JP4419612B2 - Wireless communication system, terminal, message transmission method and program for causing terminal to execute the method - Google Patents

Description

  The present invention relates to a wireless communication system, and in particular, when transmitting a message to another terminal, measures the distance from the other terminal to confirm that it is within a predetermined range, a terminal, a message transmission method, and The present invention relates to a program for causing a terminal to execute the method.

  In a communication system, in order for a terminal to connect to a network, an attribute certificate is first issued, and access authority to the network is proved by the attribute certificate. However, in the wireless communication system, since each terminal is connected to the network wirelessly, wiretapping and spoofing may be easily performed as compared with the wired communication system. Therefore, when issuing the attribute certificate, it is necessary to restrict the access from an unspecified terminal and authenticate the partner terminal reliably.

  Therefore, conventionally, when authenticating a partner terminal, a certificate is exchanged by exchanging a physical medium such as a portable storage medium or a short distance wireless medium such as a non-contact type IC card is used.

In addition, a technique has been proposed for improving security by switching transmission power and modulation method between authentication of a partner terminal and normal data communication. For example, when performing wireless communication, the transmission power is increased stepwise until a response is returned from the counterpart device, and authentication is performed using the transmission power at the time when the response is returned for the first time. A technique for preventing interception of communication by three parties has been proposed (see, for example, Patent Document 1).
JP 2000-295658 A (FIG. 1)

  However, in the method using the exchange of the physical media, although the wireless media is provided as the terminal, the physical media is manually inserted and removed, which is inconvenient. Also, when using short-distance wireless media, a combination with a terminal as a medium-distance wireless medium is required, which may complicate the system. Further, in the method of switching the transmission power and the like, not only the control for that is complicated, but also there is a possibility that a long time is required for the retry due to the influence of the communication quality at the time of authentication.

  Accordingly, an object of the present invention is to guarantee that a distance from a partner terminal is within a predetermined range when a message is transmitted to the partner terminal of communication.

Wireless communication system according to the first aspect of the present invention to solve the aforementioned problem is a wireless communication system including a plurality of terminals, a first terminal for transmitting a signal including beacon information, the signal And a second terminal that makes a registration request to the first terminal if the distance is within a predetermined range. Thereby, when the second terminal makes a registration request to the first terminal, there is an effect of ensuring that the distance from the first terminal is within a predetermined range.

The wireless communication system according to the second aspect of the present invention is a wireless communication system including a plurality of terminals, the first terminal transmitting a signal including beacon information, and the above-mentioned signal in response to the signal. A second terminal that measures a distance to the first terminal and makes a registration request to the first terminal if the distance is within a first predetermined range, and the first terminal In response to the registration request, the distance to the second terminal is measured, and if the distance is within the second predetermined range, the registration request is confirmed with respect to the second terminal. . Thereby, when performing a registration request | requirement and confirmation of a registration request | requirement between a 1st terminal and a 2nd terminal, it brings about the effect | action which ensures that a mutual distance is in a predetermined range.

A wireless communication system according to a third aspect of the present invention is the wireless communication system according to the second aspect , in which the second terminal is at a distance from the first terminal in response to confirmation of the registration request. If the distance is within the third predetermined range, the terminal authority authentication request is issued to the first terminal, and the first terminal issues the terminal authority authentication certificate. In response to the request, the distance to the second terminal is measured, and if the distance is within the fourth predetermined range, a terminal authority authentication certificate is issued to the second terminal. This ensures that the distance between the first terminal and the second terminal is within a predetermined range when further issuing a terminal authority authentication certificate request and issuing a terminal authority authentication certificate. It brings about the effect of damaging.

A wireless communication system according to a fourth aspect of the present invention is the wireless communication system according to the third aspect , wherein the second terminal responds to the issuance of the terminal authority authentication certificate with the first terminal. If the distance is within the fifth predetermined range, the terminal authority authentication certificate is confirmed to be received by the first terminal, and the first terminal authenticates the terminal authority authentication certificate. If the receipt of the terminal authority authentication certificate is not confirmed within a predetermined period from the issuance of the certificate, the revocation list of the terminal authority authentication certificate is issued. As a result, when the receipt confirmation of the terminal authority authentication certificate is further performed between the first terminal and the second terminal, it is ensured that the mutual distance is within a predetermined range, and the terminal authority authentication certificate When a timeout occurs in the receipt confirmation, the terminal authority authentication certificate that has already been issued is revoked.

A wireless communication system according to a fifth aspect of the present invention is a wireless communication system including a plurality of terminals, and a first terminal that transmits a signal including beacon information and the above-mentioned signal in response to the signal A second terminal that measures a distance to the first terminal and makes a registration proposal to the first terminal if the distance is within a predetermined range. Thereby, when the second terminal makes a registration proposal to the first terminal, there is an effect of ensuring that the distance from the first terminal is within a predetermined range.

A wireless communication system according to a sixth aspect of the present invention is a wireless communication system including a plurality of terminals, the first terminal transmitting a signal including beacon information, and the above-mentioned signal in response to the signal. A second terminal that measures a distance to the first terminal and makes a registration proposal to the first terminal if the distance is within a first predetermined range, and the first terminal In response to the registration proposal, the distance to the second terminal is measured, and if the distance is within the second predetermined range, the registration proposal is confirmed with respect to the second terminal. . Thereby, when performing registration proposal and confirmation of registration proposal between the 1st terminal and the 2nd terminal, it brings about the effect | action of ensuring that a mutual distance is in a predetermined range.

A wireless communication system according to a seventh aspect of the present invention is the wireless communication system according to the sixth aspect , in which the second terminal is at a distance from the first terminal in response to confirmation of the registration proposal. If the distance is within a third predetermined range, the terminal authority authentication certificate is issued to the first terminal, the terminal authority authentication certificate is issued, and the first terminal Measures the distance to the second terminal in response to the proposal to issue the terminal authority authentication certificate, and if the distance is within the fourth predetermined range, the terminal authority authentication is performed on the second terminal. Confirms receipt of the certificate. Thereby, when the issuance proposal of the terminal authority authentication certificate and the receipt confirmation of the terminal authority authentication certificate are further performed between the first terminal and the second terminal, the mutual distance is within a predetermined range. The effect is to guarantee.

A wireless communication system according to an eighth aspect of the present invention is the wireless communication system according to the seventh aspect , in which the second terminal receives the terminal authority within a predetermined period from a proposal for issuing the terminal authority authentication certificate. If the receipt confirmation of the authentication certificate is not performed, the revocation list of the terminal authority authentication certificate is issued. As a result, when a timeout occurs in the receipt confirmation of the terminal authority authentication certificate, the terminal authority authentication certificate that has already been issued is revoked.

The terminal according to the ninth aspect of the present invention comprises a receiving means for receiving a predetermined signal, a measuring means for measuring a distance from the other terminal when the predetermined signal is received from another terminal, and the distance Includes a transmitting means for transmitting a predetermined message to the other terminal. Thereby, when a terminal transmits a message to a partner terminal, it brings about the effect of guaranteeing that the distance from the partner terminal is within a predetermined range.

The terminal according to the tenth aspect of the present invention is the terminal according to the ninth aspect, wherein the measuring means measures the distance by communicating with the other terminal. Thus, the distance is measured by communication between terminals, and the distance between the terminals is guaranteed to be within a predetermined range.

Moreover, the terminal according to the eleventh aspect of the present invention, which in the terminal according to the tenth aspect, the measuring means measures the distance by exchanging access control packets between said other terminal is there. Thus, the distance is measured by exchanging access control packets between the terminals, and the distance between the terminals is guaranteed to be within a predetermined range.

A terminal according to a twelfth aspect of the present invention is the terminal according to the tenth aspect, wherein the measuring means measures a distance by a response signal from the other terminal with respect to communication with the other terminal. is there. As a result, the distance is measured based on the response signal from the counterpart terminal, and the distance between the terminals is guaranteed to be within a predetermined range.

The terminal according to the thirteenth aspect of the present invention is a receiving means for receiving a signal including beacon information and a measuring means for measuring a distance from the other terminal when receiving a signal including the beacon information from another terminal. And a registration request message transmitting means for transmitting a registration request message to the other terminal if the distance is within a predetermined range. As a result, when the terminal transmits a registration request message to the counterpart terminal, it is possible to ensure that the distance from the counterpart terminal is within a predetermined range.

A terminal according to a fourteenth aspect of the present invention is the terminal according to the thirteenth aspect, wherein the measuring means measures distance by communicating with the other terminal. Thus, the distance is measured by communication between terminals, and the distance between the terminals is guaranteed to be within a predetermined range.

