JP2005051368A - COMMUNICATION DEVICE, BASE STATION DEVICE, AND COMMUNICATION SYSTEM - Google Patents

Abstract

A wireless communication system that provides a wireless communication connection service with restrictions on time and place is provided.
A communication system in which a first communication device and a second communication device communicate with each other using encryption, wherein the first communication device and the second communication device are a first common key shared by both devices. First key holding means for holding, second key generation means for generating a second common key based on a result of calculating position information and time information of the second communication device and the first common key, and An encryption unit that generates a ciphertext using a second common key and a decryption unit that decrypts a ciphertext encrypted using the second common key.
[Selection] Figure 2

Description

[0001]
[Technical field to which the invention belongs]
The present invention relates to an encryption device for encrypting wireless communication performed between a communication device such as a base station and a terminal.
[0002]
[Prior art]
As a wireless communication system that performs high-speed and large-volume data transmission, a time-division multi-carrier transmission system that divides data to be transmitted in time series and performs transmission using two or more same or different frequencies has been proposed. . At that time, a common key cryptosystem is used as a high-speed cryptosystem for the purpose of data concealment in order to secure a secure communication path between the transmission side and the reception side. The common key used in this common key cryptosystem is exchanged by the public key cryptosystem at the start of communication. A terminal that has obtained a common key of a communication partner using a public key method can perform encrypted communication using a common key encryption method.
[0003]
As such encrypted communication, one that encrypts a “calling number” using an encryption means has been proposed.
[0004]
[Patent Document 1]
Japanese Patent Laid-Open No. 2003-69695 [0005]
[Problems to be solved by the invention]
However, when a key is exchanged in the public key cryptosystem, there is a possibility of being subjected to an attack such as forgery of authentication information by a malicious communication terminal, an intermediate match attack, an excessive key distribution request, or the like. For example, if a malicious party steals a caller number even if the caller number is encrypted, a key using that number can be created, and the forged key is used to impersonate the original user. There was a problem that important communication was possible.
[0006]
The present invention generates a shared encryption key between communication devices using spatio-temporal information, and thereby can give a time constraint and a space constraint on the connection between communication devices. Provided is a wireless communication system capable of highly confidential communication using an encryption device that provides a restricted wireless communication connection service.
[0007]
[Means for Solving the Problems]
1st invention is a communication apparatus which communicates with another communication apparatus using encryption, Comprising: The positional information and time information of the own apparatus, and the 1st common key shared with the said other communication apparatus were calculated. Based on the result, the second key generating means for generating the second common key and the other communication device are provided with the position information and the time information of the own device in order to cause the other communication device to generate the second common key. Information transmitting means for transmitting; encryption means for generating ciphertext using the second common key; position information and time information of the communication device acquired by the other communication device from the communication device; and the first information And decryption means for decrypting ciphertext encrypted using the second common key generated based on the result of calculating the common key.
[0008]
According to a second invention, in the first invention, a first key generating means for generating the first common key using a secret key generated by a random number and a public key generated by the other communication device. It is characterized by providing.
[0009]
According to a third invention, in the first or second invention, the validity period of the second common key is determined based on the location information and / or the time information of the own device, whereby the other communication device It is characterized in that a permissible connection time is defined.
[0010]
4th invention is a base station apparatus which communicates with a terminal device using encryption, Comprising: The information receiving means which receives the positional information and time information of the said terminal device, The positional information and time of the said received terminal device A second key generating means for generating a second common key based on a result of computing information and a first common key shared with the terminal device, and a cipher for generating a ciphertext using the second common key And decrypting the ciphertext encrypted by using the second common key generated based on the result of calculating the position information and time information of the terminal device and the first common key by the terminal device And a converting means.
[0011]
According to a fifth invention, in the fourth invention, an allowable period of connection with the terminal device is defined by determining an effective period of the second common key based on the position information and / or the time information. It is characterized by that.
[0012]
A sixth invention is characterized in that, in the fifth invention, provided with a disconnecting means for disconnecting the connection with the terminal device when the valid time of the second common key ends.
[0013]
A seventh invention is a communication system in which a first communication device and a second communication device communicate with each other using encryption, and the first communication device and the second communication device are shared by both devices. A first key holding means for holding a common key; a second key generating means for generating a second common key based on a result of calculating the position information and time information of the second communication device and the first common key; And an encryption unit that generates a ciphertext using the second common key, and a decryption unit that decrypts the ciphertext encrypted using the second common key.
