JP2014027415A - Visible light communication system, communication method, and communication program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a visible light communication system which performs rigorous authentication in order to realize excellent security even if encryption key information is leaked, and furthermore, has simple structure.SOLUTION: A visible light communication system is provided with a portable terminal 11 having individual information A as authentication verification information. A visible light communication module 12 is implemented in the portable terminal 11. The portable terminal 11 can connect to a network 13 via an access point 14. The network 13 is connected with an authentication server 15 and an LED lighting device 16. The LED lighting device 16 receives the individual information A from the visible light communication module 12, and transmits encryption key information C to be used for communication to the visible light communication module 12. The authentication server 15 receives the individual information A and a position signal B of the lighting device 16 from the lighting device 16, then registers the individual information A and the position signal B, and transmits the encryption key information C to the lighting device 16 and the access point 14. Further, when the authentication server 15 receives inquiry concerning use propriety of the portable terminal 11 from the access point 14, the authentication server 15 transmits a result of determination concerning use propriety of the portable terminal 11 to the access point 14.

Description

  The present invention relates to a visible light communication system with enhanced security when connecting a mobile terminal to a network.

  In general, a mobile terminal having a communication function is connected to a network via an access point to perform data communication. The portable terminal here is a movable portable terminal, and includes a portable personal computer. When connecting a mobile terminal to a network, it is necessary to authenticate whether the mobile terminal can use the network. Therefore, the portable terminal sets ID information and accompanying encryption key information as information for authentication confirmation, and transmits and registers the information for authentication confirmation in advance to an authentication server connected to the network. .

  When connecting the mobile terminal to the network, the mobile terminal transmits ID information and encryption key information to the authentication server via the access point. The authentication server compares the received ID information and encryption key information with the registered information, and performs authentication for each portable terminal. When the authentication server authenticates the mobile terminal, the authentication server sends a notification that the connection is permitted to the access point, and the mobile terminal can use the network.

  As described above, the connection of the mobile terminal to the network is performed by authentication for each terminal. Therefore, if the ID information and the encryption key information are correct, the authentication server authenticates the mobile terminal as a normal one even if the connection request is received from the stolen mobile terminal. Therefore, it is important to prevent the third party from knowing the ID information and the encryption key information, which are authentication confirmation information.

  However, since the portable terminal uses radio waves when transmitting ID information and encryption key information to the access point, there is a possibility that these pieces of information may be intercepted. Particularly in trains or airplane seats where mobile terminals are used close to each other, the operable areas of the mobile terminals overlap, and ID information and encryption key information are likely to leak to adjacent mobile terminals. If ID information and encryption key information are leaked to a third party, and the mobile terminal itself is stolen and passed over to a third party, even a person who does not have proper access authority can use the network. In particular, wireless LANs such as corporations often use employee numbers for ID information, and practically prevent unauthorized access to a wireless network using only encryption key information, and security vulnerability becomes a problem. It was.

  Therefore, a communication system using visible light communication has been proposed to increase security. For example, in the visible light communication system described in Patent Document 1, the descrambling information is superimposed on the visible light emitted by the lighting device, and the descrambling information transmitted by the information device placed under the lighting device is transmitted by the lighting device. It is set to be operable by receiving information.

  In such a visible light communication system, the information device cannot operate in a place where the visible light from the lighting device does not reach, because the decryption information is not acquired from the lighting device. If a portable terminal is applied to the information device in the above visible light communication system, even if the portable terminal is stolen and the ID information and encryption key information of the portable terminal are leaked, visible light from the lighting device arrives. In places where there is no mobile terminal, it does not work. Thereby, it is possible to prevent the stolen mobile terminal from being illegally used on the network.

JP 2009-10487 A

However, the following points are problems in the conventional visible light communication system.
(A) Further security improvement is required.
Visible light communication is excellent in information propagation closure, and the technology of Patent Document 1 is used to limit the operable area of information equipment to the range where visible light from the lighting device can reach, ensuring high security. ing.

  However, even if the reachable range of the visible light is limited, it is often only divided by a curtain or the like, and it is difficult to prevent the visible light from leaking at all. If visible light leaks, the encryption key information superimposed thereon may also leak. Therefore, even if the encryption key information is leaked, a visible light communication system capable of exhibiting excellent security by avoiding unauthorized use of the network by performing strict authentication has been awaited.

