JP2015132734A - Communication apparatus and method for controlling the communication apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique for selecting cryptographic communication to be applied, in accordance with a connection route with the other party of communication.SOLUTION: A command transmission unit 11 generates a route search command which is a command for searching a connection route leading to the other party of communication (counterparty), and makes a communication unit 16 transmit the route search command to the other party of communication. A route determination unit 12 specifies a connection route with the other party of communication from a response that the other party of communication has transmitted in accordance with reception of the route search command transmitted by the communication unit 16. A selection unit 13 performs selection of executing first cryptographic communication with the other party of communication by activating a first encryption processing unit 14 or executing second cryptographic communication with the other party of communication by activating a second encryption processing unit 15, in accordance with the result of determination by the route determination unit 12.

Description

  The present invention relates to cryptographic communication technology.

  In recent years, due to the rise of Wi-Fi function-equipped digital cameras and smartphones, the number of cases in which devices communicate directly without using a PC or the like is increasing. At that time, it is important to protect the information transmitted to the opposite device and the Internet service, for example, authentication information such as an ID / password and privacy information such as photographed image data by encryption.

  Usually, as encryption technology in communication, encryption technology is used for each layer such as wireless encryption by WEP, WPA or the like in the data link layer (layer 2), and encryption by SSL in the application layer. A problem in this case is a decrease in processing speed due to the double application of encryption.

  As an example of the technique for preventing the double encryption, a double encryption prevention technique in three-party communication has been proposed (Patent Document 1). In Patent Document 1, when the space between the terminal device and the first relay device (first interval) is encrypted, the interval from the terminal device to the second relay device via the first relay device (second interval) ) To detect the encryption of the first section on the left has been proposed.

WO2009 / 078103

  The technique described in Patent Document 1 described above is a technique for controlling encryption in the first section triggered by detection of encryption in the second section. Until the encryption of the first section is controlled, the encryption of the first section and the second section is effective, and thus double encryption cannot be prevented. The technique described in Patent Document 1 is a technique for controlling the encryption in the first section, and the technique for controlling the encryption in the second section is not disclosed in Patent Document 1.

  The present invention has been made in view of such a problem, and provides a technique for selecting encryption communication to be applied in accordance with a connection path with a communication partner.

  One aspect of the present invention includes: a specifying unit that specifies a connection path to a communication partner; and a communication unit that performs encrypted communication corresponding to the connection path specified by the specifying unit with the communication partner. Features.

  According to the configuration of the present invention, it is possible to select the encryption communication to be applied according to the connection path with the communication partner.

The block diagram which shows the function structural example of a communication apparatus. The flowchart of a connection process. Flow chart of encryption communication performed between communication device and communication partner The block diagram which shows the function structural example of a communication apparatus. The flowchart of the encryption communication performed between a communication apparatus and a communicating party.

  Preferred embodiments of the present invention will be described below with reference to the accompanying drawings. The embodiment described below shows an example when the present invention is specifically implemented, and is one of the specific examples of the configurations described in the claims.

[First Embodiment]
First, a functional configuration example of a communication apparatus (information processing apparatus) according to the present embodiment will be described with reference to the block diagram of FIG. The configuration shown in FIG. 1 is merely an example of a configuration that can realize each process described below, and any configuration may be adopted as long as each process described below can be realized. Absent.

  The command transmission unit 11 generates a route search command that is a command for searching for a connection route reaching the communication partner (opposite), and causes the communication unit 16 to transmit the route search command to the communication partner. The route search command is an arbitrary command for automatically determining a connection route to a communication partner by transmitting a control packet to the communication partner, for example, traceroot or ping.

  The route determination unit 12 specifies a connection route with the communication partner from the response transmitted in response to the communication partner receiving the route search command transmitted by the communication unit 16. This response is, for example, a path log generated as a result of traceroot. When the IP address appearing in the route log as a response is only on the same subnet, the route determination unit 12 determines that the connection route with the communication partner is LAN, and when the IP address appears in a different subnet, the connection route with the communication partner is WAN. Judge.