The terminal according to the fifteenth aspect of the present invention is the terminal according to the fourteenth aspect, wherein the measuring means measures the distance by exchanging access control packets with the other terminals. is there. Thus, the distance is measured by exchanging access control packets between the terminals, and the distance between the terminals is guaranteed to be within a predetermined range.

A terminal according to a sixteenth aspect of the present invention is the terminal according to the fourteenth aspect, wherein the measuring means measures a distance by a response signal from the other terminal with respect to communication with the other terminal. is there. As a result, the distance is measured based on the response signal from the counterpart terminal, and the distance between the terminals is guaranteed to be within a predetermined range.

The terminal according to the seventeenth aspect of the present invention is the terminal according to the thirteenth aspect, wherein when the registration request message transmitting means transmits the registration request message to the other terminal, the terminal is disclosed. A key certificate is also presented. This brings about the effect that the identity of the registration request message transmitting terminal is authenticated in the counterpart terminal that has received the registration request message.

The terminal according to the eighteenth aspect of the present invention is a receiving means for receiving a signal including beacon information, and a measuring means for measuring a distance from the other terminal when receiving a signal including the beacon information from another terminal. And a registration proposal message transmitting means for transmitting a registration proposal message to the other terminal if the distance is within a predetermined range. Thereby, when a terminal transmits a registration proposal message to a partner terminal, an effect of ensuring that the distance from the partner terminal is within a predetermined range is brought about.

The terminal according to the nineteenth aspect of the present invention is the terminal according to the eighteenth aspect, wherein when the registration request message transmitting means transmits the registration proposal message to the other terminal, the terminal is disclosed. A key certificate is also presented. This brings about the effect that the identity of the registration proposal message transmission terminal is authenticated at the partner terminal that has received the registration proposal message.

The message transmission method according to the twentieth aspect of the present invention includes a procedure for receiving a predetermined signal from another terminal, a procedure for measuring a distance from the other terminal, and the measured distance within a predetermined range. Then, a procedure for transmitting a predetermined message to the other terminal is provided. Thereby, when a terminal transmits a message to a partner terminal, it brings about the effect of guaranteeing that the distance from the partner terminal is within a predetermined range.

The message transmission method according to the twenty-first aspect of the present invention includes a procedure for receiving a signal including beacon information from another terminal, a procedure for measuring a distance from the other terminal, and the measured distance is predetermined. And a procedure for transmitting a registration request message to the other terminal within the range. As a result, when the terminal transmits a registration request message to the counterpart terminal, it is possible to ensure that the distance from the counterpart terminal is within a predetermined range.

A message transmission method according to a twenty-second aspect of the present invention includes a procedure for receiving a signal including beacon information from another terminal, a procedure for measuring a distance from the other terminal at a first time point, A procedure for transmitting a registration request message to the other terminal if the distance at time 1 is within a first predetermined range; a procedure for receiving a registration request confirmation message for the registration request message from the other terminal; , A procedure for measuring the distance at the second time point with the other terminal, and if the distance at the second time point is within a second predetermined range, a terminal authority authentication certificate issuance request to the other terminal And a procedure for transmitting a message. As a result, when the terminal transmits a registration request message and a terminal authority authentication certificate issuance request message to the counterpart terminal, there is an effect that the distance from the counterpart terminal at each time point is guaranteed to be within a predetermined range.

The message transmission method according to the twenty-third aspect of the present invention includes a procedure for receiving a signal including beacon information from another terminal, a procedure for measuring a distance from the other terminal, and the measured distance is predetermined. And a procedure for transmitting a registration proposal message to the other terminal if within the range. Thereby, when a terminal transmits a registration proposal message to a partner terminal, an effect of ensuring that the distance from the partner terminal is within a predetermined range is brought about.

A message transmission method according to a twenty-fourth aspect of the present invention includes a procedure for receiving a signal including beacon information from another terminal, a procedure for measuring a distance at a first time point with the other terminal, A procedure for transmitting a registration proposal message to the other terminal if the distance at time 1 is within a first predetermined range; a procedure for receiving a registration proposal confirmation message for the registration proposal message from the other terminal; , A procedure for measuring the distance at the second time point with the other terminal, and if the distance at the second time point is within the second predetermined range, a terminal authority authentication certificate issuance proposal to the other terminal And a procedure for transmitting a message. Thus, when the terminal transmits a registration proposal message and a terminal authority authentication certificate issuance proposal message to the counterpart terminal, there is an effect of ensuring that the distance from the counterpart terminal at each time is within a predetermined range.

The program according to the 25th aspect of the present invention, there a procedure for receiving a predetermined signal from another terminal, the procedure for measuring the distance between the other terminals, distances the measured within a predetermined range For example, the terminal is caused to execute a procedure for transmitting a predetermined message to the other terminal. Thereby, when a terminal transmits a message to a partner terminal, it brings about the effect of guaranteeing that the distance from the partner terminal is within a predetermined range.

According to a twenty-sixth aspect of the present invention, there is provided a program for receiving a signal including beacon information from another terminal, a procedure for measuring a distance to the other terminal, and the measured distance within a predetermined range. If so, the terminal is caused to execute a procedure for transmitting a registration request message to the other terminal. As a result, when the terminal transmits a registration request message to the counterpart terminal, it is possible to ensure that the distance from the counterpart terminal is within a predetermined range.

A program according to a twenty-seventh aspect of the present invention includes a procedure for receiving a signal including beacon information from another terminal, a procedure for measuring a distance from the other terminal at a first time point, and the first A procedure for transmitting a registration request message to the other terminal if the distance at the time is within a first predetermined range; a procedure for receiving a registration request confirmation message for the registration request message from the other terminal; A procedure for measuring a distance from another terminal at a second time point, and if the distance at the second time point is within a second predetermined range, a terminal authority authentication certificate issuance request message is sent to the other terminal. The transmission procedure is executed by the terminal. As a result, when the terminal transmits a registration request message and a terminal authority authentication certificate issuance request message to the counterpart terminal, there is an effect that the distance from the counterpart terminal at each time point is guaranteed to be within a predetermined range.

According to a twenty-eighth aspect of the present invention, there is provided a program for receiving a signal including beacon information from another terminal, a procedure for measuring a distance to the other terminal, and the measured distance within a predetermined range. If so, the terminal is caused to execute a procedure for transmitting a registration proposal message to the other terminal. Thereby, when a terminal transmits a registration proposal message to a partner terminal, an effect of ensuring that the distance from the partner terminal is within a predetermined range is brought about.

A program according to a twenty-ninth aspect of the present invention includes a procedure for receiving a signal including beacon information from another terminal, a procedure for measuring a distance at a first time point with the other terminal, and the first A procedure for transmitting a registration proposal message to the other terminal if the distance at the time is within a first predetermined range; a procedure for receiving a registration proposal confirmation message for the registration proposal message from the other terminal; A procedure for measuring a distance at a second time point with another terminal, and a terminal authority authentication certificate issuance proposal message to the other terminal if the distance at the second time point is within a second predetermined range. The transmission procedure is executed by the terminal. Thus, when the terminal transmits a registration proposal message and a terminal authority authentication certificate issuance proposal message to the counterpart terminal, there is an effect of ensuring that the distance from the counterpart terminal at each time is within a predetermined range.

  According to the present invention, when a message is transmitted to a communication partner terminal, an excellent effect of ensuring that the distance from the partner terminal is within a predetermined range can be achieved.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram showing a configuration example of a radio terminal 300 used in a radio communication system according to an embodiment of the present invention. The wireless terminal 300 includes a communication processing unit 320, a control unit 330, a display unit 340, an operation unit 350, a speaker 360, a microphone 370, and a memory 600, and a bus 380 is connected therebetween. It has become. An antenna 310 is connected to the communication processing unit 320. The communication processing unit 320 configures a network interface layer (data link layer) frame from a signal received via the antenna 310. Further, the communication processing unit 320 transmits a frame of the network interface layer via the antenna 310.

