mode.

[Configuration Example of Access Point Device 10]
FIG. 2 shows a configuration example of the AP device 10. The AP device 10 includes a control unit 11, a memory 12, a data processing unit 14, a transmission processing unit 15, a wireless I / F unit 16, an antenna 17, and an NFC communication unit 18.

The control unit 11 controls the entire AP apparatus 10. In particular, the control unit 11 controls each unit of the AP device 10 to perform one-to-one communication with the terminal device 20 and supplies various keys (described later). The memory 12 holds a control program executed by the control unit 11. The memory 12 is provided with a key holding area 13. The key holding area 13 stores a pair master key K _PM , a pair key K _P , a group key K _{GP and the} like which will be described later.

  At the time of transmission, the data processing unit 14 packetizes data to be transmitted to the terminal device 20 and outputs the packetized data to the transmission processing unit 15. In addition, the data processing unit 14 performs processing according to data stored in the packet at the time of reception. At the time of transmission, the transmission processing unit 15 adds a header, an error correction code, and the like to the packet from the data processing unit 14 and outputs the packet to the wireless I / F unit 16. Further, the transmission processing unit 15 analyzes the header of the packet input from the wireless I / F unit 16 at the time of reception, and outputs the packet to the data processing unit 14 according to the analysis result.

  At the time of transmission, the wireless I / F unit 16 modulates the carrier wave output from the antenna 17 based on the packet input from the transmission processing unit 15, thereby transmitting the packet to the terminal device 20 in the unicast mode. To do. In addition, the wireless I / F unit 16 demodulates the carrier wave input from the antenna 17 at the time of reception, and outputs the resulting packet to the transmission processing unit 15.

The NFC communication unit 18 communicates with an NFC-compatible external device incorporating an NFC card or an NFC chip by near field communication (NFC). The NFC communication unit 18 may acquire the group key K _GP from an NFC card or an NFC compatible external device. Further, communication with a card, an external device, or the like may be performed by any communication method other than near field communication (NFC). Alternatively, the camera unit provided in the terminal device 20, by reading the like QR code representing the group key K _GP, may acquire the group key K _GP. Further, a character string that the user corresponding to the group key K _GP of the terminal device 20 may be manually input.

[Configuration Example of Terminal Device 20]
FIG. 3 shows a configuration example of the terminal device 20. The terminal device 20 includes a control unit 21, a memory 12, a data processing unit 24, a transmission processing unit 25, a wireless I / F unit 26, an antenna 27, and an NFC communication unit 28.

  The control unit 21 controls the entire terminal device 20. In particular, the control unit 21 controls each unit of the terminal device 20 to perform one-to-one communication with the AP device 10 and obtain various keys (described later). The memory 22 holds a control program executed by the control unit 21. The memory 22 is provided with a key holding area 23.

  FIG. 4 shows a configuration example of the key holding area 23. In the key holding area 23, a pair master key register 31, a pair key register 32, and a plurality of group key registers 33 are provided.

The pair master key register 31 stores a pair master key K _PM possessed in common by the AP device 10 and the terminal devices 20 belonging to the same group.

The pair key register 32 stores a pair key K _P generated after mutual authentication with the AP device 10 using the pair master key K _PM .

The group key register 33, group key K _GP are stored. Note that the group key register 33-0, group key K _GP0 key ID = 0 is stored. The group key register 33-1, group key K _GP1 key ID = 1 is stored. The same applies to the group key register 33-2 and the group key register 33-3.

  Returning to FIG. The data processing unit 24 packetizes data to be transmitted to the AP device 10 or ACK at the time of transmission and outputs the packetized data to the transmission processing unit 25. In addition, the data processing unit 24 performs processing for discarding duplicate received packets or arranging received packets in the order of transmission at the time of reception, and outputs them to the subsequent stage. Further, the data processing unit 24 decrypts the received encrypted packet at the time of reception.

  The transmission processing unit 25 adds a header, an error correction code, and the like to the packet from the data processing unit 24 and outputs the packet to the wireless I / F unit 26 at the time of transmission. Further, the transmission processing unit 25 analyzes the header of the packet input from the wireless I / F unit 26 at the time of reception, and outputs the packet to the data processing unit 24 according to the analysis result. Note that the transmission processing unit 25 also executes generation and disassembly of aggregate speed-up technology Aggregated MPDU (A-MPDU) defined in IEEE 802.11n, block ACK buffer management, window management, and the like.

