JP6880658B2 - Wireless communication device, private key creation method, bit string creation module and program - Google Patents

Description

The present invention relates to a wireless communication device, a method for creating a private key, a bit string creation module and a program, and more particularly to a wireless communication device for performing encrypted communication using a private key, a method for creating a private key and a program.

In recent years, serious security accidents such as information leakage have become a social problem, and the introduction of various security technologies is being considered. With the spread of smartphones and IoT (Internet of Things) devices, wireless communication networks have become widely used. With the spread of wireless communication networks, the threat of eavesdropping, which is peculiar to wireless communication, is increasing.

Traditionally, data encryption has been performed as a security technology against eavesdropping. There are two types of encryption methods: common key cryptography and public key cryptography. The common key cryptosystem can encrypt data with low computational complexity, but it is necessary to securely share the private key in advance. The public key cryptosystem does not need to share the private key in advance, but is inferior to the common key cryptosystem in terms of calculation cost. Therefore, secure communication of data is performed by combining the public key cryptosystem and the common key cryptosystem.

Specifically, the public key encryption method is used only for prior private key sharing in the common key encryption method, and after the private key sharing, data is encrypted using the common key encryption method. In ordinary data communication, the above method is used. However, when the public key cryptosystem is implemented in a mass-produced small device such as an IoT device, the cost of implementing and managing a private key unique to each device cannot be ignored.

As a method for eliminating the above costs, a technique called Secret Key Generation (hereinafter, “SKG”) described in Non-Patent Document 1 has begun to attract attention. SKG is a technology for exchanging a private key between two users by using the duality of a communication path. SKG belongs to the field of security technology and the field of physical layer security that utilize the characteristics of radio waves in wireless communication.

Here, SKG will be briefly described. Hereinafter, the users who exchange the private key will be referred to as Alice and Bob, and the eavesdropper will be referred to as Eve. The duality of the communication path means that the state of the communication path of Alice and Bob is the same at the same time. The state of the communication path is, for example, the reception strength or the phase of the received signal. The ideal channel duality is that if Alice and Bob transmit frames at the same frequency and at the same time and receive them at the same time, the channel conditions measured by Alice and Bob will be the same. ..

However, in reality, the state of the communication path between Alice and Bob is not exactly the same. Reasons for this include the fact that Alice and Bob cannot transmit and receive frames at the same frequency and at the same time, and that the thermal noise of the communication path is independent between Alice and Bob.

Therefore, SKG proposes a method of sharing the secret key with each other from the state of the communication path measured by Alice and Bob, respectively, while considering the incomplete duality of the communication path as an algorithm. Before explaining the algorithm, here are three assumptions about the eavesdropper Eve.

The first is that Eve can only receive radio waves and cannot transmit such as emitting disturbing radio waves. Therefore, the contents of the frame exchanged between Alice and Bob can be confirmed.

Second, Eve is fully aware of the SKG algorithm used by Alice and Bob. Therefore, if Eve can obtain the input data used by Alice and Bob for the SKG algorithm, Eve can obtain the same private key as the key shared by Alice and Bob.

Third, Eve cannot obtain the state of the communication path used by Alice and Bob as input data for the SKG algorithm.

Since the state of the communication path in wireless communication strongly depends on the physical position of the transmitter / receiver, the third assumption is secured by the physical position conditions of Eve, Alice, and Bob. That is, the more physically distant the Eve is from Alice or Bob, the more difficult it is to know the state of the communication path shared by Eve between Alice and Bob.

Generally, if the physical distance between Eve and Alice and Eve and Bob are more than half the wavelength of the radio waves used for communication, the state of the communication path between Eve and Alice and between Eve and Alice or Bob. It is said that the state of the communication path is uncorrelated with each other. The third assumption, in other words, means that Eve is located at least half the wavelength of the radio waves used for communication from Alice and Bob.

From the above assumption, the case where the private key information is leaked to Eve in SKG is only when the information about the private key is included in the frame exchanged between Alice and Bob.

The SKG algorithm includes a step of transmitting and receiving information about the private key by including it in a frame (Information Recognition step), but finally by a conversion step (Privacy Amplication step) considering the amount of information leaked to Eve. Convert to a private key that Eve cannot estimate at all.

The SKG algorithm will be described. FIG. 16 shows the flow of the entire algorithm. The SKG algorithm can be divided into four steps: parameter setting, quantization, information reconciliation, and privacy expression. Each step is executed in sequence.

Hereinafter, for convenience of explanation, Received Signal Strength Intelligence (RSSI) will be used as the "state of the communication path" used for creating the private key. RSSI means analog data of reception intensity.

In the parameter setting step, frames are transmitted and received between Alice and Bob, the probability distribution of RSSI and the autocorrelation of RSSI are measured, and used for parameter setting of the SKG algorithm. Examples of the parameters include a sampling period and dispersion of thermal noise described later.

In the quantization step, a frame in which a known signal is inserted is transmitted and received between Alice and Bob. Alice and Bob each repeat sampling the RSSI measured each time a frame is received and converting it into a bit string by a threshold value determination. When the bit string reaches a predetermined length, the next step is performed.

