JP6422254B2 - COMMUNICATION DEVICE, COMMUNICATION DEVICE CONTROL METHOD, AND PROGRAM - Google Patents

Description

  The present invention relates to a communication apparatus that performs encryption settings related to communication.

  In a wireless network compliant with the IEEE 802.11 series, packets that are wirelessly communicated are encrypted using various encryption methods (Patent Document 1). Here, the IEEE is The Institute of Electrical and Electronics Engineers, Inc. Is an abbreviation. In addition, it is possible to perform IP communication conforming to IP (Internet Protocol) on a wireless network conforming to the IEEE 802.11 series. Also in IP communication, for example, a packet can be encrypted by using IPSec (Security Architecture for the Internet Protocol).

Special table 2007-510191 gazette

  However, conventionally, the setting of the encryption method used in the wireless network and the encryption setting in the IP communication are individually performed, and the following problems have occurred.

  That is, even when the security is sufficiently ensured by the encryption method used in the wireless network, encryption settings with high security strength are set in IP communication, and the processing load on the apparatus may increase. It was.

  In addition, despite the low security strength of encryption schemes used in wireless networks, encryption settings with low security strength are also set in IP communication, and sufficient security may not be ensured.

  In view of the above problems, an object of the present invention is to make a setting for encrypting the second communication based on the encryption method used in the first communication.

  In view of the above problems, a communication device according to the present invention includes a first communication unit that performs first communication with another communication device in accordance with the first communication protocol, and a second communication device that is different from the first communication protocol. A second communication unit that performs the second communication using the first communication with the other communication device in accordance with a communication protocol, and one of the first communication and the second communication. And setting means for setting encryption processing and authentication processing in the other communication based on the encryption method used in the communication and the presence or absence of the authentication processing in the communication.

  According to the present invention, it is possible to perform setting for encrypting the second communication based on the encryption method used in the first communication.

Network configuration diagram Hardware configuration diagram of communication apparatus 101 Flowchart realized by communication device 101 Table showing characteristics of cryptographic algorithms

  FIG. 1 shows the system configuration of this embodiment.

  The communication device 101 and the counterpart device 102 perform wireless communication conforming to the IEEE (The Institute of Electrical and Electronics Engineers, Inc.) 802.11 series. The communication device 101 and the partner device 102 are, for example, a camera, a printer, a smartphone, a PC, a server, a storage, a projector, a router, a vehicle, and the like.

  Further, the communication apparatus 101 and the partner apparatus 102 perform IP communication based on the Internet Protocol (hereinafter referred to as IP) on the wireless communication based on the IEEE802.11 series (upper layer of wireless communication). In other words, the communication device 101 and the partner device 102 perform communication based on a plurality of communication protocols in different layers (over a plurality of layers).

  Here, the layer refers to each communication layer (hierarchy) in the OSI reference model. Wireless communication in the IEEE 802.11 series corresponds to a data link layer or a physical layer. On the other hand, IP communication corresponds to a network layer. The network layer corresponds to an upper layer (upper layer) of the data link layer and the physical layer.

  In the present embodiment, the communication apparatus 101 operates as a station (STA) compliant with the IEEE 802.11 series. On the other hand, the partner apparatus 102 operates as a base station conforming to the IEEE 802.11 series. Here, the base station is, for example, an access point (AP) conforming to the IEEE802.11 series or a Group Owner (GO) defined by Wi-Fi. The base station periodically transmits a beacon as a notification signal to form the wireless network 110.

  The communication device 101 can be connected to the Internet 111 via the partner device 102. The communication device 101 can communicate with the external device 104 via the Internet 111.

  The other communication device 103 is a device belonging to the wireless network 110 formed by the counterpart device 102. The other communication devices 103 also perform wireless communication and IP communication that comply with the IEEE 802.11 series.

  FIG. 2 shows a hardware configuration of the communication apparatus 101.

  The storage unit 201 includes a ROM and a RAM, and stores various information such as a program for performing various operations described later and communication parameters for wireless communication. In addition to the memory such as ROM and RAM, the storage unit 201 is a storage medium such as a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, a nonvolatile memory card, and a DVD. May be used.