[0014]
DETAILED DESCRIPTION OF THE INVENTION
Next, embodiments of the present invention will be described with reference to the drawings.
[0015]
FIG. 1 is a block diagram showing a configuration of a wireless communication system to which a communication apparatus according to an embodiment of the present invention is applied.
[0016]
As shown in FIG. 1, the radio communication system according to the embodiment of the present invention includes a base station 1 and a terminal 2 that communicates with the base station 1, and the base station 1 and the terminal 2 use a cipher. Function as.
[0017]
First, the configuration of the base station 1 will be described.
[0018]
The antenna 101 is connected to the wireless unit 102, receives radio waves from the terminal 2, and transmits radio waves to the terminal 2. The radio unit 102 includes a transmission unit and a reception unit, and the transmission unit generates a high frequency signal to be transmitted from the antenna 101. The receiving unit amplifies and converts the high frequency signal received by the antenna 101 and outputs the signal to the transmitting / receiving unit 103 as a baseband signal.
[0019]
The transmission / reception unit 103 includes a baseband unit and a radio control unit. The baseband unit decodes the baseband signal into an audio signal by a codec unit provided in the baseband unit. The codec unit encodes the audio signal to generate a baseband signal. Further, the wireless control unit controls the frequency transmitted / received by the wireless unit 102, the transmission / reception timing, and the output of the transmitted radio wave.
[0020]
The I / F unit 104 is an interface for connecting the base station 1 to the external network 3, and converts a signal inside the base station and a signal suitable for the network 3.
[0021]
The control unit 105 is mainly configured by a CPU, and controls each unit of the base station 1 such as the radio unit 102, the transmission / reception unit 103, and the I / F unit 104 based on programs and data stored in the RAM and ROM. Control.
[0022]
The database 106 holds a terminal-by-terminal service database 18 that defines service contents allowed for each terminal.
[0023]
Next, the configuration of the terminal 2 will be described.
[0024]
The antenna 201 is connected to the radio unit 202, receives radio waves from the base station 1, and transmits radio waves to the base station 1. The radio unit 202 includes a transmission unit and a reception unit, and the transmission unit generates a high frequency signal to be transmitted from the antenna 201.
The receiving unit amplifies and converts the high frequency signal received by the antenna 201 and outputs the signal as a baseband signal to the transmitting / receiving unit 203.
[0025]
The transmission / reception unit 203 includes a baseband unit and a radio control unit. The baseband unit decodes the baseband signal into an audio signal by a codec unit provided in the baseband unit. The codec unit encodes the audio signal to generate a baseband signal. Further, the wireless control unit controls the frequency transmitted / received by the wireless unit 202, the transmission / reception timing, and the output of the transmitted radio wave.
[0026]
The I / F unit 204 is an interface with a device connected to the terminal 2 and converts a signal inside the terminal into a signal format suitable for external output.
[0027]
The control unit 205 is mainly composed of a CPU, and based on the programs and data stored in the RAM and ROM, the wireless unit 202, the transmission / reception unit 203, the I / F unit 204, the operation unit 206, and the display unit 207. And the like, each part of the terminal 2 is controlled.
[0028]
The operation unit 206 accepts input of characters and numbers and operation instructions to the terminal 2. The display unit 207 displays character information, the operating state of the terminal 2, and the like based on display data from the control unit 205.
[0029]
FIG. 2 is a functional block diagram of a communication apparatus using encryption according to the present embodiment.
[0030]
First, the function of the base station 1 will be described.
[0031]
The random number generator 11 generates a random number that serves as a seed for the encryption key. The one-way group operation encryptor 12 performs a one-way operation using the random number generated by the random number generator 11, and generates an encryption key (base station public key 31, base station secret key 33). The common key encryption / decryption device 13 uses the base station public key 31 generated by the one-way group operation encryption device 12 as a common key, and the terminal public key 32 transmitted from the terminal 2 as the encryption information 35, The terminal information 36, the terminal space information 37, and the terminal time information 38 are decoded.