(B) If the lighting device is made compatible with a plurality of types of portable terminals, the configuration of the lighting device becomes complicated.
For example, in order to realize a lighting device A that can handle different types of portable terminals X and Y, the lighting device A gives the descrambling information x to the portable terminal X and the descrambling information y to the portable terminal Y. Must be configured to give Therefore, it is indispensable to register the types of portable terminals X and Y and the corresponding descrambling information x and y in the lighting device A and collate them. In other words, the illumination device corresponding to a plurality of types of mobile terminals must incorporate the function of the authentication server, and the configuration is complicated.

  The present invention has been proposed to solve the above-described problems. An object of the present invention is to provide a visible light communication system capable of exerting excellent security by performing strict authentication even if encryption key information is leaked and having a simplified configuration. It is in.

In order to achieve the above object, the visible light communication system according to the present invention has the following features.
(1) A portable terminal that has authentication confirmation information and can be connected to a network via an access point.
(2) A visible light communication module installed in the portable terminal.
(3) An illumination device that is connected to the network, receives authentication confirmation information from the visible light communication module, and transmits encryption key information used for communication to the visible light communication module.
(4) Connect to the network, receive and register the authentication confirmation information from the lighting device, transmit the encryption key information to the lighting device and the access point, and from the access point to the mobile terminal An authentication server that, when receiving an inquiry about availability, checks the authentication confirmation information and sends a determination result regarding availability of the mobile terminal to the access point.
(5) When the access point receives the encryption key information from the authentication server and receives the encryption key information that matches the access point from the mobile terminal, the access point transmits an inquiry regarding the availability of the mobile terminal to the authentication server. Configure as follows.

  In the visible light communication system of the present invention, the authentication server sends the encryption key information to the access point and the lighting device during the initial stage and connection to the network via the access point. You may make it deliver at intervals. In the visible light communication system of the present invention, the visible light communication module may be connected to the portable terminal through an interface. In the visible light communication system of the present invention, the visible light communication module may be incorporated in the portable terminal.

  In the visible light communication system of the present invention, individual information of the portable terminal may be used as the authentication confirmation information. Moreover, in the visible light communication system of this invention, you may make it use combining the individual information of the said portable terminal, and the positional information regarding the installation position of the said illuminating device as the said information for authentication confirmation. Furthermore, the lighting device may be a spotlight. In addition, the present invention also includes a communication method and a communication program using the above visible light communication system.

  In the visible light communication system of the present invention having the above-described configuration, the visible light communication module sends authentication confirmation information held by the portable terminal to the illumination device, and the illumination device sends authentication confirmation information to the authentication server via the network. . The authentication server registers the authentication confirmation information received from the lighting device, and transmits the encryption key information to the lighting device and the access point. The lighting device sends the encryption key information to the portable terminal by visible light.

  The mobile terminal that has obtained the encryption key information from the lighting device transmits the encryption key information received from the authentication server to the access point and requests to start communication. The access point that has received this request has received from the authentication server. After confirming a match between the encryption key information and the encryption key information from the mobile terminal, an inquiry about whether or not the mobile terminal can be used is sent to the authentication server. The authentication server compares the registered authentication confirmation information with each other to determine whether or not the mobile terminal that received the inquiry can be used. When the authentication server permits the connection of the mobile terminal, the access point can connect the mobile terminal to the network.

  According to the present invention, it is possible to provide a visible light communication system in which security is further strengthened by performing authentication following the strict procedure described above.

The block diagram which shows the structure of typical embodiment of this invention. Operation | movement explanatory drawing of this embodiment.

[1] Configuration of Representative Embodiment An embodiment of the visible light communication system according to the present invention will be specifically described with reference to FIGS. 1 and 2. As illustrated in FIG. 1, the present embodiment includes a mobile terminal 11, a visible light communication module 12, a network 13, an access point 14, an authentication server 15, and an LED lighting device 16.