  The control unit 202 is configured by a CPU or MPU, and controls the entire communication apparatus 101 by executing a program stored in the storage unit 201. Note that the entire communication apparatus 101 may be controlled in cooperation with an OS (Operating System) executed by the control unit 202.

  The control unit 202 also controls the function unit 203 to execute predetermined processing such as imaging, printing, and projection. The functional unit 203 is hardware for the communication apparatus 101 to execute predetermined processing. For example, when the communication apparatus 101 is a camera, the function unit 203 is an imaging unit and performs an imaging process. For example, when the communication apparatus 101 is a printer, the function unit 203 is a printing unit, and performs a printing process. For example, when the communication apparatus 101 is a projector, the function unit 203 is a projection unit, and performs a projection process. The data processed by the function unit 203 may be data stored in the storage unit 201 or data communicated with another communication device via the communication unit 207 described later.

  The input unit 204 receives various operations from the user. The output unit 205 performs various outputs to the user. Here, the output includes at least one of display on a screen, sound output by a speaker, vibration output, and the like. Note that both the input unit 204 and the output unit 205 may be realized by one module like a touch panel.

  The encryption unit 206 performs encryption processing for wireless communication and IP communication. As encryption of IP communication, IPSec (Security Architecture for the Internet Protocol) defined by RFC is used. IPSec provides a data falsification prevention function and a secret function for each IP packet. Specifically, the above function is provided by performing authentication processing using AH (Authentication Header) and IP packet encryption processing using ESP (Encapsulated Security Payload). Also, the encryption key sharing process used in IPSec is performed by IKE (Internet Key Exchange protocol).

  Note that the IP packet encrypted by IPSec is encrypted up to the final destination device regardless of inside or outside the wireless network 110. On the other hand, encryption in wireless communication is effective only within the wireless network 110, and encryption is released outside the wireless network 110.

  The communication unit 207 performs wireless communication control and IP communication control conforming to the IEEE 802.11 series. In addition, the communication unit 207 controls the antenna 208 to transmit and receive wireless signals for wireless communication. In addition, the communication unit 207 can control the encryption unit 206 to perform wireless communication and IP communication using the encrypted data.

  These hardware modules are connected to each other via a bus circuit.

  FIG. 3 shows a flowchart of the flow of processing realized by the control unit 202 reading and executing the program stored in the storage unit 201 when the communication device 101 starts communication with the counterpart device 102. . Here, in response to the user instructing the communication device 102 to start communication via the input unit 204, the communication device 101 starts the processing shown in FIG. However, the present invention is not limited to this, and the communication apparatus 101 may automatically start the processing shown in FIG. 3 when the communication apparatus 101 enters the communication range of the counterpart apparatus 102.

  When the process shown in FIG. 3 is started as described above, the communication apparatus 101 detects the wireless network formed by the partner apparatus 102 (S301). Specifically, the communication device 101 uses the communication unit 207 to search for each frequency channel. And the communication apparatus 101 detects a wireless network by receiving the alerting signal which the other party apparatus 102 is transmitting. The communication device 101 transmits a search signal for searching for a wireless network using the communication unit 207, and receives a search response signal from the counterpart device 102 that has received the search signal. May be detected. Here, the search signal is, for example, a Probe Request signal conforming to the IEEE 802.11 series, and the search response signal is, for example, a Probe Response signal conforming to the IEEE 802.11 series.

  When the communication device 101 detects the wireless network, the communication device 101 performs wireless connection processing with the counterpart device 102 forming the wireless network (S302). Specifically, the communication apparatus 101 transmits a connection request signal to the counterpart apparatus 102 using the communication unit 207, and receives a connection response signal from the counterpart apparatus 102 that has received the connection request signal. In this way, the wireless connection process of the communication apparatus 101, the partner apparatus 102, and the wireless connection process is completed. Here, the connection request signal is, for example, an Association Request signal that conforms to the IEEE 802.11 series, and the connection response signal is, for example, an Association Response signal that conforms to the IEEE 802.11 series.