  The control unit 330 controls the entire wireless terminal 300. For example, a predetermined process is performed with reference to a frame configured by the communication processing unit 320. In addition, the control unit 330 includes a timer 335, and measures an elapsed time from a predetermined event. The display unit 340 displays predetermined information, and for example, a liquid crystal display can be used. The display for issuing the attribute certificate can also be performed on the display unit 340 by a GUI (Graphical User Interface). The operation unit 350 is for performing an operation instruction to the wireless terminal 300 from the outside. For example, a keyboard, a button switch, or the like can be used. An instruction for issuing an attribute certificate can also be given via the operation unit 350. The speaker 360 outputs audio and is used to alert the user of the wireless terminal 300 and exchange audio information with other terminals. The microphone 370 performs voice input from the outside to the wireless terminal 300, and is used for exchanging voice information with other terminals and instructing operations.

  The memory 600 includes an attribute certificate issuing terminal list table 610 that holds information related to the issuing terminal of the attribute certificate, an attribute certificate table 620 that holds an attribute certificate indicating the access authority of the wireless terminal 300 itself, and expired attributes. An attribute certificate revocation list table 630 that holds information related to a certificate, and a generated key table 650 that holds a public key, a private key, and a public key certificate are stored as information related to the generated key of the wireless terminal 300 itself.

  FIG. 2 is a configuration example of the attribute certificate issuing terminal list table 610 according to the embodiment of the present invention. This attribute certificate issuance terminal list table 610 holds information related to terminals that have a history of issuing attribute certificates in the past, and corresponds to each of the terminal identifiers 611 of the attribute certificate issuance terminals. The certificate 612 is held. The terminal identifier 611 only needs to uniquely identify the terminal in the network. For example, a MAC (Media Access Control) address in Ethernet (registered trademark) can be used. The public key certificate 612 is a terminal public key certificate identified by the corresponding terminal identifier 611. The public key certificate proves the identity of the certificate owner (subject) and includes the public key of the certificate owner. This public key certificate is signed by a certificate authority (CA) as a certificate issuer. It is assumed that the public key of the certificate authority is distributed to each terminal in advance.

  FIG. 3 is a diagram showing a format 710 of the public key certificate 612 held in the attribute certificate issuing terminal list table 610. The public key certificate format 710 is roughly composed of a pre-signature certificate 711, a signature algorithm 718, and a signature 719. The pre-signature certificate 711 includes a serial number 712, an issuer 714, an expiration date 715, an owner 716, an owner 716, and an owner public key 717.

  The serial number 712 is a serial number of the public key certificate and is numbered by a certificate authority. The issuer 714 is the name of the certificate authority that is the issuer of the public key certificate. The public key certificate is uniquely identified by the issuer 714 and the serial number 712. The expiration date 715 is the expiration date of the public key certificate. The owner 716 is the name of the owner of the public key certificate. The owner public key 717 is the owner 716 public key.

  The signature 719 is a signature by the certificate authority for the public key certificate, and the signature algorithm 718 is a signature algorithm used for this signature 719. The signature algorithm is composed of a message digest algorithm and a public key encryption algorithm. The message digest algorithm is one of hash functions (summary functions), and is an algorithm for creating a message digest of the pre-signature certificate 711. Here, the message digest is obtained by compressing input data (pre-signature certificate 711) into a fixed-length bit string, and is also called a thumbprint or a fingerprint (fingerprint). Known message digest algorithms include SHA-1 (Secure Hash Algorithm 1), MD2 (Message Digest # 2), MD5 (Message Digest # 5), and the like. The public key encryption algorithm is an algorithm for encrypting the message digest obtained by the message digest algorithm with the secret key of the certificate authority. Known public key encryption algorithms include RSA based on a prime factorization problem, DSA based on a discrete logarithm problem, and the like. Thus, the signature 719 is obtained by encrypting the message digest of the pre-signature certificate 711 with the private key of the certificate authority.

  Accordingly, a message digest can be obtained by decrypting the signature 719 of the public key certificate with the public key of the certificate authority. The user of the public key certificate creates the message digest of the pre-signature certificate 711 by itself and compares it with the message digest decrypted with the public key of the certificate authority, so that the contents of the pre-signature certificate 711 can be obtained. It can be verified that it has not been tampered with.

  FIG. 4 is a diagram showing an attribute certificate format 720 held in the attribute certificate table 620. This attribute certificate is roughly composed of attribute certification information 721, a signature algorithm 728, and a signature 729. The attribute certification information 721 includes an owner public key certificate identifier 723, an issuer 724, a serial number 722, and an expiration date 725.

  The owner public key certificate identifier 723 is for identifying the public key certificate of the owner of the attribute certificate. Specifically, it is identified by the issuer 714 and serial number 712 of the public key certificate 710 (FIG. 3). The issuer 724 is a name of an attribute certificate authority (AA) that is an issuer of the attribute certificate. The serial number 722 is a serial number of the attribute certificate and is numbered by the attribute certificate authority that is the issuer of the attribute certificate. The attribute certificate is uniquely identified by the serial number 722 and the issuer 724. The expiration date 725 is the expiration date of the attribute certificate.

  The signature 729 is a signature by the attribute certificate authority for the attribute certificate, and the signature algorithm 728 is a signature algorithm used for this signature 729. The contents of the signature algorithm are the same as the signature algorithm 718 of the public key certificate described above, and the signature 729 is obtained by encrypting the message digest of the attribute certification information 721 with the secret key of the attribute certification authority.

  Therefore, a message digest can be obtained by decrypting the signature 729 of the attribute certificate with the public key of the attribute certificate authority. The user of the attribute certificate creates a message digest of the attribute certification information 721 by itself and compares it with the message digest decrypted with the public key of the attribute certification authority, so that the contents of the attribute certification information 721 are falsified. You can verify that it is not.

  In the embodiment of the present invention, an attribute certificate is described as an example of a terminal authority authentication certificate. For example, the terminal authority is described in an XML language or the like, and an authority having the authority signs it. Even if it is created by this, it can function as a terminal authority authentication certificate in the present invention.

  FIG. 5 is a configuration example of the attribute certificate revocation list table 630 according to the embodiment of the present invention. This attribute certificate revocation list table 630 holds information related to a revoked attribute certificate, and holds a pair of a revoked attribute certificate identifier 631 and a revoked revocation time 632. Yes. An attribute certificate revocation list (ARL: Attribute certificate Revocation List) is issued in order to forcibly revoke an attribute certificate when a terminal is lost or stolen. A pair of attribute certificate identifier 631 and revocation time 632 is extracted from each revocation list entry of the attribute certificate revocation list and held. The attribute certificate identifier 631 is for identifying a revoked attribute certificate. Specifically, the attribute certificate identifier 631 is identified by the issuer 724 and the serial number 722 of the attribute certificate 720 (FIG. 4).

  FIG. 6 is a diagram showing the format of the attribute certificate revocation list 730. This attribute certificate revocation list is roughly composed of a pre-signature revocation list 731, a signature algorithm 738, and a signature 739. The pre-signed revocation list 731 includes a pre-signed revocation list issuer 734 and zero or more revocation list entries 735. The revocation list entry 735 is a pair of the attribute certificate identifier 736 of the revoked attribute certificate and the revocation time 737 that has been revoked. A pair of the attribute certificate identifier 736 and the revocation time 737 in the revocation list entry 735 corresponds to a pair of the attribute certificate identifier 631 and the revocation time 632 in the attribute certificate revocation list table 630 (FIG. 5).

  The signature 739 is a signature by the issuer for the attribute certificate revocation list, and the signature algorithm 738 is a signature algorithm used for this signature 739. The contents of the signature algorithm are the same as the signature algorithm 718 of the public key certificate described above, and the signature 739 is obtained by encrypting the message digest of the pre-signature revocation list 731 with the issuer's private key.

  Therefore, a message digest can be obtained by decrypting the signature 739 of the attribute certificate revocation list with the issuer's public key. The user of the attribute certificate revocation list creates the message digest of the pre-signature revocation list 731 by itself and compares it with the message digest decrypted by the issuer's public key, so that the contents of the pre-signature revocation list 731 Can be verified that has not been tampered with.

  In the wireless communication system according to the embodiment of the present invention, it is assumed that all terminals constituting the network can issue the attribute certificate revocation list. A terminal that has issued an attribute certificate revocation list broadcasts the attribute certificate revocation list to other terminals, so that the validity of the attribute certificate can be verified at other terminals. Further, when reconnecting to the network, each terminal exchanges the attribute certificate revocation list with each other and merges the attribute certificate revocation list table 630 to maintain the latest state. When issuing an attribute certificate revocation list, it is desirable to attach a public key certificate and an attribute certificate so that the issuer can be easily authenticated.

  FIG. 7 is a diagram showing a frame configuration used in communication in the embodiment of the present invention. The frame 800 includes a header part 801 and a payload part 802. The header portion 801 includes a receiving terminal identifier 803, a transmitting terminal identifier 804, and a frame type 805.

