JP7738490B2 - Wireless communication system and terminal authentication method - Google Patents

Description

This disclosure relates to a wireless communication system and a terminal authentication method that performs processing to authenticate a wireless communication terminal.

Wireless communication terminals used in wireless communication systems that require confidentiality and high communication continuity are used by an unspecified number of people who are authorized to use the wireless communication terminals within an organization. Furthermore, wireless communication terminals may be used by different people on different days. Therefore, in such wireless communication systems, wireless communication terminals are authenticated in order to be used.

In the above-described usage environment for wireless communication terminals, authentication of the wireless communication terminal is performed using, for example, cryptographic technology, using an authentication server that communicates with an authentication device. The authentication device is, for example, a device owned by each different user. The authentication device is also a device distributed to each user by an organization. The authentication server is installed, for example, at the organization's headquarters. The cryptographic technology is, for example, private key cryptography, public key cryptography, etc.

The primary functions of this wireless communication system are voice communication and data communication. Authentication of a wireless communication terminal is a process performed, for example, to enable the wireless communication terminal to use voice communication.

Patent Document 1 discloses a configuration (hereinafter also referred to as "related configuration A") in which an authentication server is used to perform authentication processing to authenticate a wireless terminal as a wireless communication terminal. This authentication processing is performed using wireless communication.

Patent No. 4705944

In related configuration A, there is only one type of authentication process for authenticating a wireless communication terminal. Therefore, if a situation arises in which one type of authentication process cannot be performed, there is a problem in that the wireless communication terminal cannot be authenticated.

This disclosure has been made to solve these problems, and aims to provide a wireless communication system that can prevent situations in which wireless communication terminals cannot be authenticated.

To achieve the above object, a wireless communication system according to one aspect of the present disclosure includes a wireless communication terminal having the capability to perform wireless communication, and an authentication server used to perform a first authentication process to authenticate the wireless communication terminal using wireless communication. The wireless communication terminal is a device that, when authenticated, is capable of performing specific communication with a communication terminal with which the wireless communication terminal is to communicate. The wireless communication system has an authentication configuration having the capability to perform a second authentication process to authenticate the wireless communication terminal. If a special situation occurs in which the first authentication process using the authentication server is not possible, the wireless communication system uses the authentication configuration to perform the second authentication process to authenticate the wireless communication terminal.

According to the present disclosure, a wireless communication system includes an authentication server used to perform a first authentication process to authenticate a wireless communication terminal using wireless communication. The wireless communication system has an authentication configuration that has the function of performing a second authentication process to authenticate the wireless communication terminal. When a special situation occurs in which the first authentication process using the authentication server cannot be performed, the wireless communication system uses the authentication configuration to perform the second authentication process to authenticate the wireless communication terminal.

This helps prevent situations where a wireless communication terminal cannot be authenticated.

1 is a diagram illustrating a configuration of a wireless communication system according to a first embodiment. FIG. 10 is a diagram for explaining a normal authentication control process. FIG. 2 is a block diagram showing a configuration of a wireless communication terminal. FIG. 2 is a block diagram showing a configuration of an authentication device. FIG. 10 is a diagram for explaining an authentication control process A according to the first embodiment. FIG. 10 is a diagram illustrating a configuration of a wireless communication system according to a second embodiment. 1 is a block diagram showing a characteristic functional configuration of a wireless communication system. FIG. 1 is a diagram illustrating an example of a hardware configuration of a wireless communication system. FIG. 10 is a diagram illustrating another example of the hardware configuration of a wireless communication system.

Embodiments will be described below with reference to the drawings. In the following drawings, identical components are assigned the same reference numerals. Components assigned the same reference numerals have the same names and functions. Therefore, detailed descriptions of some of the components assigned the same reference numerals may be omitted.

First Embodiment
(composition)
FIG. 1 is a diagram showing a configuration of a wireless communication system 1000 according to a first embodiment. The wireless communication system 1000 is a system capable of performing, for example, press-to-talk communication. The press-to-talk communication is, for example, voice communication performed from one wireless communication terminal to multiple other wireless communication terminals. Voice communication is communication for making a call using voice (hereinafter also referred to as a "voice call"). The wireless communication system 1000 is also a system that performs wireless communication using a time division multiple access method (i.e., a TDMA method).

Note that the wireless communication system 1000 is not limited to a system capable of press-to-talk communication. The wireless communication system 1000 may be, for example, a system capable of communicating with a communication terminal located outside the wireless communication system 1000 (hereinafter also referred to as an "external communication terminal").

The main functions of the wireless communication system 1000 are wide-area communication and direct communication. Wide-area communication is communication that takes place in a wide area. Wide-area communication is communication that takes place using, for example, the base station device 501 described below. Wide-area communication includes voice communication and data communication. Hereinafter, voice communication as wide-area communication will also be referred to as "wide-area voice communication." Also, hereinafter, data communication as wide-area communication will also be referred to as "wide-area data communication."

Direct communication is communication that takes place directly between multiple wireless communication terminals. Direct communication is carried out via wireless communication. Direct communication includes voice communication and data communication. In the following, voice communication as a form of direct communication will also be referred to as "direct voice communication." Also, in the following, data communication as a form of direct communication will also be referred to as "direct data communication."

As shown in FIG. 1, the wireless communication system 1000 includes communication units M10, M20, and M30, a base station device 501, a headquarters device 401, and an authentication server 301.

The communication unit M10 includes a wireless communication terminal 101 and an authentication device 201. The wireless communication terminal 101 has the ability to perform wireless communication. This wireless communication can be, for example, short-distance wireless communication or long-distance wireless communication. Short-distance wireless communication is communication using, for example, a wireless LAN (Local Area Network) or Bluetooth. "Bluetooth" is a registered trademark. Long-distance wireless communication is wireless communication performed over a long distance. This long distance is, for example, a distance in the range of 1 km to 10 km. In other words, the wireless communication terminal 101 has the ability to perform short-distance wireless communication and long-distance wireless communication.

The communication unit M10 may also be an integrated unit of the wireless communication terminal 101 and the authentication device 201.

Each of the communication units M20 and M30 has the function of performing wireless communication with the wireless communication terminal 101.

Communication unit M20 includes a wireless communication terminal 102 and an authentication device 202. Communication unit M30 includes a wireless communication terminal 103 and an authentication device 203. Wireless communication terminal 102 and wireless communication terminal 103 each have the function of communicating wirelessly with wireless communication terminal 101.

The communication unit M20 may be an integrated unit of the wireless communication terminal 102 and the authentication device 202. The communication unit M30 may be an integrated unit of the wireless communication terminal 103 and the authentication device 203.

Each of the communication units M10, M20, and M30 is a unit that can be carried by the user. For example, the wireless communication terminal 101 and authentication device 201 included in the communication unit M10 are carried by the user as a pair.

Wireless communication terminals 101, 102, and 103 have the same configuration. Hereinafter, each of wireless communication terminals 101, 102, and 103 will also be referred to as "wireless communication terminal M1." Wireless communication terminal M1 is, for example, a transceiver that has the function of performing press-to-talk communication as voice communication. Note that wireless communication terminal M1 is not limited to a transceiver. Wireless communication terminal M1 may also be, for example, a mobile phone.

As an example, the wireless communication system 1000 includes three wireless communication terminals M1. Note that the number of wireless communication terminals M1 included in the wireless communication system 1000 is not limited to three, and may be two, four, or more.

Authentication devices 201, 202, and 203 each have the same configuration. Hereinafter, each of authentication devices 201, 202, and 203 will also be referred to as "authentication device M2." Authentication device M2 is, for example, a smartphone. Authentication device M2 has the function of performing wireless communication. Furthermore, authentication device M2 performs processing related to authentication of wireless communication terminal M1.

The wireless communication terminal M1 and authentication device M2 included in each of the communication units M10, M20, and M30 have the function of performing communication A with each other. Communication A is wireless communication or wired communication. Wireless communication, which is communication A, is, for example, communication using Bluetooth. Wired communication, which is communication A, is communication using a communication cable. For example, the wireless communication terminal 101 included in the communication unit M10 has the function of communicating with the authentication device 201.

The wireless communication system 1000 performs processing to authenticate the wireless communication terminal M1. Hereinafter, processing to authenticate the wireless communication terminal M1 using wireless communication will also be referred to as "authentication processing Pr1." This wireless communication is, for example, the aforementioned short-range wireless communication or long-range wireless communication. Also, below, processing to authenticate the wireless communication terminal M1 that is different from authentication processing Pr1 will also be referred to as "authentication processing Pr2."

The wireless communication system 1000 performs authentication process Pr1 or authentication process Pr2 depending on the status of the wireless communication system 1000. Hereinafter, the configuration having the function of performing authentication process Pr2 will also be referred to as "authentication configuration Ca." The wireless communication system 1000 has authentication configuration Ca.

Authentication configuration Ca is a configuration that uses multiple communication units. In this embodiment, authentication configuration Ca is a configuration that uses communication units M20 and M30. Note that the number of communication units used in authentication configuration Ca is not limited to two, and may be three or more.

In the following, the state of wireless communication terminal M1 when it has been authenticated by authentication process Pr1 or Pr2 will also be referred to as the "authenticated state." Also, in the following, the state of wireless communication terminal M1 when it has not been authenticated by authentication process Pr1 or Pr2 will also be referred to as the "non-authenticated state."