  Next, the communication apparatus 101 determines whether to perform communication (encrypted communication) using an encrypted packet in wireless communication with the counterpart apparatus 102 (S303). The notification signal periodically transmitted by the partner apparatus 102 includes information indicating a wireless communication encryption algorithm (encryption method). As encryption algorithms for wireless communication, for example, there are WEP, WPA (including TKIP), and WPA2 (including AES) for performing encrypted communication. The information indicating the encryption algorithm for wireless communication includes information indicating whether encryption communication is performed using WEP, WPA, or WPA2, or information indicating that encryption communication is not performed. Note that the wireless communication encryption algorithm used here is not limited to WEP, WPA, and WPA2, and other algorithms may be used.

  More specifically, regarding the processing of S303, whether or not to perform encrypted communication using WEP is indicated by a WEP bit included in a beacon or a Probe Response signal. In the case of WEP, the WEP bit is 1. Whether or not to perform encrypted communication using WPA or WPA2 is indicated by an RSN IE included in a beacon or a Probe Response signal.

  The communication device 101 can determine whether or not to perform cryptographic communication with the counterpart device 102 by analyzing the notification signal received from the counterpart device 102. Note that the search response signal transmitted by the counterpart apparatus 102 also includes information indicating the encryption algorithm for wireless communication. Therefore, the communication apparatus 101 can determine whether or not to perform encrypted communication with the counterpart apparatus 102 by analyzing the search response signal received from the counterpart apparatus 102. In addition, the present invention is not limited to this, and it may be determined whether or not to perform encrypted communication with the counterpart apparatus 102 based on the content input by the user via the input unit 204. That is, information indicating whether or not to perform encrypted communication based on the content input by the user via the input unit 204 is stored in the storage unit 201, and the control unit 202 determines whether or not to perform encrypted communication based on this information. Determine.

  When performing encrypted communication, the communication apparatus 101 determines whether or not an encryption key used for encrypted communication in wireless communication is periodically updated (S304). As described above, the notification signal and the search response signal periodically transmitted by the counterpart apparatus 102 include information indicating the encryption algorithm for wireless communication. Furthermore, as shown in FIG. 4, it is determined for each encryption algorithm whether or not the encryption key is periodically updated. For example, in WPA, the encryption key is repeatedly changed every predetermined period. Here, the communication apparatus 101 stores the correspondence table shown in FIG. 4 in the storage unit 201, searches the correspondence table based on the wireless communication encryption algorithm information acquired from the notification signal or the search response signal, and performs encryption. It is determined whether the key is updated periodically. Further, the present invention is not limited to this, and the user may input information on whether or not the encryption key is periodically updated via the input unit 204, and the control unit 202 may determine based on this information. Good.

  When the encryption key is periodically updated, the communication apparatus 101 determines whether authentication processing is performed on a packet transmitted / received by encrypted communication in wireless communication (S305). As shown in FIG. 4, it is determined for each encryption algorithm whether or not authentication processing (packet authentication) for a packet is performed. Here, the communication apparatus 101 stores the correspondence table shown in FIG. 4 in the storage unit 201, searches the correspondence table based on the information of the encryption algorithm of the wireless communication acquired from the notification signal or the search response signal, and packet It is determined whether or not authentication processing is performed. Further, the present invention is not limited to this, and the user may input information on whether or not the authentication process is performed on the packet via the input unit 204.

  If an affirmative determination is made in any of S303, S304, and S305, the process proceeds to S306. In step S <b> 306, when the communication apparatus 101 performs IP communication with the counterpart apparatus 102 or another communication apparatus 103 that belongs to the wireless network 110, the setting for IPSec is performed based on the determination result as described below.

  That is, the communication apparatus 101 does not periodically update the encryption key in IPSec, and does not perform packet authentication in IPSec (S306). Thereby, when sufficient cryptographic processing is performed in wireless communication, the processing load can be reduced while ensuring security by reducing the cryptographic processing in IPSec.

  In addition, when an affirmative determination is made in S303 and S304, but a negative determination is made in S305, the process proceeds to S307. In step S <b> 307, when the communication apparatus 101 performs IP communication with the counterpart apparatus 102 or another communication apparatus 103 that belongs to the wireless network 110, the communication apparatus 101 performs settings for IPSec as described below based on the determination result.

  That is, the communication apparatus 101 does not periodically update the encryption key in IPSec, but sets to perform packet authentication in IPSec (S307). Thereby, instead of performing packet authentication in wireless communication, security can be ensured by performing packet authentication in IPSec. Also, since the encryption key is not periodically updated in IPSec, the processing load can be reduced.