  The receiving terminal identifier 803 is the terminal identifier of the terminal that transmitted this frame. Here, the terminal identifier only needs to uniquely identify the terminal in the network as described above. For example, a MAC address in Ethernet (registered trademark) can be used. The transmission terminal identifier 804 is a terminal identifier of a terminal that receives this frame. The frame type 805 indicates the type of frame. The payload portion 802 stores data 809 that is the content of communication. This payload portion 802 is usually a target for encryption and decryption using an encryption key.

  Next, the operation of the wireless communication system according to the embodiment of the present invention will be described with reference to the drawings. In the embodiment of the present invention, as a preparation stage for a terminal to connect to a network resource, an authentication procedure by exchanging public key certificates and a registration procedure for issuing attribute certificates are performed. Each process in these procedures is realized by the control unit 330 in the wireless terminal 300.

  FIG. 8 is a diagram showing an example of an authentication procedure in the embodiment of the present invention. Here, the terminal A (100) is an attribute certificate issuing terminal that has already entered the network, and the terminal B (200) is a terminal that is newly entering the network.

In this authentication procedure, the process starts when terminal B receives a beacon from terminal A. In a wireless communication system having a base station, the base station transmits a beacon and other child stations receive the beacon. In addition, a wireless ad hoc communication system that does not have a base station is configured such that each terminal sends out a beacon so as to notify the other terminal of its own existence. In the embodiment of the present invention, the beacon includes not only a signal including only beacon information as a beacon signal but also a signal in which some data information is added to the beacon information.

  The terminal B receives (211) the beacon 1112 transmitted (111) by the terminal A. The configuration of the beacon 1112 is based on the frame configuration described with reference to FIG. In the beacon frame, the frame type 805 of the header portion 801 indicates that the frame is a beacon frame. Further, the header unit 801 holds an identifier of the type of attribute certificate possessed by the beacon transmission terminal (terminal A) following the frame type 805. As the identifier of the attribute certificate type, for example, an attribute certificate issuing terminal identifier can be used. If a valid terminal identifier is not held in the identifier field of this attribute certificate type (for example, all zeros), the beacon transmission terminal (terminal A) does not have an attribute certificate. It will be.

  When terminal B receives beacon 1112 from terminal A, terminal B measures the distance to terminal A at that time. In order to measure this distance, terminal B communicates with terminal A. In the example of FIG. 8, an RTS (Request To Send) control message and a CTS (Clear To Send) control message are used as an example of an access control packet for measuring the distance. The RTS control message and the CTS control message are originally used for avoiding a collision between stations in wireless communication, and the transmission side transmits an RTS control message prior to data transmission and responds to this. Thus, the receiving side transmits a CTS control message. Since other stations that have not received the RTS control message can also recognize that any station has started transmission by receiving the CTS control message, an interrupt can be avoided. In the embodiment of the present invention, by using this mechanism, the time from when the RTS control message is transmitted until the CTS control message is received is measured by the timer 335 (FIG. 1), and the distance is calculated from this time. It shall be.

For example, when time T _TAT from the transmission of the RTS control message to the reception of the CTS control message, the propagation speed of the radio wave is V, the distance D _AB between terminals A and B can be calculated by the following formula .
D _AB = (1/2) ・ V ・ T _TAT

Since the propagation speed V of radio waves is 3 × 10 ⁸ [m], for example, if the time T _TAT is 100 [ns],
D _AB = (1/2) × (3 × 10 ⁸ ) × (100 × 10 ⁻⁹ )
= 15 [m]
Thus, it can be seen that the distance between the terminal A and the terminal B is 15 [m].

  The configuration of the RTS control message is based on the frame configuration described with reference to FIG. In the RTS frame, the frame type 805 of the header portion 801 indicates that the frame is an RTS frame. Similarly, the structure of the CTS control message is based on the frame structure described with reference to FIG. In the CTS frame, the frame type 805 of the header portion 801 indicates that the frame is a CTS frame.

  When the terminal B transmits the RTS control message 2121 to the terminal A (212), the terminal A receives the RTS control message 2121 (112), and in response, sends a CTS control message 1132 to the terminal B. Transmit (113). When the terminal B receives the CTS control message 1132 from the terminal A, the terminal B measures the time from the transmission of the RTS control message 2121 to the reception of the CTS control message 1132 by the timer 335. Thereby, the terminal B calculates the distance to the terminal A.

  If the distance from the terminal A is within the predetermined distance X1, the terminal B transmits (214) a registration request message 2141. By limiting the distance to the terminal A within the predetermined distance X1, it is possible to prevent the registration request message 2141 from being transmitted to unnecessary terminals. The configuration of the registration request message 2141 is based on the frame configuration described with reference to FIG. In the registration request frame, the frame type 805 of the header portion 801 indicates that the frame is a registration request frame. Also, the public key certificate of terminal B is held as data 809 of the payload portion 802.

  When terminal A receives registration request message 2141 from terminal B (114), terminal A verifies the public key certificate of terminal B included in registration request message 2141 (115). Thus, when the identity of the terminal B is confirmed, the terminal A measures the distance to the terminal B at that time. In order to measure this distance, the terminal A transmits an RTS control message 1162 to the terminal B as in the case of the terminal B (116).

  Upon receiving the RTS control message 1162 from the terminal A (216), the terminal B responds to this by transmitting a CTS control message 2171 to the terminal A (217). When the terminal A receives the CTS control message 2171 from the terminal B (117), the timer 335 measures the time from when the RTS control message 1162 is transmitted until the CTS control message 2171 is received. Thereby, the terminal A calculates the distance to the terminal B.

  If the distance from the terminal B is within the predetermined distance X2, the terminal A transmits a registration request confirmation message 1182 (118). By limiting the distance to the terminal B to be within the predetermined distance X2, it is possible to prevent the registration request confirmation message 1182 from being transmitted to unnecessary terminals. The configuration of the registration request confirmation message 1182 is based on the frame configuration described with reference to FIG. In the registration request confirmation frame, the frame type 805 of the header portion 801 indicates that the frame is a registration request confirmation frame. Further, the public key certificate of terminal A is held as data 809 of the payload portion 802.

  When terminal B receives registration request confirmation message 1182 from terminal A (218), if it is within a predetermined time T1 from transmission of registration request message 2141 (214), terminal B includes terminal A included in registration request confirmation message 1182. The public key certificate is verified (219). The reason why the message response time is limited to the predetermined time T1 is based on the assumption that the message response is lost due to a change in the communication state.

  Thus, when the identity of the terminal A is confirmed (219), the terminal A and the terminal B authenticate each other's identity.

  FIG. 9 is a diagram showing an example of a registration procedure in the embodiment of the present invention. In FIG. 8, when the identity of the terminal A is confirmed (219), the terminal B measures the distance to the terminal A at that time. In order to measure this distance, terminal B transmits (221) an RTS control message 2211 to terminal A, as in the previous case.

  Upon receiving the RTS control message 2211 from the terminal B (121), the terminal A responds to this by transmitting a CTS control message 1222 to the terminal B (122). When the terminal B receives the CTS control message 1222 from the terminal A (222), the terminal B measures the time from the transmission of the RTS control message 2211 to the reception of the CTS control message 1222 by the timer 335. Thereby, the terminal B calculates the distance to the terminal A.

  If the distance to the terminal A is within the predetermined distance X3, the terminal B transmits (223) the attribute certificate issuance request message 2231. By limiting the distance to the terminal A to be within the predetermined distance X3, it is possible to prevent the attribute certificate issuance request message 2231 from being transmitted to unnecessary terminals. The configuration of the attribute certificate issue request message 2231 is based on the frame configuration described with reference to FIG. In the attribute certificate issuance request frame, the frame type 805 of the header portion 801 indicates that the frame is an attribute certificate issuance request frame.

  When the terminal A receives the attribute certificate issuance request message 2231 from the terminal B (123), if it is within the predetermined time T2 from the transmission (118) of the registration request confirmation message 1182, the terminal A is the terminal at that time Measure the distance to B. In order to measure this distance, terminal A transmits (124) an RTS control message 1242 to terminal B, as in the previous case. Note that the reason why the message response time is limited to within the predetermined time T2 is based on the assumption that the message response is lost due to a change in the communication state.