  The portable terminal 11 is a wireless LAN client including a portable personal computer, and is equipped with a wireless LAN module 6 that performs high-speed wireless communication, and driver software 5 is mounted. When the wireless LAN module 6 operates, the portable terminal 11 requests connection to the network 13 via the access point 14 and can connect to the network 13 if permission is obtained from the authentication server 15. The mobile terminal 11 has individual information A unique to the terminal 11.

  The visible light communication module 12 is provided with a USB interface unit 1, a frame control unit 2, an infrared modulation transmission unit 3, and a visible light reception demodulation unit 4. The USB interface unit 1 is an interface for connecting the visible light communication module 12 to the portable terminal 11.

  A frame control unit 2 is connected to the USB interface unit 1, and an infrared modulation transmission unit 3 and a visible light receiving demodulation unit 4 are connected to the frame control unit 2. The infrared modulation transmission unit 3 is a part for notifying the LED illumination device 16 of the individual information A of the portable terminal 11. The visible light receiving / demodulating unit 4 is a part that receives the encryption key information C from the LED illumination device 16.

  Such a visible light communication module 12 is a part that performs visible light communication, and is directly connected to the portable terminal 11 via the USB interface unit 1. The visible light communication module 12 operates by the driver software 5 and has a function of performing visible light communication and infrared communication with the LED lighting device 16.

  An access point 14, an authentication server 15, and an LED lighting device 16 are connected to the network 13. The network 13 is typically a LAN constructed in a company or the like, but the scale is not limited.

  The access point 14 is a wireless device for connecting the mobile terminal 11 to the network 13, and a plurality of access points 14 including a spare device may be installed and switched according to radio wave conditions. The access point 14 receives the encryption key information C from the authentication server 15. Further, the access point 14 receives a communication start request from the mobile terminal 11 and simultaneously receives the encryption key information C from the terminal mobile 11.

  When the encryption key information C received from the authentication server 15 and the encryption key information C received from the mobile terminal 11 match, the access point 14 authenticates whether the mobile terminal 11 has a legitimate access authority. An inquiry is made to the server 15. Further, when the mobile terminal 11 is authenticated by the authentication server 15, the access point 14 receives a permission notice from the authentication server 15 side.

  The authentication server 15 is a server that performs RADIUS authentication, and when there is an inquiry from the access point 14 regarding whether or not the mobile terminal 11 has a proper access authority, the access to the mobile terminal 11 that has received the inquiry The presence / absence of authority is determined, and if it is determined that the authorized access authority is possessed, the portable terminal 11 is authenticated and a permission notice is sent to the access point 14.

  Further, the authentication server 15 receives the individual information A of the mobile terminal 11 and the position information B indicating the installation position of the LED lighting apparatus 16 from the LED lighting device 16, and compares the received individual information A and the position information B. And register it in a predetermined table. When the authentication server 15 registers the individual information A and the position information B, the authentication server 15 sends the encryption key information C used for communication to the access point 14 and the LED lighting device 16. Further, in the present embodiment, the authentication server 15 sends the encryption key information C to the access point 14 and the LED lighting device 16 at a predetermined interval while the mobile terminal 11 is initially connected to the network 13 via the access point 14. It is set to be handed over.

  The LED lighting device 16 is a lighting device that performs visible light communication and infrared communication, and is disposed in a conference room or the like. The LED lighting device 16 receives the individual information A from the portable terminal 11 by infrared communication from the infrared modulation transmission unit 3 of the visible light communication module 12 and encrypts from the authentication server 15 by visible light communication to the visible light receiving demodulation unit 4. Key information C is sent. Further, the LED lighting device 16 has position information B indicating the installation position of the device 16 itself. The position information B and the individual information A from the portable terminal 11 are combined to authenticate the authentication server 15 via the network 13. To send to.

[2] Operation of the present embodiment The operation of the present embodiment will be described with reference to FIG. In the state where the visible light communication module 12 is mounted on the portable terminal 11, the portable terminal 11 uses the driver software 5 to arrange the visible light communication module 12 when it is arranged below the LED lighting device 16 and desired to connect to the network 13. And the individual information A of the portable terminal 11 is notified from the infrared modulation transmitter 3 to the LED lighting device 16 (step ST1). The LED lighting device 16 notifies the individual information A obtained from the portable terminal 11 to the authentication server 15 together with the position information B of the LED lighting device 16 (step ST2).

