JP2016213721A - Authentication method and authentication program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To allow even a terminal with low computing power to appropriately protect radio communication against attacks.SOLUTION: Radio stations 10 each obtain the signal strength of a signal transmitted by a communication device, a normal communication object, and each create a secret key on the basis of the obtained signal strength. The radio stations 10 each generate a communication frame on the basis of the created secret key, and transmit the communication frame to each other. Then, if the radio stations 10 receive a communication frame generated on the basis of the secret key, they authenticate and see if a communication device which is the transmission source of the communication frame is a normal communication object on the basis of the received communication frame.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an authentication method and an authentication program.

  In recent years, with the spread of public wireless LAN (Local Area Network) and WiFi (Wireless Fidelity) terminals, users can easily connect to the Internet even outside their homes.

  In public wireless LAN that can be used free of charge, communication may not be encrypted, and anyone can eavesdrop on the contents of the communication unless the user uses an encryption protocol such as SSL (Secure Sockets Layer). Since the user's connection destination is not authenticated by the password, the access point can be camouflaged.

  For this reason, attacks on the wireless LAN are problematic. For example, as an attack technique, a fake AP disconnects a connection between a legitimate AP (Access Point) and a legitimate client, and the fake AP impersonates the MAC (Media Access Control) address and SSID (Service Set Identifier) of the legitimate AP. Wireless LAN is attacked by connecting to a legitimate client, or connecting a legitimate client with a legitimate MAC address by connecting the legitimate client by spoofing the connection between the legitimate AP and the legitimate client. .

  Here, the attack method will be described with reference to the examples of FIGS. For example, as illustrated in FIG. 8, the connection between the regular AP 100 and the regular client 200 is disconnected using a deauthentication packet or the like that is a disconnection notification packet, and the MAC address and SSID of the regular AP 100 are impersonated, Is connected to the fake AP 300.

  Further, as illustrated in FIG. 9, the attacker disconnects the connection between the regular AP 100 and the regular client 200 using a deauthentication packet or the like, and impersonates the MAC address of the regular client 200, so that the fake client 400 is authorized. Connect to the AP 100 instead of the regular client 200.

  Further, as illustrated in FIG. 10, the attacker's terminal 600 disconnects communication between the regular radio station 500A and the regular radio station 500B each having an ad hoc communication function using a deauthentication packet or the like, By impersonating identification information such as the MAC address of the wireless station 500B, the wireless station 500A may be connected to the attacker's terminal 600 in some cases.

  Even if communication encryption processing is performed, the existing encryption protocol such as “IEEE802.11i” uses a strong password because the communication of the temporary key generation process is exchanged in plain text. If not, it can be deciphered in a realistic time. In addition, in an AP whose communication is not encrypted, an attacker can easily impersonate a legitimate communication partner simply by spoofing header information such as a MAC address exchanged in plain text. For this reason, an attacker can construct an AP impersonating a legitimate AP and disconnect the legitimate connection so that the user is not noticed and can connect to the spoofed AP.

  As an authentication technique for the attack as described above, there is known a technique for determining whether or not the communication partner is a regular communication by performing authentication using a certificate, authentication using a password, and authentication using an external DB.

T. Aono, K. Higuchi, T. Ohira, B. Komiyama, and H. Sasaoka, “Wireless Secret Key Generation Exploiting Reactance-Domain Scalar Response of Multipath Fading Channels”, IEEE Trans. Antennas Propag., Vol.53, no .11, pp.3776-3784, Nov. 2005. Sriram Nandha Premnath, et al. “Secret Key Extraction from Wireless Signal Strength in Real Environments”, IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL.12, NO.5, MAY 2013, Internet (http://ieeexplore.ieee.org/stamp /stamp.jsp?arnumber=6171198)

  However, since the amount of calculation in the authentication processing as described above increases, the processing load required for the authentication processing increases, and there is a problem that a terminal with low computing ability may not be able to appropriately defend against attacks on wireless communication. It was.