  Upon receiving the RTS control message 1242 from the terminal A (224), the terminal B responds to this by transmitting a CTS control message 2251 to the terminal A (225). When the terminal A receives this CTS control message 2251 from the terminal B (125), the timer 335 measures the time from when the RTS control message 1242 is transmitted until the CTS control message 2251 is received. Thereby, the terminal A calculates the distance to the terminal B.

  If the distance to the terminal B is within the predetermined distance X4, the terminal A transmits (126) an attribute certificate issuance message 1262. By limiting the distance to the terminal B within the predetermined distance X4, it is possible to prevent the attribute certificate issuance message 1262 from being transmitted to unnecessary terminals. The attribute certificate issuance message 1262 is configured according to the frame configuration described with reference to FIG. In the attribute certificate issuance frame, the frame type 805 of the header portion 801 indicates that the frame is an attribute certificate issuance frame. Also, an attribute certificate is held as data 809 of the payload portion 802.

  When the terminal B receives the attribute certificate issuance message 1262 from the terminal A (226), if it is within a predetermined time T3 from the transmission (223) of the attribute certificate issuance request message 2231, the terminal B The distance to terminal A is measured. In order to measure this distance, terminal B transmits an RTS control message 2271 to terminal A (227) as in the previous case. Note that the reason why the message response time is limited to the predetermined time T3 is based on the assumption that the message response is lost due to a change in the communication state.

  Upon receiving the RTS control message 2271 from the terminal B (127), the terminal A responds to this by transmitting a CTS control message 1282 to the terminal B (128). When the terminal B receives the CTS control message 1282 from the terminal A (228), the terminal B measures the time from the transmission of the RTS control message 2271 to the reception of the CTS control message 1282 by the timer 335. Thereby, the terminal B calculates the distance to the terminal A.

  If the distance to the terminal A is within the predetermined distance X5, the terminal B transmits (229) an attribute certificate receipt confirmation message 2291. By limiting the distance to the terminal A to within the predetermined distance X5, it is possible to prevent the attribute certificate receipt confirmation message 2291 from being transmitted to unnecessary terminals. The configuration of the attribute certificate receipt confirmation message 2291 is based on the frame configuration described with reference to FIG. In the attribute certificate receipt confirmation frame, the frame type 805 of the header portion 801 indicates that the frame is an attribute certificate receipt confirmation frame.

  Upon receiving the attribute certificate receipt confirmation message 2291 from the terminal B (129), the terminal A validates the issued attribute certificate if it is within the predetermined time T4 from the transmission (126) of the attribute certificate issuance message 1262. Treat it as something. If the attribute certificate receipt confirmation message 2291 cannot be received from the terminal B even after the predetermined time T4 has elapsed, the attribute certificate revocation list 730 is issued to revoke the issued attribute certificate. The reason why the message response time is limited to within the predetermined time T4 is based on the assumption that the message response is lost due to a change in the communication state.

  Next, processing in each terminal of an example of the wireless communication system according to the embodiment of the present invention will be described with reference to the drawings.

  FIG. 10 is a diagram showing a flow of registration request processing in the terminal B of FIG. First, when receiving a beacon from terminal A (step S901), terminal B determines whether or not it owns an attribute certificate (step S902). If terminal B owns the attribute certificate, the beacon from terminal A is confirmed (step S903), and it is determined whether terminal A owns the attribute certificate (step S904). If terminal A has an attribute certificate, it is determined whether the attribute certificate of terminal A is from the same issuing authority as that of terminal B (step S905).

  If the attribute certificate of terminal A and the attribute certificate of terminal B are from the same issuing authority in step S905, terminal B already has a valid attribute certificate. The process returns to the initial state without performing the process (step S909). In other cases, that is, when either terminal B or terminal A does not have an attribute certificate (steps S902 and S904), even if terminal B and terminal A have an attribute certificate, the issuer If the (attribute certificate authority) is different (step S905), the terminal B measures the distance to the terminal A (step S906). In order to measure this distance, communication is performed between the terminal B and the terminal A as described above. For example, RTS control messages and CTS control messages can be used.

  As a result of the measurement in step S906, if the distance to the terminal A is within the predetermined distance X1 (step S907), the terminal B transmits a registration request message to the terminal A (step S908). On the other hand, if the distance to the terminal A exceeds the predetermined distance X1, the process returns to the initial state without further processing (step S909).

  FIG. 11 is a diagram showing a flow of registration request confirmation processing in the terminal A of FIG. When the registration request message transmitted from the terminal B in step S908 in FIG. 10 is received (step S911), the terminal A verifies the public key certificate of the terminal B included in the registration request message (step S912). The public key of the certificate authority is used for verification of the public key certificate. As a result of the verification, if the identity of terminal B can be authenticated (step S913), terminal A measures the distance to terminal B (step S914). On the other hand, if the identity of the terminal B cannot be authenticated in step S913, the process returns to the initial state without further processing (step S919).

  As a result of the measurement in step S914, if the distance to the terminal B is within the predetermined distance X2 (step S915), the terminal A transmits a registration request confirmation message to the terminal B (step S916). On the other hand, if the distance to the terminal B exceeds the predetermined distance X2, the process returns to the initial state without further processing (step S919).

  FIG. 12 is a diagram showing a flow of attribute certificate issuance request processing in the terminal B of FIGS. 8 and 9. When the registration request confirmation message transmitted from terminal A in step S916 in FIG. 11 is received within a predetermined time T1 from the transmission of the registration request message (step S908) (steps S921, S922), terminal B is included in the registration request confirmation message. The public key certificate of the terminal A is verified (step S923). On the other hand, if the registration request confirmation message cannot be received within the predetermined time T1, a timeout occurs and the process returns to the initial state (step S939).

  As a result of the verification in step S923, if the identity of terminal A can be authenticated (step S924), terminal B validates the registration permission mechanism in terminal B (step S925). The registration permission mechanism is a mechanism for making an issuance request for an attribute certificate from the terminal B. For example, the registration permission mechanism displays that an issuance request for an attribute certificate can be made on the display unit 340 of the terminal B ( It is conceivable that the user is alerted by operating a vibrator mechanism (not shown), and a registration permission input from the operation unit 350 is prompted. On the other hand, if the identity of terminal A cannot be authenticated in step S924, the process returns to the initial state without further processing (step S939).

  Here, if the terminal B possesses the attribute certificate (step S926), it is assumed that no further attribute certificate is issued unless registration permission is input in the above-described registration permission mechanism (step S927). The process returns to the initial state without further processing (step S939).

  Subsequently, terminal B measures the distance to terminal A (step S928). As a result of the measurement, if the distance to the terminal A is within the predetermined distance X3 (step S929), the terminal B transmits an attribute certificate issuance request message to the terminal A (step S931). On the other hand, if the distance from the terminal A exceeds the predetermined distance X3, the process returns to the initial state without further processing (step S939).

  FIG. 13 is a diagram showing a flow of attribute certificate issuance processing in terminal A of FIG. When the attribute certificate issuance request message transmitted from terminal B in step S931 in FIG. 12 is received within a predetermined time T2 from transmission of the registration request confirmation message (step S916) (steps S941, S943), terminal A and terminal B Is measured (step S944). On the other hand, if the attribute certificate issuance request message cannot be received within the predetermined time T2, the process times out and returns to the initial state (step S949).

  As a result of the measurement in step S944, if the distance to the terminal B is within the predetermined distance X4 (step S945), the terminal A transmits an attribute certificate issuance message to the terminal B (step S946). On the other hand, if the distance to the terminal B exceeds the predetermined distance X4, the process returns to the initial state without further processing (step S949).

  FIG. 14 is a diagram showing a flow of attribute certificate receipt confirmation processing in the terminal B of FIG. When the attribute certificate issuance message transmitted from terminal A in step S946 in FIG. 13 is received within a predetermined time T3 from the transmission of the attribute certificate issuance request message (step S931) (steps S951 and S953), terminal B Is measured (step S954). On the other hand, if the attribute certificate issuance message cannot be received within the predetermined time T3, a timeout occurs and the initial state is restored (step S959).

  As a result of the measurement in step S954, if the distance to the terminal A is within the predetermined distance X5 (step S955), the terminal B transmits an attribute certificate receipt confirmation message to the terminal A (step S956). On the other hand, if the distance to the terminal A exceeds the predetermined distance X5, the process returns to the initial state without further processing (step S959).