In the Information Reconciliation step, considering that the duality of the communication path is partially broken, the mismatch of the bit strings generated by Alice and Bob is corrected. For correction, for example, Alice sends Bob the compressed information about the generated bit string. Based on the received information, Bob confirms and corrects a discrepancy with the bit string generated by Bob. The above is repeated a predetermined number of times.

In the Privacy Amplification step, in a series of steps including the Information Reconciliation step, the bit string is converted into a private key that is difficult to be guessed by Eve in consideration of the fact that a part of the bit string is leaked to Eve.

In Patent Document 1, it is pointed out that the bit value is biased in the above-mentioned quantization step. In Patent Document 1, n / k threshold values determined for each k first radio field intensities that are a part of the detected n first radio field intensities (corresponding to the above RSSI) are used. It is proposed to increase the value of n first radio wave intensities. Specifically, the median value of a plurality of time-consecutive radio field intensity profiles of Patent Document 1 (for example, RSSI1 to RSSI8 in FIGS. 8 and 9 of the same publication) is set as a threshold value RSSI_TH1 and compared with each radio field strength. We are proposing to increase the value.

Also in Non-Patent Document 2, it is pointed out that there is a security problem in using a fixed threshold value in the above-mentioned quantization step (see the beginning of IV. STUDYING THE IMPACT OF QUANTION PHASE). Therefore, Non-Patent Document 2 proposes a method of increasing the value of the channel state estimation while narrowing the upper and lower threshold values from the maximum value at predetermined intervals (V.AN ADAPTIVE QUANTION SCHEME, Fig). See .5).

Japanese Unexamined Patent Publication No. 2008-24521

U.S. M. Maurer, "Secret Key Agreement by Public Discussion from Common Information," IEEE Transfer. Information Theory, vol. 39, no. 3, pp. 733-742, May 1993. S. Tmar, B. Hamida, J. et al. B. Pierrot, C.I. Castelluccia, "An Adaptive Quantization Algorithm for Secret Key Generationsing Radio Channel Measurements," IEEE NewTechn.

The following analysis is given by the present invention. As described in Patent Document 1 and Non-Patent Document 2, randomness is required for the bit string converted in the quantization step of SKG. For that purpose, the sampling cycle (frame transmission cycle) of the “communication path state” such as RSSI on the Alice side or the Bob side is set long enough to sufficiently reduce the autocorrelation. As a result, the value of the "communication path state" that is the basis of the bit string becomes uncorrelated with each other, so that the bit string also becomes random.

However, the "state of the communication path" changes from moment to moment depending on the time and place, and the sampling cycle may be set shorter than an appropriate value. In this case, the same bit string is continuously extracted by the threshold value determination, and the randomness of the original bit string that generates the private key is lost. Hereinafter, the continuation of the same bit string is referred to as "burst", and the length thereof is referred to as "burst length".

In Non-Patent Document 2, it is possible to accumulate the channel state estimation values for a certain period of time in order to eliminate the burst, and to increase the values while adaptively changing the threshold value based on the accumulated channel state estimation values. It is done. However, in this method, since it is necessary to accumulate RSSI for a certain period of time, problems such as delay and memory increase may occur.

Similarly, in the method of Patent Document 1, it is necessary to calculate and hold the threshold value for each channel and each of k radio field intensity data, which may cause problems such as delay and increase in memory.

An object of the present invention is to provide a wireless communication device, a method for creating a private key, a bit string creation module, and a program that can contribute to suppressing the occurrence of bursts in the above-mentioned quantization step.

According to the first viewpoint, it is provided with a measuring unit that exchanges a wireless frame with a predetermined communication partner and measures a value indicating a state of a communication path, and is a secret created from data of a predetermined communication partner and a predetermined bit length. A wireless communication device that communicates using a key is provided. Further, this wireless communication device further uses time-series data of values representing the state of the communication path before the time when the value representing the state of the communication path is measured, and a predicted value obtained by using a predetermined time-series model. It is provided with a predicted value calculation unit for calculating. This wireless communication device further determines a bit based on the result of comparison using a value representing the state of the communication path and the predicted value as a threshold value, thereby using a predetermined value for communication with the predetermined communication partner. It includes a bit string creation unit that creates bit length data.

According to the second viewpoint, a wireless communication device that communicates with a predetermined communication partner by using a private key created from data having a predetermined bit length exchanges a wireless frame with the predetermined communication partner and exchanges a wireless frame with the predetermined communication partner. It was obtained by using a step of measuring a value representing a state, time-series data of a value representing the state of the communication path before the time when the value representing the state of the communication path was sampled, and a predetermined time-series model. A predetermined value used for communication with the predetermined communication partner by determining a bit based on a step of calculating a predicted value, a value representing the state of the communication path, and a result of comparison using the predicted value as a threshold value. A step of creating bit-length data and a method of creating data for encrypted communication including include are provided. This method is linked to a specific machine called a wireless communication device that communicates using the private key.

According to the third viewpoint, the predicted value calculation unit that calculates the predicted value obtained by using the time series data of the value representing the state of the communication path measured in the predetermined measurement cycle and the predetermined time series model. A bit string creation unit including a value representing the state of the communication path and a bit string creation unit that creates data having a predetermined bit length by determining bits based on the result of comparison using the predicted value as a threshold value. Modules are provided.

