Communication device, communication method, and program

Abstract

In a case where a connection of a second link 105 is established between the communication device 102 and the other communication device 103 via a second frequency channel in a state where a connection of a first link 104 has been established between the communication device 102 and the other communication device 103 via a first frequency channel, a second key for encrypting broadcast or multicast communication using the second frequency channel is shared with the other communication device 103 via the first frequency channel by a key sharing process performed with the other communication device 103 via the first frequency channel, and the first key generated in the first frequency channel and the second key are set as an encryption key in the second frequency channel.

Description

TECHNICAL FIELD

[0001] The present application relates to a communication apparatus and a wireless communication method for wireless communication. BACKGROUND

[0002] The IEEE 802.11 series is referred to as a wide area network (WLAN) communication standard developed by the Institute of Electrical and Electronics Engineers (IEEE). WLAN is an abbreviation for Wireless Local Area Network. The IEEE 802.11 series standards include IEEE 802.11a / b / g / n / ac / ax standards.

[0003] Patent Document 1 discloses that wireless communication is performed using Orthogonal Frequency Division Multiple Access (OFDMA) in the case of communication conforming to the IEEE 802.11ax standard. The IEEE 802.11ax standard achieves a high peak throughput by performing wireless communication using OFDMA.

[0004] IEEE is studying the development of the IEEE 802.11be standard as a new standard of the IEEE 802.11 series to further improve throughput and frequency use efficiency. In the IEEE 802.11be standard, a technique in which an access point (AP) establishes a connection with a station (STA) via a plurality of different frequency channels is studied to achieve higher-speed wireless communication.

[0005] List of Citations

[0006] Patent Literature

[0007] Patent Document 1: Japanese Patent Laid-Open No. 2018-50133 SUMMARY

[0008] Technical Problem

[0009] In conventional communication via one frequency channel, communication is encrypted using a pairwise transient key (PTK) that serves as an encryption key for encrypted unicast transmission and a group transient key (GTK) that serves as an encryption key for encrypted broadcast transmission or multicast communication. PTK is an abbreviation for Pairwise Transient Key, and GTK is an abbreviation for Group Transient Key.

[0010] When communication is performed via a plurality of frequency channels, for example, a PTK and a GTK are generated and shared via a first frequency channel, and then a connection is established between communication apparatuses via a second frequency channel. However, there is no provision for a method of exchanging encryption keys at the time of establishing a connection. Therefore, a problem can occur in which encryption key exchange cannot be performed with a communication apparatus that has already established a connection by the second frequency channel.

[0011] The present application aims to provide a cryptographic key exchange method when the number of frequency channels of an established connection changes when communication is performed via a plurality of frequency channels.

[0012] Solution to the problem

[0013] To achieve the above object, a communication apparatus capable of performing multi-link communication conforming to the IEEE 802.11 standard series includes: an establishing unit configured to establish a link with another communication apparatus via a frequency channel; and a first sharing unit configured to, in a case where the establishing unit has established a second link between the communication apparatus and the other communication apparatus via a second frequency channel in addition to a first link between the communication apparatus and the other communication apparatus via a first frequency channel in a state where the first link has been established by the establishing unit, share, by a first key sharing process performed with the other communication apparatus, a first key for encrypting unicast communication using the second frequency channel and a second key for encrypting broadcast or multicast communication.

[0014] Further, a communication apparatus capable of performing multi-link communication conforming to the IEEE 802.11 standard series includes: an establishing unit configured to establish a link with another communication apparatus via a frequency channel; a first sharing unit configured to, in a case where the establishing unit has established a second link between the communication apparatus and the other communication apparatus via a second frequency channel in addition to a first link between the communication apparatus and the other communication apparatus via a first frequency channel in a state where the first link has been established by the establishing unit, share, by a first key sharing process performed with the other communication apparatus via the first frequency channel, a first key for encrypting unicast communication using the second frequency channel; a second sharing unit configured to share, by a second key sharing process performed with the other communication apparatus via the first frequency channel, a second key for encrypting broadcast or multicast communication using the second frequency channel, which is generated by the communication apparatus; and a setting unit configured to set the first key and the second key as cryptographic keys to be used in communication via the second frequency channel.