  At the time of transmission, the wireless I / F unit 26 modulates the carrier wave output from the antenna 27 based on the packet input from the transmission processing unit 25 to transmit the packet to the AP device 10. Further, the wireless I / F unit 26 demodulates the carrier wave input from the antenna 27 at the time of reception, and outputs the resulting packet to the transmission processing unit 25.

The NFC communication unit 28 communicates with an NFC card or an NFC compatible external device by near field communication (NFC). The NFC communication unit 28 may acquire the group key K _GP from the NFC card or the NFC compatible external device. Moreover, you may make it communicate with a card | curd, an external apparatus, etc. by arbitrary communication systems other than near field communication.

[Group key K _GP supply method]
As a first method of supplying the group key K _GP to the AP device 10 and the plurality of terminal devices 20, the NFC card or the NFC compatible external device in which the group key K _GP is recorded is used as the AP device 10 and the terminal device 20. is brought close to to communicate, it is possible to supply the group key K _GP from such as NFC card.

As a second method, the AP device 10 and each terminal device 20 individually establish a wireless connection before data distribution, and use a unicast communication pair key K _P defined in IEEE802.11. The group key K _GP can be supplied from the AP device 10 to each terminal device 20. This will be specifically described with reference to FIGS.

  FIG. 5 is a timing chart for explaining the second method. FIG. 6 shows a key holding area 23 provided in the memory 22 of the terminal device 20 in which various keys are recorded by the second method. Note that the same holds for the key holding area 13 provided in the memory 12 of the AP device 10, and thus illustration thereof is omitted.

Given the second method, the AP device 10 each of the terminal devices 20, it is assumed that the common pairwise master key K _PM has already been held.

First, as step S1, the AP device 10 and each terminal device 20 are individually connected, and each uses the pair master key K _PM to set the pair key K _P by the 4-way handshake specified by IEEE802.11. Generate. The generated pair key K _P is held in the pair key register 32 of the key holding area 23 as shown in FIG. 6A. This pair key K _P is used for encryption of normal unicast communication.

Next, in step S2, the AP device 10 generates a group key K _GP based on the group master key K _GPM that is previously _stored , and is defined by IEEE802.11 with the group key K _GP encrypted with the pair key K _P. It is supplied to the terminal device 20 by the 2-way handshake. The supplied group key K _GP is held in the group key register 33 in the key holding area 23 as shown in FIG. 6B.

The group key _KGP is used for encryption of normal multicast communication. Therefore, in the present embodiment, the group key K _GP used for encryption of normal multicast communication is used for encryption of unicast communication.

[How to change group key K _GP ]
Next, a description will be given of the method of updating the group key K _GP. The group key _KGP is updated so that when a certain terminal device 20 is removed from the group receiving the same data distribution, the terminal device 20 cannot receive the data distributed to the group. Executed. In addition, in order to ensure the safety of the group key K _GP, there is also a case to be updated regularly.

Figure 7 is a timing chart illustrating a method of updating the group key K _GP. As a premise, the AP device 10 and each terminal device 20 have already been connected, and the AP device 10 and each terminal device 20 have a pair master key K common to the key holding area 23 as shown in FIG. 6A. _{It is} assumed that _PM and pair key K _P are already held.

In step S11, the group key K _GP1 encrypted with the pair key K _P is individually distributed from the AP device 10 to each terminal device 20. The group key K _GP1 is held in the group key register 33-1 in the key holding area 23 as shown in FIG. 6B. In step S12, the data (packet) encrypted by the group key K _GP1 is transmitted from the AP device 10 to the terminal device 20 in the unicast communication mode as a destination.

The data (packet) encrypted with the group key K _GP1 is received by the terminal device 20 in the unicast communication mode and intercepted by the terminal device 20 in the sniffer mode, and is described in the packet in each. It is decrypted and used by the group key recorded in the group key register 33 corresponding to the key ID (in this case, the group key K _GP1 recorded in the group key register 33-1).

Next, as step S13, the group key K _GP2 encrypted with the pair key K _P is individually distributed from the AP device 10 to each of the terminal devices 20. The group key K _GP2 is held in the group key register 33-2 in the key holding area 23 as shown in FIG. 6C.