According to the fourth viewpoint, a process of exchanging a wireless frame with a predetermined communication partner and measuring a value indicating the state of the communication path, and a process of measuring the value indicating the state of the communication path and the time before the measurement of the state of the communication path. A process of calculating a predicted value obtained by using time-series data of a value representing a state and a predetermined time-series model, a value representing the state of the communication path, and the predicted value as a threshold value were compared. By determining the bits based on the result, the process of creating the data of the predetermined bit length used for communication with the predetermined communication partner is performed by using the secret key created from the data of the predetermined bit length. A program to be executed by a computer mounted on a wireless communication device that performs wireless communication with a predetermined communication partner is provided. The program can be recorded on a computer-readable (non-transient) storage medium. That is, the present invention can also be embodied as a computer program product.

According to the present invention, it is possible to contribute to the suppression of the occurrence of bursts in the above-mentioned quantization step.

It is a figure which shows the structure of one Embodiment of this invention. It is a figure for demonstrating operation of one Embodiment of this invention. It is a figure which shows the schematic structure of the wireless communication apparatus of 1st Embodiment of this invention. It is a figure which shows the detailed structure of the wireless communication apparatus of 1st Embodiment of this invention. It is a flow chart which shows an example of the operation of the wireless communication apparatus of 1st Embodiment of this invention. It is a flow chart which shows another example of the operation of the wireless communication apparatus of 1st Embodiment of this invention. It is a figure which shows the sampling operation of the wireless communication apparatus (Alice side) of 1st Embodiment of this invention, and the transition of a threshold value. It is an example of the threshold value determination result of the sampling value of FIG. 7 and the created bit string. It is a figure which shows the sampling operation of the wireless communication apparatus (Bob side) of 1st Embodiment of this invention, and the transition of a threshold value. It is an example of the threshold value determination result of the sampling value of FIG. 9 and the created bit string. It is a figure which shows another sampling operation of the wireless communication apparatus (Alice side) of 1st Embodiment of this invention, and the transition of a threshold value. It is an example of the threshold value determination result of the sampling value of FIG. 11 and the created bit string. It is a figure which shows another sampling operation of the wireless communication apparatus (Bob side) of 1st Embodiment of this invention, and the transition of a threshold value. It is an example of the threshold value determination result of the sampling value of FIG. 13 and the created bit string. It is a figure which shows the structure of the modification embodiment of this invention. It is a sequence diagram which showed the algorithm (processing flow) of SKG explained as a background technique.

First, an outline of one embodiment of the present invention will be described with reference to the drawings. It should be noted that the drawing reference reference numerals added to this outline are added to each element for convenience as an example for assisting understanding, and the present invention is not intended to be limited to the illustrated embodiment. Further, the connecting line between blocks such as drawings referred to in the following description includes both bidirectional and unidirectional. The one-way arrow schematically shows the flow of the main signal (data), and does not exclude interactivity.

In one embodiment of the present invention, as shown in FIG. 1, the present invention can be realized by a set of a wireless communication device including a measurement unit 11A, a predicted value calculation unit 12A, and a bit string creation unit 13A.

More specifically, the measuring unit 11A exchanges a wireless frame with a predetermined communication partner (wireless communication device (BOB) of FIGS. 1 and 2), and sets a value indicating the state of the communication path in a predetermined measurement cycle. Measure (see the O mark in the upper balloon in FIG. 2). The predicted value calculation unit 12A calculates the predicted value obtained by using the time-series data of the value representing the state of the communication path before the time when the value representing the state of the communication path is measured and the predetermined time-series model. Calculate (see the X mark in the middle balloon in FIG. 2). The bit string creation unit 13A determines a bit based on the result of comparison between a value representing the state of the communication path and the predicted value as a threshold value, thereby determining a predetermined bit length used for communication with the predetermined communication partner. Create the data of (see the lower balloon in Fig. 2).

Although omitted in FIG. 1, the wireless communication device (BOB) of FIG. 1 is also provided with a measurement unit 11A, a prediction value calculation unit 12A, and a bit string creation unit 13A, so that they can be predetermined to each other. Bit length data can be created. Then, the wireless communication device (Alice) and the wireless communication device (Bob) in FIG. 1 create a common secret key from the data having the predetermined bit length, and perform encrypted communication using the secret key.

According to the present invention described above, in the quantization (quantization) step of SKG, even if the sampling interval (measurement interval) is an inappropriate length, the occurrence of burst can be suppressed. The reason is that a configuration is adopted in which the threshold value is dynamically changed by using the time series data of the value representing the state of the communication path.

[First Embodiment]
Subsequently, in the Quantization step, the first embodiment of the present invention using the moving average model as a method of dynamically changing the threshold value used to obtain the bit string will be described in detail with reference to the drawings. .. FIG. 3 is a diagram showing a schematic configuration of a wireless communication device according to the first embodiment of the present invention.

As shown in FIG. 3, in the wireless communication device 1000A of the first embodiment, the parameter setting unit 20 for performing the parameter setting step, the quantization unit 10 for performing the quantization step, and the Information Reconciliation unit 30 for performing the information reconciliation step. , The Privacy Amplification unit 40 for carrying out the Privacy Amplification step is provided. The basic operation of each part is the same as that shown in FIG. 16 (the dashed arrow in FIG. 16 means the transmission of a frame).