[0032]
The one-way group operation encryptor 14 performs a one-way operation using the base station secret key 33 generated by the one-way group operation encryptor 12 and the terminal public key 32 acquired from the terminal 2, and the base station and A first common secret key 39 that is commonly used by terminals is generated. The encryptor 15 performs an operation (for example, an operation using a hash function) using the first common secret key 39 and the terminal information 36, the terminal space information 37, and the terminal time information 38 transmitted as the encryption information 35 from the terminal 2. Then, the second common secret key 40 is generated.
[0033]
The common key encryption / decryption device 16 encrypts the plaintext 41 into the encrypted information 42 and decrypts the encrypted information 42 into the plaintext 41 using the second common secret key generated by the encryptor 15.
[0034]
The service database 18 for each terminal stores the contents of services that can be received by the terminal based on the terminal information 36 connected to the base station 1. For example, in a public wireless LAN service, the contents are stored when a time when a terminal can be connected or when a region (a connectable base station) is restricted. The spatio-temporal information evaluation application 19 determines the types and ranges of services allowed for each terminal stored in the terminal-by-terminal service database 18, so that the common key system encryption / decryption device 16 operates within the allowable range. The operation of the key system encryption / decryption device 16 is controlled.
[0035]
Next, functions of the terminal 2 will be described.
[0036]
The random number generator 21 generates a random number that serves as a seed for the encryption key. The one-way group operation encryptor 22 performs a one-way operation using the random number generated by the random number generator 21, and generates an encryption key (terminal public key 32, terminal secret key 34). The common key encryption / decryption device 23 encrypts the terminal public key 32, the terminal information 36, the terminal space information 37, and the terminal time information 38 by using the base station public key 31 transmitted from the base station 1 as a common key. Then, the encrypted information 35 is transmitted to the base station 1.
[0037]
The one-way group operation encryption unit 24 performs a one-way operation using the terminal secret key 34 generated by the one-way group operation encryption unit 22 and the base station public key 31 acquired from the base station 1, and And the 1st common secret key 39 used in common with a terminal is produced | generated. The encryptor 25 uses the first common secret key 39 and the terminal information 36, the terminal space information 37, and the terminal time information 38 transmitted as the encryption information 35 to the base station 1 to perform an operation (for example, an operation using a hash function). Thus, the second common secret key 40 is generated.
[0038]
The common key encryption / decryption device 26 encrypts the plaintext 41 into the encrypted information 42 and decrypts the encrypted information 42 into the plaintext 41 using the second common secret key generated by the encryptor 25.
[0039]
Next, an operation when encrypted communication is started between the base station 1 and the terminal 2 will be described. This operation is executed when a connection is established between the base station 1 and the terminal 2.
[0040]
First, when there is a connection request from the terminal 2, the base station 1 performs an authentication process to determine whether the connection request from the terminal is valid. As a result of the authentication process, when the authentication is successful, the base station 1 transmits an authentication response to the terminal 2 and starts an encryption key generation process.
On the other hand, when the terminal 2 receives the authentication response from the base station 1, the terminal 2 starts the encryption key generation process.
[0041]
In the base station 1, first, the random number generator 11 generates a random number that serves as a seed for the encryption key. Then, the one-way group operation encryptor 12 performs a one-way operation using the random number generated by the random number generator 11, and generates an encryption key (base station public key 31, base station secret key 33). . The generated base station public key 31 is transmitted to the terminal 2.
[0042]
In the terminal 2, first, the random number generator 21 generates a random number as a seed for the encryption key. Then, the one-way group operation encryptor 22 performs a one-way operation using the random number generated by the random number generator 21, and generates an encryption key (terminal public key 32, terminal secret key 34). Then, terminal information 36, terminal space information 37, and terminal time information 38 to be transmitted to the base station 1 are prepared. The terminal information 36 is an identification number uniquely assigned to the terminal 2. The terminal space information 37 is terminal position information (longitude / latitude information), and is generated by a GPS device (not shown) provided in the terminal 2. The terminal time information 38 is the current time measured by a clock (not shown) provided in the terminal 2.
[0043]
In the present invention, since the encryption key is generated using the terminal space information 37 and the terminal time information 38 in addition to the terminal information 36 of the terminal 2, the same encryption is used even in the encrypted communication between the same base station and the terminal. Highly concealed communication can be performed in which the probability of generating the encryption key can be made extremely low.
[0044]
Then, the common key encryption / decryption device 23 uses the base station public key 31 transmitted from the base station 1 as a common key to obtain the terminal public key 32, the terminal information 36, the terminal space information 37, and the terminal time information 38. Encrypt. The generated encryption information 35 is transmitted to the base station 1.