Until the new group key K _GP2 is supplied to all the terminal devices 20, the data (packet) encrypted with the group key K _GP1 is received from the AP device 10 as step S14. The terminal device 20 in the unicast communication mode is transmitted as the destination.

Then, after the new group key K _GP2 is supplied to all the terminal devices 20, in step S15, the data (packet) encrypted by the group key K _GP2 is transmitted from the AP device 10 to the unicast communication. The terminal device 20 in the mode is transmitted as the destination.

The data (packet) encrypted with the group key K _GP2 is received by the terminal device 20 in the unicast communication mode and intercepted by the terminal device 20 in the sniffer mode, and is described in the packet in each. It is decrypted and used by the group key recorded in the group key register 33 corresponding to the key ID (in this case, the group key K _GP2 recorded in the group key register 33-2). That is, since the terminal device 20 can know the change of the group key K _{GP from} the key ID, it is not necessary to notify the terminal device 20 of the change timing of the group key K _GP in advance from the AP device 10. The group key _KGP can be updated even while a series of data is being distributed.

Also, the group key K _GP1 that has been used for data encryption until then is erased from the group key register 33-1.

[Change of terminal device 20 as packet destination]
For example, the terminal device 20-1 that is the destination of the packet and operates in the unicast communication mode goes out of the wireless communication area of the data distribution system 1 or is turned off. An ACK may not be returned to the device 10. In such a case, since the AP device 10 cannot know the data transmission status, the AP device 10 changes the destination of the packet to any of the terminal devices 20-2 to 20-4 that have been operating in the sniffer mode. As a result, any of the terminal devices 20-2 to 20-4 newly set as the packet destination operates in the unicast communication mode. Specifically, a packet addressed to itself is received and an ACK is returned to the AP device 10.

FIG. 8 is a timing chart showing an operation when the packet destination is changed from the terminal device 20-1 to the terminal device 20-2. In the case of FIG. 8, the group key K _GP is not changed before and after the packet destination is changed.

  While the destination of the packet is the terminal device 20-1, the terminal device 20-1 receives the packet addressed to itself and returns an ACK to the AP device 10. During this time, the terminal devices 20-2 to 20-4 in the sniffer mode intercept a packet addressed to the terminal device 20-1.

  When the AP device 10 changes the destination of the packet from the terminal device 20-1 to the terminal device 20-2 for some reason, the terminal device 20-2 receives the packet addressed to itself and enters the unicast communication mode, and the ACK is changed to AP. A reply is sent to the device 10. On the other hand, the terminal device 20-1 that has been in the unicast communication mode until then operates in the sniffer mode.

  In this way, the AP device 10 can change the operation mode of the terminal device 20 simply by changing the destination of the packet.

[Reception processing of terminal device 20]
Next, the reception process of the terminal device 20 will be described in detail. FIG. 9 is a flowchart for explaining the reception process of the terminal device 20.

In step S21, the terminal device 20 is individually connected to the AP device 10, and acquires the pair key K _P , the group key K _GP , and the group ID. The group ID acquired here represents the group to which the terminal device 20 belongs. However, if the pair key K _P or the like has already been acquired, or if the group key K _GP is not changed during data distribution, the process of step S21 may be omitted.

Note that when the group key K _GP is supplied to the terminal device 20 by an NFC card or the like, the pair key K _P and the group ID are acquired here.

  In step S22, the terminal device 20 receives a packet in which the same group ID as the group ID acquired in step S21 (the group ID indicating the group to which the terminal device 20 belongs) is described among the packets transmitted by wireless communication. To do. In step S23, the terminal device 20 determines whether or not the received packet is addressed to itself. If this determination result is affirmative, the terminal device 20 operates in the unicast communication mode, and the process proceeds to step S24.

In step S24, the terminal apparatus 20 of the unicast communication mode, a packet addressed to itself received already decrypted using the group key K _GP who owns, utilizing data of the decoded result. In step S <b> 25, the terminal device 20 in the unicast communication mode returns an ACK indicating that the packet addressed to itself has been successfully received to the AP device 10. Thereafter, the process returns to step S21, and the subsequent steps are repeated.

  On the other hand, if the determination result in step S24 is negative, the terminal device 20 operates in the sniffer mode, and the process proceeds to step S26. In step S26, the terminal device 20 in the sniffer mode receives the packet in duplicate based on the sequence number described in the packet addressed to the other terminal device 20 belonging to the same group as that received (intercepted). If it is received, the packet is discarded. If the reception order is different from the sequence number, the packets are arranged.