In the parameter setting unit 20, wireless communication devices (hereinafter, referred to as Alice and Bob), which are communication partners, measure the state of the communication path and set parameters. Specifically, parameters such as the probability density distribution of RSSI, the variance of thermal noise (σ ² ), and the autocorrelation of RSSI are calculated.

The RSSI probability density distribution is used to set the median of each threshold in the quantization step. Specifically, the wireless communication device sets the median threshold value based on the probability density distribution of RSSI. As a result, when the sampled RSSI is threshold-determined and converted into a bit string, the frequency of occurrence of the bit string can be made equal. When converting 1-bit information from RSSI of one sample, one median threshold value may be set, and the average value of RSSI may be used as the median threshold value as it is.

The variance of thermal noise (σ ² ) is used to set the undetermined region of the threshold. RSSIs measured by Alice and Bob, respectively, are inconsistent at least due to the influence of thermal noise. Therefore, it is necessary to provide an undetermined region in order to absorb the uncertainty according to the magnitude of the thermal noise. Thermal noise dispersion is used to determine the size of this undetermined region.

The RSSI autocorrelation is used to determine the sampling period. Specifically, the sampling period is set so that the correlation of RSSI becomes sufficiently small. The reason is to reduce the correlation of the bit strings generated by the threshold value determination from RSSI.

The quantization unit 10 includes a sampling unit 11, a predicted value calculation unit 12, and a bit string creation unit 13, similar to the configuration shown in FIG.

FIG. 4 is a diagram showing a detailed configuration of a wireless communication device (Alice) 1000A including functional elements corresponding to the measurement unit, the predicted value calculation unit, and the bit string creation unit. Referring to FIG. 4, the receiving antenna 301, the frame synchronization unit 302, the header reading unit 303, the RSSI sampling unit 304, the threshold value determination unit 305, the memory 306, the header generation unit 307, and the frame generation unit 308. , A configuration including a transmitting antenna 309 and a threshold value updating unit 310 is shown. Although omitted in FIG. 3, it is assumed that the wireless communication device (Bob) 1000B also has the same configuration as Alice in FIG.

The receiving antenna 301 receives the frame transmitted from the Bob. The transmitting antenna 309 transmits the created frame toward the Bob.

The frame synchronization unit 302 takes the reception signal received via the reception antenna 301 as an input, and performs synchronization using a known signal inserted in the frame.

The header reading unit 303 extracts information such as success or failure of bit string generation on the Bob side embedded in the header of the frame received from the Bob side.

The RSSI sampling unit 304 corresponds to the measurement unit described above, and measures RSSI as the reception intensity of the frame. The measured RSSI is sent to the threshold value determination unit 305 and the threshold value update unit 310.

The threshold value determination unit 305 corresponds to the above-mentioned bit string creation unit, and determines whether or not RSSI can be converted into a bit string and a specific bit value using a preset threshold value. When the determination of the specific bit value is successful, the threshold value determination unit 305 stores the bit string in the memory 306. When the length of the bit string stored in the memory reaches a predetermined length (for example, N bits), the process proceeds to the Information Reconciliation step of the next step.

The header generation unit 307 generates a header including information indicating whether or not the threshold value determination unit 305 has succeeded in determining a specific bit value. Hereinafter, in the present embodiment, the value "1" is inserted in the predetermined field of the header when the determination of the specific bit value is successful, and the value "0" is inserted in the predetermined field of the header when the determination of the specific bit value is unsuccessful. To do.

The frame generation unit 308 creates a frame by adding a known signal for frame synchronization to the header generated by the header generation unit 307.

The threshold value update unit 310 corresponds to the predicted value calculation unit described above, and stores the sampled RSSI, which is the output of the RSSI sampling unit 304, as time series data in the internal memory. The threshold value update unit 310 updates the threshold value used for the determination in the threshold value determination unit 305 by using the RSSI sampling values (time series data) stored in the internal memory from the present to the past several times.

In the following description, the threshold value update unit 310 will be described as calculating _{the median value (μ i} ) of the threshold value by using a three-segment moving average model that calculates the average of the time series data for the last three times. Further, in the following description, the threshold value update unit 310 calculates the threshold value each time a new RSSI sampling value is received, but the user may change the threshold update frequency. For example, when the 5-interval moving average model is used, the threshold value may be calculated each time the RSSI sampling value is received, but the calculation amount is reduced by calculating the threshold value when two RSSI sampling values are received. You may do so.

Each part (processing means) of the wireless communication device shown in FIGS. 3 and 4 is realized by a computer program that causes a computer equipped with the wireless communication device to execute each of the above-mentioned processes by using the hardware thereof. You can also do it.

Subsequently, the operation of the present embodiment will be described in detail with reference to the drawings. First, the procedure for generating a bit string in the quantization step on the Alice side will be described. FIG. 5 is a flow chart showing an example of the operation of the wireless communication device (Alice) according to the first embodiment of the present invention. In the following description, k represents the number of the bit string generated in the quantization step, and is independently incremented (added by 1) in the flow of Alice and Bob and updated respectively.

As shown in FIG. 5, first, when Alice receives a frame from a Bob that is a communication partner, it performs frame synchronization using a known signal in the frame (321 in FIG. 5).