  For example, when authentication is performed using a public key in certificate authentication, the amount of calculation required for the authentication processing increases, so an authentication method using a public key is implemented in a terminal with low computing power. It was difficult. Further, for example, in the case of password authentication, there is a case where an attack on wireless communication cannot be appropriately prevented if a strong password is not used. Further, for example, in authentication using an external DB, an external DB is provided, or prior registration in the external DB is required, so that the operation cost for the authentication process increases.

  In order to solve the above-described problems and achieve the object, an authentication method of the present invention is an authentication method executed by a communication device, and the signal strength of a signal transmitted from a communication device that is a regular communication target is determined. An acquisition step of acquiring, a generation step of creating a secret key based on the signal strength acquired by the acquisition step, a communication frame is generated based on the secret key generated by the generation step, and the communication frame is In the case of receiving a transmission frame to be transmitted and a communication frame generated based on the secret key, based on the received communication frame, whether the communication device that is the transmission source of the communication frame is a regular communication target And an authentication step of authenticating.

  Further, the authentication program of the present invention creates a secret key based on an acquisition step of acquiring a signal strength of a signal transmitted from a communication device that is a regular communication target, and the signal strength acquired by the acquisition step. When generating a communication frame based on the creation step, the secret key created in the creation step, transmitting the communication frame, and when receiving the communication frame generated based on the secret key, Based on the received communication frame, the computer is caused to execute an authentication step of authenticating whether the communication device that is the transmission source of the communication frame is a regular communication target.

  According to the present invention, there is an effect that it is possible to appropriately prevent an attack on wireless communication even with a terminal having a low processing load for authentication processing and low computing ability.

FIG. 1 is a diagram illustrating an example of a configuration of a communication system according to the first embodiment. FIG. 2 is a block diagram showing the configuration of the radio station according to the first embodiment. FIG. 3 is a diagram illustrating a process for creating a secret key. FIG. 4 is a flowchart showing a flow of authentication processing by the radio station according to the first embodiment. FIG. 5 is a block diagram showing a configuration of a radio station according to the second embodiment. FIG. 6 is a flowchart showing a flow of authentication processing by the radio station according to the second embodiment. FIG. 7 is a diagram illustrating a computer that executes an authentication program. FIG. 8 is a diagram for explaining an impersonation action of a fake AP. FIG. 9 is a diagram for explaining an impersonation act of a fake client. FIG. 10 is a diagram for explaining an attacker's impersonation act.

  Embodiments of an authentication method and an authentication program according to the present application will be described below in detail with reference to the drawings. It should be noted that the authentication method and the authentication program according to the present application are not limited by this embodiment.

[First embodiment]
In the following embodiments, the configuration of the communication system, the configuration of the radio station, and the flow of processing of the radio station according to the first embodiment will be described in order, and finally the effects of the first embodiment will be described.

[Configuration of communication system]
FIG. 1 is a diagram illustrating an example of a configuration of a communication system according to the first embodiment. As shown in FIG. 1, the communication system 1 according to the first embodiment includes a radio station 10A and a radio station 10B. Assume that the wireless station 10A and the wireless station 10B recognize each other as a regular communication partner in the initial state.

  The radio stations 10A and 10B obtain signal strengths of signals transmitted from the communication devices that are regular communication targets, and create secret keys based on the obtained signal strengths. Then, the radio stations 10A and 10B each generate a communication frame based on the created secret key, and transmit the communication frame to each other. Thereafter, when the wireless stations 10A and 10B receive the communication frame generated based on the secret key, the communication device that is the transmission source of the communication frame is determined to be a regular communication target based on the received communication frame. Authenticate if there is.

  In the following description, the authentication process for the two radio stations 10A and 10B will be described. However, the present invention is not limited to this, and the present invention is applied to the authentication process performed between the AP and the client. May be. The two radio stations 10A and 10B are assumed to have the same configuration, and are described as radio stations 10 when they are described without being particularly distinguished.