[0015] Further, a communication apparatus capable of performing multi-link communication conforming to the IEEE 802.11 standard series includes: an establishment unit configured to establish a link with another communication apparatus via a frequency channel; a first sharing unit configured to, in a case where the establishment unit has established a first link between the communication apparatus and the other communication apparatus via a first frequency channel and the establishment unit has established a second link between the communication apparatus and the other communication apparatus via a second frequency channel in addition to the first link, share, by a first key sharing process performed with the other communication apparatus via the second frequency channel, a first key for encrypting unicast communication using the second frequency channel; and a second sharing unit configured to share, by a second key sharing process performed with the other communication apparatus via the second frequency channel, a second key for encrypting broadcast or multicast communication using the second frequency channel, which is generated by the communication apparatus.

[0016] Further, a communication apparatus capable of performing multi-link communication conforming to the IEEE 802.11 standard series includes: an establishment unit configured to establish a link with another communication apparatus via a frequency channel; a first sharing unit configured to, in a case where the establishment unit has established a first link between the communication apparatus and the other communication apparatus via a first frequency channel and the establishment unit has established a second link between the communication apparatus and the other communication apparatus via a second frequency channel in addition to the first link, share, by a first key sharing process performed with the other communication apparatus via the second frequency channel, a first key for encrypting unicast communication using the second frequency channel; and a second sharing unit configured to share, by a second key sharing process performed with the other communication apparatus via the second frequency channel, a second key for encrypting broadcast or multicast communication using the second frequency channel, which is generated by the communication apparatus.

[0017] Advantageous Effects of Invention

[0018] According to the present application, even in a case where the number of frequency channels of a connection established in communication via a plurality of frequency channels changes, it is possible to exchange an encryption key. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 is a diagram showing a configuration of a network to which the communication apparatus 102 belongs.

[0020] Figure 2 is a diagram showing a hardware configuration of the communication apparatus 102 and the communication apparatus 103.

[0021] Figure 3 is a diagram showing a functional configuration of the communication apparatuses 102 and 103.

[0022] Figure 4 is a sequence diagram showing a method in which the communication apparatus 102 exchanges encryption keys when the number of frequency channels of an established connection changes.

[0023] Figure 5 is a flowchart showing the processing performed by the communication apparatus 102 according to the present exemplary embodiment.

[0024] Figure 6 is a sequence diagram showing a method in which the communication apparatus 102 exchanges encryption keys when the number of frequency channels of an established connection changes.

[0025] Figure 7 is a flowchart showing the processing performed by the communication apparatus 102 according to the present exemplary embodiment.

[0026] Figure 8 is a sequence diagram showing a method in which the communication apparatus 102 exchanges encryption keys when the number of frequency channels of an established connection changes.

[0027] Figure 9 is a flowchart showing the processing performed by the communication apparatus 102 according to the present exemplary embodiment. DETAILED DESCRIPTION

[0028] Exemplary embodiments of the present application will be described in detail below with reference to the accompanying drawings. The configuration according to the following exemplary embodiments will be regarded as exemplary configurations, and the present application is not limited to the illustrated configurations.

[0029] Figure 1 A configuration of a network established by the communication apparatus 102 according to the present exemplary embodiment is shown. The communication apparatus 102 is an access point (AP) having a role of establishing a network 101. The network 101 is a wireless network. According to the present exemplary embodiment, when the communication apparatus 102 establishes a plurality of networks, all the networks have the same basic service set identifier (BSSID). The BSSID is an abbreviation of Basic Service Set Identifier as a network identifier. The communication apparatus 102 shares the same service set identifier (SSID) to all the networks. The SSID is an abbreviation of Service Set Identifier serving as an AP identifier. Even in a case where the communication apparatus 102 establishes a plurality of connections, the present exemplary embodiment uses one SSID.

[0030] The communication devices 103 are stations (STAs) that have a role of participating in the network 101. Each of the communication devices that supports the Institute of Electrical and Electronics Engineers (IEEE) 802.11be standard can perform wireless communication conforming to the IEEE 802.11be standard through the network 101. IEEE is an abbreviation for the Institute of Electrical and Electronics Engineers. Each of the communication devices can perform communication in 2.4 GHz, 5 GHz, and 6 GHz bands. The frequency bands used by each of the communication devices are not limited to the above-described frequency bands. For example, the communication devices are also capable of using different frequency bands, such as a 60 GHz band. Each of the communication devices can perform communication by using 20 MHz, 40 MHz, 80 MHz, 160 MHz, and 320 MHz frequency bands.