In step S27, the terminal apparatus 20 of the sniffer mode, the intercepted packets already decrypted using the group key K _GP who owns, utilizing data of the decoded result. Thereafter, the process returns to step S21, and the subsequent steps are repeated.

  As described above, the terminal device 20 can operate in the unicast communication mode or the sniffer mode according to the destination of the received packet.

[Release of connection by the terminal device 20 that is the destination of the packet]
Next, the connection release by the terminal device 20 which is the destination of the packet and operates in the unicast communication mode will be described.

  FIG. 10 is a timing chart when the connection with the AP apparatus 10 is released in response to a request from the terminal apparatus 20 that is the destination of the packet.

For example, when the user of the terminal device 20-1 that is the destination of the packet and operates as the unicast communication mode goes out of the wireless communication area of the data distribution system 1, the user connects to the AP device 10 by a predetermined operation. It is desirable to notify the release request. In response to this connection release request, the AP device 10 distributes the group key K _GP2 different from the currently used group key K _GP1 to the terminal devices 20-2 to 20-4 other than the terminal device 20-1. Start. Until the distribution of the group key K _GP2 is completed, the destination of the packet is the terminal device 20-1, and the group key K _GP1 is used for the encryption. Naturally, since the terminal device 20-1 still operates in the unicast communication mode, an ACK is returned from the terminal device 20-1 to the AP device 10. Therefore, the quality of wireless communication in the data distribution system 1 is maintained.

When the distribution of the group key K _GP2 is completed to the terminal devices 20-2 to 20-4 other than the terminal device 20-1, the AP device 10 notifies the terminal device 20-1 of the connection release permission.
The terminal device 20-1 releases the connection with the AP device 10 in response to the connection release permission.

Immediately, the AP device 10 changes the destination of the packet to something other than the terminal device 20-1 (in the case of FIG. 10, the terminal device 20-2), and the data (packet) is distributed using the group key K _GP2 for the encryption. Continue. Thereafter, the terminal device 20-2 operates in the unicast communication mode.

In the case of FIG. 10, since the group key K _GP is changed along with the change of the packet destination, the terminal device 20-1 remains temporarily outside the wireless communication area of the data distribution system 1 and is set in the sniffer mode. Even if it is operating, the packet transmitted from the AP device 10 cannot be decoded and used.

[Connection release processing of terminal device 20]
Next, the connection release processing of the terminal device 20 will be described in detail. FIG. 11 is a flowchart detailing the connection release processing of the terminal device 20. Hereinafter, for example, when the user of the terminal device 20-1 operating in the unicast communication mode goes out of the wireless communication area of the data distribution system 1, a connection release request is sent to the terminal device 20-1. It is assumed that a predetermined operation for instructing notification is performed.

  In step S31, the terminal device 20-1 notifies the AP device 10 of a connection release request in accordance with a predetermined operation from the user.

  In step S <b> 32, the terminal device 20-1 determines whether the connection release permission from the AP device 10 has been notified in response to the notified connection release request. If this determination result is negative, the process proceeds to step S33. Note that, as described above, the AP device 10 keeps the destination of the packet at the terminal device 20-1 until the terminal device 20-1 is notified of the connection release permission, and the terminal device 20-1 Continues to receive packets.

  In step S33, the terminal device 20-1 determines whether the destination of the received bucket is self. If this determination result is affirmative, the process proceeds to step S <b> 34, and the terminal device 20-1 returns an ACK indicating that the packet addressed to itself can be normally received to the AP device 10. On the other hand, if the determination result of step S33 is negative, the process of step S34 is skipped. Thereafter, the process returns to step S32 and the subsequent steps are repeated.

If the determination result of step S32 is affirmative, the process proceeds to step S35. In step S35, the terminal device 20-1 deletes the pair key K _{P and the} group key K _GP held in the key holding area 23. In step S <b> 36, the terminal device 20-1 releases the connection with the AP device 10.

  According to the connection release processing described above, even if the terminal device 20-1 remains outside the wireless communication area of the data distribution system 1 and operates in the sniffer mode, the packet transmitted from the AP device 10 is transmitted. It can be in a situation where it cannot be decrypted and used.

