JP7220132B2 - Communication device, communication system, communication method, and program - Google Patents

Description

The present invention relates to communication devices, communication systems, communication methods, and programs.

2. Description of the Related Art Techniques for monitoring and controlling home appliances, for example in houses, have been known for some time. This type of technology is a technology for realizing a so-called smart house. A smart house is a concept that realizes a comfortable and energy-saving lifestyle by connecting household appliances and equipment to a network. In order to realize a smart house, for example, a device called a HEMS (Home Energy Management System) controller is installed in a house. The HEMS controller monitors and controls the operation status and power consumption of home appliances and home equipment connected to the home network.

The HEMS controller automatically detects target devices in order to monitor and control home appliances and home equipment (hereinafter referred to as target devices). To achieve this, the HEMS controller utilizes multicast and broadcast communications. Communication protocols for home networks, such as DLNA (Digital Living Network Alliance, registered trademark), mainly for personal computers and AV equipment, and communication protocols for personal computers, such as UPnP (Universal Plug and Play). Target devices are automatically detected by multicast communication or broadcast communication. Furthermore, the ECHONET Lite standard is known as a communication protocol for realizing a smart house. The ECHONET Lite standard also uses multicast communication to automatically detect target devices.

In the Wi-Fi (registered trademark) standard defined by IEEE (Institute of Electrical and Electronics Engineers) 802.11, an infrastructure mode residential network consists of an access point (AP) and target devices (stations) connected to the access point. , STA). An access point has a function corresponding to a switching hub in Ethernet (registered trademark), and a plurality of target devices are connected to the access point. A wireless router in a home network is usually a device that integrates the functions of a home broadband router and the functions of an access point. A home broadband router has functions such as a routing function, an IP masquerade function, and a DHCP (Dynamic Host Configuration Protocol) server function.

In a residential network using Ethernet (registered trademark), communication is performed using two MAC addresses, a source MAC (Media Access Control) address and a destination MAC address. , communication is performed using four MAC addresses. The four MAC addresses include, for example, a source MAC address, a destination MAC address, an access point MAC address, and a device MAC address connected via Ethernet (registered trademark).

When a target device connects to an access point, each target device authenticates with WPA (Wi-Fi Protected Access) or WPA2 (Wi-Fi Protected Access version 2) to prevent eavesdropping between target devices. Get two keys. Two types of keys are PTK (Pair-wise Transient Key) and GTK (Group Transient Key). A PTK is a key used to send and receive unicast packets. The PTK is a key that is set every time a target device connects to an access point and is used as long as the target device is not disconnected from the access point. GTK is the key used to send and receive broadcast and multicast packets. GTK is one key that is set for each access point, and is a key that is commonly set for a plurality of target devices. Each target device updates GTK as requested by the access point. GTK is updated, for example, triggered by the passage of a certain interval or the removal of the target device.

Packets transmitted and received between target devices in infrastructure mode pass through access points. When the target device transmits a packet by broadcast or multicast, the target device first transmits a unicast packet encrypted by PTK to the access point, and the access point transmits the broadcast packet or multicast packet encrypted by GTK. Send to device.

ECHONET Lite System Design Guidelines 2nd Edition, Chapter 2 ECHONET Lite Implementation Guidelines, “2.12 Notes on Wireless LAN Networks” June 24, 2019 ECHONET CONSORTIUM

By the way, GTK update triggers and update intervals are not standardized. For this reason, a mismatch of GTK may occur between the access point and the target device depending on compatibility between the access point and the target device. GTK discrepancies are disclosed, for example, in Non-Patent Document 1. If the GTK does not match between the target device and the access point, the target device cannot connect to the Internet via the access point, so it cannot receive the benefits of various cloud services, resulting in reduced convenience. There is a problem of doing so. Furthermore, there is a problem that the HEMS controller cannot automatically detect the target device via the access point and cannot monitor or control the target device.

Regarding connectivity with access points, IEEE802.11 does not standardize a method for confirming connectivity (disconnection detection) between access points and target devices. Normally, the target device periodically transmits a null frame to the access point, and confirms whether or not it is possible to connect to the access point based on whether or not the target device can receive a response. However, even with this connectivity confirmation method, the target device cannot detect GTK mismatch, and cannot eliminate the deterioration in convenience due to GTK mismatch.

In response to the degradation of connectivity due to GTK mismatch, in Non-Patent Document 1, the target device periodically (for example, about 10 minutes) transmits DHCP Discover with the broadcast flag set to ON to the access point, and responds (DHCP Offer) is described to reconnect to the access point.

However, if the target device does not have the function of setting the broadcast flag and transmitting DHCP Discover, there is a problem that the method described in Non-Patent Document 1 cannot be executed.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a communication device, a communication system, a communication method, and a program capable of detecting group key mismatch.