Next, Alice extracts information indicating whether or not the bit string can be generated on the Bob side from a predetermined field in the header of the frame received from the Bob, and confirms the value (322, D1 in FIG. 5). In the frame received from Bob, it is assumed that information indicating whether or not Bob was able to generate the kth bit string is inserted in the header (described later).

Specifically, Alice considers that Bob has succeeded in generating a bit string when the value of the information extracted from the header is "1". On the other hand, when the value of the information is "0", Alice considers Bob to have failed to generate the bit string.

If it is determined in step D1 that Bob has succeeded in generating the bit string (Yes in D1 of FIG. 5), Alice considers that the k-th bit string generation has been completed in Alice and Bob, and increments k (yes). 323) in FIG.

On the other hand, if it is determined in step D1 that Bob has failed to generate the bit string (No in D1 in FIG. 5), Alice does not increment k in order to redo the generation of the kth bit string (step 324). Jump to).

Next, Alice samples and reads RSSI at the time of frame reception (324 in FIG. 5).

Next, Alice updates the threshold using RSSI time series data including RSSI measured by RSSI sampling 324 (330 in FIG. 5). For example, when the sampling values shown in FIG. 7 are obtained, Alice calculates the average of the three most recent RSSI sampling values, and sets the median threshold value (μ _i ) and the pre-calculated thermal noise. _{The upper limit μ i} + α σ and the lower limit μ _{i −} α σ of the threshold value are calculated, where α σ obtained by using the variance (σ ² ) of is 1 W. In addition, α is an adjustment coefficient.

Next, Alice compares the RSSI sampling value with the threshold value calculated in 330 in FIG. 5 to determine the threshold value (325 in FIG. 5).

Bit determination method of the i-th RSSI sampling values alice (referred to as _{s i)} can be expressed by the following equation (1).

As a result of the above threshold determination, when a bit string of 0 or 1 can be generated and k indicating the bit string is N, the length of the bit string stored in the memory reaches a predetermined length (for example, N bits). Since both Alice and Bob have succeeded in generating N bits, the process proceeds to the Information Reconfiguration step (Yes in D2 of FIG. 5).

On the other hand, although the bit string of 0 or 1 could be generated, if k <N, the generation of the bit string is continued. In this case, Alice creates a header in which the value "1" is embedded in a predetermined field in order to inform Bob that the corresponding bit string has been successfully generated. Further, when the bit string cannot be generated (undetermined), Alice creates a header in which the value "0" is embedded in the predetermined field in order to inform Bob that the generation of the corresponding bit string has failed.

Next, Alice creates a frame by adding a known signal for frame synchronization to the header created above, and transmits the frame to Bob.

Subsequently, the operation of the Alice side and the Bob side that exchanges frames will be described. FIG. 6 is a flow chart showing an example of the operation of the wireless communication device (Bob) according to the first embodiment of the present invention. The basic processing is the same as that on the Alice side, but the order of RSSI sampling and the like is changed to calculate the threshold value.

As shown in FIG. 6, first, when Bob receives a frame from Alice in step 327 of FIG. 5, frame synchronization is performed using a known signal in the frame (321 in FIG. 5).

Next, Bob samples and reads RSSI at the time of frame reception (324 in FIG. 6).

Next, Bob updates the threshold using RSSI time-series data, including RSSI measured by RSSI sampling 324 (330 in FIG. 6). Since the method of calculating the threshold value is the same as that of Alice, the description thereof will be omitted.

Next, Bob extracts information indicating whether or not a bit string can be generated on the Alice side from a predetermined field in the header of the frame received from Alice, and confirms the value (322, D1 in FIG. 6). As described in the header generation 326 of FIG. 5, information indicating whether or not Alice was able to generate the kth bit string is inserted in the header in the frame received from Alice.

If it is determined in step D1 that Alice succeeded in generating the bit string (Yes in D1 of FIG. 6), Bob compares the RSSI sampling value read in step 324 with the threshold value calculated in 330 of FIG. Then, the threshold value is determined (325 in FIG. 6). The determination method is the same as the above-mentioned equation (1). If it is determined in step D1 that Alice has failed to generate the bit string (No in D1 in FIG. 6), Bob creates the header without performing threshold determination or increment by RSSI read from the corresponding frame (No in FIG. 6). To step 326).

If the bit string of 0 or 1 can be generated as a result of the above threshold value determination, the bit string generation will be continued. In this case, Bob creates a header in which the value "1" is embedded in a predetermined field in order to inform Alice that the corresponding bit string has been successfully generated (prompting Alice to increment k) (FIG. 6). 326). If the bit string could not be generated (undetermined), or if it was found that Alice failed to generate the bit string in step D1, the generation of the corresponding bit string failed for Alice. (To prevent Alice from incrementing k), Bob creates a header with the value "0" embedded in a predetermined field (326 in FIG. 6).

Next, Bob creates a frame by adding a known signal for frame synchronization to the header created above, and transmits the frame to Alice (327 in FIG. 6). On the Alice side, the frame processing shown in FIG. 5 is performed.