  In step S307, the communication apparatus 101 may be set not to perform IPSec. As a result, the processing load can be further reduced.

  If a negative determination is made in either S303 or S304, the process proceeds to S308. In S <b> 308, when the communication apparatus 101 performs IP communication with the counterpart apparatus 102 or another communication apparatus 103 that belongs to the wireless network 110, based on the determination result, the communication apparatus 101 performs settings for IPSec as described below.

  In other words, the communication apparatus 101 is configured to periodically update the encryption key in IPSec and further perform packet authentication in IPSec (S308). This setting has higher security strength than a setting that does not periodically update the encryption key in IPSec or does not perform packet authentication in IPSec. Thereby, when the security strength ensured by wireless communication is low, security can be ensured by IPSec.

  Then, the communication apparatus 101 communicates with the counterpart apparatus 102 using the IPSec set in S306 to 308 (S309). The contents set in S306 to 308 are stored in the storage unit 201, and the control unit 202 causes the communication unit 207 to perform communication according to the setting contents stored in the storage unit 201. When the communication device 101 ends communication with the counterpart device 102 (Yes in S310), the processing shown in the flowchart is ended and the state transitions to a standby state. Note that the case where the communication ends is, for example, a case where the user of the communication apparatus 101 instructs the end of communication via the input unit 204. For example, this is a case where a signal indicating the end of communication is received from the partner apparatus 102.

  In any of the cases of S306 to 308, when the communication apparatus 101 communicates with an apparatus that does not belong to the wireless network 110 (for example, the external apparatus 104), it is for IPSec as follows. Set up. That is, the communication apparatus 101 performs communication with a setting for periodically updating the encryption key in IPSec and further performing packet authentication in IPSec. That is, whether to use the setting for IPSec determined according to the flowchart shown in FIG. 3 is switched according to the destination to which data is transmitted.

  In this way, when communicating with a device outside the wireless network to which the communication device 101 belongs, encryption processing in IPSec is sufficiently performed, so that, for example, data security can be ensured also in the Internet 111.

  In the above-described embodiment, the characteristics of the encryption algorithm in wireless communication are sequentially determined in S303 to S305. However, the present invention is not limited to this, and IPSec setting may be performed according to the encryption algorithm. That is, if the wireless communication encryption algorithm is WPA2, the process may proceed to S306, if it is WPA, the process proceeds to S307, and if there is no encryption in WEP or wireless communication, the process may proceed to S308. In this case, since the processing of S303 to S306 can be omitted, the processing load on the communication apparatus 101 is reduced.

  Further, when the base station to which the communication apparatus 101 is connected is changed due to a handover or the like, the processing from S303 may be re-executed to determine the IPSec setting again. Thereby, IPSec setting according to a base station can be performed.

  In the above-described embodiment, the wireless communication conforming to the IEEE 802.11 series has been described. However, the present invention is not limited to this, and other communication media such as wireless USB, MBOA, Bluetooth (registered trademark), UWB (WUSB, W1394, WINET), ZigBee, and Ethernet (registered trademark) may be used. MBOA is an abbreviation for Multi Band OFDM Alliance.

  As described above, even if the user does not manually select the setting for IPSec, the appropriate IPSec setting corresponding to the encryption algorithm used in the wireless network is performed. Therefore, user convenience is improved.

  Further, when the security strength of an encryption algorithm used in a wireless network is high, the processing load on the communication apparatus can be reduced while protecting the security by setting the security strength of IPSec low.

  Further, when the security strength of an encryption algorithm used in a wireless network is low, security of data communication can be ensured by setting the security strength of IPSec high.

  Further, the IPSec setting may be changed based on whether or not the communication partner is a device in the wireless network in which the communication partner (the communication device 101) participates. That is, when the device is not a device in the wireless network in which the device is participating, it is possible to ensure end-to-end security by performing communication using the IPSec setting with high security strength. Note that in the case of a device in a wireless network, communication is performed using an IPSec setting with a security strength corresponding to the security strength of the wireless network, so that end-to-end security can also be ensured.

  In the above-described embodiment, IPSec setting with security strength corresponding to the security strength of the wireless network is performed. However, the present invention is not limited to this. For example, when it is known from before wireless setting that communication using IPSec is performed, setting is performed so that the wireless network has a security strength corresponding to the security strength of IPSec. Also good.