[Configuration of radio station]
Next, the configuration of the radio station 10 shown in FIG. 1 will be described with reference to FIG. FIG. 2 is a block diagram showing a configuration of the radio station 10 according to the first embodiment. As illustrated in FIG. 2, the wireless station 10 includes a communication processing unit 11, a control unit 12, and a storage unit 13. The processing of each of these units will be described below. It should be noted that the signal strength collection time interval δ, bit string length n, interval average time interval α, constant β multiplied by the standard deviation σ, among other wireless stations recognized as regular communication partners, Assume that the hash function G is shared in advance.

  The communication processing unit 11 controls communication related to various information exchanged with other wireless stations. For example, the communication processing unit 11 performs transmission / reception of a reference packet for time synchronization and transmission / reception of a secret key with another wireless station.

  The storage unit 13 stores data and programs necessary for various processes performed by the control unit 12, and particularly includes a signal strength storage unit 13 a and a secret key storage unit 13 b that are closely related to the present invention. For example, the storage unit 13 is a semiconductor memory device such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.

  The signal strength storage unit 13a stores the signal strength of packets from other wireless stations recognized as regular communication partners. For example, the signal strength storage unit 13a stores a packet reception time and a packet signal strength in association with each other.

  The secret key storage unit 13b creates a secret key X created from the signal strength of packets from other radio stations collected at regular time intervals. For example, the secret key storage unit 13b stores, as the secret key X, an n-bit value negotiated in advance with another wireless station recognized as a regular communication partner. Note that the value of the secret key X is updated every predetermined time, but each time the value is updated, the value of the secret key X stored in the secret key storage unit 13b is overwritten.

  The control unit 12 has an internal memory for storing a program that defines various processing procedures and necessary data, and performs various processes using them, and particularly as closely related to the present invention, It has an acquisition unit 12a, a creation unit 12b, an execution unit 12c, a transmission unit 12d, and an authentication unit 12e.

  The acquisition unit 12a acquires the signal strength of a packet transmitted from a communication device that is a regular communication target. Specifically, a reference packet for time synchronization with another wireless station recognized as a regular communication partner is transmitted to each other, and the time at which the packet is transmitted and received is synchronized as a reference time, and synchronized communication The signal strength of the frame is collected every fixed time interval δ seconds and stored in the signal strength storage unit 13a.

  The creation unit 12b creates a secret key based on the signal strength acquired by the acquisition unit 12a. Specifically, the creation unit 12b reads the signal strength stored in the signal strength storage unit 13a, and creates a secret key according to the time change of the read signal strength.

  For example, the creating unit 12b uses n-bits determined in advance from each other in advance from δ · ω (ω is the number of collected communication frames per unit time) of signal strengths collected at regular time intervals of δ seconds. The value X is obtained as the secret key X. Here, the process of creating the secret key X will be described with reference to FIG. FIG. 3 is a diagram illustrating a process for creating a secret key. As illustrated in FIG. 3, it is assumed that the wireless stations A and B, which are regular communication partners, collect signal strength (dBm) at regular time intervals of δ seconds. Then, the creation unit 12b calculates a section average z for the latest α seconds.

  Then, the creation unit 12b sequentially determines whether the deviation from the section average z exceeds the section threshold value βσ with respect to the collected signal strength. As a result, when the signal strength is three consecutively and exceeds the section threshold βσ and the signal strength is stronger than the section average z, the secret key storage section is “1”, and when the signal strength is weaker than the section average z, the secret key storage section is “0”. A value is stored in 13b, and a bit string stored when n bits are stored is created as a secret key X. The secret key X is updated every ε seconds (ε> δ) decided in advance. Since it takes a certain amount of time for the attacker to disconnect the regular communication and to disguise the terminal information, it is possible to take over the connection even if the attacker is sniffing the secret key X by reducing the value of ε. It becomes difficult.

  For example, in the example of FIG. 3, the wireless station A sequentially determines whether or not the deviation from the section average z exceeds the section threshold value βσ for the collected signal strength, and first, the section has three consecutive signal strengths. Since the threshold value βσ is exceeded and the signal intensity is stronger than the section average, a bit of “1” is stored. Next, since the signal intensity exceeds the section threshold βσ for three consecutive times, the signal intensity is weaker than the section average, and therefore, the bit “0” is stored. Note that the time at which the signal strength corresponding to each bit is acquired may be stored in association with the secret key X.