The wireless communication terminal M1 has the function of performing wireless communication. The wireless communication terminal M1 also has the function of performing the wide area communication and direct communication described above. Specifically, the wireless communication terminal M1 has the function of performing the wide area voice communication, wide area data communication, direct voice communication, and direct data communication described above. Hereinafter, the function of the wireless communication terminal M1 to perform direct data communication with another wireless communication terminal M1 using wireless communication is also referred to as the "direct communication function." The wireless communication terminal M1 has the direct communication function.

A wireless communication terminal M1 in an authenticated state can perform wide-area voice communication, wide-area data communication, direct voice communication, and direct data communication. On the other hand, a wireless communication terminal M1 in an unauthenticated state can only perform direct data communication. In other words, a wireless communication terminal M1 in an unauthenticated state cannot perform wide-area voice communication, wide-area data communication, or direct voice communication.

In this embodiment, as an example, a process for authenticating wireless communication terminal 101, which is wireless communication terminal M1, will be described. Hereinafter, wide-area voice communication, wide-area data communication, and direct voice communication will be collectively referred to as "specific communication" or "specific communication." Wide-area voice communication and wide-area data communication are each wide-area communications. Therefore, wide-area communications are specific communications. The function of performing specific communications is a primary function of wireless communication terminal M1.

A wireless communication terminal 101 in an authenticated state can perform specific communication and direct data communication. In other words, a wireless communication terminal 101 in an authenticated state can use specific communication and direct data communication. On the other hand, a wireless communication terminal 101 in an unauthenticated state can only perform direct data communication. In other words, a wireless communication terminal 101 in an unauthenticated state can only use direct data communication.

Hereinafter, the terminal with which wireless communication terminal 101 communicates will also be referred to as "communication terminal A." Communication terminal A is, for example, both or one of wireless communication terminal 102 and wireless communication terminal 103. Note that communication terminal A may also be, for example, an external communication terminal that is a communication terminal located outside wireless communication system 1000. Communication terminal A may also be communication unit M20, M30, etc.

When the wireless communication terminal 101 is authenticated by authentication process Pr1 or authentication process Pr2, the state of the wireless communication terminal 101 becomes the authenticated state. Therefore, when the wireless communication terminal 101 is authenticated, the wireless communication terminal 101 is a device that can perform the above-mentioned specific communication with communication terminal A.

The authentication server 301 has the ability to perform wireless communication. The authentication server 301 is used to perform the authentication process Pr1, which will be described in detail later. The authentication process Pr1 is a process that uses the authentication server 301. Each of the authentication devices 201, 202, and 203 has the ability to perform wireless communication with the authentication server 301.

The base station device 501 is a communication device installed in a base station. The base station device 501 is a wireless transceiver capable of performing long-distance wireless communication. The base station device 501 is installed, for example, on a mountain or the rooftop of a high-rise building. The base station device 501 has the ability to perform wireless communication with the wireless communication terminal 101.

Hereinafter, the communication area of the authentication server 301 will also be referred to as "area Ar3." Area Ar3 is an area in which the authentication server 301 can communicate wirelessly with the authentication device M2. For example, if the authentication device 201 is present in area Ar3 of the authentication server 301, the authentication server 301 can communicate wirelessly with the authentication device 201. Figure 1 shows a state in which authentication devices 201, 202, and 203 are present in area Ar3 of the authentication server 301.

Furthermore, below, the communication area of base station device 501 is also referred to as "area Ar5." Area Ar5 is an area in which base station device 501 can communicate wirelessly with wireless communication terminal M1. For example, if wireless communication terminal 101 is present in area Ar5 of base station device 501, base station device 501 can communicate wirelessly with wireless communication terminal 101. Figure 1 shows a state in which wireless communication terminals 101, 102, and 103 are present in area Ar5 of base station device 501. Area Ar3 of authentication server 301 is smaller than area Ar5 of base station device 501.

Furthermore, hereinafter, the communication area of wireless communication terminal M1 will also be referred to as "area Ar1." Area Ar1 of wireless communication terminal M1 is smaller than area Ar5 of base station device 501. Area Ar1 is also smaller than area Ar3 of authentication server 301. Area Ar1 exists within area Ar5. Area Ar1 also exists within area Ar3.

Area Ar1 is an area in which wireless communication terminal M1 can communicate wirelessly with other wireless communication terminals M1. For example, if wireless communication terminal 102 is present in area Ar1 of wireless communication terminal 101, wireless communication terminal 101 can communicate wirelessly with wireless communication terminal 102.

Furthermore, the base station device 501 is connected to the headquarters device 401 via a communication cable C1. The communication cable C1 is, for example, an optical fiber cable, a coaxial cable, etc. The base station device 501 communicates with the headquarters device 401 via the communication cable C1. In other words, the base station device 501 communicates with the headquarters device 401 via a wired connection.

The headquarters device 401 communicates with the base station device 501 via the communication cable C1. The headquarters device 401 has the function of performing specific communication support processing. The specific communication support processing is processing that enables the wireless communication terminal M1 in an authenticated state to perform wide-area communication, which is a specific communication. As mentioned above, wide-area communication is communication that is performed using the base station device 501.

The wide-area communication is, for example, a press-to-talk communication as a wide-area voice communication. To explain a specific example of the specific communication support process, let's assume that wireless communication terminal 101, which is in an authenticated state, is conducting a press-to-talk communication as a wide-area voice communication with wireless communication terminals 102 and 103, which are communication terminals A and are located in area Ar5.

In this case, in the specific communication response process, the headquarters device 401 performs communication control processing. The communication control processing is processing that enables the wireless communication terminal 101 to perform press-to-talk communication with the wireless communication terminals 102 and 103. The communication control processing includes, for example, determining the priority of communications performed by each of the wireless communication terminals 102 and 103, and transferring audio data for press-to-talk communication.

Note that the wide-area communication described above is not limited to press-to-talk communication as wide-area voice communication. The wide-area communication may be, for example, communication between an authenticated wireless communication terminal M1 and a communication terminal A that is located in an area of the base station device 501's area Ar5 outside the area Ar1 of the wireless communication terminal M1.

Here, to explain a specific example of specific communication support processing, let's assume that a wireless communication terminal 101 in an authenticated state is performing wide-area voice communication, which is a wide-area communication, with a wireless communication terminal 102 (communication terminal A) that is located in an area outside area Ar1 of the wireless communication terminal 101, within area Ar5 of base station device 501.

In this case, in the specific communication response process, the headquarters device 401 uses the base station device 501 to transmit voice data to the wireless communication terminal 102, which is used by the wireless communication terminal 101 in an authenticated state to perform wide-area voice communication with the wireless communication terminal 102 serving as communication terminal A.

Here, let's assume that the wireless communication terminal 101 transmits voice data for wide-area voice communication with the wireless communication terminal 102 to the headquarters device 401 via the base station device 501. In this case, in the specific communication response process, the headquarters device 401 performs processing to transmit the received voice data to the wireless communication terminal 102 via the base station device 501.

In addition, the wireless communication system 1000 may be configured so that the wireless communication terminal M1 in an authenticated state can communicate with a communication terminal A that exists outside the wireless communication system 1000 as an external communication terminal (hereinafter also referred to as an "external communication configuration").

In the external communication configuration, the headquarters device 401 is connected to an external network (not shown) via a communication cable (not shown). The external network is, for example, the Internet. In the external communication configuration, the external network can communicate with, for example, communication terminal A, an external communication terminal located outside the wireless communication system 1000.

The above-mentioned wide-area communication in the external communication configuration is, for example, communication between wireless communication terminal M1 in an authenticated state and communication terminal A, which serves as an external communication terminal and communicates with an external network, via base station device 501 and headquarters device 401.

Here, in the external communication configuration, it is assumed that the authenticated wireless communication terminal M1 performs wide-area voice communication, which is a wide-area communication, with, for example, communication terminal A as an external communication terminal. In this case, in the specific communication response process, the headquarters device 401 performs processing to transmit to communication terminal A voice data for wide-area voice communication between the authenticated wireless communication terminal M1 and communication terminal A as an external communication terminal.

By the headquarters device 401 performing the above-mentioned specific communication support process, the authenticated wireless communication terminal M1 becomes able to perform wide-area communication, which is specific communication, with communication terminal A.

In the following, the situation in which the wireless communication system 1000 is operating normally will also be referred to as the "normal situation." In the normal situation, the authentication device 201 is able to communicate wirelessly with the authentication server 301. In the following, the process for authenticating the wireless communication terminal M1 in the normal situation will also be referred to as the "normal authentication control process." In addition, in the following, the communication path for authenticating the wireless communication terminal 101 in the normal authentication control process, which uses the authentication device 201 and the authentication server 301, will also be referred to as the "normal authentication path."

(Normal authentication control process)
Next, a normal authentication control process for authenticating the wireless communication terminal 101, which is the wireless communication terminal M1, will be described with reference to Fig. 2. Fig. 2 is a diagram for explaining the normal authentication control process.

Hereinafter, the signal for starting the authentication process will also be referred to as the "authentication start signal." Also, hereinafter, the information identifying the wireless communication terminal M1 will also be referred to as "ID information J1." For example, if the wireless communication terminal M1 is the wireless communication terminal 101, the ID information J1 is information that identifies the wireless communication terminal 101. The wireless communication terminal 101 holds the ID information J1.