  The authentication server 15 registers the individual information A and the position information B as a pair in the table (step ST3), and sends the encryption key information C to the access point 14 and the LED lighting device 16 (steps ST41 and ST42). The LED illumination device 16 superimposes the encryption key information C received from the authentication server 15 on the visible light and transmits it to the mobile terminal 11, and the visible light receiving demodulation unit 4 of the visible light communication module 12 receives the encryption key information C ( Step ST43). Such delivery of the encryption key information C (steps ST41 to ST43) is performed not only during the initial period when the mobile terminal 11 starts communication with the network 13, but also during a period in which communication is continued.

  After acquiring the encryption key information C from the visible light communication module 12, the mobile terminal 11 uses the driver software 5 to control the wireless LAN module 6 mounted on the mobile terminal 11 and requests the access point 14 to start communication. (Step ST5). The access point 14 confirms that the encryption key information C received from the authentication server 15 matches the encryption key information C received from the mobile terminal 11. If both pieces of the encryption key information C match, an inquiry is made to the authentication server 15 as to whether or not the portable terminal 11 that has requested the start of communication has a proper access authority (step ST6).

  The authentication server 15 collates the individual information A and position information B of the mobile terminal 11 to determine whether the mobile terminal 11 can be used (step ST7). When the authentication server 15 authenticates the portable terminal 11, a permission notice is sent to the access point 14 (step ST8). The access point 14 that has received the permission notification from the authentication server is connected to the wireless LAN module 6, and the mobile terminal 11 can be connected to the network 13 via the wireless LAN module 6. If the authentication server 15 does not permit the use of the mobile terminal 11, a determination that it cannot be used is sent to the access point 14. The access point 14 is not connected to the wireless LAN module 6, and the mobile terminal 11 is connected to the network 13. Do not connect to.

[3] Operational effects of the present embodiment The operational effects of the present embodiment are as follows.
(A) Strengthening of security In the present embodiment, the connectable area of the mobile terminal 11 to the network 13 can be limited to a place where the visible light from the LED lighting device 16 can reach. It is possible to connect to the network 13 only under the LED lighting device 16 having the above, and security can be enhanced.

  In this embodiment, the registration of the individual information A and position information B of the mobile terminal 11 in the authentication server 15, the determination of the availability of the mobile terminal 11, the confirmation of the encryption key information C at the access point 14, etc. By following this procedure, strict authentication can be realized. For this reason, in this embodiment, it becomes possible to give connection permission to the network 13 only to the legitimate portable terminal 11 in which the individual information A and the position information B are registered. As a result, according to the present embodiment, even if the encryption key information C leaks due to leakage of visible light, the network 13 is not used illegally and excellent security can be exhibited.

  In addition, in this embodiment, since the position information B of the LED lighting device 16 is added to the individual information A as the authentication confirmation information of the mobile terminal 11 registered in the authentication server 15, it is temporarily based on the model of the mobile terminal 11 and the like. Even if the individual information A is known by a third party, the combination of the individual information A and the position information B should not be understood, and excellent security can be ensured.

(B) Simplification of configuration In this embodiment, the authentication server 15 connected to the network 13 authenticates a plurality of types of mobile terminals 11, so that the LED illumination device 16 itself does not need to have an authentication function. Therefore, the LED lighting device 16 does not require a table for registering the individual information A of the mobile terminal 11 and the position information B of the LED lighting device 16. As a result, the configuration of the lighting device 16 can be simplified.

  As described above, according to the present embodiment, it is possible to prevent information leakage and improve security, maintain the usability of the mobile terminal, realize high-speed communication, and further simplify the configuration. In addition, a communication system excellent in safety, convenience, high speed, and compactness can be provided.

[4] Other Embodiments The present invention is not limited to the above-described embodiment, and the shape and material of the constituent elements, the arrangement location, the contents such as encryption key information, the length of the wavelength of visible light, and the like are appropriately selected. Is possible. For example, the visible light communication module may be connected to the mobile terminal through an interface, or may be incorporated in the mobile terminal. Furthermore, the present invention can be applied to cloud computing.