[0031] The communication devices 102 and 103 perform Orthogonal Frequency Division Multiple Access (OFDMA) communication conforming to the IEEE 802.11be standard to realize Multi-User (MU) communication that multiplexes signals of a plurality of users. OFDMA is an abbreviation for Orthogonal Frequency Division Multiple Access. In OFDMA communication, a divided frequency band called a Resource Unit (RU) is allocated to different STAs in a manner not to overlap with each other, and carriers allocated to the respective STAs are orthogonal to each other. Thus, the AP can communicate with a plurality of STAs in parallel.

[0032] The communication apparatuses 102 and 103 establish links via a plurality of frequency channels and perform multi-link communication. A frequency channel is a frequency channel defined in the IEEE 802.11 series standards, and refers to a frequency channel capable of performing wireless communication conforming to the IEEE 802.11 series standards. In the IEEE 802.11 series standards, a plurality of frequency channels are defined in each of the 2.4 GHz, 5 GHz, and 6 GHz bands. In the IEEE 802.11 series standards, the bandwidth of each frequency channel is defined as 20 MHz. A bandwidth of 40 MHz or more created by channel bonding of adjacent frequency channels can be used in the frequency channels. Channel bonding enables the communication apparatuses 102 and 103 to communicate with each other by using 40 MHz, 80 MHz, 160 MHz, and 320 MHz bandwidths. For example, the communication apparatuses 102 and 103 can establish a first link 104 via a first frequency channel of the 2.4 GHz band and a second link 105 via a second frequency channel of the 5 GHz band to communicate with each other via the two links. In this case, the communication apparatus 102 maintains the second link 105 via the second frequency channel in parallel with the first link 104 via the first frequency channel. The communication apparatus 102 establishes links with the communication apparatus 103 via a plurality of frequency channels in this way, so that the throughput of communication with the communication apparatus 102 can be improved. The communication apparatuses 102 and 103 can establish a plurality of links in different frequency bands in multi-link communication. For example, the communication apparatuses 102 and 103 can establish a first link 104 in the 2.4 GHz band, a second link 105 in the 5 GHz band, and a third link in the 6 GHz band. Alternatively, the communication apparatuses 102 and 103 can establish links via a plurality of different channels included in the same frequency band. For example, the communication apparatuses 102 and 103 can establish a first link 104 via channel 1 in the 2.4 GHz band and a second link 105 via channel 5 in the 2.4 GHz band. Different links can also be established in the same frequency band and different frequency bands. For example, in addition to the first link 104 via channel 1 in the 2.4 GHz band and the second link 105 via channel 5 in the 2.4 GHz band, the communication apparatuses 102 and 103 can establish a third link via channel 36 in the 5 GHz band. Establishing a plurality of connections with the communication apparatus 103 in different frequency bands in this way allows the communication apparatus 102 to communicate with the communication apparatus 103 in other bands when a certain band is congested, which prevents a decrease in throughput of communication with the communication apparatus 102.

[0033] In the multi-link communication, the plurality of links established between the communication apparatuses 102 and 103 need to be different at least in frequency channels. In the multi-link communication, the interval between the frequency channels of the plurality of links established by the communication apparatuses 102 and 103 need to be greater than at least 20 MHz. Although the communication apparatuses 102 and 103 establish the first link 104 and the second link 105 in the present exemplary embodiment, the two communication apparatuses can establish three or more links.