As described above, on the Bob side, the procedure is to perform RSSI sampling 324 before reading the header 322. The reason is that in the procedure of Alice shown in FIG. 5, depending on the result of header reading 322, the increment of k may be executed first, and it is necessary to generate the same k-th bit as Alice in the threshold value determination 325. Because there is.

As described above, N-bit data is generated by performing bit generation while Alice and Bob send and receive frames, measure their RSSI, and update the threshold value.

Hereinafter, a mechanism for suppressing the occurrence of bursts by the present invention will be described with reference to specific data examples.

FIG. 7 is a chart showing the change in RSSI value between Bob and Alice observed on the Alice side. The circles in FIG. 7 represent the sampling positions and the actually measured RSSI values based on the frames received from Bob. Further, one-dot chain line in FIG. 7 shows the upper limit μ _{i +} ασ threshold calculated median threshold value (.mu.i) from the variance of thermal noise. Similarly, the broken line in FIG. 7 _{indicates the lower limit of the threshold value μ i −} ασ.

FIG. 8 shows the RSSI obtained at each sampling position in FIG. 7, the median threshold value (μ _kA ) that is sequentially updated by the three-interval moving average model, the upper limit μ _kA + ασ and the lower limit μ _kA − of the threshold value. The ασ and the threshold value judgment result by these are shown. In the following, A and B of the subscripts kA and kB in the table represent Alice and Bob, respectively. In FIG. 8, for the sake of explanation, the past RSSI is set to 0, and the threshold values of the first time and the second time are calculated. Therefore, each value is calculated low, and the initial determination bit value is 1. Actually, the value measured as the past RSSI may be used, or the calculation may be performed using a predetermined default value.

As shown in FIGS. 7 and 8, the median threshold (μ _kA ) is updated each time RSSI is measured. In the present embodiment, the threshold value is updated every time the RSSI is updated, but it is clearly stated here that the present invention does not impose restrictions on the update frequency of the threshold value. That is, the update frequency of the median threshold value (μ _kA ) does not have to be every frame. For example, the median threshold value (μ _kA ) is calculated every few frames received, or is independent of frame reception. The median threshold value (μ _kA ) may be calculated at predetermined time intervals.

As described with reference to FIG. 5, the threshold value is determined when the RSSI sampling value is larger than the upper limit of the threshold value, 1, when the RSSI sampling value is smaller than the lower limit of the threshold value, and undetermined in other cases. The results are as shown at the bottom of the table above FIG. If the determination is not made, the bit value is not created and the frame is retransmitted. Therefore, a bit string as shown in the table below in FIG. 8 can be obtained from the sampling data in FIG. 7.

FIG. 9 is a chart showing the change in RSSI value between Alice and Bob observed on the Bob side communicating with Alice. The circles in FIG. 9 represent the sampling positions and the actually measured RSSI values based on the frames received from Alice. Due to the duality of the communication path mentioned at the beginning, the change in RSSI in Bob has the same waveform as that on the Alice side. Further, one-dot chain line in FIG. 9 shows the upper limit μ _{i +} ασ threshold calculated median threshold value (.mu.i) from the variance of thermal noise. Similarly, the broken line in FIG. 9 _{indicates the lower limit of the threshold value μ i −} ασ.

FIG. 10 shows the RSSI obtained at each sampling position in FIG. 9, the median threshold value (μ _kB ) that is sequentially updated by the three-interval moving average model, the upper limit μ _kB + ασ and the lower limit μ _kB − of the threshold value. The ασ and the threshold value determination result by these are shown.

As described with reference to FIG. 6, the threshold value is determined when the RSSI sampling value is larger than the upper limit of the threshold value, 1, when the RSSI sampling value is smaller than the lower limit of the threshold value, and undetermined in other cases. The results are as shown at the bottom of the table above FIG. Further, the RSSI obtained from the frame of sampling number # 3 is a value that creates a bit value = 1 in comparison with the threshold value, but since it has not been determined on the Alice side, Bob determines the threshold value or less. It is omitted (see 322 and D1 in FIG. 6). When such threshold value determination is omitted or undetermined, the bit value is not created and the frame is retransmitted. Therefore, a bit string as shown in the table at the bottom of FIG. 8 is obtained from the sampling data of FIG. Will be.

As a result, the bit strings obtained on the Alice side and the Bob side are the same as shown in FIGS. 8 and 10.

Next, the effect of the present invention when the sampling period is set shorter than an appropriate value will be described.

FIG. 11 is a chart showing the change in RSSI value between Bob and Alice observed on the Alice side. The circles in FIG. 11 represent the sampling positions and the actually measured RSSI values based on the frames received from Bob. It is clear that a burst occurs when a method in which the threshold value is fixed at the sampling cycle shown in FIG. 11 is applied to the RSSI pattern as shown in FIG.

FIG. 12 shows the RSSI obtained at each sampling position in FIG. 11, the median threshold value (μ _kA ) that is sequentially updated by the three-interval moving average model, the upper limit μ _kA + ασ and the lower limit μ _kA − of the threshold value. The ασ and the threshold value determination result by these are shown. In the example of FIG. 12, since the change in RSSI is small, the variance is small and the range of the upper and lower thresholds is also narrowed.