(1) One aspect of the present invention is a communication device that communicates with a device using first key information that is set for each device and second key information that is commonly set for a plurality of devices. a storage unit that stores an IP address based on a received packet; a communication unit that transmits and receives packets; and a detection unit that detects a mismatch of the second key information, within the IP address range of, performing an active scan in which a first response request packet is encrypted with the second key information and transmitted, and if there is no response to the first response request packet, the second When the IP address of one response request packet is stored in the storage unit, a second response request packet whose destination IP address is the IP address of the first response request packet with no response is encrypted using the first key information. wherein, when receiving a response to the second response request packet, the detection unit detects a mismatch of the second key information between the device that transmitted the response and the device itself, wherein be.

(2) An aspect of the present invention is the communication device described above, wherein the storage unit may store a combination of a MAC address and an IP address as a result of executing passive scanning.

(3) An aspect of the present invention is the communication device described above, wherein the storage unit may store a combination of a MAC address, an IP address, and a detection time as a result of executing a passive scan.

(4) An aspect of the present invention is the communication device described above, and may further include a notifying unit that notifies when the detecting unit detects a mismatch of the second key information.

(5) An aspect of the present invention is the communication device described above, wherein the communication unit detects a mismatch of the second key information between the device and a device having an access point function in the wireless LAN to which the device belongs. The active scan may be performed when there is no

(6) An aspect of the present invention is the communication device described above, wherein the communication unit is a packet that stores a broadcast or multicast address as a source IP address and stores a MAC address of a target device as a destination MAC address. and transmits a third response request packet encrypted by the first key information, and the detection unit, when receiving a response packet to the third response request packet, encrypts a message between the target device and the own device It is desirable not to detect a mismatch of the second key information in the.

(7) An aspect of the present invention is the communication device described above, wherein the detecting unit detects the third The apparatus may further include a control unit that detects a mismatch of two key information and updates the second key information held by the device when the detection unit detects a mismatch of the second key information.

(8) One aspect of the present invention is a communication method for communicating with a device using first key information set for each device and second key information commonly set for a plurality of devices. storing an IP address based on the received packet in a storage unit, and performing active scanning in which the first response request packet is encrypted with the second key information and transmitted within a predetermined IP address range. , when there is no response to the first response-request packet and the IP address of the first response-request packet to which the response is not received is stored in the storage unit, the IP address of the first response-request packet to which the response is not received When a second response request packet with a destination IP address is encrypted with the first key information and transmitted, and a response to the second response request packet is received, communication between the device that transmitted the response and the self device A communication method for detecting a mismatch of the second key information.

(9) One aspect of the present invention is a communication device that communicates with devices using first key information that is set for each device and second key information that is commonly set for a plurality of devices. A program for causing a computer of the communication device to store an IP address based on the received packet in a storage unit, and encrypting a first response request packet with the second key information within a predetermined IP address range. active scanning is executed to convert and transmit the first response request packet, and when there is no response to the first response request packet, and the IP address of the first response request packet to which there is no response is stored in the storage unit, the A second response request packet whose destination IP address is the IP address of the first response request packet is encrypted by the first key information and transmitted, and when a response to the second response request packet is received, the response is transmitted. and a program for a communication device that detects a mismatch of the second key information between the device and the device itself.

(10) In one aspect of the present invention, first key information for unicast communication and second key information for broadcast or multicast communication are set in a device in a wireless LAN, and the second key information is set to a predetermined an access point that updates according to a condition, a storage unit that stores an IP address based on a received packet, a communication unit that transmits and receives packets, and a detection unit that detects a mismatch of the second key information, The communication unit executes active scanning in which a first response request packet is encrypted with the second key information and transmitted within a predetermined IP address range, and when there is no response to the first response request packet, When the IP address of the first response request packet with no response is stored in the storage unit, the second response request packet having the IP address of the first response request packet with no response as the destination IP address is 1 key information for encryption and transmission, and when the detection unit receives a response to the second response request packet, detects a mismatch of the second key information between the device that transmitted the response and the device itself. A communication system comprising: a communication device that

(11) An aspect of the present invention is the communication system described above, wherein the access point and the communication device may perform processing conforming to IEEE802.11.

(12) In one aspect of the present invention, an access point sets first key information for unicast communication and second key information for broadcast or multicast communication to a device in a wireless LAN, and the access point , the second key information is updated according to a predetermined condition, the communication device stores an IP address based on the received packet, and the communication device transmits the first response request packet within a predetermined IP address range. and executing an active scan to encrypt and transmit with the second key information, and the communication device, when there is no response to the first response request packet, the IP address of the first response request packet to which there is no response is the when stored in the storage unit, encrypting and transmitting a second response request packet whose destination IP address is the IP address of the first response request packet to which there is no response using the first key information; 1. The communication method, wherein, when receiving a response to the second response request packet, a mismatch of the second key information between the device that transmitted the response and the self device is detected.

According to one aspect of the present invention, group key mismatch can be detected.

