JPH11308673A - Radio lan system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a radio LAN system that ensures confidentiality in the system in units of groups. SOLUTION: An encryption group setting means 14 sets a dependent group and an encryption key or the like using encryption to a network side master station device and a terminal side slave station device as group dependent information and stores them to a storage device 15, transmission data are encrypted and encryption of received data is decoded by the use of an encryption key used for the groups, based on the group-dependent information included in an authentication request from the slave station device in this radio LAN system.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a wireless LAM system, and more particularly, to a mobile station, which permits the mobility of a terminal-side slave station, and sets a group for each specific department or group in the system and for each group. The present invention relates to a wireless LAN system that realizes confidential communication in a specific group unit by using both use / non-use of encryption and setting of an encryption key to be used.

[0002]

2. Description of the Related Art Regarding a basic wireless LAN system,
This will be described with reference to FIG. FIG. 5 is a schematic configuration diagram of the wireless LAN system. As shown in FIG. 5, the wireless LAN system includes a network-side master station device connected to an Ethernet or ATM (Asynchronous Transfer Mode) cable constituting a LAN (Local Area Network), and the master station device. It is composed of a plurality of terminal-side slave stations that transmit and receive data wirelessly.

Next, a terminal-side slave station device in a conventional wireless LAN system will be described with reference to FIG. FIG. 3 is a configuration block diagram of a terminal-side slave station device in a conventional wireless LAN system. As shown in FIG. 3, the conventional terminal-side slave station apparatus includes a personal computer and a printer 1, a terminal interface 2, a transmission data scramble processing unit 4, a transmission data processing unit 5, a transmission unit 6, It comprises a switch 7, a receiving means 9, a received data processing unit 10, a received data descrambling processing unit 11, and a control means 16.

A network-side master station device in a conventional wireless LAN system will be described with reference to FIG. FIG.
FIG. 1 is a configuration block diagram of a network-side master station device in a conventional wireless LAN system. As shown in FIG. 4, a conventional network-side master station device is an Ethernet or A
TM 17, network interface 18, transmission data scramble processing section 4, transmission data processing section 5, transmission section 6, transmission / reception switch 7, reception section 9, reception data processing section 10, reception data scramble It comprises a release processing unit 11 and a control unit 16.

[0005] The terminal interface 2 is an interface between the personal computer and the printer 1 and a portion that performs wireless processing on the terminal side, and the network interface 18 is an interface between Ethernet or ATM and a portion that performs wireless processing on the network side. It is.

The transmission data scrambling processing section 4 scrambles transmission data, and the transmission data processing section 5 performs encoding processing such as error correction on the scrambled transmission data. The means 6 is for transmitting and outputting transmission data wirelessly, the transmission / reception switch 7 is for switching between transmission and reception, and the receiving means 9 is for receiving a radio signal and outputting it as reception data. The received data processing unit 10 performs a decoding process such as error correction of the received data, and the received data descrambling processing unit 11 descrambles the received data. The control means 16 controls the operation timing of the transmission data scramble processing section 4 and the reception data scramble descramble processing section 11.

As a security measure in such a conventional wireless LAN system, as a security measure, a network-side master station device holds information on all terminal-side slave station devices to be communicated, and only a specific slave station device can be connected. Some had authentication processing.

[0008] The encryption processing in the wireless section is hardly mounted, and only simple scrambling is performed. Also, even if an encryption processing function is provided, the master station device in the same system,
The slave station device previously holds a common encryption key, and uses it to determine whether to encrypt communication data to use or not use in the system at once.

[0009]

In recent years, crimes intercepted from a wireless section, such as mobile phones, have increased. Also, in a wired system, transmission data encryption has become commonsense, and it is desirable that unauthorized access from outside the company be prevented and concealed, and that concealment be possible between in-house users. However, in the above-described conventional wireless LAN system, encryption is used for each slave station device.
There is no option to select non-use, and there is a problem that secrecy cannot be ensured in a specific group unit in the system.