  FIG. 15 is a diagram showing the flow of attribute certificate revocation processing in terminal A of FIG. If the attribute certificate receipt confirmation message transmitted from terminal B in step S956 in FIG. 14 cannot be received within a predetermined time T4 from the transmission of the attribute certificate issuance message (step S946) (steps S961 and S962), the attribute certificate has already been received. In order to revoke the attribute certificate issued by the issue message (step S946), the attribute certificate revocation list 730 is issued (step S963), and the initial state is returned (step S964).

  On the other hand, when the attribute certificate receipt confirmation message transmitted from the terminal B can be received within the predetermined time T4 (steps S961 and S962), the issued attribute certificate is regarded as valid and the registration procedure is processed. finish. As a result, the terminal B can connect to the network using the attribute certificate issued from the terminal A.

  As described above, according to the embodiment of the present invention, when the terminal B receives the issuance of the attribute certificate from the terminal A, the terminal B and the terminal A measure each other's distance and are within a predetermined distance range. By confirming the above, the processing is continued, so that the attribute certificate issuance process can be performed in a safe state in which the mutual distance is guaranteed to be within the predetermined range.

  Next, the operation of another example of the wireless communication system according to the embodiment of the present invention will be described with reference to the drawings.

  FIG. 16 is a diagram showing another example of the authentication procedure in the embodiment of the present invention. Here, the terminal C (400) is a terminal that is newly entering the network, and the terminal D (500) is an attribute certificate issuing terminal that has already entered the network.

  Terminal D receives (511) the beacon 4112 transmitted (411) by terminal C. The configuration of the beacon 4112 is based on the frame configuration described with reference to FIG. In the beacon frame, the frame type 805 of the header portion 801 indicates that the frame is a beacon frame. Further, the header part 801 holds an identifier of the type of attribute certificate possessed by the beacon transmission terminal (terminal C) following the frame type 805. As the identifier of the attribute certificate type, for example, an attribute certificate issuing terminal identifier can be used. When a valid terminal identifier is not held in the identifier field of this attribute certificate type (for example, all zeros), the beacon transmission terminal (terminal C) does not have an attribute certificate. It will be.

  When terminal D receives beacon 4112 from terminal C, terminal D measures the distance to terminal C at that time. In order to measure this distance, terminal D communicates with terminal C. In the example of FIG. 16, as in the case of the example of FIG. 8, an RTS control message and a CTS control message are used as an example of an access control packet for measuring the distance.

  When the terminal D transmits the RTS control message 5121 to the terminal C (512), the terminal C receives the RTS control message 5121 (412), and in response thereto, sends the CTS control message 4132 to the terminal D. Transmit (413). When the terminal D receives the CTS control message 4132 from the terminal C, the terminal D measures the time from the transmission of the RTS control message 5121 to the reception of the CTS control message 4132 by the timer 335. Thereby, the terminal D calculates the distance to the terminal C.

  If the distance to the terminal C is within the predetermined distance X1, the terminal D transmits (514) a registration proposal message 5141. By limiting the distance to the terminal C within the predetermined distance X1, it is possible to prevent the registration proposal message 5141 from being transmitted to unnecessary terminals. The configuration of the registration proposal message 5141 is based on the frame configuration described with reference to FIG. In the registration proposal frame, the frame type 805 of the header portion 801 indicates that the frame is a registration proposal frame. Also, the public key certificate of terminal D is held as data 809 of the payload portion 802.

  When terminal C receives registration proposal message 5141 from terminal D (414), terminal C verifies the public key certificate of terminal D included in registration proposal message 5141 (415). Thus, when the identity of the terminal D is confirmed, the terminal C measures the distance to the terminal D at that time. In order to measure this distance, the terminal C transmits (416) the RTS control message 4162 to the terminal D as in the case of the terminal D.

  Upon receiving the RTS control message 4162 from the terminal C (516), in response to this, the terminal D transmits a CTS control message 5171 to the terminal C (517). When the terminal C receives the CTS control message 5171 from the terminal D (417), the terminal C measures the time from the transmission of the RTS control message 4162 to the reception of the CTS control message 5171 by the timer 335. Thereby, the terminal C calculates the distance to the terminal D.

  If the distance to the terminal D is within the predetermined distance X2, the terminal C transmits a registration proposal confirmation message 4182 (418). By limiting the distance to the terminal D within the predetermined distance X2, the registration proposal confirmation message 4182 is prevented from being transmitted to unnecessary terminals. The configuration of the registration proposal confirmation message 4182 is based on the frame configuration described with reference to FIG. In the registration proposal confirmation frame, the frame type 805 of the header portion 801 indicates that the frame is a registration proposal confirmation frame. Further, the public key certificate of terminal C is held as data 809 of the payload portion 802.

  When terminal D receives registration proposal confirmation message 4182 from terminal C (518), if it is within predetermined time T1 from transmission of registration proposal message 5141 (514), terminal D includes terminal C included in registration proposal confirmation message 4182. The public key certificate is verified (519). The reason why the message response time is limited to the predetermined time T1 is based on the assumption that the message response is lost due to a change in the communication state.

  Thus, when the identity of the terminal C is confirmed (219), the terminal C and the terminal D authenticate each other's identity.

  FIG. 17 is a diagram showing another example of the registration procedure in the embodiment of the present invention. In FIG. 16, when the identity of the terminal C is confirmed (519), the terminal D measures the distance to the terminal C at that time. In order to measure this distance, the terminal D transmits (521) an RTS control message 5211 to the terminal C as in the previous case.

  Upon receiving the RTS control message 5211 from the terminal D (421), the terminal C responds to this by transmitting (422) the CTS control message 4222 to the terminal D. When the terminal D receives the CTS control message 4222 from the terminal C (522), the terminal D measures the time from the transmission of the RTS control message 5211 to the reception of the CTS control message 4222 by the timer 335. Thereby, the terminal D calculates the distance to the terminal C.

  If the distance to the terminal C is within the predetermined distance X3, the terminal D transmits (523) an attribute certificate issuance proposal message 5231. By limiting the distance to the terminal C within the predetermined distance X3, it is possible to prevent the attribute certificate issue proposal message 5231 from being transmitted to unnecessary terminals. The attribute certificate issuance proposal message 5231 has a frame configuration described with reference to FIG. In the attribute certificate issuance proposal frame, the frame type 805 of the header portion 801 indicates that the frame is an attribute certificate issuance proposal frame.

  When the terminal C receives the attribute certificate issuance proposal message 5231 from the terminal D (423), if it is within the predetermined time T2 from the transmission (418) of the registration proposal confirmation message 4182, the terminal C is the terminal at that time Measure the distance to D. In order to measure this distance, terminal C transmits (424) an RTS control message 4242 to terminal D, as in the previous case. Note that the reason why the message response time is limited to within the predetermined time T2 is based on the assumption that the message response is lost due to a change in the communication state.

  When receiving the RTS control message 4242 from the terminal C (424), the terminal D responds to this by transmitting (525) the CTS control message 5251 to the terminal C. When the terminal C receives the CTS control message 5251 from the terminal B (425), the terminal C measures the time from the transmission of the RTS control message 4242 to the reception of the CTS control message 5251 by the timer 335. Thereby, the terminal C calculates the distance to the terminal D.

  If the distance from the terminal D is within the predetermined distance X4, the terminal C transmits an attribute certificate receipt confirmation message 4262 (426). By limiting the distance to the terminal D to be within the predetermined distance X4, it is possible to prevent the attribute certificate receipt confirmation message 4262 from being transmitted to unnecessary terminals. The attribute certificate receipt confirmation message 4262 is configured according to the frame configuration described with reference to FIG. In the attribute certificate receipt confirmation frame, the frame type 805 of the header portion 801 indicates that the frame is an attribute certificate receipt confirmation frame.

  When terminal D receives attribute certificate receipt confirmation message 4262 from terminal C (526), if it is within a predetermined time T3 from transmission of attribute certificate issuance proposal message 5231 (523), terminal D receives the issued attribute certificate. Treat as valid. If the attribute certificate receipt confirmation message 4262 cannot be received from the terminal C even after the predetermined time T3 has elapsed, the attribute certificate revocation list 730 is issued in order to revoke the issued attribute certificate. Note that the reason why the message response time is limited to the predetermined time T3 is based on the assumption that the message response is lost due to a change in the communication state.

  Next, processing in each terminal of another example of the wireless communication system according to the embodiment of the present invention will be described with reference to the drawings.

  FIG. 18 is a diagram showing a flow of registration proposal processing in terminal D of FIG. First, upon receiving a beacon from terminal C (step S1001), terminal D determines whether or not it owns an attribute certificate (step S1002). If the terminal D owns the attribute certificate, the beacon from the terminal C is confirmed (step S1003), and it is determined whether the terminal C owns the attribute certificate (step S1004). If the terminal C owns the attribute certificate, it is determined whether the attribute certificate of the terminal C is from the same issuing authority as the attribute certificate of the terminal D (step S1005).