[0034] In the multi-link communication, the communication apparatuses 102 and 103 can divide one piece of data into a plurality of pieces and transmit the data via the plurality of links to the partner apparatus. Alternatively, the communication apparatuses 102 and 103 can transmit the same data via each of the plurality of links to use the communication via one link as a backup communication of the communication via the other link. More specifically, the communication apparatus 102 transmits the same data to the communication apparatus 103 by using the first link via the first frequency channel and the second link via the second frequency channel. In this case, for example, even in the case where an error occurs in the communication via the first link, the communication apparatus 103 can receive the data transmitted from the communication apparatus 102 since the communication apparatus 102 transmits the same data to the communication apparatus 103 via the second link. Alternatively, the communication apparatuses 102 and 103 can use different links depending on the type of frame and the type of data to be communicated. For example, the communication apparatuses 102 and 103 can transmit a management frame via the first link and a data frame containing data via the second link. More specifically, the management frame refers to a beacon frame, a probe request frame, a probe response frame, an association request frame, and an association response frame. In addition to these frames, a disassociation frame, an authentication frame, a deauthentication frame, and an action frame are also referred to as management frames. The beacon frame is a frame for announcing network information. The probe request frame is a frame for requesting network information. The probe response frame is a frame for providing network information as a response to the probe request frame. The association request frame is a frame for requesting connection. The association response frame is a frame for indicating connection permission or an error as a response to the association request frame. The disassociation frame is a frame for disconnecting connection. The authentication frame is a frame for authenticating a partner apparatus. The deauthentication frame is a frame for canceling the authentication of a partner apparatus and disconnecting connection. The action frame is a frame for performing an additional function other than the above-described frames. The communication apparatuses 102 and 103 transmit and receive the management frames conforming to the IEEE 802.11 series standards. Alternatively, for example, when the communication apparatus 102 transmits data related to a captured image, the communication apparatus 102 can transmit meta information such as a date, a camera parameter (an aperture value and a shutter speed), and position information through the first link and transmit pixel information via the second link.

[0035] The communication apparatuses 102 and 103 can be capable of performing multiple-input multiple-output (MIMO) communication. In this case, the communication apparatuses 102 and 103 have a plurality of antennas, and one communication apparatus transmits different signals from the antennas by using the same frequency channel. The receiving side receives all the signals from a plurality of streams at the same time by using a plurality of antennas, separates the signals in each stream, and decodes the signals. Thus, the communication apparatuses 102 and 103 can communicate more data in the same time period by performing MIMO communication than in the case where MIMO communication is not performed. When performing multi-link communication, the communication apparatuses 102 and 103 can perform MIMO communication via some links.

[0036] The communication apparatuses 102 and 103 manage operation parameters for wireless communication, such as the number of spatial streams and the communication bandwidth when performing MIMO communication via each link. Although these operation parameters are determined at the time of establishing a connection, the operation parameters can be changed after the connection. For example, there can be a case where the operation parameter of the communication bandwidth is limited due to congestion of an adjacent channel. In the case where the operation parameter is to be changed, the partner apparatus must be immediately notified of the change.

[0037] Although the communication apparatuses 102 and 103 conform to the IEEE 802.11be standard, the apparatuses can conform to at least any one of legacy standards older than the IEEE 802.11be standard in addition to the IEEE 802.11be standard. The legacy standards include the IEEE 802.11a / b / g / n / ac / ax standards. According to the present exemplary embodiment, at least any one of the IEEE 802.11a / b / g / n / ac / ax / be standards and subsequent standards is referred to as an IEEE 802.11 series standard.

[0038] Although specific examples of the communication apparatus 102 include a wireless local area network (LAN) router and a personal computer (PC), the present application is not limited thereto. The communication apparatus 102 can be any communication apparatus capable of performing multi-link communication with other communication apparatuses. The communication apparatus 102 can also be an information processing apparatus capable of performing wireless communication conforming to the IEEE 802.11be standard, such as a wireless chip. Although specific examples of the communication apparatus 103 include a camera, a tablet, a smartphone, a PC, a portable telephone, and a video camera, the present application is not limited thereto. The communication apparatus 103 can be any communication apparatus capable of performing multi-link communication with other communication apparatuses. The communication apparatus 103 can also be an information processing apparatus capable of performing wireless communication conforming to the IEEE 802.11be standard, such as a wireless chip. Figure 1 The network in FIG. 1 includes one AP and one STA, but the number of APs and the number of STAs are not limited thereto.

[0039] For example, in a case where one AP maintains three different wireless communication links, the partner STA can be one to three STAs. Likewise, in a case where one STA maintains three different wireless communication links, the partner AP can be one to three APs. Examples of applicable configurations include a configuration in which a STA and an AP communicate with each other on a one-to-one basis and a configuration in which two STAs communicate with one AP on a multi-link basis. The information processing apparatus (for example, a wireless chip) has an antenna for transmitting a generated signal.