1 is a block diagram showing an example of a radio communication system according to an embodiment to which the present invention is applied; FIG. It is a block diagram showing an example of functional composition of a HEMS controller concerning an embodiment to which the present invention is applied, a wireless router device, and household appliances. It is a figure which shows an example of a device database. It is a figure which shows an example of network NW2 in a house in embodiment. It is an explanatory view for explaining passive scanning. It is a figure which shows an example of a device database. 4 is an example of a flow chart for detecting mismatch of group keys (GTK) in a residential network according to the embodiment; 4 is a flow chart showing an example of a process (step S100) for confirming mismatch of group keys of HEMS controllers. FIG. 10 is a diagram showing an example of an operation (step S100) of detecting mismatch of group keys by the HEMS controller; FIG. 10 is a flow chart showing an example of a process (step S200) for detecting target devices in an in-house network by active scanning; FIG. FIG. 4 is a diagram showing an example of packets transmitted and received in active scanning; FIG. 10 is a diagram for explaining an example of an operation (step S200) when active scanning is performed in the embodiment; It is a figure which shows an example of the apparatus database to which the detection date and time were added. It is a figure which shows an example of the process which updates a device database. FIG. 10 is a flowchart showing an example of processing (step S300) for detecting group key mismatch for devices not detected by active scanning. FIG. It is a figure which shows an example of a device database. FIG. 10 is a diagram for explaining an operation of confirming a mismatch between group keys of each device; FIG. 10 is a diagram showing an example of a device database in which detection dates and times of devices whose group keys do not match are updated; FIG. 10 is a diagram for explaining another operation of confirming a mismatch between group keys of each device; FIG. 10 is a diagram showing an example of a device database in which records of devices with mismatched group keys are deleted; FIG. 10 is a diagram illustrating an operation of performing active scanning on a device that has not responded to an ARP request; FIG. 10 is a diagram showing a device database in which IP addresses and the like are updated based on active scan results;

A communication device, a communication system, a communication method, and a program to which the present invention is applied will be described below with reference to the drawings.

(system overview)
FIG. 1 is a block diagram showing an example of a radio communication system according to an embodiment to which the present invention is applied. The wireless communication system of the embodiment includes, for example, a HEMS controller 100, a wireless router device 200, home appliances 300A, 300B and 300C, and a mobile terminal device 400. The wireless communication system of the embodiment is, for example, a HEMS that monitors the state of the home appliance 300 and controls the operation of the home appliance 300 by transmitting an instruction based on a user's operation to the home appliance 300 (device to be controlled). (Home Energy Management System).

Wireless router device 200 and mobile terminal device 400 are connected to wide area network NW1. Each device connected to the wide area network NW1 has a communication interface such as a NIC (Network Interface Card) or a wireless communication module (not shown in FIG. 1). The wide area network NW1 is, for example, the Internet. HEMS controller 100, wireless router device 200, and home appliance 300 are connected to in-home network NW2. The in-home network NW2 is, for example, a wireless LAN (Wifi (registered trademark) network) standardized by IEEE802.11. Each device connected to the in-home network NW2 has a communication interface such as a NIC and a wireless communication module (not shown in FIG. 1). Although three home appliances 300A, 300B, and 300C are shown in FIG. 1, the home appliances 300A, 300B, and 300C are simply referred to as "home appliances 300" in the following description. Moreover, the home appliance 300 is not limited to a plurality, and may be one.

FIG. 2 is a block diagram showing an example of functional configurations of a HEMS controller, a wireless router device, and home electric appliances according to an embodiment to which the present invention is applied.

The HEMS controller 100 includes, for example, a communication unit 110, a detection unit 120, a control unit 130, a notification unit 140, and a device database 150. The communication unit 110 is a communication interface such as an NIC or a wireless communication module that connects to the in-house network NW2. The detection unit 120 detects mismatch of group keys in the in-house network NW2. The control unit 130 controls various processes and operations in the HEMS controller 100 . The control unit 130 performs, for example, a process of collecting signals related to the operation status of the home appliance 300, a process of controlling the home appliance 300, a process of acquiring control results of the home appliance 300, and the like. The notification unit 140 is, for example, a display device such as an indicator. Note that functional units such as the detection unit 120 and the control unit 130 are implemented by a processor such as a CPU (Central Processing Unit) executing a program stored in a program memory. Some or all of these functional units may be realized by hardware such as LSI (Large Scale Integration), ASIC (Application Specific Integrated Circuit), or FPGA (Field-Programmable Gate Array), It may be realized by cooperation of software and hardware.

The device database 150 is implemented by a storage device such as a HDD (Hard Disc Drive), flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), ROM (Read Only Memory), RAM (Random Access Memory), or the like. The device database 150 is a database that stores information on the home appliances 300 in the in-house network NW2. FIG. 3 is a diagram showing an example of a device database. The device database 150 is, for example, information that associates IP addresses, MAC addresses, and detection dates and times.

The wireless router device 200 has, for example, a router section 210 and an access point section 220 . The router unit 210 relays communication between the wide area network NW1 and the in-house network NW2. The router unit 210 performs IP address conversion between, for example, a global IP address and a private IP address. The router unit 210 executes, for example, a process called NAPT (Network Address Port Translation).

The access point unit 220 relays communication within the in-house network NW2. The access point unit 220 sets a unicast key with the HEMS controller 100 and with the home appliance 300 . The unicast key is key information used for unicast communication, and is key information that differs for each HEMS controller 100 and each home appliance 300 . Access point unit 220 sets a group key. The group key is key information common to the in-home network NW2, and is the same key information for the HEMS controller 100 and the home appliance 300. FIG.