In the following, information identifying authentication device M2 will also be referred to as "ID information J2." For example, if authentication device M2 is authentication device 201, ID information J2 is information identifying authentication device 201. Authentication device 201 holds ID information J2. Each of ID information J1 and ID information J2 is expressed, for example, using numbers, letters, etc.

Here, we will explain the normal authentication control process using the wireless communication terminal 101, authentication device 201, and authentication server 301. The normal authentication control process is performed, for example, when the wireless communication terminal 101 is powered on.

In summary, the normal authentication control process involves the authentication device 201 and authentication server 301 performing a process to authenticate the wireless communication terminal 101. Only when the wireless communication terminal 101 is authenticated can the wireless communication terminal 101 use the specific communication described above. Before the normal authentication control process is performed, the wireless communication terminal 101 is in an unauthenticated state.

When the wireless communication terminal 101 and authentication device 201 are powered on and the wireless communication terminal 101 and authentication device 201 start up, normal authentication control processing is performed.

Specifically, in the normal authentication control process, the authentication device 201 first transmits an authentication start signal to the wireless communication terminal 101. Upon receiving the authentication start signal, the wireless communication terminal 101 in an unauthenticated state generates plaintext based on the authentication start signal.

The plaintext generated by the wireless communication terminal 101 changes randomly each time the plaintext is generated. In other words, the content of the plaintext generated by the wireless communication terminal 101 is different each time the plaintext is generated.

Hereinafter, a signal containing encrypted plaintext will also be referred to as an "encrypted signal." Also, hereinafter, the plaintext generated by the wireless communication terminal 101 will also be referred to as "plaintext Na." Also, hereinafter, the plaintext Na generated by the wireless communication terminal 101 will also be referred to as "original data."

The wireless communication terminal 101 transmits the plaintext Na, which is the original data, to the authentication device 201. As a result, the authentication device 201 receives the plaintext Na, which is the original data, from the wireless communication terminal 101. The authentication device 201 stores the received plaintext Na, which is the original data.

The authentication device 201 also performs encryption processing on the received plain text Na, which is the original data, based on the ID information J2 and ID information J1, to generate an encrypted signal including the encrypted plain text Na. To decrypt the encrypted plain text Na, the decryption processing described below is performed. Each of the encryption processing and decryption processing uses, for example, a secret key cryptosystem or a public key cryptosystem.

Specifically, in this encryption process, for example, the authentication device 201 encrypts the plaintext Na using the ID information J2 and ID information J1 as keys. Then, the authentication device 201 generates an encrypted signal including the encrypted plaintext Na.

Note that the process of encrypting the plaintext Na in the encryption process is not limited to the process described above. In the encryption process, for example, the authentication device 201 may encrypt the plaintext Na using the ID information J2 as a key.

Next, in the normal authentication control process, normal authentication processing is performed by the wireless communication system 1000. The normal authentication processing is authentication processing Pr1. As described above, authentication processing Pr1 is processing for authenticating the wireless communication terminal M1 using wireless communication. The normal authentication processing, which is authentication processing Pr1, is processing performed in a situation where the wireless communication terminal 101 is able to communicate with the authentication server 301 via the authentication device 201.

In the normal authentication process, which is authentication process Pr1, the authentication device 201 transmits an encrypted signal to the authentication server 301 via wireless communication.

Upon receiving the encrypted signal, the authentication server 301 performs a decryption process to decrypt the encrypted plaintext Na. This decryption process uses a key for decrypting the encrypted plaintext Na.

Next, the authentication server 301 performs a re-encryption process on the decrypted plaintext Na. The re-encryption process uses a secret key cryptosystem or a public key cryptosystem. In the re-encryption process, the authentication server 301 re-encrypts the plaintext Na using a different key. This different key is different from the key used by the authentication device 201 in the encryption process.

The authentication server 301 then generates an encrypted signal including the plaintext Na encrypted by the re-encryption process. The authentication server 301 transmits the generated encrypted signal to the authentication device 201 via wireless communication. As a result, the authentication device 201 receives the encrypted signal.

The authentication device 201 performs a decryption process to decrypt the encrypted plaintext Na contained in the encrypted signal received from the authentication server 301. In this decryption process, a key for decrypting the encrypted plaintext Na is used.

As a result, the authentication device 201 obtains the plaintext Na from the encrypted signal received from the authentication server 301. Next, the authentication device 201 performs a comparison authentication process.

In the following, the plaintext Na obtained by the authentication device 201 from the encrypted signal received from the authentication server 301 is also referred to as "comparison data."

Next, in the normal authentication process, a comparison authentication process is performed. In the comparison authentication process, the authentication device 201 compares the comparison data with the original data. Specifically, the authentication device 201 determines whether the plain text Na used as the comparison data is the same as the plain text Na used as the original data.

If the plaintext Na as comparison data is the same as the plaintext Na as the original data, the authentication device 201 determines that authentication is successful. On the other hand, if the plaintext Na as comparison data is different from the plaintext Na as the original data, the authentication device 201 determines that authentication is unsuccessful. Hereinafter, a situation in which the plaintext Na as comparison data is different from the plaintext Na as the original data is also referred to as an "authentication failure situation."

An authentication failure situation occurs, for example, when the key used by the authentication device 201 in the decryption process is different from another key used by the authentication server 301 in the re-encryption process.

An authentication failure state occurs, for example, when the wireless communication state is poor. This wireless communication state is, for example, the state of wireless communication between the authentication device 201 and the authentication server 301. This wireless communication state is, for example, the state of wireless communication between the wireless communication terminal 101 and the authentication device 201.

Furthermore, an authentication failure situation occurs, for example, when wireless communication conditions are poor and part of the original plaintext Na data is not transmitted to the authentication server 301.

Next, the authentication device 201 generates authentication result information indicating whether the aforementioned specific communication can be used. If the authentication is determined to be successful, the authentication device 201 generates authentication result information that enables the wireless communication terminal 101 to use the specific communication. The authentication result information indicates "usable."

If authentication is determined to be unsuccessful, the authentication device 201 generates authentication result information that does not allow the wireless communication terminal 101 to use the specific communication. This authentication result information indicates "unusable."

Next, the authentication device 201 uses the direct communication function to transmit the generated authentication result information to the wireless communication terminal 101 in an unauthenticated state.

When wireless communication terminal 101 receives authentication result information indicating "enabled," the state of wireless communication terminal 101 is set to the authenticated state. This enables wireless communication terminal 101 to use specific communications. Specifically, wireless communication terminal 101 becomes able to perform specific communications with communication terminal A. Such specific communications include wide-area voice communications, wide-area data communications, and direct voice communications.

This completes the normal authentication process and the normal authentication control process.

(Configuration of wireless communication terminal)
Next, the configuration of wireless communication terminal M1 will be described using Fig. 3. Fig. 3 is a block diagram showing the configuration of wireless communication terminal M1. Wireless communication terminal M1 includes an antenna 602, a changeover switch 603, a modulation unit 604, a demodulation unit 605, an antenna 606, a changeover switch 607, a modulation unit 608, a demodulation unit 609, a control unit 610, a plaintext generation unit 611, a storage unit 612, and a voice processing unit 613.

The antenna 602, the selector switch 603, the modulator 604, and the demodulator 605 are used when the wireless communication terminal M1 communicates with the base station device 501. Hereinafter, the process by which the wireless communication terminal M1 transmits a signal to the base station device 501 via wireless communication is also referred to as the "transmission process Pks." The transmission process Pks is, for example, the process of transmitting a modulated signal to the base station device 501 using the antenna 602.

Furthermore, hereinafter, the processing by which wireless communication terminal M1 receives a signal transmitted by base station device 501 via wireless communication is also referred to as "reception processing Pkr." Reception processing Pkr is, for example, processing for receiving a signal transmitted by base station device 501 using antenna 602.

The antenna 606, the selector switch 607, the modulator 608, and the demodulator 609 are used when the wireless communication terminal M1 communicates with the authentication device M2. Hereinafter, the process by which the wireless communication terminal M1 transmits a signal to the authentication device M2 via wireless communication will also be referred to as the "transmission process Pds." The transmission process Pds is, for example, the process of transmitting a modulated signal to the authentication device M2 using the antenna 606.

Furthermore, hereinafter, the process by which the wireless communication terminal M1 receives a signal transmitted by the authentication device M2 via wireless communication is also referred to as the "reception process Pdr." The reception process Pdr is, for example, a process for receiving a signal transmitted by the authentication device M2 using the antenna 606.

The control unit 610 controls each unit within the wireless communication terminal M1. For example, the control unit 610 controls the selector switch 603 and the selector switch 607.

Each of the changeover switches 603 and 607 has the function of changing the signal transmission path. To perform either the transmission process Pks or the reception process Pkr, the changeover switch 603 changes the signal transmission path in accordance with the control of the control unit 610. To perform either the transmission process Pds or the reception process Pdr, the changeover switch 607 changes the signal transmission path in accordance with the control of the control unit 610.

The modulation units 604 and 608 have the function of modulating signals. In the aforementioned transmission process Pks, processing is performed to transmit the signal modulated by the modulation unit 604 to the base station device 501. In the aforementioned transmission process Pds, processing is performed to transmit the signal modulated by the modulation unit 608 to the authentication device M2.