[0040] Figure 2 A hardware configuration of the communication apparatuses 102 and 103 according to the present exemplary embodiment is shown. The communication apparatus 102 includes a storage unit 201, a control unit 202, a function unit 203, an input unit 204, an output unit 205, a communication unit 206, and an antenna 207.

[0041] The storage unit 201 includes at least one memory (for example, a read only memory (ROM) and a random access memory (RAM)), and stores computer programs for implementing various operations (described below) and various information such as communication parameters for wireless communication. ROM is an abbreviation of Read Only Memory, and RAM is an abbreviation of Random Access Memory. Storage media that can be used as the storage unit 201 include not only ROM and RAM, but also storage media such as a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a compact disc read only memory (CD-ROM), a compact disc recordable (CD-R), a magnetic tape, a non-volatile memory card, and a digital versatile disk (DVD). The storage unit 201 can also include a plurality of memories.

[0042] The control unit 202 includes, for example, at least one processor such as a central processing unit (CPU) and a micro processing unit (MPU), and executes computer programs stored in the storage unit 201 to control the entire communication apparatus 102. The control unit 202 can control the entire communication apparatus 102 by cooperation of computer programs stored in the storage unit 201 and an operating system (OS). The control unit 202 generates data and signals (wireless frames) to be transmitted in communication with other communication apparatuses. CPU is an abbreviation of Central Processing Unit, and MPU is an abbreviation of Micro Processing Unit. The control unit 202 can also include a plurality of processors (for example, a multi-core), and control the entire communication apparatus 102 by using the plurality of processors.

[0043] The control unit 202 also controls the functional unit 203 to perform wireless communication, image capturing, printing, projection, and other predetermined processing. The functional unit 203 is a hardware component for enabling the communication apparatus 102 to perform predetermined processing.

[0044] The input unit 204 receives various operations from a user. The output unit 205 performs various output operations to the user via a monitor screen and a speaker. The output operation of the output unit 205 includes display on the monitor screen and sound output from the speaker. The input unit 204 and the output unit 205 can be implemented as one module such as a touch panel. Each of the input unit 204 and the output unit 205 can be integrated with or separated from the communication apparatus 102.

[0045] The communication unit 206 controls wireless communication conforming to the IEEE 802.11be standard. The communication unit 206 can control wireless communication conforming not only to the IEEE 802.11be standard but also to other IEEE 802.11 series standards, and control wired communication using, for example, a wired LAN. The communication unit 206 controls the antenna 207 to transmit and receive a wireless communication signal generated by the control unit 202. In a case where the communication apparatus 102 conforms not only to the IEEE 802.11be standard but also to near field communication (NFC) or The communication unit 206 can control wireless communication conforming to these communication standards. NFC is an abbreviation for near field communication. In a case where the communication apparatus 102 can perform wireless communication conforming to a plurality of communication standards, the communication apparatus 102 can include a communication unit and an antenna conforming to each communication standard, respectively. The communication apparatus 102 communicates image data, document data, video data, and other data with the communication apparatus 103 via the communication unit 206. The antenna 207 can be configured separately from the communication unit 206 or configured integrally with the communication unit 206.

[0046] The antenna 207 supports communication in 2.4 GHz, 5 GHz, and 6 GHz bands. Although the communication apparatus 102 is equipped with one antenna in the present exemplary embodiment, the communication apparatus 102 can have different antennas for respective frequency bands. In a case where the communication apparatus 102 has a plurality of antennas, the communication apparatus 102 can include a communication unit 206 for supporting each antenna.

[0047] Figure 3 A functional configuration of the communication apparatuses 102 and 103 according to the present exemplary embodiment is shown. Each of the communication apparatuses 102 and 103 includes an operation parameter changing unit 301, an operation parameter acquiring unit 302, a link selection unit 303, an encryption key management unit 304, a medium access control (MAC) frame generating unit 305, and a data transmitting / receiving unit 306.

[0048] The operation parameter change unit 301 is a block for managing a change of an operation parameter of each link configuring a multi-link of the communication apparatuses 102 and 103. After a link is established, the operation parameter can be dynamically changed. For example, there can be a case where the operation parameter is changed (limited) to change a communication bandwidth due to congestion of an adjacent channel. There are two different cases of changing the operation parameter. In one case, the own apparatus determines to change the operation parameter. In the other case, the own apparatus changes the operation parameter based on a notification from the partner apparatus. In a case where the notification is received from the partner apparatus, the own apparatus changes the operation parameter by using the operation parameter acquired by the operation parameter acquisition unit 302.