A process for detecting mismatch of group keys (GTK) in the in-home network NW2 will be described below. FIG. 4 is a diagram showing an example of the in-home network NW2 in the embodiment. In the following description, the in-house network NW2 is given a network configuration, IP addresses and MAC addresses as shown in FIG. 4, for example. In this in-home network NW2, the HEMS controller 100, the home appliances 300A, 300B, and the home appliance 300C are connected to the wireless router device 200 by Wifi communication.

FIG. 5 is an explanatory diagram for explaining passive scanning. The HEMS controller 100 always performs passive scanning in the process of detecting mismatch of group keys. For example, it is assumed that the home appliance 300C has transmitted an ARP (Address Resolution Protocol) request P1 in order to communicate with an arbitrary device. This ARP request P1 is received by the wireless router device 200 . The wireless router device 200 broadcasts the ARP request P2 to all devices within the residential network NW2. HEMS controller 100 receives ARP request P2 from wireless router device 200 . The HEMS controller 100 adds the source IP address, the source MAC address, and the detection date and time of the ARP request P2 included in the ARP request P2 to the device database 150. FIG.

FIG. 6 is a diagram showing an example of the device database 150. As shown in FIG. When receiving the ARP request P2, the HEMS controller 100 searches the device database 150 using the source MAC address of the ARP request P2 as a key, and adds a new record if there is no source MAC address. If the source MAC address exists in the device database 150, the HEMS controller 100 updates the detection date and time corresponding to the source MAC address.

FIG. 7 is an example of a flow chart for detecting mismatch of group keys (GTK) in a residential network according to the embodiment. The HEMS controller 100 repeats, for example, the processes (steps S100 to S300) shown in FIG. 7 at regular intervals. The fixed period is, for example, 10 minutes. Note that the HEMS controller 100 executes the process shown in FIG. 7 in parallel with the passive scan described above.

First, the HEMS controller 100 confirms that its own group key does not match (step S100). Next, HEMS controller 100 detects target devices (wireless router device 200, home appliances 300A, 300B and 300C) in in-home network NW2 by active scanning (step S200). Next, the HEMS controller 100 confirms that the group keys of the target device do not match (step S300).

As a result, the HEMS controller 100 first detects whether or not the group key held by itself does not match the group keys held by other devices (step S100), and then the group keys held by the devices other than itself are detected. , and the group key that it owns does not match (step S300).

FIG. 8 is a flow chart showing an example of the process (step S100) of checking the mismatch of the group keys of the HEMS controller.
First, the HEMS controller 100 acquires its own network setting information (step S102). The network setting information includes, for example, an IP address, network address, subnet mask, default gateway IP address, and network interface type. The HEMS controller 100 then transmits a response request packet (step S104). The response request packet is a packet requesting the device that received the response request packet to transmit the response packet to the HEMS controller 100 . The HEMS controller 100 sets the source IP address of the response request packet to a broadcast or multicast IP address, and sets the destination IP address of the response request packet to the IP address of any device.

Next, the HEMS controller 100 determines whether or not a response to the response request packet has been received (step S106). When the HEMS controller 100 receives a response (step S106: YES), it ends the processing of this flowchart. If the HEMS controller 100 has not received a response (step S106: NO), it notifies the group key mismatch (step S108). The HEMS controller 100 notifies the user to restart the HEMS controller 100 and the wireless router device 200 by, for example, display or voice on the smartphone. In addition, it is desirable that the control unit 130 of the HEMS controller 100 updates the group key held by the HEMS controller 100 when detecting a mismatch of the group keys. The HEMS controller 100 may perform a process of reconnecting to the wireless router device 200 and a process of requesting (prompting) restart of the wireless router device 200 as the process of updating the group key. Thereby, the HEMS controller 100 can cause the wireless router device 200 to reset the group key in the in-home network NW2.

FIG. 9 is a diagram showing an example of the operation (step S100) of detecting mismatch of group keys by the HEMS controller. First, the HEMS controller 100 transmits an ICMP (Internet Control Message Protocol) echo request P10 as a response request packet to the wireless router device 200 . The HEMS controller 100 sets the source IP address of the ICMP echo request P10 to a broadcast or multicast IP address, and sets the destination IP address of the ICMP echo request P10 to the IP address of the wireless router device 200 . Since the destination IP address is the IP address of wireless router device 200 (unicast transmission), HEMS controller 100 encrypts ICMP echo request P10 with PTK.

Upon receiving the ICMP echo request P10, the wireless router device 200 transmits an ICMP echo reply P12 to the broadcast or multicast IP address. Since the destination IP address is a broadcast IP address (broadcast transmission) or a multicast IP address (multicast transmission), wireless router device 200 encrypts ICMP echo reply P12 with a group key.

The HEMS controller 100 does not detect group key mismatch when the ICMP echo reply P12 can be decrypted (received) using its own group key. If the HEMS controller 100 cannot decrypt (cannot receive) the ICMP echo reply P12 with its own group key, it detects group key mismatch. If the destination IP address is a broadcast IP address or multicast IP address, wireless router device 200 determines the MAC address from the broadcast IP address or multicast IP address. The wireless router device 200 encrypts the ICMP echo reply P12 with the group key because the destination MAC address is determined from the MAC address from the broadcast IP address or the multicast IP address.