[Description position of packet sequence number and group ID]
Next, description positions of packet sequence numbers and group IDs will be described with reference to FIGS. FIG. 12 shows the data structure of the 802.11 MAC header (in the case of a QoS Data frame). FIG. 13 shows the data structure of the RTP header included in the 802.11 Data frame payload.

  The sequence number of the packet in the present embodiment can be described in the Seq. Ctrl field of the 802.11 MAC header shown in FIG. Further, the group ID in this embodiment can be described in the Traffic ID field included in the QoS Ctrl of the 802.11 MAC header shown in FIG. 12 or the SSRC field of the RTP header shown in FIG. Further, although not shown, it may be described in the BSSID or source address of the packet.

[Description location of key ID indicating group key K _GP used for encryption]
Next, the description position of the key ID indicating the group key K _GP used in the encryption, will be described with reference to FIG. 14.

FIG. 14 shows the data structure of the 802.11iCCMP header. The key ID in this embodiment can be described in the CCMP header. For example, if it is determined that the key ID = 0 can be received only in the unicast communication mode and the sniffer mode can be intercepted other than the key ID = 0 and the key ID and the group key _KGP are operated, the terminal device in the sniffer mode 20 can identify the packet to be received by the key ID.

[Use Case of Data Distribution System 1]
Next, the use case of the data distribution system 1 which is this Embodiment is demonstrated.

For example, the data distribution system 1 distributes a moving image to a terminal device 20 (for example, assuming a mobile phone, a smartphone, a tablet PC, a portable game machine, etc.) possessed by an attendee at an event venue such as an exhibition or a concert. Can be applied to services. Specifically, if the group key K _GP is distributed to the terminal device 20 at the entrance gate or the like, the terminal device 20 possessed by a person located outside the event venue cannot use the video distribution, and the event attendee It is possible for only the terminal device 20 possessed by to be able to play the distributed video.

Members More specifically, for example, when idol group of the event, a video of each member of the idol group are prepared to encrypted with a different group key K _GP, which to select the favorite members in attendance, has been selected The group key K _GP corresponding to is distributed. As a result, the visitors can use the moving images of their favorite members.

In addition, if NFC or QR code (registered trademark) is used for distribution of the group key K _{GP in} the use case as described above, the group key K _GP can be unilaterally supplied to the terminal device 20, so that the visitors can The moving image can be used without transmitting its own information to the AP device 10 side.

  Further, for example, the data distribution system 1 can be used for the schedule management of the user of the terminal device 20 and the distribution of material data.

This will be described more specifically. It is assumed that the terminal device 20 of each user has a schedule management function, in which a conference schedule and participants to be attended are registered. A different group key K _GP is set for each conference, and a group key K _GP corresponding only to the terminal device 20 of each conference participant is distributed. And in each meeting, to be delivered by encrypting the data of the material to be used in the group key K _GP. Thus, the material can be distributed only to the conference participants.

  The data distribution system 1 can be used for various scenes other than the use cases described above.

  By the way, a series of processes of the AP device 10 and the terminal device 20 described above can be executed by hardware or can be executed by software. When a series of processing is executed by software, a program constituting the software is installed in the computer. Here, the computer includes, for example, a general-purpose personal computer capable of executing various functions by installing a computer incorporated in dedicated hardware and various programs.

  FIG. 15 is a block diagram illustrating a configuration example of hardware of a computer that executes the above-described series of processing by a program.

  In a computer, a CPU (Central Processing Unit) 101, a ROM (Read Only Memory) 102, and a RAM (Random Access Memory) 103 are connected to each other via a bus 104.

  An input / output interface 105 is further connected to the bus 104. An input unit 106, an output unit 107, a storage unit 108, a communication unit 109, and a drive 110 are connected to the input / output interface 105.

  The input unit 106 includes a keyboard, a mouse, a microphone, and the like. The output unit 107 includes a display, a speaker, and the like. The storage unit 108 includes a hard disk, a nonvolatile memory, and the like. The communication unit 109 includes a network interface or the like. The drive 110 drives a removable medium 111 such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory.

  In the computer configured as described above, the CPU 101 loads, for example, the program stored in the storage unit 108 to the RAM 103 via the input / output interface 105 and the bus 104 and executes the program. Is performed.

  The program executed by the computer may be a program that is processed in time series in the order described in this specification, or in parallel or at a necessary timing such as when a call is made. It may be a program for processing.