[0049] The operation parameter acquisition unit 302 is a block for acquiring an operation parameter included in a MAC frame received from a partner apparatus. The operation parameter can be included in a header of the MAC frame.

[0050] The link selection unit 303 is a block for determining which of a plurality of links is to be used to notify a partner apparatus of a change of an operation parameter.

[0051] The encryption key management unit 304 is a block for managing an encryption key of each link. The encryption key management unit 304 performs an encryption key exchange process for each link. For example, the encryption key management unit 304 performs a four-way handshake and a group key handshake process conforming to the IEEE 802.11 standard, and manages various types of encryption keys such as a pairwise master key (PMK), a pairwise transient key (PTK), a group master key (GMK), and a group transient key (GTK). PMK is an abbreviation of Pairwise Master Key, PTK is an abbreviation of Pairwise Transient Key; GMK is an abbreviation of Group Master Key; and GTK is an abbreviation of Group Transient Key.

[0052] The MAC frame generation unit 305 is a block for generating a MAC frame including an operation parameter generated by the operation parameter change unit 301. Examples of the MAC frame generated by the MAC frame generation unit 305 include various management frames such as a beacon frame and a probe response frame as well as a data frame. The operation parameter (described below) included in the MAC frame generated by the MAC frame generation unit 305 is as shown in Figure 5

[0053] The data transmission / reception unit 306 transmits a wireless frame including the MAC frame generated by the MAC frame generation unit 305, and receives a wireless frame from a partner apparatus.

[0054]

First Exemplary Embodiment

[0055] Figure 4 is a sequence diagram showing an exchange process of an encryption key used in an encryption of a newly established connection of a frequency channel when the communication apparatuses 102 and 103 perform communication via a plurality of frequency channels.

[0056] The present exemplary embodiment will be described below focusing on an example using two different links. In link 1 (primary link), the communication apparatuses 102 and 103 perform a communication process via a first frequency channel (e.g., channel 1 in the 2.4 GHz band). In link 2 (secondary link), the communication apparatuses 102 and 103 perform a communication process via a second frequency channel (e.g., channel 36 in the 5 GHz band). Referring to Figure 4 , although a third frequency channel is not shown, the communication apparatuses 102 and 103 can increase the number of links and perform communication by, for example, using the 6 GHz band as link 3 (third link).

[0057] In the present exemplary embodiment, when the number of frequency channels of which a connection has been established changes, the four-way handshake and group key handshake are performed again via the first frequency channel of which a connection has been established. In the following example, the PTK and GTK generated in the first frequency channel are shared between the communication apparatuses by using out-of-band communication for the second frequency channel.

[0058] When the power of the communication apparatuses 102 and 103 is turned on, the process in the sequence starts. Alternatively, at least either of the communication apparatuses 102 and 103 can start the sequence when an instruction for starting multi-link communication is issued from a user or an application. Alternatively, at least either of the communication apparatuses 102 and 103 can start the sequence when the amount of data to be communicated with a partner apparatus becomes a predetermined threshold or more.

[0059] First, the communication apparatuses 102 and 103 establish link 1 via the first frequency channel in the process of step F401. More specifically, the communication apparatus 103 transmits an authentication request frame to perform authentication, and then the communication apparatus 102 transmits an authentication response frame as a response to the request. Then, the communication apparatus 103 transmits an association request frame to establish a connection, and then the communication apparatus 102 transmits an association response frame as a response to the request.

[0060] Then, to share the PTK as a unicast key via the first frequency channel in the process of step F402, the communication apparatuses 102 and 103 perform a four-way handshake process which is a key sharing process defined by the IEEE 802.11 standard.

[0061] First, a PMK for encryption in communication between the communication apparatuses 102 and 103 is generated, and then the PMK is notified from the authentication server to the communication apparatus 102. The PMK is used to generate a PTK in the four-way handshake. Then, the communication apparatus 102 exchanges random numbers called Anonce and Snonce in the four-way handshake messages 1 and 2 with the communication apparatus 103, and generates a PTK based on the PMK and these random numbers. The PTK includes three different keys: a key encryption key (KEK), a key confirmation key (KCK), and a temporal key (TK). The TK is used for encryption in unicast communication, and the KCK is used for encryption of broadcast or multicast communication.