The destination of the response request packet must be a device that has the ability to encrypt the response packet with the group key and transmit the response packet when it receives a request packet containing a broadcast address or multicast address among multiple devices. desirable. Further, the destination of the response request packet may be the device with which the HEMS controller 100 communicated at the closest date and time among the devices with which the HEMS controller 100 communicated. This is because there is a high probability that a response to the response request packet will be obtained. Moreover, the destination of the response request packet is preferably a device having an access point function in the residential network NW2 to which the HEMS controller 100 belongs, or a device having both the access point function and the router function. This is because the in-house network NW2 always includes a device having an access point function.

Although the HEMS controller 100 transmits an ICMP echo request as a response request packet, it is not limited to this, and may be a Get request in ECHONET Lite.

FIG. 10 is a flow chart showing an example of processing (step S200) for detecting a target device in a residential network by active scanning.
The HEMS controller 100 first calculates the IP address range of devices in the in-home network NW2 based on the network address and subnet mask (step S202). The HEMS controller 100 then sets one of the IP addresses within the calculated range as the target and performs an active scan. Active scanning includes a process of broadcasting or multicasting an ARP request including one IP address set as a target as a target IP address, and a process of registering in response to an ARP reply to the ARP request.

FIG. 11 is a diagram illustrating an example of packets transmitted and received in active scanning.
In the active scan, the HEMS controller 100 transmits multiple ARP requests while changing the target IP address within the IP address range of devices in the residential network NW2. For example, the HEMS controller 100 sets the target IP address of ARP request #1 to "192.168.1.3", sets the target IP address of ARP request #2 to "192.168.1.4", and sets the target IP address of ARP request #3 to "192.168.1.4". Set the address to "192.168.1.5" and send each ARP request #1, #2, #3. Since home appliances with IP addresses "192.168.1.3 and 192.168.1.4" do not exist, the HEMS controller 100 cannot receive ARP replies to ARP requests #1 and #2. When the HEMS controller 100 receives the ARP reply to the home appliance 300 ARP reply #3, it determines that the home appliance 300 with the IP address “192.168.1.5” exists, and registers it in the device database 150 .

Next, the HEMS controller 100 determines whether or not an ARP reply has been received as a response to the ARP request (step S206). When the HEMS controller 100 does not receive an ARP reply (step S206: NO), the process proceeds to step S214. When receiving the ARP reply (step S206: YES), the HEMS controller 100 determines whether or not the MAC address of the device that sent the response has been registered in the device database 150 (step S208).

If the MAC address of the device that sent the response has not been registered in the device database 150 (step S208: NO), the HEMS controller 100 stores the combination of the IP address, MAC address, and detection date and time of the device that sent the response in the device database. 150 (step S210). After step S210, the HEMS controller 100 advances the process to step S214. If the MAC address of the device that sent the response has already been registered in the device database 150 (step S208: YES), the HEMS controller 100 updates the combination of the IP address and detection date and time for the entry of the MAC address in the device database 150 ( step S212). After step S212, the HEMS controller 100 advances the process to step S214.

In step S214, the HEMS controller 100 determines whether or not all IP addresses within the range calculated in step S202 have been actively scanned. If the HEMS controller 100 has not actively scanned all IP addresses within the range (step S214: NO), the process returns to step S204. When the HEMS controller 100 has actively scanned all IP addresses within the range, the process proceeds to step S216.

In step S216, the HEMS controller 100 searches the device database 150 using one of the IP addresses within the range calculated in step S202 as a key (step S216). As a result of the search, the HEMS controller 100 determines whether or not multiple records containing the IP address as the key have been searched (step S218). When a plurality of records including an IP address as a key are retrieved (step S218: YES), the HEMS controller 100 leaves the IP address column blank in records other than the record with the latest retrieval date and time among the plurality of retrieved records. (step S220). If multiple records containing the IP address as the key are not found (step S218: NO), the process proceeds to step S222.

Next, the HEMS controller 100 determines whether or not all IP addresses within the range calculated in step S202 have been searched (step S222). If the HEMS controller 100 has not searched for all IP addresses within the range (step S222: NO), it repeats the processing from step S216 onwards, and has searched for all IP addresses within the range (step S222: YES). , the processing of this flowchart ends.

FIG. 12 is a diagram for explaining an example of the operation (step S200) when active scanning is performed in the embodiment. The HEMS controller 100 stores the start date and time of the active scan, and executes the active scan for all IP addresses within the in-house network NW2. As a result, an ARP request P20 including each IP address as a target IP address is unicast-transmitted from the HEMS controller 100 to the wireless router device 200 .