  Then, the wireless station A recalculates the section average z for the latest α seconds, and repeats the process of sequentially determining whether the deviation from the section average z exceeds the section threshold βσ for the collected signal strength. As a result, in the example of FIG. 3, when n is “5”, a 5-bit bit string “1, 0, 1, 1, 0” is created as the secret key X. Note that the bit string (secret key X) may be created from the bits stored within a predetermined time without determining the length n of the bit string in advance.

  The wireless station B also performs the same processing, and similarly creates a 5-bit bit string “1, 0, 1, 1, 0” as the secret key X. The radio stations A and B collect the signal strength of the communication frame from the other party, and using the fact that signals using the same frequency at the same time have the same propagation characteristics, the time change of the signal strength It is possible to share the same secret key using the observed quantity obtained by observing.

  The execution unit 12c executes error correction of the secret key X when the creation of the secret key X is completed. For example, the execution unit 12c obtains the output value G (X) using the secret key X as a seed for the hash function G. Then, the output value G (X) is transmitted to another wireless station that is recognized as a regular communication partner, and the output value G (X) transmitted from the own apparatus and the output value G ( Determine whether X) matches. As a result, if they do not match, error correction using the error correction protocol is performed, and the process of transmitting the output values G (X) to each other is repeated until the output values G (X) match. As a result, it is possible to confirm that the correct X can be shared with other wireless stations recognized as regular communication partners.

  Note that the execution unit 12c executes error correction using, for example, a cascade protocol as an error correction protocol. In the cascade protocol, a key is randomly divided into a plurality of blocks, a parity is calculated, and if the parity does not match, an error is corrected using a binary search. By repeating this trial a plurality of times, the output values G (X) can be matched with high probability. Further, by making the length of the bit string used as the output value G (X) shorter than the secret key X, the information of the secret key X is rounded off, making it difficult to decrypt.

  The transmission unit 12d generates a communication frame based on the secret key X created by the creation unit 12b, and transmits the communication frame to another wireless station that is recognized as a regular communication partner. Specifically, the transmission unit 12d adds the secret key X created by the creation unit 12b to the communication frame, and transmits the communication frame to another wireless station that is recognized as a regular communication partner.

  When the authentication unit 12e receives a communication frame generated based on the secret key X, the authentication unit 12e authenticates based on the received communication frame whether the communication device that is the transmission source of the communication frame is a regular communication target. To do. Specifically, when the authentication unit 12e receives a communication frame to which the secret key X is added, the authentication device 12e uses the received secret key X and the communication device that transmitted the communication frame is an authorized wireless terminal. It authenticates whether it is.

  For example, when the authentication unit 12e receives a communication frame to which the secret key X is added, the value of the received secret key X matches the value of the secret key X stored in the secret key storage unit 13b. If they match, the communication frame is accepted as a regular communication partner, and if they do not match, the communication frame is discarded.

[Wireless station processing flow]
First, processing in the radio station 10 according to the first embodiment will be described with reference to FIG. FIG. 4 is a flowchart showing a flow of authentication processing by the radio station according to the first embodiment.

  As illustrated in FIG. 4, the acquisition unit 12a of the wireless station 10 transmits a reference packet for time synchronization with another wireless station that is recognized as a regular communication partner (step S101). Then, the acquisition unit 12a synchronizes with the time at which the packet was transmitted / received as a reference time, and collects the signal strength of the synchronized communication frame at regular time intervals δ seconds (step S102).

  Subsequently, the creating unit 12b creates the secret key X from the time series change of the signal strength (Step S103). For example, the creating unit 12b uses n-bits determined in advance from each other in advance from δ · ω (ω is the number of collected communication frames per unit time) of signal strengths collected at regular time intervals of δ seconds. The value X is obtained as the secret key X.