The present invention has been made in view of the above circumstances, and has as its object to provide a wireless LAN system capable of ensuring secrecy in a group unit in the system.

In particular, authentication processing and DES (Data Encrypt
ion Standard), FEAL (Fast date Encipherment A)
Lgorithm) and other common key encryption processes, and by introducing it to a wireless LAN system, allow the mobility of the terminal-side slave station device, and encrypt data in units of departments and groups within the system. Use / non-use can be specified.
This enables confidential communication in each group unit.

[0012]

According to the first aspect of the present invention, there is provided a wireless communication system between a network-side master station apparatus and a plurality of terminal stations on a terminal side. In a wireless LAN system for transmitting and receiving signals, a specific device is grouped among the master station device and the plurality of slave station devices, a group belonging to the device belonging to the group, and an encryption key used in the group. Is set as group belonging information, and if the signal transmitted and received between the parent station device and the child station device includes the group belonging information, the parent device belonging to the belonging group indicated by the group belonging information is set. The station apparatus and the slave station apparatus transmit and receive signals by encrypting using the encryption key indicated by the group affiliation information, and secrecy can be secured for each group in the system.

According to a second aspect of the present invention, there is provided a radio communication system for transmitting and receiving signals between a master station on the network side and a plurality of slave stations on the terminal side. In the LAN system, the slave station device includes a transmission data encryption processing unit that encrypts transmission data, a reception data decryption processing unit that decrypts encrypted reception data, and a group to which the slave station device belongs. And information on whether to use encryption in the relevant group and information on the encryption key when using it as group belonging information.
Group setting means, a storage device for storing the group affiliation information, and recognition of group setting and encryption use / non-use from the group affiliation information stored in the storage device;
Control means for indicating whether encryption is used / not used in the transmission data encryption processing unit and the reception data decryption processing unit, and an encryption key to be used in the case of using encryption; A slave station device for transmitting a signal including the group affiliation information to a master station device, wherein the master station device performs a transmission data encryption processing unit for encrypting transmission data, and decrypts received data for encryption. The received data decryption processing unit to be performed, the group to which the slave station device of the communication partner belongs, the information on whether to use encryption in the group, and the information on the encryption key in the case of using the group as group belonging information for each group. Encryption / group setting means to be set; a storage device for storing the group affiliation information for each group; and a group affiliation information included in a signal transmitted from a slave station device of a communication partner. Recognizing the group setting and the use / non-use of encryption, the encryption used / unused in the transmission data encryption processing unit and the reception data decryption processing unit and the encryption used in the case of using encryption It is characterized in that it is a master station device having a control means for instructing a key, and secrecy can be secured for each group in the system.

[0014]

Embodiments of the present invention will be described with reference to the drawings. A wireless LAN system (this system) according to an embodiment of the present invention includes a group belonging to a network-side master station device and a terminal-side slave station device, and an encryption key or the like when using encryption. Is transmitted and received using an encryption key indicated by group belonging information included in a signal between the master station device and the slave station device. If the group affiliation information is held, confidential communication can be made in units of groups in the system.

Next, the wireless LA according to the embodiment of the present invention
The terminal-side slave station device in the N system will be described with reference to FIG. FIG. 1 is a diagram illustrating a wireless L according to an embodiment of the present invention.
FIG. 3 is a block diagram illustrating a configuration of a terminal-side slave station device in an AN system. As shown in FIG. 1, the terminal side slave station device of the present system includes a personal computer and a printer 1, a terminal interface 2, a transmission data encryption processing unit 3, a transmission data scramble processing unit 4, a transmission data processing unit 5, a transmission unit 6, a transmission / reception changeover switch 7, a reception unit 9, a reception data processing unit 10, a reception data descrambling processing unit 11, a reception data decryption processing unit 12, an encryption
Group setting means 14, storage device 15, control means 1
6 is comprised.