In response to receiving ARP request P20, wireless router device 200 broadcasts or multicasts an ARP request to residential network NW2. Wireless router device 200 encrypts the ARP request with the group key. As a result, ARP request P21 is sent to home appliance 300A, ARP request P22 is sent to home appliance 300B, and ARP request P23 is sent to home appliance 300C. If the home appliance 300 has a group key that matches the group key held by the wireless router device 200, the home appliance 300 can receive the ARP request and respond to the ARP request. Assume that only the home appliance 300A among the home appliances 300 has a group key that matches the group key held by the wireless router device 200. FIG. In this case, home appliance 300A unicasts ARP reply P24 to wireless router device 200, and home appliances 300B and 300C cannot send ARP replies. When the wireless router device 200 receives the ARP reply P24 from the home appliance 300A, the wireless router device 200 unicasts the ARP reply P25 to the HEMS controller 100 .

Upon receiving the ARP reply P25, the HEMS controller 100 adds the MAC address stored in the destination MAC address field, the IP address stored in the destination IP address field, and the detection date and time to the device database 150 in the ARP reply P25. do. FIG. 13 is a diagram showing an example of a device database in which detection dates and times are added. At this time, as described in steps S208 to S212, if the MAC address is registered in the device database 150, the HEMS controller 100 updates the IP address and detection date and time, and updates the MAC address to the device database 150. If not registered, the MAC address, IP address, and detection date and time are newly registered.

FIG. 14 is a diagram illustrating an example of processing for updating the device database.
Since the device database 150 manages MAC addresses as key information, the same IP address may be registered in multiple MAC address entries. For example, the IP address used by the mobile terminal may be reused by another terminal because the mobile terminal has left the in-house network NW2 and is no longer used.
Therefore, after completing the active scan, the HEMS controller 100 searches the device database 150 using the IP address as a key. When there are two or more records in the search result ((a) in FIG. 14), the HEMS controller 100 updates the IP addresses in records other than the record with the latest detection date and time to blanks ((b) in FIG. 14, step S220 ).

Note that even if the IP address corresponding to the MAC address registered in the device database 150 is updated to blank, the HEMS controller 100 does not delete the record including the MAC address. This is because there is a possibility that the device having the MAC address is communicating with the HEMS controller 100 using another IP address.

FIG. 15 is a flow chart showing an example of processing (step S300) for detecting group key mismatch for devices that have not been detected by active scanning.
First, the HEMS controller 100 extracts records whose detection date and time are older than the active scan start time from the device database 150 (step S302). FIG. 16 is a diagram showing an example of a device database. For example, when the active scan start time is "2019-06-20 10:15:00", the HEMS controller 100 extracts records before the start time.

Next, the HEMS controller 100 unicasts an ARP request to the device with the combination of the IP address and MAC address included in the extracted record (step S304). Next, the HEMS controller 100 determines whether or not an ARP reply has been received as a response to the ARP request (step S306). If the HEMS controller 100 can receive the ARP reply (step S306: YES), the HEMS controller 100 notifies that the group key held by the device to which the ARP request is sent does not match the group key held by the HEMS controller 100. (step S308). For example, the HEMS controller 100 notifies the user to restart the device with the mismatched group key or the wireless router device 200 by display or voice on the smartphone. When the HEMS controller 100 cannot receive the ARP reply (step S306: NO), it determines whether or not the ARP request has been transmitted to all the extracted devices (step S310).

17A and 17B are diagrams for explaining the operation of confirming that the group keys of each device do not match. The HEMS controller 100 unicasts an ARP request P30 to the device with the combination of the IP address (192.168.1.4) and MAC address (00-00-00-00-00-04) extracted from the device database 150 . Upon receiving ARP request P30, wireless router device 200 unicasts ARP request P31 to home appliance 300B. The home appliance 300B unicasts an ARP reply P32 to the wireless router device 200 in response to receiving the ARP request P31. The wireless router device 200 unicasts an ARP reply P33 to the HEMS controller 100 in response to receiving the ARP reply P32. In response to receiving the ARP reply P33, the HEMS controller 100 updates the detection date and time of the device database 150 with the date and time when the ARP reply P33 was received, as shown in FIG. FIG. 17 is a diagram showing an example of a device database in which detection dates and times of devices with mismatched group keys are updated.

FIG. 19 is a diagram for explaining another operation for confirming mismatch of group keys of each device. The HEMS controller 100 unicasts an ARP request P40 to the device with the combination of the IP address (192.168.1.5) and MAC address (00-00-00-00-00-05) extracted from the device database 150 . Upon receiving ARP request P40, wireless router device 200 unicasts ARP request P41 to home appliance 300C. The home appliance 300C cannot receive the ARP request P41, or does not have the function of returning an ARP reply even if it receives the ARP request P41. Therefore, the HEMS controller 100 cannot receive the ARP reply. In this case, the HEMS controller 100 deletes the record regarding the home appliance 300C from the device database 150, as shown in FIG. FIG. 20 is a diagram showing an example of a device database in which records of devices whose group keys do not match are deleted. As a result, the HEMS controller 100 can delete from the device database 150 the record regarding the device that has left the in-house network NW2.

If the HEMS controller 100 has not sent an ARP request to all the extracted devices (step S310: NO), it repeats the processing from step S304 onwards, and if it has sent an ARP request to all the extracted devices (step S310: YES), the processing of this flowchart is terminated.