  Then, the execution unit 12c transmits the output value G (X) when using the X of the hash function G determined in advance as a seed to other wireless stations that are recognized as regular communication partners (step S104). . Then, the execution unit 12c determines whether the value of the output value G (X) received from another radio station matches the value of the output value G (X) held by itself (step S105). As a result, when it is determined that they do not match (No at Step S105), the execution unit 12c performs error correction by the cascade protocol (Step S106), and returns to Step S104.

  If it is determined that the execution units 12c match (Yes at Step S105), the transmission unit 12d adds the secret key X to the communication frame (Step S107). Then, the transmission unit 12d transmits the communication frame to and from other wireless stations that are recognized as regular communication partners.

  Then, the authentication unit 12e determines whether or not a correct secret key is added to the communication frame received from the communication partner (step S108). For example, when the authentication unit 12e receives a communication frame to which the secret key X is added, the value of the received secret key X matches the value of the secret key X stored in the secret key storage unit 13b. It is determined whether or not.

  As a result, when it is determined that the correct secret key is added (Yes at Step S108), the authentication unit 12e accepts the communication frame as a regular communication partner (Step S110), and returns to Step S102. If the authentication unit 12e determines that the correct private key is not added (No at Step S108), the authentication unit 12e discards the communication frame (Step S109).

[Effect of the first embodiment]
As described above, the radio station 10 according to the first embodiment collects signal strengths with radio stations that are recognized as regular communication counterparts, and signals in the same period have the same propagation characteristics. By utilizing this, it is possible to share a secret key using an observation amount obtained by observing a change in signal strength over time, and appropriately take over the wireless LAN.

  In addition, it is possible to prevent session hijacking between legitimate terminals without depending on the protocol above the physical layer or the computing capacity of the terminals. That is, unlike the authentication method using a certificate or a public key, only the calculation of the hash function is used. Therefore, it is possible to prevent the wireless LAN from being hijacked even by a terminal having a low calculation capability.

[Second Embodiment]
By the way, in the first embodiment described above, the case where the value of the secret key X is directly added to the communication frame has been described. However, the present invention is not limited to this, and it is determined in advance using the secret key X. An authentication code may be generated from the rules, and the generated authentication code may be added to the communication frame.

Therefore, in the following description of the second embodiment, the bit string X, which is a secret key, is decomposed into bit strings X ₁ and X ₂ having a predetermined length, and an appropriate hash function F and the number k of authentication codes are obtained. An example will be described in which (δ · ω ≦ k <2 ^ n) is given, and authentication codes are sequentially added to the body of subsequent communication frames from the authentication code list S.

  First, the configuration of the radio station 10a according to the second embodiment will be described with reference to FIG. FIG. 5 is a block diagram showing a configuration of a radio station according to the second embodiment. As shown in FIG. 5, the radio station 10a is different from the radio station 10 described in FIG. 2 in that it includes a generation unit 12f and an authentication code storage unit 13c. The processing of each of these units will be described below.

The generation unit 12f generates a predetermined number of authentication codes from predetermined rules using the secret key generated by the generation unit 12b. Specifically, the generating unit 12f reads the secret key X stored in the secret key storage unit 13b, the read decomposed into a bit string bit string X a length prearranged X ₁ and bit sequence X ₂ is a secret key To do. Then, a list S having a set of k authentication codes is generated using the hash function F, the bit string X ₁ , and the bit string X ₂ and stored in the authentication code storage unit 13c.

Generating unit 12f may, for example, decomposed bit sequence of the private key prearranged length n in IV (Initialization Vector) moiety X ₁ of length i and list generation seed X ₂ length j (i + j = n) Generate k authentication code pairs (the hash seed is max (i, j) bits). For example, the generation unit 12f sets “key 1: F (X ₁ ) = Y ₁ ”, “key 2: F (X ₁ + X ₂ ) = Y ₂ ”, etc. as a set of k authentication codes. “Key k: F (X ₁ + (k−1) X ₂ ) = Y _k ” is generated.