As described with reference to FIG. 5, the threshold value is determined when the RSSI sampling value is larger than the upper limit of the threshold value, 1, when the RSSI sampling value is smaller than the lower limit of the threshold value, and undetermined in other cases. The results are as shown at the bottom of the table above FIG. If the determination is not made, the bit value is not created and the frame is retransmitted. Therefore, a bit string as shown in the table at the bottom of FIG. 12 can be obtained from the sampling data of FIG.

FIG. 13 is a chart showing the change in RSSI value between Alice and Bob observed on the Bob side. Due to the duality of the communication path mentioned at the beginning, the change in RSSI in Bob has the same waveform as that on the Alice side. It is clear that a burst occurs when a method in which the threshold value is fixed in the sampling cycle shown in FIG. 13 is applied to the case of the RSSI pattern as shown in FIG.

FIG. 14 shows the RSSI obtained at each sampling position in FIG. 13, the median threshold value (μ _kB ) that is sequentially updated by the three-interval moving average model, and the upper limit μ _kB + ασ and the lower limit μ _kB − of the threshold value. The ασ and the threshold value determination result by these are shown.

As described with reference to FIG. 6, the threshold value is determined when the RSSI sampling value is larger than the upper limit of the threshold value, 1, when the RSSI sampling value is smaller than the lower limit of the threshold value, and undetermined in other cases. The results are as shown at the bottom of the table above FIG. If the threshold value determination is omitted or not determined due to the failure to create the bit value on the Alice side, the bit value is not created and the frame is retransmitted. Therefore, from the sampling data of FIG. 13, FIG. You will get a bit string as shown in the table below.

As is clear from FIGS. 11 to 14, according to the present embodiment, the range to be undetermined changes depending on the degree of variation in RSSI. Therefore, even when the sampling period is set shorter than an appropriate value, it is not determined. It is possible to obtain a bursty bit string.

Further, also in the present invention, if the state in which the RSSI fluctuation is small continues, the bit string cannot be generated at all. However, in this case, since the process does not move to the Information Reconciliation step, the key sharing itself is not performed, and it is possible to prevent communication with a low-security key. On the other hand, in the method of fixing the threshold value described in the background technique, since there is a possibility that the private key is created with burst data, it can be said that the present invention has higher security.

Although each embodiment of the present invention has been described above, the present invention is not limited to the above-described embodiment, and further modifications, substitutions, and adjustments are made without departing from the basic technical idea of the present invention. Can be added. For example, the configuration of the device, the configuration of each element, the configuration of the frame, etc. shown in each drawing are examples for assisting the understanding of the present invention, and are not limited to the configurations shown in these drawings.

In the above-described embodiment, as a time-series model, a three-section moving average using sampling values of three consecutive points is used from the viewpoints of both that a value suitable for threshold value determination can be obtained and that the calculation cost is low. Although it has been described that a model is used, there is no particular reason for model selection, and another time series model can be used in the same manner. Examples of other time-series models include an autoregressive model (AR model), an autoregressive moving average model (ARMA model), and a model using a probability recurrence formula.

For example, when the AR model is used, the threshold value (predicted value) RSSi _t at a certain time point t can be calculated from the following equation (2) using the past data of the RSSI data. In equation (2), c is a constant term, φ is a model parameter, and ε _t is a white noise term.

Further, in the above-described embodiment, RSSI has been described as the "state of the communication path", but for example, the channel response (CR) used in Non-Patent Document 2 may be used.

Further, in the above-described embodiment, the example in which the wireless communication device is used alone has been described, but a mode in which the bit string creation function is separated can also be adopted. For example, as shown in FIG. 15, the sampling process is performed by a wireless communication device, and the prediction value (threshold) is calculated (predicted value calculation unit 42A in FIG. 15) and the bit string is created (bit string creation unit 43A in FIG. 15) wirelessly. It is also possible to adopt a configuration performed by a bit string creation module 400A that is independent of the communication terminal in terms of hardware. In this case, the predicted value calculation unit 42A and the bit string creation unit 43A of the bit string creation module 400A are the predicted value calculation unit 42A (or the threshold value update unit 310 in FIG. 4) and the bit string creation unit 43A (or the threshold value determination unit in FIG. 4). It will operate in the same manner as 305).

Finally, a preferred embodiment of the present invention is summarized.
[First form]
(Refer to the wireless communication device from the first viewpoint above)
[Second form]
The wireless communication device described above determines an upper predicted value and a lower predicted value as the predicted value, and a value representing the state of the communication path is between the upper predicted value and the lower predicted value. In this case, it is preferable that the value representing the state of the communication path at that time point is not used for creating the bit string.
[Third form]
The wireless communication device described above may be configured to synchronously create a bit string while exchanging with the predetermined communication partner whether or not the received frame is used for creating the bit string.
[Fourth form]
The wireless communication device described above may be configured to omit the creation of a bit string from a frame that the predetermined communication partner did not use to create the bit string, based on the frame header received from the predetermined communication partner. ..
[Fifth form]
As the time series model used by the wireless communication device described above for calculating the threshold value, an autoregressive model and an autoregressive moving average model can be used in addition to the mobile model.
[Sixth form]
As a value representing the state of the communication path, Received Signal Intensity (RSSI) at the time of transmitting / receiving a frame with the predetermined communication partner can be used.
[7th form]
(Refer to the method of creating encrypted communication data from the second viewpoint above)
[8th form]
(Refer to the bit string creation module from the third viewpoint above)
[9th form]
(Refer to the computer program from the fourth viewpoint above).
The seventh to ninth forms can be developed into the second to sixth forms in the same manner as the first form.