Although the HEMS controller 100 deleted the record regarding the device to which the ARP request was sent when there was no response to the ARP request, the active scan may be performed again. FIG. 21 is a diagram for explaining the operation of performing an active scan on devices that do not respond to ARP requests. FIG. 4 is a diagram showing; If there is no response to the ARP request, for example, the home appliance 300C temporarily leaves the in-home network NW2, and the IP address of the home appliance 300C changes from "192.168.1.5" before leaving to "192.168" after leaving. .1.6".

When there is no response to the ARP request, the HEMS controller 100 unicast-transmits an ARP request P50 to the MAC address of the ARP request while changing the IP address within the IP address range of the devices in the residential network NW2. . ARP request P50 is received by wireless router device 200, and wireless router device 200 unicasts ARP request P51 to home appliance 300C.

The home appliance 300C unicasts an ARP reply P52 to the wireless router device 200 in response to the ARP request P51. The wireless router device 200 unicasts an ARP reply P53 to the HEMS controller 100 in response to receiving the ARP reply P52.

According to the HEMS controller 100 of the embodiment described above, the response request packet is a packet that stores a broadcast or multicast address as the source IP address and stores the MAC address of the target device as the destination MAC address. information (PTK) is encrypted and transmitted, and when a response packet to the response request packet is received, a mismatch of the second key information (GTK) between the wireless router device 200 and the wireless router device 200 is not detected, and the response request is sent. If no response packet to the packet is received, a mismatch of second key information (GTK) between the wireless router device 200 and its own device is detected. Specifically, according to the HEMS controller 100 of the embodiment, when the response packet transmitted from the target device to which the response request packet is transmitted can be decrypted by the second key information possessed by the own device, the second key If no information mismatch is detected and decryption is not possible with the second key information possessed by the device itself, the mismatch of the second key information between the wireless router device 200 and the device itself is detected. Thereby, according to the HEMS controller 100, the mismatch of the group key (GTK) of the HEMS controller 100 itself can be detected. As a result, according to the HEMS controller 100, deterioration of convenience can be suppressed.

Further, according to the HEMS controller 100 of the embodiment, when receiving a response request packet in which a broadcast or multicast address is stored, the response request packet is sent to a device capable of encrypting it with the second key information and transmitting the response packet. Send. Furthermore, according to the HEMS controller 100 of the embodiment, the response request packet is transmitted to a device having an access point function or a device having both an access point function and a router function in the wireless LAN to which the device belongs. Thereby, according to the HEMS controller 100, it is possible to detect a mismatch of group keys (GTK) by increasing the possibility of receiving a response packet to a response request packet.

Furthermore, according to the HEMS controller 100 of the embodiment, when the mismatch of the second key information is detected, the second key information held by the own device is updated, so the period during which communication using the second key information cannot be performed is shortened. be able to.

Furthermore, according to the HEMS controller 100 of the embodiment, when a mismatch of the second key information is detected, notification is given, so the user is prompted to update the second key information by restarting the HEMS controller 100 or the wireless router device 200. can be encouraged.

Furthermore, according to the HEMS controller 100 of the embodiment, within a predetermined IP address range, active scanning is performed to encrypt and transmit the first response request packet using second key information (GTK), and the first response request packet is sent. When there is no response to the request packet, if the IP address of the first response request packet with no response is stored in the device database 150, the IP address of the first response request packet with no response is the destination IP address. When the response request packet is encrypted with the first key information (PTK) and transmitted, and a response to the second response request packet is received, the first communication between the device (home appliance 300) that transmitted the response and the own device 2 Detect mismatch of key information. Thereby, according to the HEMS controller 100, the household appliances 300 whose group keys do not match those of the HEMS controller 100 can be detected. As a result, according to the HEMS controller 100, it is possible to suppress deterioration in the convenience of the home appliance 300. FIG.

Furthermore, according to the HEMS controller 100 of the embodiment, active scanning can be executed after confirming that there is no mismatch in the second key information between the HEMS controller 100 and the wireless router device 200 .

Although each embodiment and modifications have been described, these are only examples and are not limited to these. A section may be combined with one or more other embodiments or one or more other modifications to realize one aspect of the present invention.

By recording a program for executing each process of the HEMS controller 100 in the present embodiment on a computer-readable recording medium and causing the computer system to read and execute the program recorded on the recording medium, , the various processes described above related to the HEMS controller 100 may be performed.

Note that the “computer system” referred to here may include hardware such as an OS and peripheral devices. The "computer system" also includes the home page providing environment (or display environment) if the WWW system is used. In addition, "computer-readable recording medium" means writable non-volatile memory such as flexible disk, magneto-optical disk, ROM, flash memory, portable medium such as CD-ROM, hard disk built in computer system, etc. storage device.

Furthermore, "computer-readable recording medium" means a volatile memory (e.g., DRAM (Dynamic
Random Access Memory)), which holds a program for a certain period of time. Also, the program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium.

Here, the "transmission medium" for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the program may be for realizing part of the functions described above. Further, it may be a so-called difference file (difference program) that can realize the above-described functions in combination with a program already recorded in the computer system.