  In addition, the illumination device that performs visible light communication may be a spotlight installed in each seat of a train or airplane, a hotel room, or the like. According to this embodiment, since the range in which the visible light reaches is narrow, there is an advantage that the information propagation is highly closed and the high security range becomes clear.

DESCRIPTION OF SYMBOLS 1 ... USB interface part 2 ... Frame control part 3 ... Infrared modulation transmission part 4 ... Visible light light reception demodulation part 5 ... Driver software 6 ... Wireless LAN module 11 ... Portable terminal 12 ... Visible light communication module 13 ... Network 14 ... Access point 15 ... Authentication server 16 ... LED lighting device

Claims (10)

A mobile device that has authentication confirmation information and can be connected to the network via an access point;
A visible light communication module installed in the mobile terminal;
An illumination device that connects to the network, receives authentication confirmation information from the visible light communication module, and transmits encryption key information used for communication to the visible light communication module;
Connected to the network, received and registered the authentication confirmation information from the lighting device, transmitted the encryption key information to the lighting device and the access point, and further, whether or not the portable terminal can be used from the access point An authentication server that sends a determination result regarding availability of the mobile terminal to the access point by collating with the authentication confirmation information when receiving an inquiry,
The access point is configured to receive the encryption key information from the authentication server, and when the encryption key information matching the access point is received from the mobile terminal, transmits an inquiry about the availability of the mobile terminal to the authentication server. A visible light communication system characterized by that.   The authentication server delivers the encryption key information to the access point and the lighting device at a predetermined interval when the portable terminal is initially connected to the network via the access point and during connection. Item 12. The visible light communication system according to Item 1.   The visible light communication system according to claim 1, wherein the visible light communication module is connected to the portable terminal through an interface.   The visible light communication system according to claim 1, wherein the visible light communication module is built in the portable terminal.   The visible light communication system according to claim 1, wherein individual information of the portable terminal is used as the authentication confirmation information.   The visible light communication system according to any one of claims 1 to 4, wherein individual information of the portable terminal and position information related to an installation position of the lighting device are used in combination as the authentication confirmation information.   The visible light communication system according to claim 1, wherein the illumination device is a spotlight. A communication method using the visible light communication system according to any one of claims 1 to 7,
Visible light transmission step of authentication confirmation information, wherein the visible light communication module sends the authentication confirmation information to the illumination device;
An authentication confirmation information receiving step in which the authentication server receives the authentication confirmation information from the lighting device via the network;
An encryption key information receiving step in which the lighting device and the access point receive the encryption key information from the authentication server via the network;
Visible light transmission step of encryption key information in which the lighting device sends the encryption key information to the visible light communication module;
A communication start request step in which the mobile terminal requests the access point to start communication;
An inquiry step in which the access point inquires to the authentication server whether or not the mobile terminal can be used;
A determination step in which the authentication server determines whether or not the mobile terminal can be used;
A permission notification step in which the authentication server notifies the access point of connection permission based on a determination result;
A communication method comprising: a portable terminal connection step of connecting the portable terminal to the network when the access point receives the connection permission. In the visible light transmission step, the visible light communication module sends individual information of the mobile terminal as the authentication confirmation information to the lighting device,
In the authentication confirmation information receiving step, the authentication server receives a combination of the individual information of the portable terminal and the positional information on the installation position of the illumination device as the authentication confirmation information from the illumination device via the network. The communication method according to claim 8. A communication program used in the visible light communication system according to any one of claims 1 to 7,
Using a computer
A visible light transmission function of authentication confirmation information, wherein the visible light communication module sends the authentication confirmation information to the lighting device;
An authentication confirmation information receiving function in which the authentication server receives the authentication confirmation information from the lighting device via the network;
An encryption key information receiving function in which the illumination device and the access point receive the encryption key information from the authentication server via the network;
Visible light transmission function of encryption key information in which the lighting device sends the encryption key information to the visible light communication module;
A communication start request function in which the mobile terminal requests the access point to start communication;
An inquiry function for the access point to inquire of the authentication server whether the mobile terminal can be used;
A determination function in which the authentication server determines whether or not the mobile terminal can be used;
A permission notification function in which the authentication server notifies the access point of connection permission based on a determination result;
A communication program that realizes a mobile terminal connection function for connecting the mobile terminal to the network when the access point receives the connection permission.

Images