  If the attribute certificate of terminal C and the attribute certificate of terminal D are from the same issuing authority in step S1005, terminal C already has a valid attribute certificate. The process returns to the initial state without performing the process (step S1009). In other cases, that is, when either terminal D or terminal C does not have an attribute certificate (steps S1002 and S1004), even if terminal D and terminal C have an attribute certificate, the issuer If the (attribute certificate authority) is different (step S1005), the terminal D measures the distance to the terminal C (step S1006). In order to measure this distance, communication is performed between the terminal D and the terminal C as described above. For example, RTS control messages and CTS control messages can be used.

  As a result of the measurement in step S1006, if the distance to the terminal C is within the predetermined distance X1 (step S1007), the terminal D transmits a registration proposal message to the terminal C (step S1008). On the other hand, if the distance to the terminal C exceeds the predetermined distance X1, the process returns to the initial state without further processing (step S1009).

  FIG. 19 is a diagram showing a flow of registration proposal confirmation processing in the terminal C of FIG. When the registration proposal message transmitted from the terminal D in step S1008 in FIG. 18 is received (step S1011), the terminal C verifies the public key certificate of the terminal D included in the registration proposal message (step S1012). The public key of the certificate authority is used for verification of the public key certificate. As a result of the verification, if the identity of the terminal D can be authenticated (step S1013), the terminal C measures the distance to the terminal D (step S1014). On the other hand, if the identity of the terminal D cannot be authenticated in step S1013, the process returns to the initial state without further processing (step S1019).

  As a result of the measurement in step S1014, if the distance to the terminal D is within the predetermined distance X2 (step S1015), the terminal C transmits a registration proposal confirmation message to the terminal D (step S1016). On the other hand, if the distance to the terminal D exceeds the predetermined distance X2, the process returns to the initial state without further processing (step S1019).

  FIG. 20 is a diagram illustrating a flow of attribute certificate issuance proposal processing in the terminal D in FIGS. 16 and 17. When the registration proposal confirmation message transmitted from terminal C in step S1016 of FIG. 19 is received within a predetermined time T1 from the transmission of the registration proposal message (step S1008) (steps S1021 and S1022), terminal D is included in the registration proposal confirmation message. The public key certificate of the terminal C is verified (step S1023). On the other hand, if the registration proposal confirmation message cannot be received within the predetermined time T1, a timeout occurs and the initial state is restored (step S1031).

  As a result of the verification in step S1023, if the identity of terminal C can be authenticated (step S1024), terminal D validates the registration permission mechanism in terminal D (step S1025). The registration permission mechanism is a mechanism for issuing an attribute certificate from the terminal D. For example, the registration permission mechanism displays that the attribute certificate can be issued on the display unit 340 of the terminal D (not shown). ) It is conceivable that the user is alerted by operating the vibrator mechanism to prompt the registration permission input from the operation unit 350. On the other hand, if the identity of the terminal C cannot be authenticated in step S1024, the process returns to the initial state without further processing (step S1031).

  Here, unless a registration permission input is made in the above-described registration permission mechanism (step S1026), it is assumed that no further attribute certificate is issued and the process returns to the initial state without further processing (step S1031).

  Subsequently, the terminal D measures the distance to the terminal C (step S1027). As a result of the measurement, if the distance from the terminal C is within the predetermined distance X3 (step S1028), the terminal D issues an attribute certificate to the terminal C (step S1029), and sends an attribute certificate issuance proposal message to the terminal C. (Step S1030). On the other hand, if the distance to the terminal C exceeds the predetermined distance X3, the process returns to the initial state without further processing (step S1031).

  FIG. 21 is a diagram showing the flow of attribute certificate issuance proposal confirmation processing in terminal C of FIG. When the attribute certificate issuance proposal message transmitted from terminal D in step S1030 of FIG. 20 is received within a predetermined time T2 from transmission of the registration proposal confirmation message (step S1016) (steps S1041 and S1042), terminal C Is measured (step S1043). On the other hand, if the attribute certificate issuance proposal message cannot be received within the predetermined time T2, a timeout occurs and the initial state is restored (step S1049).

  As a result of the measurement in step S1043, if the distance from the terminal D is within the predetermined distance X4 (step S1044), the terminal C receives the attribute certificate (step S1045), and notifies the fact through the attribute certificate receipt confirmation message. It transmits with respect to the terminal D (step S1046). On the other hand, if the distance to the terminal D exceeds the predetermined distance X4 (step S1044), the reception of the attribute certificate is rejected (step S1048), and the rejection is transmitted to the terminal D through the attribute certificate receipt confirmation message. (Step S1046).

  FIG. 22 is a diagram showing the flow of attribute certificate revocation processing in terminal D of FIG. If the attribute certificate receipt confirmation message transmitted from the terminal C in step S1046 of FIG. 21 cannot be received within the predetermined time T3 from the transmission of the attribute certificate issuance proposal message (step S1030) (steps S1061, S1062), the attribute certificate has already been obtained. In order to revoke the attribute certificate issued by the certificate issuance proposal message (step S1029), the attribute certificate revocation list 730 is issued (step S1063), and the initial state is returned (step S1064).

  On the other hand, if the attribute certificate receipt confirmation message transmitted from the terminal C is received within the predetermined time T3 (steps S1061 and S1062), the issued attribute certificate is regarded as valid and the registration procedure is processed. finish. As a result, the terminal C can connect to the network using the attribute certificate issued from the terminal D.

  Thus, according to another example of the embodiment of the present invention, when terminal D makes an issuance proposal of an attribute certificate for terminal C, terminal D and terminal C measure each other's distance and By confirming that it is within the range, the processing is continued, so that the attribute certificate issuance processing can be performed in a safe state in which it is ensured that the distance between each other is within the predetermined range.

  In the embodiment of the present invention, an example in which an access control packet (RTS control message and CTS control message) is used as an example of measuring the distance between terminals has been described. However, the present invention is not limited to this. It is also possible to measure the time until a response signal (for example, an ACK signal) that responds to this signal returns.

  Further, the embodiments of the present invention are illustrated here, and the present invention is not limited thereto, and various modifications can be made without departing from the gist of the present invention.

  Further, the processing procedure described here may be regarded as a method having a series of these procedures, or may be regarded as a program for causing a computer to execute the series of procedures or a recording medium storing the program.

  As an application example of the present invention, for example, the present invention can be applied when message transmission is performed between terminals in a wireless communication system.

It is a figure which shows the structural example of the radio | wireless terminal 300 used in the radio | wireless communications system in embodiment of this invention. It is a structural example of the attribute certificate issuing terminal list table 610 in the embodiment of the present invention. It is a figure which shows the format 710 of the public key certificate 612 hold | maintained at the attribute certificate issuing terminal list table 610 in embodiment of this invention. It is a figure which shows the format 720 of the attribute certificate hold | maintained at the attribute certificate table 620 in embodiment of this invention. It is a structural example of the attribute certificate revocation list table 630 in the embodiment of the present invention. It is a figure which shows the format of the attribute certificate revocation list | wrist 730 in embodiment of this invention. It is a figure which shows the frame structure used in the communication in embodiment of this invention. It is a figure which shows an example of the authentication procedure in embodiment of this invention. It is a figure which shows an example of the registration procedure in embodiment of this invention. It is a figure which shows the flow of the registration request process of the terminal B in embodiment of this invention. It is a figure which shows the flow of the registration request confirmation process of the terminal A in embodiment of this invention. It is a figure which shows the flow of the attribute certificate issue request process of the terminal B in embodiment of this invention. It is a figure which shows the flow of the attribute certificate issuing process of the terminal A in embodiment of this invention. It is a figure which shows the flow of the attribute certificate receipt confirmation process of the terminal B in embodiment of this invention. It is a figure which shows the flow of the attribute certificate revocation process of the terminal A in embodiment of this invention. It is a figure which shows the other example of the authentication procedure in embodiment of this invention. It is a figure which shows the other example of the registration procedure in embodiment of this invention. It is a figure which shows the flow of the registration proposal process of the terminal D in embodiment of this invention. It is a figure which shows the flow of the registration proposal confirmation process of the terminal C in embodiment of this invention. It is a figure which shows the flow of the attribute certificate issuance proposal process of the terminal D in embodiment of this invention. It is a figure which shows the flow of the attribute certificate issue proposal confirmation process of the terminal C in embodiment of this invention. It is a figure which shows the flow of the attribute certificate revocation process of the terminal D in embodiment of this invention.