  Further, for example, the security of another layer may be set so that the security strength according to the security strength of one layer in the OSI reference model is obtained. For example, the security strength of IPSec that is the network layer in the OSI reference model may be set to be lower as the security strength in HTTP that is the application layer in the OSI reference model is higher.

  In this way, when communicating using a plurality of protocols or layers, the encryption method in the other protocol or layer can be set based on the encryption method in one protocol or layer. In particular, the higher the encryption strength of the encryption method in one protocol or layer, the lower the encryption method in the other protocol or layer. Thereby, security can be ensured while reducing the processing load.

  Also, a process of supplying a program that realizes one or more functions of the above-described embodiment to a system or apparatus via a network or a storage medium, and one or more processors in a computer of the system or apparatus reading and executing the program But it is feasible. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

  The present invention has several effects from one or more of the above.

101 communication device 102 partner device 103 other communication device 104 external device 110 wireless network 111 internet

Claims (16)

A communication device,
First communication means for performing first communication in accordance with the first communication protocol with another communication device;
A second communication unit that conforms to a second communication protocol different from the first communication protocol, and performs second communication using the first communication with the other communication device;
Based on the encryption method used in one of the first communication and the second communication and the presence / absence of the authentication process in the communication, the encryption process and the authentication process in the other communication are set. Setting means;
A communication apparatus comprising:   The communication apparatus according to claim 1, wherein the first communication is communication in a lower layer of the second communication. When the first communication uses the first encryption method, the setting means performs the first setting,
When the first communication uses a second encryption method whose security strength is higher than that of the first encryption method, the setting means performs a second setting whose security strength is lower than that of the first setting. The communication apparatus according to claim 1 or 2, characterized in that:   When the encryption key used in the encryption method used in the first communication is periodically updated, the setting unit sets the encryption key not to be periodically updated in the encryption processing in the second communication. The communication device according to any one of claims 1 to 3, wherein   2. The method according to claim 1, wherein when the encryption method used in the first communication performs packet authentication, the setting means sets so as not to perform packet authentication in the encryption processing in the second communication. 5. The communication device according to any one of items 1 to 4. Transmitting means for transmitting a search signal to the other communication device;
Receiving means for receiving a response signal transmitted in response to the search signal by the other communication device;
A determination means for determining an encryption method used in the first communication based on the response signal;
6. The communication apparatus according to claim 1, wherein the setting unit sets encryption processing in the second communication based on the encryption method determined by the determination unit. .   The communication apparatus according to claim 1, wherein the first communication is wireless communication. The first communication protocol is one of protocols conforming to the IEEE 802.11 series,
The communication apparatus according to claim 1, wherein the second communication protocol is IP (Internet Protocol).   The other communication device is an access point conforming to the IEEE 802.11 series, and when a handover for changing the access point to which the communication device is connected is executed, the setting unit is configured to communicate with the access point after the change. The encryption process and the authentication process in the second communication are set again based on the encryption method used in the first communication and the presence or absence of the authentication process in the first communication. Item 9. The communication device according to Item 8.   The communication apparatus according to claim 1, wherein the encryption processing in the second communication is IPSec.   The apparatus further comprises switching means for switching whether or not the setting by the setting means is used as a setting for encrypting the second communication in accordance with a partner apparatus as a destination to which data is transmitted. Item 11. The communication device according to any one of Items 1 to 10.   The communication device according to any one of claims 1 to 11, wherein the communication device is a camera having an imaging unit for further imaging.   The communication device according to claim 1, wherein the communication device is a printer having a printing unit for further printing.   The communication device according to any one of claims 1 to 11, wherein the communication device is a projector having a projection unit for further projecting. A communication device control method comprising:
A first communication step of performing a first communication in accordance with a first communication protocol with another communication device;
A second communication step that conforms to a second communication protocol different from the first communication protocol and performs second communication using the first communication with the other communication device;
Based on the encryption method used in one of the first communication and the second communication and the presence / absence of the authentication process in the communication, the encryption process and the authentication process in the other communication are set. A setting process;
A control method characterized by comprising:   The program for operating a computer as a communication apparatus of any one of Claim 1 to 11.

Images