The generation unit 12f may decompose the length n of the bit string of the secret key into X ₁ (mbit) and X ₂ (n-mbit), and generates k authentication code sets (k <2 ^ N). In this case, for example, the generation unit 12f sets “Key 1: F (X ₁ || (X ₂ xor Y ₀ )) = Y _1” , “Key 2: F as a set of k authentication codes. (X ₁ || (X ₂ xor Y ₁ )) = Y ₂ ”,“ Key k: F (X ₁ || (X ₂ xor Y _k−1 )) = Y _k ”is generated. Here, Y ₀ is an initial value of a recognition code shared in advance.

The transmission unit 12d adds the authentication code generated by the generation unit 12f to the communication frame, and transmits the communication frame. Specifically, the transmission unit 12d alternately adds a set of _k authentication codes Fk in the list S to the communication frame and transmits to / from a wireless station that is a regular communication partner.

When receiving the communication frame to which the authentication code is added, the authenticating unit 12e uses the received authentication code to authenticate whether the communication device that has transmitted the communication frame is a legitimate wireless terminal. . For example, since the transmission unit 12d alternately adds and transmits _k authentication code sets F _k in the list S to the communication frame, the authentication unit 12e receives the communication frame to which the authentication code is added. The authentication code stored in the authentication code storage unit 13c is referred to authenticate whether the correct key is added to the communication frame in the correct order. As a result, if the correct authentication code is added in the correct order, it is judged as a communication frame from an authorized communication partner and the communication frame is accepted, and if an incorrect order or an incorrect value is added, an invalid terminal The communication frame is discarded.

As in the first embodiment, the secret key X is updated every ε seconds determined in advance. The smaller the value of ε and k in the above ranges (ε> δ, δ · ω ≦ k <2 ⁿ ), the smaller the secret key information given to the eavesdropper, so the list S can be expected. It becomes more difficult.

  Next, processing in the radio station 10a according to the second embodiment will be described with reference to FIG. FIG. 6 is a flowchart showing a flow of authentication processing by the radio station according to the second embodiment.

  As illustrated in FIG. 6, the acquisition unit 12a of the wireless station 10a transmits a reference packet for time synchronization with another wireless station that is recognized as a regular communication partner (step S201). Then, the acquisition unit 12a synchronizes with the time at which the packet was transmitted / received as a reference time, and collects the signal strength of the synchronized communication frame at regular time intervals δ seconds (step S202).

  Subsequently, the creating unit 12b creates the secret key X from the time series change of the signal strength (Step S203). For example, the creating unit 12b uses n-bits determined in advance from each other in advance from δ · ω (ω is the number of collected communication frames per unit time) of signal strengths collected at regular time intervals of δ seconds. The value X is obtained as the secret key X.

  Then, the execution unit 12c transmits the output value G (X) when the X of the hash function G determined in advance is used as a seed to other wireless stations that are recognized as regular communication partners (step S204). . Then, the execution unit 12c determines whether the value of the output value G (X) received from another wireless station matches the value of the output value G (X) held by itself (step S205). As a result, when it is determined that they do not match (No at Step S205), the execution unit 12c performs error correction by the cascade protocol (Step S206), and returns to Step S204.

  If it is determined that the execution units 12c match (Yes at Step S205), the generation unit 12f generates k sets of authentication codes from the secret key X using an algorithm determined in advance (Step S207). Then, the transmission unit 12d adds an authentication code to the communication frame (step S208). Then, the transmission unit 12d transmits the communication frame to and from other wireless stations that are recognized as regular communication partners.

  Then, the authentication unit 12e determines whether or not the authentication codes in its list S are added in the correct order to the communication frame received from the communication partner (step S209). As a result, if the authentication unit 12e determines that the authentication codes are added in the correct order (Yes at Step S209), the authentication unit 12e accepts the communication frame as a regular communication partner (Step S211), and returns to Step S202. . If it is determined that the authentication codes are not added in the correct order (No at Step S209), the authentication unit 12e discards the communication frame (Step S210).