  The embodiment of the present disclosure is not limited to the above-described embodiment, and various modifications can be made without departing from the gist of the present disclosure.

  DESCRIPTION OF SYMBOLS 1 Data delivery system, 10 AP apparatus, 11 Control part, 12 Memory, 13 Key holding | maintenance area, 14 Data processing part, 15 Transmission processing part, 16 Wireless I / F part, 17 Antenna, 18 NFC communication part, 20 Terminal device, 21 control unit, 22 memory, 23 key holding area, 24 data processing unit, 25 transmission processing unit, 26 wireless I / F unit, 27 antenna, 28 NFC communication unit

Claims (17)

In the terminal device that receives the data transmitted from the distribution device,
A holding unit for holding a group key corresponding to a group to which the user belongs;
A reception unit that receives a packet that is encrypted with the group key, in which a group ID representing a group to which the device belongs is described, regardless of the destination of the packet;
And a decryption unit that decrypts the received encrypted packet by using the acquired group key. The terminal device according to claim 1, further comprising: an acquisition unit that acquires a group key corresponding to the group to which the self belongs and holds the group key in the holding unit. The terminal device according to claim 2, wherein the receiving unit returns an ACK only when the destination of the received packet is self. The terminal device according to claim 2, wherein the acquisition unit acquires the group key by communicating with an external device. The terminal device according to claim 4, wherein the acquisition unit acquires the group key by communicating one-to-one with the distribution device as the external device. The terminal device according to claim 4, wherein the acquisition unit acquires the group key by communicating with an external device using NFC. The terminal device according to claim 4, wherein the acquisition unit acquires the group key supplied unilaterally from outside. In a reception method of a terminal device that receives data transmitted from a distribution device,
According to the terminal device,
A reception step of receiving a packet encrypted with a group key corresponding to a group to which the group belongs, in which a group ID representing a group to which the packet belongs is described, regardless of the destination of the packet;
A decrypting step of decrypting the received encrypted packet using the acquired group key. A computer that receives data transmitted from the distribution device,
A holding unit for holding a group key corresponding to a group to which the user belongs;
A reception unit that receives a packet that is encrypted with the group key, in which a group ID representing a group to which the device belongs is described, regardless of the destination of the packet;
A program that functions as a decryption unit that decrypts a received encrypted packet using the acquired group key. In a distribution device that distributes data targeting a group of one or more terminal devices,
The data is encrypted using a group key corresponding to the group, and the packet including the encrypted data and describing a group ID representing the group is included in at least one of the terminal devices belonging to the group A distribution apparatus comprising a transmission unit that transmits a message as a destination. The distribution device according to claim 10, further comprising a distribution unit that distributes the group key to the terminal device by performing one-to-one communication with the terminal device belonging to the group. The distribution device according to claim 11, wherein the transmission unit dynamically changes the destination of the packet to another terminal device belonging to the group. The distribution device according to claim 12, wherein the transmission unit dynamically changes the destination to another terminal device belonging to the group based on an ACK or a connection release request from the terminal device that is the destination of the packet. . The transmitting unit dynamically changes the group key used for encrypting the data,
The distribution device according to claim 11, wherein the distribution unit distributes the changed group key to the terminal device prior to the change of the group key by the transmission unit. In a delivery method for a delivery device that delivers data to a group of one or more terminal devices as a delivery target,
According to the distribution device,
The data is encrypted using a group key corresponding to the group, and the packet including the encrypted data and describing a group ID representing the group is included in at least one of the terminal devices belonging to the group A delivery method including a sending step of sending a message as a destination. A computer that distributes data for a group of one or more terminal devices,
The data is encrypted using a group key corresponding to the group, and the packet including the encrypted data and describing a group ID representing the group is included in at least one of the terminal devices belonging to the group Program that functions as a transmitter that transmits a message as a destination. In a distribution system consisting of a distribution device and a terminal device,
The distribution device includes:
The terminal encrypts data using a group key corresponding to a group of one or more terminal devices, includes the encrypted data, and describes a packet in which a group ID representing the group is described. A transmission unit that transmits at least one of the devices as a destination;
The terminal device
A holding unit for holding a group key corresponding to a group to which the user belongs;
A reception unit that receives a packet that is encrypted with the group key, in which a group ID representing a group to which the device belongs is described, regardless of the destination of the packet;
And a decryption unit that decrypts the received encrypted packet using the acquired group key.

Images