The disclosures of the above patented documents and non-patented documents shall be incorporated into this document by citation. Within the framework of the entire disclosure (including the scope of claims) of the present invention, it is possible to change or adjust the embodiments or examples based on the basic technical idea thereof. Further, within the framework of the disclosure of the present invention, various combinations or selections of various disclosure elements (including each element of each claim, each element of each embodiment or embodiment, each element of each drawing, etc.) are possible. Is. That is, it goes without saying that the present invention includes all disclosure including claims, and various modifications and modifications that can be made by those skilled in the art in accordance with the technical idea. In particular, with respect to the numerical range described in this document, it should be interpreted that any numerical value or small range included in the range is specifically described even if there is no other description.

10 Quantization unit 11 Sampling unit 11A Measuring unit 12, 12A, 42A Predicted value calculation unit 13, 13A, 43A Bit string creation unit 20 Parameter setting unit 30 Information Recognition unit 40 Privacy Amplification unit 100A, 100B, 1000A, 1000B Wireless communication device 301 Antenna 302 Frame synchronization unit 303 Header reading unit 304 RSSI sampling unit 305 Threshold determination unit (bit string creation unit)
306 Memory 307 Header generation unit 308 Frame generation unit 309 Transmission antenna 310 Threshold update unit (Prediction value calculation unit)
321 Frame synchronization 322 Header reading 323 Increment 324 RSSI sampling 325 Threshold judgment 326 Header generation 327 Frame generation 330 Threshold update 400A Bit string creation module S100 Alice parameter setting step S200 Bob parameter setting step S300 Alice quantization step S400 Bob Quantization step S500 Alice's Information Quantization Step S600 Bob's Information Quantization Step S700 Alice's Privilege Amplification Step S800 Bob's Privilege Amplification Step

Claims (9)

A measuring unit that exchanges a wireless frame with a predetermined communication partner and measures a value indicating the state of the communication path in a predetermined measurement cycle.
The predicted value obtained by using the time-series data of the value representing the state of the communication path before the time when the value representing the state of the communication path is measured and the predetermined time-series model is calculated, and the predicted value is calculated. Predicted value calculation unit that updates the threshold using
Comprising a value representing the state of the communication path, by it is determined where the bits by the result of comparing the updated threshold, the bit string creation unit for creating data of a predetermined bit length, a,
A wireless communication device that communicates with a predetermined communication partner using a private key created from the data having the predetermined bit length. As the predicted value, an upper predicted value and a lower predicted value are determined, and the predicted value is determined.
When the value representing the state of the communication path is between the upper predicted value and the lower predicted value, the value representing the state of the communication path at that time is not used for creating the bit string. Communication device. The wireless communication device according to claim 2, wherein a bit string is created in synchronization with the predetermined communication partner while exchanging whether or not the received frame is used for creating the bit string. The wireless communication device according to claim 3, wherein the creation of a bit string from a frame corresponding to a frame that the predetermined communication partner did not use for creating the bit string is omitted based on the frame header received from the predetermined communication partner. The wireless communication device according to any one of claims 1 to 4, which uses the moving average method as the time series model. The wireless communication device according to any one of claims 1 to 5, which uses Received Signal Strength Integrity (RSSI) when transmitting and receiving a frame with the predetermined communication partner as a value representing the state of the communication path. A wireless communication device that communicates with a predetermined communication partner using a private key created from data of a predetermined bit length.
A step of exchanging a wireless frame with the predetermined communication partner and measuring a value indicating the state of the communication path in a predetermined measurement cycle.
The predicted value obtained by using the time-series data of the value representing the state of the communication path before the time when the value representing the state of the communication path is measured and the predetermined time-series model is calculated, and the predicted value is calculated. Steps to update the threshold using
A value representing the state of the communication path, by it is determined where the bits by the result of comparing the updated threshold value, and creating data of a predetermined bit length to be used for communication with the predetermined communication partner ,
How to create data for encrypted communication including. Prediction that calculates the predicted value obtained by using the time series data of the value representing the state of the communication path measured in the predetermined measurement cycle and the predetermined time series model, and updates the threshold value using the predicted value. Value calculation unit and
Bit sequence creation module comprising a value representing the state of the communication path, by it is determined where the bits by the result of comparing the updated threshold, the bit string creation unit for creating data of a predetermined bit length, a. A process of exchanging a wireless frame with a predetermined communication partner and measuring a value indicating the state of a communication path in a predetermined measurement cycle.
The predicted value obtained by using the time-series data of the value representing the state of the communication path before the time when the value representing the state of the communication path is measured and the predetermined time-series model is calculated, and the predicted value is calculated. The process of updating the threshold using
A value representing the state of the communication path, by it is determined where the bits by the result of comparing the updated threshold, the process of creating data of a predetermined bit length to be used for communication with the predetermined communication partner ,
A program to be executed by a computer mounted on a wireless communication device that wirelessly communicates with the predetermined communication partner by using a private key created from the data of the predetermined bit length.

Images