  The selection unit 13 operates the first encryption processing unit 14 according to the determination result by the route determination unit 12 to execute the first encryption communication with the communication partner, or the second encryption The processor 15 is operated to select whether to execute the second encrypted communication with the communication partner.

  For example, if it is determined that the connection path is a LAN, the first encryption processing unit 14 is selected. In this case, the first encryption processing unit 14 executes encryption communication that can protect communication on the LAN, such as the above-described wireless encryption, as the first encryption communication.

  If it is determined that the connection path is WAN, the second encryption processing unit 15 is selected. In this case, the second cryptographic processing unit 15 executes cryptographic communication that can protect communication on the WAN, such as the above-described SSL, as the second cryptographic communication.

  In the following description, the first cryptographic processing unit 14 performs wireless cryptographic communication with the communication partner, and the second cryptographic processing unit 15 performs SSL with the communication partner. However, the type of cryptographic communication that it performs is not limited to this. In any case, it is assumed that the cryptographic communication performed by the second cryptographic processing unit 15 is slower than the cryptographic communication performed by the first cryptographic processing unit 14.

  In general, encryption communication with a narrow path that can be protected, that is, low-layer encryption, is faster than encryption communication with a wide path that can be protected, that is, high-layer encryption communication. In addition, low-layer encryption communication is often realized by hardware. The above-described first cryptographic processing unit 14 assumes low-layer encryption communication, for example, wireless encryption, and the second cryptographic processing unit 15 assumes high-layer encryption communication, for example, SSL. Therefore, the second cryptographic processing unit 15 is slower than the first cryptographic processing unit 14.

  The communication unit 16 communicates with a communication partner. For example, a wired connection using a wired LAN cable or USB, a wireless connection using Wi-Fi or Bluetooth (registered trademark), or the like, which can be connected to the communication partner. The method may be used. The communication unit 16 has a function of connecting to a WAN such as 3G or LTE through a modem connected to the communication device or the communication device.

  The communication unit 16 transmits the route search command received from the command transmission unit 11 to the communication partner and receives a response transmitted in response to the communication partner receiving the route search command. Both the first cryptographic processing unit 14 and the second cryptographic processing unit 15 execute corresponding cryptographic communication using the communication unit 16.

  Next, encryption communication performed between the communication device and the communication partner will be described with reference to the flowchart of FIG. Here, a file server on the LAN or a file server on the WAN is assumed as a communication partner.

  In step S31, the command transmission unit 11 generates the above route search command and sends it to the communication unit 16. Therefore, the communication unit 16 sends this route search command to the file server on the LAN or the file server on the WAN. To send.

  In step S32, when the file server on the LAN or the file server on the WAN receives the route search command, the response is returned to the communication device. In step S33, the communication unit 16 receives this response.

  In step S34, the path determination unit 12 may specify a device to be a communication partner (a user operates an operation unit (not shown) among the file servers on the LAN and the WAN). A response from the route determination unit 12 may be designated accordingly. Then, the route determination unit 12 specifies the connection route with the communication partner from the referenced response. For example, if the communication partner is a file server on the LAN, it is determined from the response received from the communication partner that the connection path with the communication partner is the LAN. On the other hand, if the communication partner is a file server on the WAN, it is determined from the response received from the communication partner that the connection path with the communication partner is WAN. If the connection path identified in step S34 is a LAN, the process proceeds to step S35, and if it is a WAN, the process proceeds to step S311.

  In step S35, the selection unit 13 determines whether the wireless encryption is valid (whether the first encryption processing unit 14 is operating). If the result of this determination is valid (operating), the process proceeds to step S38, and if it is invalid (not operating), the process proceeds to step S36.

  In step S36, the selection unit 13 validates the wireless encryption (selects and operates the first encryption processing unit 14), and in step S37, the communication unit 16 performs the wireless encryption by the first encryption processing unit 14. Is used to perform connection processing with the communication partner. Details of the processing in step S37 will be described using the flowchart of FIG. Note that the communication device here assumes a configuration in which a device such as a Wi-Fi Direct group owner functions as an access point.

  In step S21, the communication unit 16 performs beacon transmission. Here, as an example, it is assumed that the communication unit 16 performs beacon transmission irregularly. In step S22, the communication partner (here, a file server on the LAN) receives this beacon.