The demodulation units 605 and 609 have the function of demodulating signals. The demodulation unit 605 demodulates the signal received by the reception processing Pkr. The demodulation unit 605 transmits the demodulated signal to the control unit 610. The demodulation unit 609 demodulates the signal received by the reception processing Pdr. The demodulation unit 609 transmits the demodulated signal to the control unit 610.

The plaintext generation unit 611 has the function of generating plaintext. The memory unit 612 has the function of storing information. The memory unit 612 stores ID information J1. The ID information J1 stored in the memory unit 612 is information that can be changed from outside the wireless communication terminal M1. The audio processing unit 613 performs predetermined processing on the audio data. For example, the audio processing unit 613 encodes the audio data and decodes the encoded audio data.

Note that the configuration of wireless communication terminal M1 is not limited to the configuration shown in Figure 3. For example, wireless communication terminal M1 may be provided with a component k that has the function of performing both transmission processing Pks and reception processing Pkr. This component k is composed of, for example, a selector switch 603, a modulation unit 604, and a demodulation unit 605.

Also, for example, the control unit 610 of the wireless communication terminal M1 may be configured to have the functions of the changeover switch 603, modulation unit 604, demodulation unit 605, changeover switch 607, modulation unit 608, and demodulation unit 609. In this configuration, the control unit 610 can perform transmission processing Pks, reception processing Pkr, transmission processing Pds, and reception processing Pdr. Also, in this configuration, there is no need to provide the changeover switch 603, modulation unit 604, demodulation unit 605, changeover switch 607, modulation unit 608, and demodulation unit 609.

(Authentication device configuration)
Next, the configuration of the authentication device M2 will be described using Fig. 4. Fig. 4 is a block diagram showing the configuration of the authentication device M2. The authentication device M2 includes an antenna 702, a changeover switch 703, a modulation unit 704, a demodulation unit 705, an antenna 706, a changeover switch 707, a modulation unit 708, a demodulation unit 709, a control unit 710, an authentication encryption unit 711, an authentication decryption unit 712, an authentication verification unit 713, and a storage unit 714.

The antenna 702, the selector switch 703, the modulator 704, and the demodulator 705 are used when the authentication device M2 communicates with the authentication server 301. Hereinafter, the process by which the authentication device M2 transmits a signal to the authentication server 301 via wireless communication will also be referred to as the "transmission process Pns." The transmission process Pns is, for example, the process of transmitting a modulated signal to the authentication server 301 using the antenna 702.

Furthermore, hereinafter, the process by which the authentication device M2 receives a signal transmitted by the authentication server 301 via wireless communication is also referred to as the "reception process Pnr." The reception process Pnr is, for example, a process for receiving a signal transmitted by the authentication server 301 using the antenna 702.

The antenna 706, the selector switch 707, the modulator 708, and the demodulator 709 are used when the authentication device M2 communicates with the wireless communication terminal M1. Hereinafter, the process by which the authentication device M2 transmits a signal to the wireless communication terminal M1 via wireless communication will also be referred to as the "transmission process Pms." The transmission process Pms is, for example, the process of transmitting a modulated signal to the wireless communication terminal M1 using the antenna 706.

Furthermore, hereinafter, the process by which the authentication device M2 receives a signal transmitted by the wireless communication terminal M1 via wireless communication is also referred to as the "reception process Pmr." The reception process Pmr is, for example, a process for receiving a signal transmitted by the wireless communication terminal M1 using the antenna 706.

The control unit 710 controls each unit within the authentication device M2. For example, the control unit 710 controls the selector switch 703 and the selector switch 707.

Each of the changeover switches 703 and 707 has the function of changing the signal transmission path. To perform either the transmission process Pns or the reception process Pnr, the changeover switch 703 changes the signal transmission path in accordance with the control of the control unit 710. To perform either the transmission process Pms or the reception process Pmr, the changeover switch 707 changes the signal transmission path in accordance with the control of the control unit 710.

The modulation units 704 and 708 have the function of modulating signals. In the aforementioned transmission process Pns, processing is performed to transmit the signal modulated by the modulation unit 704 to the authentication server 301. In the aforementioned transmission process Pms, processing is performed to transmit the signal modulated by the modulation unit 708 to the wireless communication terminal M1.

The demodulation unit 705 and demodulation unit 709 have the function of demodulating signals. The demodulation unit 705 demodulates the signal received by the reception processing Pnr. The demodulation unit 705 transmits the demodulated signal to the control unit 710. The demodulation unit 709 demodulates the signal received by the reception processing Pmr. The demodulation unit 709 transmits the demodulated signal to the control unit 710.

The authentication encryption unit 711 has the function of performing data encryption processing, as will be described in detail below.

The authentication decryption unit 712, details of which will be described later, has the function of performing the process of decrypting encrypted data.

The authentication verification unit 713, details of which will be described later, has the function of performing processing related to authentication of the wireless communication terminal M1.

The memory unit 714 has the function of storing information. The memory unit 714 pre-stores ID information J2 and an authentication key. The key is information used, for example, in the encryption and decryption processes performed in the process of authenticating the wireless communication terminal M1. The ID information J2 and key stored in the memory unit 714 are information that can be changed from outside the authentication device M2. The number of keys stored in the memory unit 714 is one or more.

Note that the configuration of the authentication device M2 is not limited to the configuration shown in FIG. 4. For example, the authentication device M2 may be provided with a component n that has the function of performing both the transmission process Pns and the reception process Pnr. This component n may be composed of, for example, a selector switch 703, a modulation unit 704, and a demodulation unit 705.

Also, for example, the control unit 710 of the authentication device M2 may be configured to have the functions of the changeover switch 703, modulation unit 704, demodulation unit 705, changeover switch 707, modulation unit 708, and demodulation unit 709. In this configuration, the control unit 710 can perform transmission processing Pns and reception processing Pnr, and transmission processing Pms and reception processing Pmr. Also, in this configuration, there is no need to provide the changeover switch 703, modulation unit 704, demodulation unit 705, changeover switch 707, modulation unit 708, and demodulation unit 709.

(Operation of wireless communication system)
Next, the operation of the wireless communication system will be described. Hereinafter, a situation in which the authentication device 201 cannot communicate wirelessly with the authentication server 301 will also be referred to as a "special situation." A special situation is a situation in which the above-mentioned normal authentication process, which is the authentication process Pr1, cannot be performed. A special situation is also a situation in which authentication of the wireless communication terminal M1 cannot be performed using the normal authentication path. A special situation occurs, for example, when a malfunction occurs in the communication configuration of the authentication server 301.

The authentication device 201 has a function to detect the occurrence of a special situation (hereinafter also referred to as a "health check function"). The health check function is a function that detects the occurrence of a special situation based on, for example, a decrease in the received electric field level. The received electric field level is the level of the radio waves received by the authentication device 201 from the authentication server 301.

The health check function may also be a function that detects the occurrence of a special situation by, for example, using a watchdog timer to monitor whether the authentication device 201 is performing wireless communication.

Hereinafter, the process that can authenticate a wireless communication terminal M1 in an unauthenticated state in special circumstances will also be referred to as "authentication control process A." Authentication control process A is performed by wireless communication system 1000. Each of the encryption process and decryption process performed in authentication control process A is a process that uses, for example, a secret key cryptosystem or a public key cryptosystem.

Next, authentication control process A will be described using Figure 5. Figure 5 is a diagram for explaining authentication control process A according to embodiment 1. To make it easier to understand an example of authentication control process A, authentication control process A will be described as being performed under the following premise Pm1.

In premise Pm1, processing is performed to authenticate a wireless communication terminal 101 that is in an unauthenticated state. Also, in premise Pm1, the wireless communication terminal 101, which is wireless communication terminal M1, communicates with an authentication device 201, which is authentication device M2. Also, in premise Pm1, it is assumed, as an example, that communication between the wireless communication terminal 101 and the authentication device 201 reliably transmits and receives data.

Furthermore, in premise Pm1, a special situation has occurred. Further, in premise Pm1, the authentication device 201 has detected the occurrence of the special situation. Further, in premise Pm1, the authentication device 201 holds ID information J2 that identifies the authentication device 201.

Furthermore, under premise Pm1, wireless communication terminal 102 and wireless communication terminal 103 exist in area Ar1 of wireless communication terminal 101, which is in an unauthenticated state. That is, under premise Pm1, wireless communication terminal 101, which is in an unauthenticated state, can communicate wirelessly with wireless communication terminal 102 and wireless communication terminal 103. Therefore, under premise Pm1, communication units M20 and M30 can communicate wirelessly with wireless communication terminal 101.

Authentication control process A is performed after communication between the unauthenticated wireless communication terminal 101 and the authentication device 201 becomes possible.

In authentication control process A under premise Pm1, the authentication device 201 first transmits an authentication start signal 801 including ID information J2 to the wireless communication terminal 101.

In response to receiving the authentication start signal 801 by the wireless communication terminal 101, the plaintext generation unit 611 generates plaintext Na. The plaintext Na is, for example, a nonce. Hereinafter, the plaintext Na generated by the plaintext generation unit 611 is also referred to as "original data."

The wireless communication terminal 101 transmits an authentication response signal 802 containing the original data, plaintext Na, to the authentication device 201.

As a result, the authentication device 201 receives the authentication response signal 802 and holds the plaintext Na, which is the original data, contained in the authentication response signal 802. The plaintext Na, which is the original data, is stored in the memory unit 714.