[0062] When communication is performed based on the Wi-Fi Protected Access (WPA) authentication method or the Wi-Fi Protected Access Pre-Shared Key (WPA-PSK) authentication method, the communication apparatus 102 transmits the PTK in the four-way handshake message 3 in step F402 to share the PTK with the communication apparatus 103. However, when communication is performed using the WPA2 authentication method, the communication apparatus 102 can transmit a GTK generated by the communication apparatus 102 in addition to the PTK.

[0063] Then, in order to share the GTK via the first frequency channel in the process of step F403, the communication apparatuses 102 and 103 perform a group key handshake process as a key sharing process defined in the IEEE 802.11 standard. When operation is performed based on the WPA2 authentication method, the GTK sharing process can also be performed in the four-way handshake. Therefore, in this case, step F403 is not performed.

[0064] The communication apparatuses 102 and 103 then establish the link 2 via the second frequency channel in the process of step F404. The specific process in step F404 is similar to the process in step F401.

[0065] In the process of step F405, in order to generate a PTK to be used in communication via the second frequency channel, the communication apparatuses 102 and 103 perform a four-way handshake as a key sharing process defined in the IEEE 802.11 standard via the first frequency channel. The specific process in step F405 is similar to the process in step F402.

[0066] Then, in order to share the GTK as a group key via the first frequency channel in the process of step F406, the communication apparatuses 102 and 103 perform a group key handshake as a key sharing process defined in the IEEE 802.11 standard. The specific process in step F406 is similar to the process in step F403.

[0067] Then, in step F407, each communication apparatus shares the PTK and the GTK by using out-of-band communication different from the wireless LAN link. The out-of-band communication refers to communication other than wireless communication. For example, the PTK and the GTK generated by the communication apparatuses 102 and 103 in the first frequency channel can be notified to the second frequency channel by using, for example, a wired line in each communication apparatus. The encryption keys are managed by the encryption key management unit 304. In a case where the communication apparatus 102 forms a wired connection with a plurality of communication apparatuses to form a multi-link device (MLD), the communication apparatuses share the PTK by using a wired line between the communication apparatuses. According to the present exemplary embodiment, the PTK and the GTK are shared between the communication apparatuses by using wired communication instead of wireless communication. This method enables the encryption keys to be shared with ensured security as compared with a case where the PTK and the GTK are shared by using wireless communication.

[0068] Figure 5 A procedure showing an encryption key exchange process performed when the number of frequency channels with which a connection has been established changes in multi-link communication is shown. This process is implemented when the control unit 202 executes a program stored in the storage unit 201 of the communication apparatus 102.

[0069] The process of this flowchart starts when the power of the communication apparatus is turned on. Alternatively, the communication apparatus can start the process when an instruction for starting multi-link communication is issued from a user or an application. Alternatively, the communication apparatus can start the process when the amount of data to be communicated with a partner apparatus becomes a predetermined threshold or more. In step S501, the communication apparatus starts the multi-link setup process at the timing described above.

[0070] In step S502, the connection process and the key exchange process in steps F401 to F403 are performed via the first link (primary link).

[0071] Then, in step S503, a determination of whether or not a second link (secondary link) exists is performed. In step S503, the determination of whether or not the secondary link exists is performed based on the determination in step F404 of whether or not the communication apparatus 102 has received the association request frame. In a case where the association request frame is received in a state where a connection has been established with the communication apparatus 102 by the first link (YES in step S503), then in step S504, the communication apparatus 102 performs connection processing via the second link (secondary link). After the secondary link is established in step S504, then in step S505, the communication apparatus 102 performs a key exchange process of the PTK and GTK to be used in the secondary link via the primary link. In step S506, the communication apparatus 102 shares the PTK and GTK generated in the primary link in step S505 via the secondary link by using out-of-band communication. The key sharing method using out-of-band communication is as described above. After the PTK and GTK are shared via the secondary link in step S506, then in step S507, a determination of whether or not a third link (tertiary link) exists is performed. In a case where the communication apparatus 102 does not receive the association request frame (NO in step S503), the processing also proceeds to step S507. The processing in steps S508 to S510 is similar to that in steps S504 to S506, respectively, as connection processing via the secondary link according to the present exemplary embodiment.