As described above, the embodiments of the present invention have been described in detail with reference to the drawings, but the specific configuration is not limited to these embodiments, and includes designs within the scope of the gist of the present invention. In the above-described embodiment, as shown in FIG. 1, the in-house network NW2 in which the wireless router device 200 and the home appliance 300 are wirelessly connected has been described. To solve the problem of detecting mismatching of the group keys of the HEMS controller 100 and the problem of detecting mismatching of the group keys of the home electric appliances 300 even if a device wiredly connected to the wireless router device 200 is included in the can be done.

100 HEMS controller 110 communication unit 120 detection unit 130 control unit 140 notification unit 150 device database 200 wireless router device 210 router unit 220 access point unit 300 home appliance 400 mobile terminal device

Claims (12)

A communication device that communicates with a device using first key information set for each device and second key information commonly set for a plurality of devices,
a storage unit that stores an IP address based on the received packet;
a communication unit that transmits and receives packets;
a detection unit that detects a mismatch of the second key information,
The communication unit
performing an active scan in which a first response request packet is encrypted with the second key information and transmitted within a predetermined IP address range;
When there is no response to the first response request packet and the IP address of the first response request packet to which there is no response is stored in the storage unit, the IP address of the first response request packet to which there is no response is the destination. encrypting and transmitting a second response request packet with an IP address using the first key information;
The detection unit is
When receiving a response to the second response request packet, detecting a mismatch of the second key information between the device that sent the response and the own device,
Communication device. The storage unit stores a combination of the MAC address and the IP address as a result of executing the passive scan,
A communication device according to claim 1 . The storage unit stores a combination of a MAC address, an IP address, and a detection time as a result of executing a passive scan.
A communication device according to claim 1 . Further comprising a notification unit that notifies when the detection unit detects a mismatch of the second key information,
A communication device according to any one of claims 1 to 3. The communication unit executes the active scan when there is no mismatch of the second key information between the device having the access point function in the wireless LAN to which the device belongs and the device.
A communication device according to any one of claims 1 to 4. The communication unit encrypts a third response request packet, which is a packet storing a broadcast or multicast address as a source IP address and storing a MAC address of a target device as a destination MAC address, using the first key information. send and
The detection unit does not detect a mismatch of the second key information between the target device and the own device when receiving a response packet to the third response request packet.
6. A communication device according to claim 5. The detection unit detects a mismatch of the second key information between the target device and the own device when a response packet to the third response request packet is not received,
Further comprising a control unit that updates the second key information held by the device when the detection unit detects a mismatch of the second key information,
7. A communication device according to claim 6. A communication method for communicating with a device using first key information set for each device and second key information commonly set for a plurality of devices,
storing an IP address in a storage unit based on the received packet;
performing an active scan in which a first response request packet is encrypted with the second key information and transmitted within a predetermined IP address range;
When there is no response to the first response request packet and the IP address of the first response request packet to which there is no response is stored in the storage unit, the IP address of the first response request packet to which there is no response is the destination. encrypting and transmitting a second response request packet with an IP address using the first key information;
When receiving a response to the second response request packet, detecting a mismatch of the second key information between the device that sent the response and the own device,
Communication method. A program for a communication device that communicates with a device using first key information set for each device and second key information commonly set for a plurality of devices,
in the computer of the communication device,
storing an IP address in a storage unit based on the received packet;
performing an active scan in which the first response request packet is encrypted with the second key information and transmitted within a predetermined IP address range;
When there is no response to the first response request packet and the IP address of the first response request packet to which there is no response is stored in the storage unit, the IP address of the first response request packet to which there is no response is the destination. encrypting the second response request packet with the IP address using the first key information and transmitting the packet;
When receiving a response to the second response request packet, detecting a mismatch of the second key information between the device that sent the response and the own device,
A program for a communications device. an access point that sets first key information for unicast communication and second key information for broadcast or multicast communication in a device in a wireless LAN and updates the second key information according to predetermined conditions;
a storage unit that stores an IP address based on a received packet; a communication unit that transmits and receives packets; within the range of, performing an active scan in which the first response request packet is encrypted with the second key information and transmitted, and when there is no response to the first response request packet, the first response request with no response When the IP address of the packet is stored in the storage unit, a second response request packet whose destination IP address is the IP address of the first response request packet with no response is encrypted with the first key information and transmitted. a communication device, wherein, when receiving a response to the second response request packet, the detection unit detects a mismatch of the second key information between the device that transmitted the response and the device itself;
A communication system comprising: The access point and the communication device perform processing according to IEEE802.11;
A communication system according to claim 10. An access point sets first key information for unicast communication and second key information for broadcast or multicast communication to a device in a wireless LAN;
the access point updates the second key information according to a predetermined condition;
a communication device storing an IP address based on a received packet;
The communication device performs active scanning in which the first response request packet is encrypted with the second key information and transmitted within a predetermined IP address range,
When the IP address of the first response-request packet with no response is stored in the storage unit when there is no response to the first response-request packet, the communication device stores the IP address of the first response-request packet with no response. encrypting and transmitting a second response request packet with the IP address as the destination IP address using the first key information;
When the communication device receives a response to the second response request packet, detects a mismatch of the second key information between the device that sent the response and the device itself,
Communication method.

Images