[Effect of the second embodiment]
Thus, the radio station 10a according to a second embodiment, is decomposed into the bit string X length bit string that prearranged X ₁ and X ₂ is a secret key, a suitable hash function F and an authentication code The number k (δ · ω ≦ k <2 ^ n) is given, and the authentication code is added to the body of the subsequent communication frame in order from the list S of authentication codes. Since authentication is performed, it is possible to appropriately prevent a wireless communication attack even with a terminal having a low computing ability.

[System configuration, etc.]
Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. Further, all or any part of each processing function performed in each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic.

  In addition, among the processes described in this embodiment, all or part of the processes described as being automatically performed can be manually performed, or the processes described as being manually performed All or a part of the above can be automatically performed by a known method. In addition, the processing procedure, control procedure, specific name, and information including various data and parameters shown in the above-described document and drawings can be arbitrarily changed unless otherwise specified.

[program]
FIG. 7 is a diagram illustrating a computer that executes an authentication program. The computer 1000 includes, for example, a memory 1010 and a CPU (Central Processing Unit) 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. The serial port interface 1050 is connected to a mouse 1051 and a keyboard 1052, for example. The video adapter 1060 is connected to the display 1061, for example.

  The hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the radio stations 10 and 10a is implemented as a program module 1093 in which a code executable by a computer is described. The program module 1093 is stored in the hard disk drive 1031, for example. For example, a program module 1093 for executing processing similar to the functional configuration in the radio stations 10 and 10a is stored in the hard disk drive 1031. The hard disk drive 1031 may be replaced by an SSD (Solid State Drive).

  Further, the setting data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, the memory 1010 or the hard disk drive 1031. Then, the CPU 1020 reads the program module 1093 and the program data 1094 stored in the memory 1010 and the hard disk drive 1031 to the RAM 1012 as necessary, and executes them.

  Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1031, but may be stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive 1041 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). Then, the program module 1093 and the program data 1094 may be read by the CPU 1020 from another computer via the network interface 1070.

10, 10a Wireless station 11 Communication processing unit 12 Control unit 12a Acquisition unit 12b Creation unit 12c Execution unit 12d Transmission unit 12e Authentication unit 12f Generation unit 13 Storage unit 13a Signal strength storage unit 13b Private key storage unit 13c Authentication code storage unit

Claims (5)

An authentication method executed by a communication device,
An acquisition step of acquiring the signal strength of a signal transmitted from a communication device that is a regular communication target;
A creation step for creating a secret key based on the signal strength obtained by the obtaining step;
Generating a communication frame based on the secret key created by the creation step, and transmitting the communication frame;
When receiving a communication frame generated based on the secret key, based on the received communication frame, an authentication step of authenticating whether the communication device that is the transmission source of the communication frame is a regular communication target;
The authentication method characterized by including.   The authentication method according to claim 1, wherein the creating step creates the secret key according to a time change of the signal strength obtained by the obtaining step. The transmission step adds the secret key created in the creation step to a communication frame, transmits the communication frame,
When receiving the communication frame with the secret key added, the authentication step uses the received secret key to authenticate whether the communication device that transmitted the communication frame is a legitimate wireless terminal. The authentication method according to claim 1, wherein: Using a secret key created by the creating step, further including a generating step of generating a predetermined number of authentication codes from a predetermined rule;
The transmission step adds the authentication code generated by the generation step to a communication frame, transmits the communication frame,
In the authentication step, when the communication frame to which the authentication code is added is received, the received authentication code is used to authenticate whether the communication device that transmitted the communication frame is a legitimate wireless terminal. The authentication method according to claim 1 or 2, wherein: An acquisition step of acquiring the signal strength of a signal transmitted from a communication device that is a regular communication target;
A creating step for creating a secret key based on the signal strength obtained by the obtaining step;
Generating a communication frame based on the secret key created by the creating step, and transmitting the communication frame;
When receiving a communication frame generated based on the secret key, based on the received communication frame, an authentication step of authenticating whether the communication device that is the transmission source of the communication frame is a regular communication target;
An authentication program that causes a computer to execute.

Images