A wireless LA according to an embodiment of the present invention
A network-side master station device in the N system will be described with reference to FIG. FIG. 2 is a configuration block diagram of the network-side master station device in the wireless LAN system according to the embodiment of the present invention. As shown in FIG. 2, the master station device on the network side of this system is an Ethernet or ATM17.
, The network interface 18, the transmission data encryption processing unit 3, and the transmission data scramble processing unit 4
, A transmission data processing unit 5, a transmission unit 6, a transmission / reception changeover switch 7, a reception unit 9, and a reception data processing unit 10.
A receiving data descrambling processing unit 11, a receiving data decryption processing unit 12, an encryption / group setting unit 14, a storage device 15, and a control unit 16.

In particular, this system differs from the conventional system in that it includes a transmission data encryption processing unit 3, a reception data decryption processing unit 12, an encryption / group setting unit 14, and a storage device 15. .

Next, the features of the present system will be specifically described. The encryption / group setting means 14 of the master station device of the present system specifies and sets the group to which each slave station device on the terminal side belongs and the group belonging information indicating the encryption key to be used. Therefore, when there are a plurality of group groups, a plurality of group group information is set. Then, the encryption / group setting means 14 of the corresponding slave station device similarly sets the group belonging information for the group to which the slave station device belongs.

The storage device 15 of the master station device and the slave station device includes:
It stores the group belonging information set by the encryption / group setting means 14.

The control means 16 of the slave station device realizes encryption according to the encryption key indicated by the group belonging information stored in the storage device 15. The control unit 16 of the master station device reads the group assignment information included in the signal transmitted by the slave station device, determines whether any of the group assignment information stored in the storage device 15 matches the group assignment information, and determines whether the information matches. The encryption is realized according to the encryption key shown in the group belonging information. Here, it is determined whether or not they match, but the encryption may be performed by directly using the group belonging information included in the received signal.

Further, if the group affiliation information is set and stored in the master station apparatus and the slave station apparatus, the group affiliation information included in the signal transmitted by the slave station apparatus includes at least the group affiliation information. If the information is included, the encryption key to be used when encrypting from the belonging group may be read from the set group belonging information, and the encryption may be performed.

Basically, the control means 16 of the master station device
The encryption key to be used is determined based on the group belonging information included in the signal of the slave station device that has issued the authentication request. The use / non-use of the encryption is determined by the setting as to which of the master station and the slave station holds the decision right, and the communication is executed.

As a specific example, assuming that the encryption key of the specific group (A group) is “AAA”, when the master station device decides to use encryption, the corresponding slave station device will have an encryption group in advance. A is set, and the corresponding encryption key “AAA” is held.

It is assumed that the master station stores the encryption key of group A as "AAA" and the encryption usage is known. If the group affiliation information is held in the signal of the authentication request from the slave station, the master sta- tion knows the encryption group to which the slave station to be communicated belongs from the group affiliation information, and the group A uses the encryption. Then, encrypted communication is performed with the slave station device using the encryption key “AAA”.

Further, as another example, when a slave station device that does not belong to a group and the slave station device determines that encryption is not used, when an encryption group is not set in the slave station device, The encryption key information is an initial value. The initial value is used for the communication with the slave station device which does not belong to the group even in the master station device. If the group affiliation information is not held in the signal at the time of the authentication request from the slave station device, the belonging group is not set, and the encryption key information is the initial value, so the encryption is not used, and the master station device It performs unencrypted communication.

In the wireless LAN system according to the embodiment of the present invention, when the encryption using the common key encryption process represented by the terminal authentication process DES, FEAL, etc. is introduced into the wireless LAN system, the terminal side slave station It is possible to specify the use / non-use of encryption for each department or group in the system while allowing the mobility of the device, and by changing the encryption key used for each group, This has the effect of enabling confidential communication.

According to the present system, the use of encryption /
By adding a setting as to which of the master station and the slave station retains the right to determine non-use, it is possible to realize encryption processing that has confidentiality and can flexibly cope with situations.