  In step S23, the communication partner connects to the communication device. In step S24, the communication unit 16 receives this connection and assigns an IP address to the communication partner. Here, as an example, it is assumed that the communication unit 16 has a DHCP server function and automatically assigns an IP address to a communication partner having a DHCP client function.

  In this case, communication performed with the communication partner after the connection processing according to the flowchart of FIG. 2 is wireless encryption communication by the first encryption processing unit 14. After the process according to the flowchart of FIG. 2, the process returns to step S31.

  On the other hand, in step S311, the selection unit 13 determines whether the wireless encryption is valid. If the result of this determination is that it is valid, the process proceeds to step S312, and if it is invalid, the process proceeds to step S314.

  In step S312, the selection unit 13 invalidates the wireless encryption (deactivates the first encryption processing unit 14 and stops the operation), and in step S313, the communication unit 16 follows the flowchart of FIG. By performing the process, a wireless connection process is performed with the communication partner. In this case, the communication performed with the communication partner after the connection process according to the flowchart of FIG. 2 is performed without being encrypted by the wireless encryption by the first encryption processing unit 14. After the process according to the flowchart of FIG. 2, the process returns to step S31.

  In step S314, the selection unit 13 validates SSL (selects and operates the second encryption processing unit 15). However, the communication performed with the communication partner thereafter is encrypted by SSL by the second encryption processing unit 15.

  In step S38, the communication unit 16 transmits the designated data to the communication partner. This transmission process (communication process) is encrypted communication by a selected one of the first encryption processing unit 14 and the second encryption processing unit 15.

  In step S39, the communication partner receives the data transmitted in step S38, and receives the data and transmits the data to the communication device. In step S310, the communication unit 16 receives data transmitted from the communication partner.

  Thus, according to the present embodiment, corresponding encrypted communication can be performed according to the connection path with the communication partner, thereby avoiding double encryption in data transmission / reception with the communication partner. The reduction in processing speed can be reduced to that due to a single encryption. Further, in communication on the LAN, by applying encryption communication using wireless encryption faster than SSL, a significant increase in speed can be realized as compared with double encryption.

<Modification>
In the first embodiment, the selection of the wireless cipher and SSL in Wi-Fi communication has been described. However, as described above, the selection target is not limited to these, and any cipher that can establish a connection with the communication partner is used. It's okay. For example, in communication with a communication partner by Bluetooth (registered trademark), encrypted communication between Bluetooth (registered trademark) paths, encryption in SSL, and in communication with a communication partner on a WAN such as 3G or LTE, encrypted communication by SSL, etc. Arbitrary encryption communication may be used according to the connection method and connection path with the communication partner. Note that the number of encryption communications (encryption processing units) that can be selected according to the situation may be two or more.

  In the first embodiment, the example in which the cryptographic communication based on the first cryptographic processing unit 14 is faster than the cryptographic communication based on the second cryptographic processing unit 14 has been described. However, it may be considered that the communication speed based on the first encryption processing unit 14 is extremely low due to the use of strong encryption. Specifically, before selecting any one of the first cryptographic processing unit 14 and the second cryptographic processing unit 15, the respective cryptographic communication of the first cryptographic processing unit 14 and the second cryptographic processing unit 15. The communication device may further be provided with a configuration (comparison unit) for comparing the speeds. If the comparison result by the comparison unit indicates that the encryption communication based on the second encryption processing unit 15 is faster than the encryption communication based on the first encryption processing unit 14, the encryption based on the second encryption processing unit 15 is performed. Enable communication. Thereby, even when the first cryptographic processing unit 14 can be applied, high-speed cryptographic communication is possible by applying the second cryptographic processing unit 15.

  In the first embodiment, an example in which a route search command is transmitted to the communication partner has been described. However, the communication apparatus holds information indicating a connection route with the communication partner in advance or acquires it by some means. If this is the case, transmission of this route search command is not necessary.