Next, the authentication device 201 generates an encrypted signal by encrypting the received plaintext Na based on the ID information J2 and ID information J1. The encrypted signal includes the encrypted plaintext Na.

Specifically, in this encryption process, for example, the authentication encryption unit 711 of the authentication device 201 encrypts plaintext Na using ID information J2 and ID information J1 as keys. The authentication encryption unit 711 then generates an encrypted signal including the encrypted plaintext Na.

Note that the process of encrypting the plaintext Na in the encryption process is not limited to the process described above. In the encryption process, for example, the authentication encryption unit 711 may encrypt the plaintext Na using the ID information J2 as a key.

In the following, the process of authenticating a wireless communication terminal M1 in an unauthenticated state using authentication configuration Ca is also referred to as a "collective authentication process." Collective authentication process is a process performed using multiple other wireless communication terminals M1. In this embodiment, authentication configuration Ca is a configuration that uses communication units M20 and M30. In addition, in the following, the signal transmitted by authentication device 201 when a special situation occurs is also referred to as a "collective authentication implementation signal 803." Collective authentication implementation signal 803 is a signal that causes wireless communication system 1000 to perform collective authentication process.

In premise Pm1, the authentication device 201 detects the occurrence of a special situation. When a special situation occurs, the authentication device 201 transmits an encrypted signal containing the encrypted plaintext Na to the wireless communication terminal 101 as a collective authentication implementation signal 803. When the collective authentication implementation signal 803 is transmitted to the wireless communication terminal 101, the wireless communication system 1000 performs collective authentication processing instead of normal authentication processing.

Collective authentication processing is processing that is performed when a special situation occurs. Collective authentication processing is authentication processing Pr2 for authenticating wireless communication terminal M1 in an unauthenticated state. The collective authentication processing that is authentication processing Pr2 is processing that is performed in a situation where multiple communication units are able to communicate wirelessly with wireless communication terminal 101. The collective authentication processing in premise Pm1 is processing that is performed in a situation where communication units M20 and M30 are able to communicate wirelessly with wireless communication terminal 101.

In authentication control process A under premise Pm1, if a special situation occurs, the wireless communication system 1000 performs collective authentication processing to authenticate the wireless communication terminal 101 using the authentication configuration Ca described above. Authentication configuration Ca is a configuration that uses communication units M20 and M30.

In the collective authentication process, which is authentication process Pr2, the wireless communication terminal 101, upon receiving the collective authentication implementation signal 803 containing the encrypted plaintext Na, recognizes that a special situation has occurred. As described above, a special situation is one in which the authentication device 201 cannot communicate wirelessly with the authentication server 301.

The wireless communication terminal 101 also obtains the encrypted plaintext Na from the collective authentication execution signal 803.

Under premise Pm1, data is sent and received reliably in communications between the wireless communication terminal 101 and the authentication device 201. Therefore, the encrypted plaintext Na obtained by the wireless communication terminal 101 from the collective authentication implementation signal 803 is the original data.

Next, wireless communication terminal 101 generates a collective authentication request signal 804 including encrypted plaintext Na. Under premise Pm1, the encrypted plaintext Na included in collective authentication request signal 804 is the original data. Using the direct communication function, wireless communication terminal 101 transmits collective authentication request signal 804 to wireless communication terminals 102 and 103 that are present in area Ar1 of wireless communication terminal 101.

Furthermore, in the collective authentication process, when each of the wireless communication terminals 102 and 103 receives a collective authentication request signal 804, an authentication response process is performed. The authentication response process is performed in each of the communication units M20 and M30.

The authentication response process performed by communication unit M20 is the same as the authentication response process performed by communication unit M30. Here, we will explain the authentication response process performed by communication unit M20, which includes wireless communication terminal 102.

In the authentication response process performed by communication unit M20, the wireless communication terminal 102 receives a collective authentication request signal 804 containing encrypted plaintext Na and generates a collective authentication implementation request signal 806 containing encrypted plaintext Na. The wireless communication terminal 102 transmits the collective authentication implementation request signal 806 containing encrypted plaintext Na to the authentication device 202, which is wireless communication terminal M1.

Next, upon receiving the collective authentication implementation request signal 806, the authentication device 202 obtains the encrypted plaintext Na from the collective authentication implementation request signal 806.

Next, the authentication device 202 performs a decryption process to decrypt the encrypted plaintext Na. In this decryption process, a key for decrypting the encrypted plaintext Na is used.

Next, the authentication device 202 performs a re-encryption process on the decrypted plaintext Na. The re-encryption process uses a secret key cryptosystem or a public key cryptosystem. In the re-encryption process, the authentication encryption unit 711 of the authentication device 202 re-encrypts the plaintext Na using a different key. This different key is different from the key used by the authentication encryption unit 711 of the authentication device 201 in the encryption process described above.

Then, the authentication encryption unit 711 generates a collective authentication implementation response signal 807 that includes the plaintext Na encrypted by the re-encryption process.

The authentication device 202 transmits a collective authentication implementation response signal 807 to the wireless communication terminal 102.

Upon receiving the collective authentication implementation response signal 807, the wireless communication terminal 102 acquires the encrypted plaintext Na contained in the collective authentication implementation response signal 807. Next, the wireless communication terminal 102 generates a collective authentication response signal 805 containing the encrypted plaintext Na. The wireless communication terminal 102 then transmits the collective authentication response signal 805 to the wireless communication terminal 101 using the direct communication function. This completes the authentication response process performed by the communication unit M20.

Furthermore, the authentication response process performed by communication unit M30 is performed in the same manner as the authentication response process performed by communication unit M20. As a result, the wireless communication terminal 103 of communication unit M30 uses the direct communication function to transmit a collective authentication response signal 805 to the wireless communication terminal 101.

Wireless communication terminal 101 receives two collective authentication response signals 805 from wireless communication terminal 102 and wireless communication terminal 103, respectively.

Next, the wireless communication terminal 101 transmits the two collective authentication response signals 805 as two collective authentication review request signals 808 to the authentication device 201. One of the two collective authentication review request signals 808 is the collective authentication response signal 805 transmitted by the wireless communication terminal 102. The other of the two collective authentication review request signals 808 is the collective authentication response signal 805 transmitted by the wireless communication terminal 103.

In response to receiving two group authentication review request signals 808 by the authentication device 201, the authentication decryption unit 712 performs a decryption process to decrypt the encrypted plaintext Na included in each of the two group authentication review request signals 808. In this decryption process, a key for decrypting the encrypted plaintext Na is used.

As a result, the authentication decryption unit 712 obtains two plaintexts Na as decrypted data. Hereinafter, the plaintexts Na as decrypted data obtained by the authentication decryption unit 712 will also be referred to as "comparison data."

Next, the authentication decryption unit 712 sends the two plaintexts Na as comparison data to the authentication verification unit 713.

Next, a comparison authentication process is performed in the collective authentication process. In the comparison authentication process, the authentication verification unit 713 compares the comparison data with the original data. Specifically, the authentication verification unit 713 determines whether each of the two plaintexts Na used as comparison data is the same as the plaintext Na used as the original data.

If each of the two plaintexts Na used as comparison data is the same as the plaintext Na used as original data, the authentication verification unit 713 determines that authentication has been successful. In this case, the wireless communication terminal 101 has been authenticated. The authentication verification unit 713 also generates a collective authentication verification response signal 809 indicating "usable" as authentication result information.

If one or both of the two plaintext Na used as comparison data differs from the plaintext Na used as original data, the authentication verification unit 713 determines that authentication has failed. In this case, the wireless communication terminal 101 has not been authenticated. The authentication verification unit 713 also generates a collective authentication verification response signal 809 indicating "unusable" as authentication result information.

In the following, a situation in which one or both of the two plaintexts Na used as comparison data differ from the plaintext Na used as original data is also referred to as an "authentication impossible situation." An authentication impossible situation occurs, for example, when the wireless communication state is poor. The wireless communication state in question is, for example, the state of wireless communication performed between wireless communication terminal 101 and wireless communication terminal 102.

Furthermore, an authentication failure situation occurs, for example, when wireless communication conditions are poor and part of the plaintext Na data, which is the original data transmitted by the collective authentication request signal 804, is not transmitted to the wireless communication terminal 102.

An authentication failure state occurs, for example, in a state where signal interception fails. A signal interception failure state is a state in which an unauthorized key is used in a situation where an unauthorized wireless communication terminal 102 is used to intercept a signal transmitted by the wireless communication terminal 101. The unauthorized wireless communication terminal 102 is a terminal having the same configuration as the authorized wireless communication terminal 102. The unauthorized wireless communication terminal 102 is also a terminal created by a malicious party. The unauthorized key is a key different from the authorized key used in the collective authentication process described above.

Next, the authentication device 201 uses the direct communication function to transmit a collective authentication verification response signal 809 as authentication result information to the wireless communication terminal 101.

If the collective authentication verification response signal 809 received by the wireless communication terminal 101 as authentication result information indicates "available," the control unit 610 sets the state of the wireless communication terminal 101 to an authenticated state.

This enables wireless communication terminal 101 to use the specific communication described above. Specifically, wireless communication terminal 101 can perform the specific communication described above with communication terminal A. The specific communication in question can be wide-area voice communication, wide-area data communication, direct voice communication, etc.