[0045]
In the base station 1, the encryption information 35 including the terminal public key 32, terminal information 36, terminal space information 37, and terminal time information 38 received from the terminal 2 is input to the common key encryption / decryption device 13. The common key encryption / decryption device 13 decrypts the encrypted information 35 using the base station public key 31 as a common key, and the terminal public key 32, the terminal information 36, the terminal space information 37, and the terminal from the encrypted information 35 Time information 38 is extracted.
[0046]
The decrypted terminal public key 32 is input to the one-way group operation encryptor 14. The one-way group operation encryption unit 14 performs a one-way operation using the terminal public key 32 and the base station secret key 33 to generate a first common secret key 39. The generated first common secret key 39 is input to the encryptor 15. The encryptor 15 performs an operation using the terminal information 36, the terminal space information 37, the terminal time information 38, and the first common secret key 39 to generate a second common secret key 40.
[0047]
On the other hand, when the terminal 2 transmits the encryption information 35 to the base station 1, the one-way group operation encryption unit 24 performs a one-way operation using the terminal secret key 34 and the base station public key 31 to obtain the first A common secret key 39 is generated. The encryptor 25 performs an operation using the terminal information 36, the terminal space information 37, the terminal time information 38, and the first common secret key 39 to generate a second common secret key 40.
[0048]
The first common secret key 39 and the second common secret key 40 generated by the terminal 2 are the same as the first common secret key 39 and the second common secret key 40 generated by the base station 1. . Through the above processing, a secret key (second common secret key) used for encrypted communication between the base station 1 and the terminal 2 is generated, and a connection is established.
[0049]
In the terminal 2, the common key encryption / decryption device 26 encrypts the plaintext 41 into the encrypted information 42 using the second common secret key, and transmits the encrypted information 42 to the base station 1. In the base station 1, when receiving the encryption information 42 from the terminal 2, the common key encryption / decryption device 16 decrypts the encryption information 42 into the plaintext 41 using the second common secret key.
[0050]
On the other hand, in the base station 1, the common key encryption / decryption device 16 encrypts the plaintext 41 into the encryption information 42 using the second common secret key and transmits it to the terminal 2. When the terminal 2 receives the encryption information 42 from the base station 1, the common key encryption / decryption device 26 decrypts the encryption information 42 into the plaintext 41 using the second common secret key.
[0051]
In this way, encrypted communication using the secret key (second common secret key) between the base station 1 and the terminal 2 is performed.
[0052]
FIG. 3 is a sequence diagram of communication using encryption according to the embodiment of this invention.
[0053]
The terminal 2 receives the control channel (pilot channel) and detects the pilot signal from the base station 1 (S101). When a pilot signal transmitted from the base station 1 is detected, a connection request signal is transmitted to the base station 1 (S102).
[0054]
When receiving the connection request from the terminal 2, the base station 1 sets up a communication channel between the base station 1 and the terminal 2 (S103).
[0055]
Further, when receiving the connection request from the terminal 2, the base station 1 transmits the base station public key 31 generated by the one-way group operation encryption device 12 (S104). When the terminal 2 receives the base station public key 31 from the base station 1, the terminal 2 uses the terminal public key 32 generated by the one-way group operation encryption unit 22 as the common key and the base station public key 31 transmitted from the base station 1 as the common key. And encrypted and transmitted (S105). At this time, the terminal 2 also transmits terminal information 36, terminal space information 37, and terminal time information 38 to the base station 1.
[0056]
When receiving the terminal public key 32 from the terminal 2, the base station 1 generates the second common secret key 40 (S106). On the other hand, when the terminal 2 transmits the terminal public key 32 to the base station 1, the terminal 2 generates a second common secret key 40 (S107). Then, the base station 1 determines the service type and range allowed for each terminal stored in the terminal service database 18 by the spatio-temporal information evaluation application 19, and determines the lifetime of the generated key (S108).
[0057]
Then, encrypted communication using the second common secret key is started between the base station 1 and the terminal 2 (S109). During this encrypted communication, the base station 1 determines whether or not the key lifetime set in step S108 has elapsed by the spatiotemporal information evaluation application 19 (S110). As a result, if it is determined that the key lifetime has not elapsed, the encrypted communication using the second common secret key 40 is continued.