[0028]

According to the present invention, a group belonging to a master station device on the network side and a plurality of slave station devices on the terminal side can be assigned.
The encryption key to be used is set as group affiliation information, respectively, and if the group affiliation information is included in the signal transmitted and received between the master station device and the slave station device, the master station device and the slave station device are Since the wireless LAN system transmits and receives signals by encrypting using the encryption key indicated by the group belonging information, there is an effect that secrecy can be ensured for each group in the system.

[Brief description of the drawings]

FIG. 1 is a configuration block diagram of a terminal-side slave station device in a wireless LAN system according to an embodiment of the present invention.

FIG. 2 is a configuration block diagram of a network-side master station device in the wireless LAN system according to the embodiment of the present invention.

FIG. 3 is a configuration block diagram of a terminal-side slave station device in a conventional wireless LAN system.

FIG. 4 is a configuration block diagram of a network-side master station device in a conventional wireless LAN system.

FIG. 5 is a system configuration diagram of a wireless LAN system.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Personal computer and printer, 2 ... Terminal interface, 3 ... Transmission data encryption processing part, 4 ... Transmission data scrambling processing part, 5 ... Transmission data processing part, 6
... Transmitting means, 7 ... Transmission / reception changeover switch, 8 ... Antenna which performs radio emission and reception, 9 ... Receiving means
10: received data processing unit, 11: received data descrambling unit, 12: received data decryption processing unit, 1
4 ... Encryption / group setting means 15 ... Storage device
16: control procedure 17: Ethernet or ATM,
18 Network interface

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Shunji Miura 3-19-2 Nishi Shinjuku, Shinjuku-ku, Tokyo Inside Nippon Telegraph and Telephone Corporation (72) Inventor Yoshifumi Suzuki 3-192 Nishi Shinjuku, Shinjuku-ku, Tokyo No. Japan Telegraph and Telephone Corporation

Claims (2)

[Claims] 1. A wireless LAN for wirelessly transmitting and receiving signals between a master station on the network side and a plurality of slave stations on the terminal side.
In the AN system, a specific device is grouped among the master station device and the plurality of slave station devices, and information of a group belonging to the device belonging to the group and an encryption key used in the group are included in group belonging information. Set as
If the group affiliation information is included in the signal transmitted and received between the master station device and the slave station device, the master station device and the slave station device belonging to the group to which the group affiliation information indicates belong to the group. A wireless LA for transmitting and receiving signals by encrypting using an encryption key indicated by belonging information
N system. 2. A wireless LAN for wirelessly transmitting and receiving signals between a master station on the network side and a plurality of slave stations on the terminal side.
In the AN system, the slave station device includes a transmission data encryption processing unit that encrypts transmission data, a reception data decryption processing unit that decrypts encrypted reception data, and a group to which the slave station device belongs. And encryption / group setting means for setting information as to whether or not to use encryption in the group and information of an encryption key to be used as group belonging information, a storage device for storing the group belonging information, The group setting and the use / non-use of the encryption are recognized from the group belonging information stored in the storage device, and the use / unuse of the encryption in the transmission data encryption processing unit and the reception data decryption processing unit are determined. Control means for instructing an encryption key to be used in the case of use of encryption, and a slave station for transmitting a signal including the group belonging information to a master station apparatus of a communication partner. The master station device includes a transmission data encryption processing unit for encrypting transmission data, a reception data decryption processing unit for decrypting reception data encryption, and a slave station device of a communication partner. Encryption / group setting means for setting, for each group, information on whether to use encryption in the group, information on whether to use encryption in the group, and information on an encryption key when using the group, as group belonging information; And a storage device for storing in the transmission data encryption processing unit recognizing whether the group setting and encryption are used or not used based on group belonging information included in a signal transmitted from the slave station device of the communication partner. It is a master station device having control means for instructing the use / non-use of encryption in the received data decryption processing unit and the encryption key to be used in the case of use of encryption. Wireless LAN system.