When an authenticated wireless communication terminal 101 performs wide-area voice communication, which is a specific communication, with, for example, communication terminal A, the headquarters device 401 performs the specific communication support process described above. By performing the specific communication support process, the headquarters device 401 can perform wide-area voice communication, which is a specific communication, with the authenticated wireless communication terminal 101.

Furthermore, for example, if a wireless communication terminal 102 serving as communication terminal A exists in area Ar1 of a wireless communication terminal 101 in an authenticated state, the wireless communication terminal 101 can directly communicate by voice with the wireless communication terminal 102.

On the other hand, if the collective authentication verification response signal 809 received by the wireless communication terminal 101 as authentication result information indicates "unusable," the state of the wireless communication terminal 101 remains in an unauthenticated state. In other words, a wireless communication terminal 101 in an unauthenticated state cannot perform specific communications such as wide-area voice communication, wide-area data communication, and direct voice communication.

This completes the comparison authentication process, the collective authentication process, and authentication control process A.

(summary)
As described above, according to the present embodiment, the wireless communication system 1000 includes the authentication server 301 that is used to perform a first authentication process using wireless communication to authenticate the wireless communication terminal 101. The wireless communication system 1000 has an authentication configuration that has a function of performing a second authentication process to authenticate the wireless communication terminal 101. When a special situation occurs in which the first authentication process using the authentication server 301 cannot be performed, the wireless communication system 1000 performs the second authentication process to authenticate the wireless communication terminal 101 using the authentication configuration.

This helps prevent situations where a wireless communication terminal cannot be authenticated.

Furthermore, according to this embodiment, if a special situation occurs in which the wireless communication terminal 101 cannot be authenticated using the normal authentication path, a collective authentication process is performed to authenticate the wireless communication terminal 101 instead of the normal authentication process. The collective authentication process is performed by the wireless communication terminal 101 using its direct communication function to communicate with wireless communication terminals 102 and 103 that are present in the area Ar1 of the wireless communication terminal 101.

This prevents situations where the wireless communication terminal 101 cannot be authenticated. Furthermore, by authenticating the wireless communication terminal 101, the wireless communication terminal 101 becomes able to perform specific communications. In other words, the wireless communication terminal 101 becomes available for use in the wireless communication system 1000. Furthermore, encrypted data is used in the collective authentication process.

This makes it possible to realize a wireless communication system that offers confidentiality and high communication continuity. It also makes it possible to achieve continuous operation of the wireless communication system.

Hereinafter, the number of other wireless communication terminals M1 used to authenticate wireless communication terminal 101 in the collective authentication process of authentication control process A is also referred to as the "number of devices for authentication." In this embodiment, the collective authentication process has been described using wireless communication terminals 102 and 103 as the other wireless communication terminals M1. That is, the collective authentication process has been described in a situation where the number of devices for authentication is two. Note that the number of devices for authentication is not limited to two and may be three or more.

The authentication number may also be stored as a parameter in the memory of the authentication device M2, and may be configured to be changeable from outside the authentication device M2.

In the aforementioned related configuration A, authentication processing is performed by communicating between a wireless terminal as a wireless communication terminal and an authentication server. In related configuration A, if the wireless terminal is no longer able to communicate with the authentication server, a situation arises in which the wireless terminal cannot be authenticated. If the wireless terminal is not authenticated, the main functions of the wireless terminal cannot be used, which is a problem.

The wireless communication system 1000 of this embodiment has a configuration that achieves the above-mentioned effects. As a result, the wireless communication system 1000 of this embodiment can solve the above-mentioned problems.

<Second Embodiment>
(composition)
Hereinafter, a situation in which no other wireless communication terminal M1 is present in the area Ar1 of the wireless communication terminal M1 will also be referred to as a "terminal absent situation." In a wireless communication system, special situations and terminal absent situations may occur. As described above, a special situation is a situation in which the authentication device 201 cannot wirelessly communicate with the authentication server 301. Even in the special situation and terminal absent situation, a configuration is required that can authenticate the wireless communication terminal M1 and that allows the wireless communication system to continue operating.

The configuration of this embodiment is capable of authenticating wireless communication terminal M1 even in special situations and when no terminal is present.

Figure 6 is a diagram showing the configuration of a wireless communication system 1000A according to embodiment 2. Wireless communication system 1000A differs from wireless communication system 1000 of Figure 1 in that it does not include communication units M20 and M30, and that the headquarters device 401 is connected to the authentication server 301 via a communication cable. The remaining configuration of wireless communication system 1000A is the same as that of wireless communication system 1000, and therefore detailed description will not be repeated.

As mentioned above, wireless communication system 1000A does not include communication units M20 and M30. In other words, wireless communication system 1000A does not include wireless communication terminals 102 and 103 or authentication devices 202 and 203. Wireless communication system 1000A is a wireless communication system in the terminal-absent state described above.

The headquarters device 401 is connected to the authentication server 301 via a communication cable C2. The communication cable C2 is, for example, an optical fiber cable, a coaxial cable, or the like. The headquarters device 401 communicates with the authentication server 301 via the communication cable C2. In other words, the headquarters device 401 communicates with the authentication server 301 via a wired connection.

The base station device 501 communicates with the headquarters device 401 via communication cable C1. Therefore, the base station device 501 can communicate with the authentication server 301 via the headquarters device 401.

With the above configuration, the wireless communication system 1000A is further provided with an authentication path using the headquarters device 401 and the authentication server 301. This authentication path is a communication path for authenticating the wireless communication terminal M1.

Hereinafter, the process for authenticating wireless communication terminal M1, which is different from the authentication process Pr1 described above, will also be referred to as "authentication process Pr2b." Authentication process Pr2b in this embodiment is a process different from authentication process Pr2 in embodiment 1.

The wireless communication system 1000A performs authentication process Pr1 or authentication process Pr2b depending on the status of the wireless communication system 1000A. Hereinafter, a configuration having the function of performing authentication process Pr2b will also be referred to as "authentication configuration Cb." The wireless communication system 1000A has authentication configuration Cb. Authentication configuration Cb is a configuration that uses the authentication server 301.

In the following, the state of wireless communication terminal M1 when it has been authenticated by authentication process Pr1 or authentication process Pr2b will also be referred to as the "authenticated state." Also, in the following, the state of wireless communication terminal M1 when it has not been authenticated by authentication process Pr1 or authentication process Pr2b will also be referred to as the "non-authenticated state."

As mentioned above, the wireless communication terminal M1 in an authenticated state in embodiment 1 is capable of wide-area voice communication, wide-area data communication, direct voice communication, and direct data communication. On the other hand, the wireless communication terminal M1 in an unauthenticated state in embodiment 1 is only capable of direct data communication. In other words, the wireless communication terminal M1 in an unauthenticated state in embodiment 1 cannot perform wide-area voice communication, wide-area data communication, or direct voice communication.

In this embodiment, the wireless communication terminal M1 in an unauthenticated state is capable of performing wide-area data communication in addition to direct data communication. Therefore, in this embodiment, wide-area voice communication and direct voice communication are specific communications. This embodiment will be described on the assumption that the wireless communication terminal M1 in an unauthenticated state is capable of wide-area data communication.

In this embodiment, as an example, we will explain the process for authenticating wireless communication terminal 101, which is wireless communication terminal M1.

Hereinafter, the terminal with which wireless communication terminal 101 communicates will also be referred to as "communication terminal A." Communication terminal A is, for example, wireless communication terminal 102 or 103 that is not included in wireless communication system 1000A. Note that communication terminal A may also be, for example, an external communication terminal that is a communication terminal that exists outside wireless communication system 1000A.

When the wireless communication terminal 101 is authenticated by the authentication process Pr1 or the authentication process Pr2b, the state of the wireless communication terminal 101 becomes the authenticated state. Therefore, when the wireless communication terminal 101 is authenticated, the wireless communication terminal 101 is a device that can perform the above-mentioned specific communication with communication terminal A.

Hereinafter, the process that can authenticate an unauthenticated wireless communication terminal M1 in a special situation where the authentication device 201 cannot communicate wirelessly with the authentication server 301 is also referred to as "authentication control process B." Authentication control process B is performed by the wireless communication system 1000A. Each of the encryption process and decryption process described below that are performed in authentication control process B is a process that uses, for example, a secret key cryptosystem or a public key cryptosystem.

(Operation of wireless communication system)
Next, the authentication control process B performed by the wireless communication system 1000A will be described with reference to Fig. 6. To make an example of the authentication control process B easier to understand, the authentication control process B will be described under the following premise Pm2.

In premise Pm2, processing is performed to authenticate a wireless communication terminal 101 that is in an unauthenticated state. In premise Pm2, the wireless communication terminal 101, which is wireless communication terminal M1, communicates with an authentication device 201, which is authentication device M2. Also, in premise Pm2, it is assumed, as an example, that communication between the wireless communication terminal 101 and the authentication device 201 reliably transmits and receives data.

Furthermore, in premise Pm2, authentication control process B is performed in wireless communication system 1000A in a terminal-absent state. The terminal-absent state in premise Pm2 is a state in which wireless communication terminals 102 and 103, which are other wireless communication terminals M1, are not present in area Ar1 of wireless communication terminal 101. Furthermore, in premise Pm2, a special state has occurred. Furthermore, in premise Pm2, authentication device 201 detects the occurrence of a special state.