[0058]
On the other hand, if it is determined that the key lifetime has elapsed, it is further determined whether or not the line needs to be disconnected (S111). Whether or not the line disconnection is necessary is determined based on whether the spatiotemporal information evaluation application 19 determines the service range allowed for each terminal stored in the terminal service database 18 and whether or not the allowable range is exceeded.
[0059]
As a result, if it is determined that the line needs to be disconnected, the base station 1 transmits a disconnection request signal to the terminal 2. When the terminal 2 receives the disconnection request signal from the base station 1, the terminal 2 performs disconnection processing for disconnecting the line (S112).
[0060]
On the other hand, if it is determined that it is not necessary to disconnect the line, a handover is executed to generate a new second common secret key 40 (S113), and a new communication channel is set between the base station 1 and the terminal 2 (S103).
[0061]
As described above, according to the embodiment of the present invention, various support services can be safely realized by managing the location information of the terminal as an encryption key in the base station. For example, by setting the lifetime of the encryption key, it is possible to provide a key that is valid only within a certain period of time as in a prepaid card, and to realize a service limited to a certain period of time. In addition, it is possible to provide an encryption key that can be used only in a certain place (in a building or facility). In addition, by managing the connection lifetime based on the lifetime of the encryption key, it is possible to manage the connectable time of the terminal, so it is possible to effectively use communication resources without requiring a special protocol for managing the connection time. .
[0062]
【The invention's effect】
According to the present invention, since the connection is established by generating the encryption key using the time information and the space information in addition to the terminal information, it is possible to perform communication with higher secrecy compared to the conventional case.
[0063]
(Industrial applicability)
Since the present invention generates a common key using the position information and time information of the communication device and performs encrypted communication, the present invention can be applied to a wireless communication system that requires highly confidential communication. It is particularly suitable for a mobile communication system in which the position of the communication device moves.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a wireless communication system to which a communication apparatus according to an embodiment of the present invention is applied.
FIG. 2 is a functional block diagram of a communication apparatus using encryption according to the embodiment of this invention.
FIG. 3 is a sequence diagram of communication using encryption according to the embodiment of this invention.
[Explanation of symbols]
11, 21 Random number generators 12, 22 One-way group operation encryption unit 13, 23 Common key method encryption / decryption device 14, 24 One-way group operation encryption unit 15, 25 Encryption unit 16, 26 Common key method encryption / decryption Generator 18 Terminal-specific service database 19 Spatio-temporal information evaluation application

Claims (7)

A communication device that communicates with other communication devices using encryption,
Second key generation means for generating a second common key based on the result of calculating the position information and time information of the own device and the first common key shared with the other communication device;
Information transmitting means for transmitting the position information and time information of the own device to the other communication device in order to cause the other communication device to generate the second common key;
Encryption means for generating ciphertext using the second common key;
A ciphertext encrypted by using the second common key generated based on the result of calculating the position information and time information of the communication device acquired from the communication device by the other communication device and the first common key. And a decoding means for decoding. The first key generation means for generating the first common key by using a secret key generated by a random number and a public key generated by the other communication device. Communication device. The connection allowable time with the other communication device is defined by determining the validity period of the second common key based on the position information of the device and / or the time information. Item 3. The communication device according to Item 1 or 2. A base station device that communicates with a terminal device using encryption,
Information receiving means for receiving position information and time information of the terminal device;
Second key generation means for generating a second common key based on a result of calculating the received location information and time information of the terminal device and a first common key shared with the terminal device;
Encryption means for generating ciphertext using the second common key;
Decryption means for decrypting ciphertext encrypted using a second common key generated based on a result of the terminal device calculating position information and time information of the terminal device and the first common key; A base station apparatus comprising: The connection allowable time with the terminal device is defined by determining a validity period of the second common key based on the position information and / or the time information. Base station device. The base station apparatus according to claim 5, further comprising a disconnecting unit that disconnects the connection with the terminal device when the valid time of the second common key ends. A communication system in which a first communication device and a second communication device communicate using encryption,
The first communication device and the second communication device are:
First key holding means for holding a first common key shared by both devices;
Second key generation means for generating a second common key based on a result of calculating the position information and time information of the second communication device and the first common key;
Encryption means for generating ciphertext using the second common key;
And a decrypting means for decrypting a ciphertext encrypted using the second common key.

Images