[Second Embodiment]
In the present embodiment, a switching process in which stronger encryption communication is prioritized will be described assuming a case where a large number of devices exist on the LAN. First, a functional configuration example of the communication apparatus according to the present embodiment will be described with reference to the block diagram of FIG. In FIG. 4, the same functional units as those shown in FIG. 1 are denoted by the same reference numerals, and description thereof will be omitted.

  The device total number acquisition unit 41 uses the communication unit 16 to acquire the number of devices (peripheral device number) that can communicate with the communication device and exist around the communication device. For example, in the case of a wired connection, the number of devices existing on the LAN may be acquired using a ping command. In the case of wireless connection, the number of devices existing in the vicinity may be acquired by using the Device Discovery function of Wi-Fi Direct. Of course, any method may be employed as long as the number of devices that can communicate with the communication device and are present in the periphery of the communication device can be acquired.

  The threshold value determination unit 42 determines whether the number of peripheral devices acquired by the total device number acquisition unit 41 is equal to or greater than a specified threshold value. This threshold value may be registered in advance in a memory (not shown) in the communication apparatus, or may be input to the apparatus by a user operating an operation unit (not shown) at an arbitrary timing. For example, “2” is set as the threshold when one-to-one communication is assumed. Further, for example, when connecting to another device at home, if the number of devices already existing at home is N, “N + 1” is set as the threshold value.

  Next, encryption communication performed between the communication device and the communication partner will be described with reference to the flowchart of FIG. Here, a file server on the LAN or a file server on the WAN is assumed as a communication partner. Among the processing steps shown in FIG. 5, the same processing steps as those shown in FIG. 3 are denoted by the same step numbers, and descriptions of the processing steps are omitted.

  In step S51, the device total number acquisition unit 41 uses the communication unit 16 to acquire the number of devices (peripheral device number) that can communicate with the communication device and exist around the communication device. In step S52, the threshold value determination unit 42 determines whether or not the number of peripheral devices acquired by the total device number acquisition unit 41 is equal to or greater than a prescribed threshold value. As a result of this determination, if the number of peripheral devices is equal to or greater than the prescribed threshold value, the process proceeds to step S311. If the number of peripheral devices is less than the prescribed threshold value, the process proceeds to step S35. By switching encryption communication according to the size comparison between the number of peripheral devices and the threshold, stronger encryption communication can be selected when there are more devices than the threshold around the communication device. .

  As described above, according to the present embodiment, when there are more devices than the threshold around the communication device, priority is given to the encrypted communication by the second encryption processing unit 15. Thereby, double encryption in data transmission / reception with a communication partner can be avoided, and encryption communication stronger than wireless encryption such as SSL can be applied depending on the situation.

[Third Embodiment]
Each functional unit shown in FIGS. 1 and 4 may be configured by hardware or software (computer program). In the latter case, any device having a memory that holds such a computer program and a processor that executes processing using the computer program and data held in the memory is applied to the communication device. be able to.

(Other examples)
The present invention can also be realized by executing the following processing. That is, software (program) that realizes the functions of the above-described embodiments is supplied to a system or apparatus via a network or various storage media, and a computer (or CPU, MPU, or the like) of the system or apparatus reads the program. It is a process to be executed.

Claims (5)

A specifying means for specifying a connection path to a communication partner;
A communication device comprising: a communication unit that performs encrypted communication corresponding to the connection path specified by the specifying unit with the communication partner. The specifying means is:
A route search command that is a command for searching for a connection route up to the communication partner is transmitted to the communication partner, and the connection route is transmitted from a response transmitted in response to the communication partner receiving the route search command. The communication apparatus according to claim 1, wherein the communication apparatus is specified. The communication means includes
The communication apparatus according to claim 1 or 2, wherein encryption communication corresponding to a connection path specified by the specifying unit is performed among a plurality of encryption communication having different speeds. Furthermore,
Means for obtaining the number of peripheral devices of the communication device;
The communication device according to any one of claims 1 to 3, wherein the communication unit performs stronger encrypted communication if the number is equal to or greater than a threshold value. A communication device control method comprising:
A specifying step in which the specifying unit of the communication device specifies a connection path to a communication partner;
A communication method for controlling a communication device, comprising: a communication unit configured to perform encryption communication corresponding to the connection path specified in the specifying step with the communication partner.

Images