Furthermore, in premise Pm2, the authentication device 201 holds ID information J2 that identifies the authentication device 201.

Furthermore, under premise Pm2, the wireless communication terminal 101 is located in area Ar5 of the base station device 501. Therefore, under premise Pm2, the base station device 501 can communicate wirelessly with the wireless communication terminal 101. In other words, under premise Pm2, the wireless communication terminal 101 can communicate with the authentication server 301 via the base station device 501 and the headquarters device 401.

Authentication control process B is performed after communication between the unauthenticated wireless communication terminal 101 and the authentication device 201 becomes possible.

In authentication control process B under premise Pm2, the authentication device 201 first transmits an authentication start signal including ID information J2 to the wireless communication terminal 101.

In response to receiving the authentication start signal from the wireless communication terminal 101, the plaintext generation unit 611 generates plaintext Na, which is the original data.

The wireless communication terminal 101 transmits an authentication response signal including the original data, plaintext Na, to the authentication device 201.

As a result, the authentication device 201 receives the authentication response signal and holds the plaintext Na, which is the original data, contained in the authentication response signal. The plaintext Na, which is the original data, is stored in the memory unit 714.

Next, encryption processing is performed. In the encryption processing, for example, the authentication encryption unit 711 of the authentication device 201 encrypts the plaintext Na using the ID information J2 and ID information J1 as keys. The authentication encryption unit 711 then generates an encrypted signal including the encrypted plaintext Na.

Note that the process of encrypting the plaintext Na in the encryption process is not limited to the process described above. In the encryption process, for example, the authentication encryption unit 711 may encrypt the plaintext Na using the ID information J2 as a key.

Hereinafter, the process for authenticating the wireless communication terminal M1 in an unauthenticated state using the authentication configuration Cb will also be referred to as the "wired authentication process." As mentioned above, the authentication configuration Cb is a configuration that uses the authentication server 301. Also, below, the signal transmitted by the authentication device 201 when a special situation occurs will also be referred to as the "wired authentication execution signal." The wired authentication execution signal is a signal that causes the wireless communication system 1000A to perform wired authentication process.

In premise Pm2, the authentication device 201 detects the occurrence of a special situation in which the authentication device 201 cannot communicate wirelessly with the authentication server 301. When a special situation occurs, the authentication device 201 transmits an encrypted signal containing the encrypted plaintext Na to the wireless communication terminal 101 as a wired authentication execution signal. When the wired authentication execution signal is transmitted to the wireless communication terminal 101, the wireless communication system 1000A performs wired authentication processing instead of normal authentication processing. That is, in authentication control processing B in premise Pm2, the wireless communication system 1000A performs wired authentication processing.

The wired use authentication process is a process that is performed when a special situation occurs. The wired use authentication process is authentication process Pr2b for authenticating a wireless communication terminal M1 that is in an unauthenticated state. The wired use authentication process, which is authentication process Pr2b, is a process that is performed when the wireless communication terminal 101 is able to communicate with the authentication server 301 via the base station device 501 and the headquarters device 401.

In authentication control process B under premise Pm2, if a special situation occurs, the wireless communication system 1000A uses the above-mentioned authentication configuration Cb to perform wired authentication processing to authenticate the wireless communication terminal 101. Authentication configuration Cb is a configuration that uses the authentication server 301.

In the wired authentication process, which is authentication process Pr2b, the wireless communication terminal 101, upon receiving the wired authentication execution signal including the encrypted plaintext Na, recognizes that a special situation has occurred. The wireless communication terminal 101 also obtains the encrypted plaintext Na from the wired authentication execution signal.

As mentioned above, under premise Pm2, data is sent and received reliably in communications between the wireless communication terminal 101 and the authentication device 201. Therefore, the encrypted plaintext Na obtained by the wireless communication terminal 101 from the wired authentication execution signal is the original data.

Next, the wireless communication terminal 101 generates a wired authentication request signal that includes the encrypted plaintext Na. The destination of this wired authentication request signal is set to the authentication server 301. The header of the wired authentication request signal contains, for example, the string "terminal authentication request." The string "terminal authentication request" is a string that requests the authentication server 301 to perform processing to authenticate the wireless communication terminal.

In premise Pm1, the encrypted plaintext Na included in the wired authentication request signal is the original data. The wireless communication terminal 101 transmits the wired authentication request signal to the authentication server 301 via the base station device 501 and the headquarters device 401. Specifically, the wireless communication terminal 101 transmits the wired authentication request signal to the base station device 501 via wireless communication. The base station device 501 transmits the wired authentication request signal to the headquarters device 401. The headquarters device 401 transmits the wired authentication request signal to the authentication server 301.

When the authentication server 301 receives a wired authentication request signal containing encrypted plaintext Na, it obtains the encrypted plaintext Na from the wired authentication request signal.

Next, the authentication server 301 performs a decryption process to decrypt the encrypted plaintext Na. In this decryption process, a key for decrypting the encrypted plaintext Na is used.

Next, the authentication server 301 performs a re-encryption process on the decrypted plaintext Na. The re-encryption process uses a secret key cryptosystem or a public key cryptosystem. In the re-encryption process, the authentication server 301 re-encrypts the plaintext Na using a different key. This different key is a key different from the key used by the authentication encryption unit 711 of the authentication device 201 in the encryption process.

The authentication server 301 then generates a wired authentication response signal containing the plaintext Na encrypted by the re-encryption process. The destination of this wired authentication response signal is set to the authentication device 201.

The authentication server 301 transmits a wired authentication response signal to the authentication device 201 via the headquarters device 401, base station device 501, and wireless communication terminal 101. Specifically, the authentication server 301 transmits the wired authentication response signal to the headquarters device 401. The headquarters device 401 transmits the wired authentication response signal to the base station device 501. The base station device 501 transmits the wired authentication response signal to the wireless communication terminal 101 via wireless communication. The wireless communication terminal 101 transmits the wired authentication response signal to the authentication device 201.

The authentication device 201 performs a decryption process to decrypt the encrypted plaintext Na contained in the received wired authentication response signal. In this decryption process, a key for decrypting the encrypted plaintext Na is used.

As a result, the authentication device 201 obtains the plaintext Na as decrypted data from the received wired authentication response signal. Next, the authentication device 201 performs a comparison authentication process.

In the following, the plaintext Na, which is decrypted data obtained by the authentication device 201 from the wired authentication response signal received from the authentication server 301, is also referred to as "comparison data."

Next, in the wired authentication process, a comparison authentication process is performed. In the comparison authentication process, the authentication verification unit 713 compares the comparison data with the original data. Specifically, the authentication verification unit 713 determines whether the plain text Na used as the comparison data is the same as the plain text Na used as the original data.

If the plain text Na used as comparison data is the same as the plain text Na used as original data, the authentication verification unit 713 determines that authentication has been successful. In this case, the wireless communication terminal 101 has been authenticated. The authentication verification unit 713 also generates an authentication verification response signal indicating "usable" as authentication result information.

If the plaintext Na used as comparison data differs from the plaintext Na used as original data, the authentication verification unit 713 determines that authentication has failed. In this case, the wireless communication terminal 101 has not been authenticated. The authentication verification unit 713 also generates an authentication verification response signal indicating "unusable" as authentication result information.

In the following, a situation in which the plaintext Na as comparison data differs from the plaintext Na as original data is also referred to as an "authentication impossible situation." An authentication impossible situation occurs, for example, when the wireless communication state is poor. The wireless communication state in question is, for example, the state of wireless communication between the wireless communication terminal 101 and the base station device 501.

Furthermore, an authentication failure situation occurs, for example, when wireless communication conditions are poor and part of the plaintext Na data, which is the original data transmitted by the aforementioned wired authentication request signal, is not transmitted to the base station device 501.

Next, the authentication device 201 uses the direct communication function to send an authentication verification response signal as authentication result information to the wireless communication terminal 101.

If the authentication verification response signal received by the wireless communication terminal 101 as authentication result information indicates "usable," the control unit 610 sets the state of the wireless communication terminal 101 to an authenticated state.

This enables wireless communication terminal 101 to use the specific communication described above. Specifically, wireless communication terminal 101 can perform the specific communication described above with communication terminal A.

On the other hand, if the authentication verification response signal received by the wireless communication terminal 101 as authentication result information indicates "unusable," the state of the wireless communication terminal 101 remains in the unauthenticated state.

This completes the comparison authentication process, the wired usage authentication process, and authentication control process B.

(summary)
As described above, according to this embodiment, the headquarters device 401 communicates with the authentication server 301 via the communication cable C2. That is, the headquarters device 401 communicates with the authentication server 301 by wire. Furthermore, in special situations and terminal-absent situations, wired authentication processing is performed to authenticate the wireless communication terminal 101. The wired authentication processing is performed using a communication path as an authentication path that uses the base station device 501, the headquarters device 401, and the authentication server 301.

Therefore, even in a terminal-absence situation where there are no other wireless communication terminals M1 (i.e., wireless communication terminals 102 and 103) in area Ar1 of wireless communication terminal 101, it is possible to authenticate wireless communication terminal 101. This makes it possible to ensure continuous operation of the wireless communication system more reliably than in embodiment 1.

(Function block diagram)
Hereinafter, the wireless communication system according to the present technology will also be referred to as a “wireless communication system Hs1.” The wireless communication system Hs1 is either the wireless communication system 1000 or the wireless communication system 1000A.