Explanation of symbols

100 wireless terminal (terminal A)
200 Wireless terminal (terminal B)
DESCRIPTION OF SYMBOLS 300 Wireless terminal 310 Antenna 320 Communication processing part 330 Control part 335 Timer 340 Display part 350 Operation part 360 Speaker 370 Microphone 380 Bus 400 Wireless terminal (terminal C)
500 wireless terminal (terminal D)
600 Memory 610 Attribute Certificate Issuing Terminal List Table 620 Attribute Certificate Table 630 Attribute Certificate Revocation List Table 650 Generated Key Table 710 Public Key Certificate 720 Attribute Certificate 730 Attribute Certificate Revocation List 800 Frame

Claims (16)

A wireless communication system comprising a plurality of terminals,
A first terminal that transmits a signal including beacon information;
In response to the signal, the distance to the first terminal is measured, and if the distance is within the first predetermined range, registration for issuing a terminal authority authentication certificate to the first terminal is performed. A second terminal making a registration request to request,
In response to the registration request, the first terminal measures a distance from the second terminal, and if the distance is within a second predetermined range, the first terminal sends a request for the registration request to the second terminal. There line for confirmation,
The second terminal measures the distance to the first terminal in response to the confirmation of the registration request, and if the distance is within a third predetermined range, the second terminal Make a request to issue an authorization certificate,
The first terminal measures the distance to the second terminal in response to the request for issuing the terminal authority authentication certificate, and if the distance is within a fourth predetermined range, the first terminal A wireless communication system that issues the terminal authority authentication certificate to the wireless communication system. The second terminal measures the distance to the first terminal in response to the issuance of the terminal authority authentication certificate, and if the distance is within a fifth predetermined range, the second terminal conduct an acknowledgment of the terminal authorization certificate Te,
It said first terminal, to issue a revocation list of the terminal authorization certificate unless acknowledgment of the terminal authorization certificate is made within a predetermined time period from the terminal authorization certificate
請 Motomeko 1 wireless communication system according.   The first terminal measures distance by communicating with the second terminal;
  The second terminal measures distance by communicating with the first terminal
The wireless communication system according to claim 1.   The first terminal measures distance by exchanging access control packets with the second terminal;
  The second terminal measures distance by exchanging access control packets with the first terminal.
The wireless communication system according to claim 3.   The first terminal measures a distance by a response signal from the second terminal with respect to communication to the second terminal,
  The second terminal measures a distance by a response signal from the first terminal with respect to communication to the first terminal.
The wireless communication system according to claim 3.   The second terminal also presents the public key certificate of the second terminal when making the registration request to the first terminal,
  The first terminal also presents the public key certificate of the first terminal when confirming the registration request to the second terminal
The wireless communication system according to claim 1. A wireless communication system comprising a plurality of terminals,
A first terminal that transmits a signal including beacon information;
In response to the signal, the distance to the first terminal is measured, and if the distance is within the first predetermined range, registration for issuing a terminal authority authentication certificate to the first terminal is performed. A second terminal for making a proposed registration proposal,
The first terminal measures the distance to the second terminal in response to the registration proposal, and if the distance is within a second predetermined range, the first terminal There line for confirmation,
The second terminal measures the distance to the first terminal in response to the confirmation of the registration proposal, and if the distance is within a third predetermined range, the second terminal Issue an authorization certificate, make a proposal to issue a terminal authorization certificate,
The first terminal measures the distance to the second terminal in response to the issuance proposal of the terminal authority authentication certificate, and if the distance is within a fourth predetermined range, the first terminal A wireless communication system for confirming receipt of the terminal authority authentication certificate . Said second terminal, said terminal authorization certificate proposed to issue a revocation list of the said terminal authorization certificate unless acknowledgment of the terminal authorization certificate is made within a predetermined time period invoiced Item 8. The wireless communication system according to Item 7.   The first terminal measures distance by communicating with the second terminal;
  The second terminal measures distance by communicating with the first terminal
The wireless communication system according to claim 7.   The first terminal measures distance by exchanging access control packets with the second terminal;
  The second terminal measures distance by exchanging access control packets with the first terminal.
The wireless communication system according to claim 9.   The first terminal measures a distance by a response signal from the second terminal with respect to communication to the second terminal,
  The second terminal measures a distance by a response signal from the first terminal with respect to communication to the first terminal.
The wireless communication system according to claim 9.   The second terminal also presents the public key certificate of the second terminal when making the registration proposal to the first terminal,
  The first terminal also presents the public key certificate of the first terminal when confirming the registration proposal to the second terminal
The wireless communication system according to claim 7.   In a wireless communication system composed of a plurality of terminals,
  A procedure in which a first terminal transmits a signal including beacon information;
  The second terminal measures the distance to the first terminal in response to the signal, and if the distance is within the first predetermined range, a terminal authority authentication certificate is sent to the first terminal. A procedure for making a registration request to request registration for issuance;
  In response to the registration request, the first terminal measures the distance to the second terminal, and if the distance is within a second predetermined range, the registration request for the second terminal is sent to the second terminal. The steps to check,
  The second terminal measures the distance to the first terminal in response to the confirmation of the registration request, and if the distance is within a third predetermined range, the terminal is compared with the first terminal. A procedure for issuing an authorization certificate issuance request;
  The first terminal measures the distance to the second terminal in response to the request for issuing the terminal authority authentication certificate, and if the distance is within the fourth predetermined range, the first terminal Issuing a terminal authority authentication certificate to
A wireless communication method comprising:   In a wireless communication system composed of a plurality of terminals,
  A procedure in which a first terminal transmits a signal including beacon information;
  The second terminal measures the distance to the first terminal in response to the signal, and if the distance is within the first predetermined range, a terminal authority authentication certificate is sent to the first terminal. A procedure for making a registration proposal to propose registration for publication;
  In response to the registration proposal, the first terminal measures a distance to the second terminal, and if the distance is within a second predetermined range, The steps to check,
  The second terminal measures the distance to the first terminal in response to the confirmation of the registration proposal, and if the distance is within a third predetermined range, the terminal is compared with the first terminal. A procedure for issuing an authorization certificate and making a proposal for issuing a terminal authorization certificate;
  The first terminal measures the distance to the second terminal in response to the issuance proposal of the terminal authority authentication certificate, and if the distance is within a fourth predetermined range, the first terminal A procedure for confirming receipt of the terminal authority authentication certificate;
A wireless communication method comprising:   In a wireless communication system composed of a plurality of terminals,
  A procedure in which a first terminal transmits a signal including beacon information;
  The second terminal measures the distance to the first terminal in response to the signal, and if the distance is within the first predetermined range, a terminal authority authentication certificate is sent to the first terminal. A procedure for making a registration request to request registration for issuance;
  In response to the registration request, the first terminal measures the distance to the second terminal, and if the distance is within a second predetermined range, the registration request for the second terminal is sent to the second terminal. The steps to check,
  In response to the confirmation of the registration request, the second terminal measures the distance to the first terminal, and if the distance is within a third predetermined range, the terminal is compared with the first terminal. A procedure for issuing an authorization certificate issuance request;
  The first terminal measures the distance to the second terminal in response to the request for issuing the terminal authority authentication certificate, and if the distance is within the fourth predetermined range, the first terminal Issuing a terminal authority authentication certificate to
A program that causes a computer to execute.   In a wireless communication system composed of a plurality of terminals,
  A procedure in which a first terminal transmits a signal including beacon information;
  The second terminal measures the distance to the first terminal in response to the signal, and if the distance is within the first predetermined range, a terminal authority authentication certificate is sent to the first terminal. A procedure for making a registration proposal to propose registration for publication;
  In response to the registration proposal, the first terminal measures the distance to the second terminal, and if the distance is within a second predetermined range, The steps to check,
  The second terminal measures the distance to the first terminal in response to the confirmation of the registration proposal, and if the distance is within a third predetermined range, the terminal is compared with the first terminal. A procedure for issuing an authorization certificate and making a proposal for issuing a terminal authorization certificate;
  The first terminal measures the distance to the second terminal in response to the issuance proposal of the terminal authority authentication certificate, and if the distance is within a fourth predetermined range, the first terminal A procedure for confirming receipt of the terminal authority authentication certificate;
A program that causes a computer to execute.

Images