Figure 7 is a block diagram showing the characteristic functional configuration of the wireless communication system Hs1. In other words, Figure 7 is a block diagram showing the main functions related to the present technology among the functions possessed by the wireless communication system Hs1.

The wireless communication system Hs1 functionally comprises a wireless communication terminal BL1 and an authentication server BL2. The wireless communication terminal BL1 has the function of performing wireless communication. The wireless communication terminal BL1 corresponds to the wireless communication terminal 101.

Authentication server BL2 is used to perform a first authentication process to authenticate wireless communication terminal BL1 using wireless communication. Authentication server BL2 corresponds to authentication server 301.

When wireless communication terminal BL1 is authenticated, it is possible for wireless communication terminal BL1 to perform specific communications with the communication terminals that are its communication targets.

The wireless communication system Hs1 has an authentication configuration that has the function of performing a second authentication process to authenticate the wireless communication terminal BL1.

If a special situation occurs in which the first authentication process using the authentication server BL2 cannot be performed, the wireless communication system Hs1 uses the authentication configuration to perform the second authentication process to authenticate the wireless communication terminal BL1.

(Example of hardware configuration of wireless communication system)
Hereinafter, the main functions related to the present technology that the wireless communication system Hs1 has will also be referred to as “main functions.” The wireless communication system Hs1 has the main functions.

Figures 8 and 9 each show an example of the hardware configuration of wireless communication system Hs1. The main functions of wireless communication system Hs1 are realized, for example, by a single processing circuit 70 shown in Figure 8.

When a special situation occurs in which the first authentication process using the authentication server cannot be performed, the processing circuit 70 uses the authentication configuration to perform the second authentication process to authenticate the wireless communication terminal.

The processing circuit 70 may be dedicated hardware. Alternatively, the processing circuit 70 may be configured using a processor that executes programs stored in memory. Examples of such processors include a CPU (Central Processing Unit), central processing unit, arithmetic unit, microprocessor, microcomputer, and DSP (Digital Signal Processor).

In the following, the situation in which the processing circuit 70 is dedicated hardware will also be referred to as "Situation St1." Also, in the following, the situation in which the processing circuit 70 is configured using a processor will also be referred to as "Situation St2."

In situation St1, the processing circuit 70 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof.

Figure 9 is a diagram showing an example of the hardware configuration of a wireless communication system Hs1 in a situation St2 in which the processing circuit 70 is configured using a processor. The configuration in Figure 9 is a configuration in which the processing circuit 70 in Figure 8 is realized using a processor 71 and memory 72.

In situation St2, the main functions of wireless communication system Hs1 are realized by software A. Software A is software or firmware. Software A may also be a combination of software and firmware. Software A is written as a program and stored in memory 72.

Furthermore, in situation St2, the processor 71 reads and executes a program stored in memory 72, thereby realizing the main functions of the wireless communication system Hs1. That is, the memory 72 stores the following programs:

This program causes the processor 71 to execute a process for performing a second authentication process to authenticate a wireless communication terminal using an authentication configuration when a special situation occurs in which the first authentication process cannot be performed using an authentication server.

The program also causes a computer to execute the processes performed by the main functions of the wireless communication system Hs1, as well as methods for executing those processes.

Here, memory 72 is, for example, non-volatile or volatile semiconductor memory such as RAM (Random Access Memory), ROM (Read Only Memory), flash memory, EPROM, EEPROM, etc. Memory 72 may also be, for example, a magnetic disk, flexible disk, optical disk, compact disk, minidisk, DVD, etc. Memory 72 may also be any storage medium that will be used in the future.

As described above, the wireless communication system Hs1 can realize each of the above-mentioned functions using hardware or software A.

The present technology may also be realized as a terminal authentication method in which the steps are the operations of characteristic components of the wireless communication system Hs1. The present technology may also be realized as a program that causes a computer to execute each step included in such a terminal authentication method.

The present technology may also be realized as a computer-readable recording medium that stores such a program. The program may also be distributed via a transmission medium such as the Internet. The terminal authentication method according to the present technology corresponds, for example, to authentication control process A in embodiment 1 or authentication control process B in embodiment 2.

(Other Modifications)
It should be noted that the embodiments can be freely combined, and each embodiment can be modified or omitted as appropriate.

For example, wireless communication system 1000 or wireless communication system 1000A does not need to include all of the components shown in the figure. In other words, wireless communication system 1000 or wireless communication system 1000A only needs to include the minimum number of components necessary to achieve the effects of the present technology.

Furthermore, for example, the key used in the encryption process and re-encryption process performed in each of the normal authentication process, authentication control process A, and authentication control process B may be the same key.

Furthermore, for example, the encryption process, decryption process, and re-encryption process performed in each of the normal authentication process, authentication control process A, and authentication control process B are not limited to processes using, for example, a secret key cryptosystem or a public key cryptosystem. For example, each of the encryption process, decryption process, and re-encryption process may be a process that does not use a key.

Furthermore, for example, the base station device 501 is not limited to a wireless transceiver capable of performing long-distance wireless communication. The base station device 501 may also be, for example, a wireless LAN router.

70 Processing circuit, 71 Processor, 72 Memory, 101, 102, 103, BL1, M1 Wireless communication terminal, 201, 202, 203, M2 Authentication device, 301, BL2 Authentication server, 401 Headquarters device, 501 Base station device, 1000, 1000A, Hs1 Wireless communication system, M10, M20, M30 Communication unit.

Claims (5)

1. A wireless communication system, comprising:
a wireless communication terminal having a function of performing wireless communication;
an authentication server used to perform a first authentication process for authenticating the wireless communication terminal using wireless communication;
the wireless communication terminal is a device that, when authenticated, is capable of performing specific communication with a communication terminal that is a communication target of the wireless communication terminal;
the wireless communication system has an authentication configuration having a function of performing a second authentication process for authenticating the wireless communication terminal;
when a special situation occurs in which the first authentication process using the authentication server cannot be performed, the wireless communication system performs the second authentication process to authenticate the wireless communication terminal using the authentication configuration;
The wireless communication system includes:
further comprising a plurality of communication units each having a function of wirelessly communicating with the wireless communication terminal;
the authentication configuration is a configuration using the plurality of communication units,
the second authentication process is performed in a situation where the plurality of communication units are able to wirelessly communicate with the wireless communication terminal,
the second authentication process includes a plurality of determination processes based on a plurality of response signals from the plurality of communication units;
Wireless communication system. The wireless communication system includes:
further comprising an authentication device having a function of wirelessly communicating with the authentication server;
the wireless communication terminal has a function of communicating with the authentication device,
the first authentication process is a process that is performed in a situation where the wireless communication terminal is able to communicate with the authentication server via the authentication device,
The special situation is a situation in which the authentication device cannot wirelessly communicate with the authentication server.
10. The wireless communication system of claim 1. 1. A wireless communication system, comprising:
a wireless communication terminal having a function of performing wireless communication;
an authentication server used to perform a first authentication process for authenticating the wireless communication terminal using wireless communication;
the wireless communication terminal is a device that, when authenticated, is capable of performing specific communication with a communication terminal that is a communication target of the wireless communication terminal;
the wireless communication system has an authentication configuration having a function of performing a second authentication process for authenticating the wireless communication terminal;
when a special situation occurs in which the first authentication process using the authentication server cannot be performed, the wireless communication system performs the second authentication process to authenticate the wireless communication terminal using the authentication configuration;
The wireless communication system includes:
a base station device that performs wireless communication with the wireless communication terminal;
a headquarters device that communicates with the base station device via a first communication cable;
the headquarters device communicates with the authentication server via a second communication cable;
the authentication configuration is a configuration using the authentication server,
the second authentication process is performed in a situation where the wireless communication terminal is able to communicate with the authentication server via the base station device and the headquarters device ;
Wireless communication system. The wireless communication system includes:
further comprising an authentication device having a function of wirelessly communicating with the authentication server;
the wireless communication terminal has a function of communicating with the authentication device,
the first authentication process is a process that is performed in a situation where the wireless communication terminal is able to communicate with the authentication server via the authentication device,
The special situation is a situation in which the authentication device cannot wirelessly communicate with the authentication server.
4. The wireless communication system according to claim 3 . A terminal authentication method performed by a wireless communication system,
The wireless communication system includes:
a wireless communication terminal having a function of performing wireless communication;
an authentication server used to perform a first authentication process for authenticating the wireless communication terminal using wireless communication;
the wireless communication terminal is a device that, when authenticated, is capable of performing specific communication with a communication terminal that is a communication target of the wireless communication terminal;
the wireless communication system has an authentication configuration having a function of performing a second authentication process for authenticating the wireless communication terminal;
In the terminal authentication method,
when a special situation occurs in which the first authentication process using the authentication server cannot be performed, the wireless communication system performs the second authentication process to authenticate the wireless communication terminal using the authentication configuration;
The wireless communication system includes:
a base station device that performs wireless communication with the wireless communication terminal;
a headquarters device that communicates with the base station device via a first communication cable;
the headquarters device communicates with the authentication server via a second communication cable;
the authentication configuration is a configuration using the authentication server,
the second authentication process is performed in a situation where the wireless communication terminal is able to communicate with the authentication server via the base station device and the headquarters device ;
Device authentication method.