[0072] After the GTK exchange processing is completed via the tertiary link, then in step S511, the multi-link setting processing ends.

[0073] According to the present exemplary embodiment, in a case where the communication apparatus 102 performs communication via a plurality of frequency channels, even when the number of frequency channels of the established connection changes, the communication apparatus 102 can exchange encryption keys. Further, by sharing the encryption keys by using out-of-band communication, compared to a case where the encryption keys are shared by wireless communication, it is possible to exchange the encryption keys with ensured security.

[0074]

Second Exemplary Embodiment

[0075] Figure 6 is a sequence diagram illustrating exchange processing of encryption keys used in encrypting a newly established connection of a frequency channel when the communication apparatuses 102 and 103 perform communication via a plurality of frequency channels.

[0076] The present exemplary embodiment will be described below with focus on an example of using two different links. In link 1 as a primary link, communication processing via (for example, channel 1 in the 2.4 GHz band) is performed, and in link 2 as a secondary link, communication processing via (for example, channel 36 in the 5 GHz band) is performed. Reference is made to Figure 6Although a third frequency channel is not shown, the number of links can be increased using, for example, a 6 GHz band as link 3 (third level link).

[0077] According to the present exemplary embodiment, the communication apparatus 102 performs the four-way handshake and group key handshake every time the number of frequency channels of the established connection changes, to share the PTK and GTK between the communication apparatuses 102 and 103.

[0078] The processing in this sequence starts when the power of the communication apparatuses 102 and 103 is turned on. Alternatively, at least either of the communication apparatuses 102 or 103 can start this sequence when an instruction for starting multi-link communication is issued by a user or an application. Alternatively, at least either of the communication apparatuses 102 and 103 can start the sequence when the amount of data to be communicated with a partner apparatus becomes a predetermined threshold or more.

[0079] First, the communication apparatuses 102 and 103 establish link 1 via the first frequency channel in the processing of step F601. More specifically, the communication apparatus 103 transmits an authentication request frame to perform authentication, and the communication apparatus 102 transmits an authentication response frame as a response to the request. Then, the communication apparatus 103 transmits an association request frame to establish a connection, and the communication apparatus 102 transmits an association response frame as a response to the request.

[0080] Then, to share the PTK via the first frequency channel in the processing of step F602, the communication apparatuses 102 and 103 perform the four-way handshake processing defined in the IEEE 802.11 standard. The specific processing in step F602 is similar to that in step F402.

[0081] Then, to share the GTK as a group key via the first frequency channel in the processing of step F603, the communication apparatuses 102 and 103 perform the group key handshake processing defined by the IEEE 802.11 standard. The specific processing in step F603 is similar to that in step F403.

[0082] The communication apparatuses 102 and 103 then establish link 2 via the second frequency channel in the processing of step F604. The specific processing in step F604 is similar to that in step F601.

[0083] Then, to share the PTK via the first frequency channel in the processing of step F605, the communication apparatuses 102 and 103 perform the four-way handshake processing defined by the IEEE 802.11 standard. The specific processing in step F606 is similar to that in step F406.

[0084] Figure 7A procedure showing an encryption key exchange process performed when the number of frequency channels in which connection has been established in multi-link communication changes is shown. This process is implemented when the control unit 202 executes a program stored in the storage unit 201 of the communication apparatus 102.

[0085] The process of this flowchart starts when the power of the communication apparatus is turned on. Alternatively, the communication apparatus can start the process when an instruction for starting multi-link communication is issued from a user or an application. Alternatively, the communication apparatus can start the process when the amount of data to be communicated with a partner apparatus becomes a predetermined threshold or more. In step S701, the communication apparatus 102 starts a multi-link setup process at the timing described above.

[0086] In step S702, the communication apparatus 102 performs the connection process and the key exchange process in steps F601 to F603 via the first link (primary link).

[0087] Then, in step S703, the communication apparatus 102 determines whether or not there is a second link (secondary link). In step S703, the communication apparatus 102 determines whether or not there is a secondary link based on the determination in step F604 as to whether or not the communication apparatus 102 has received an association request frame. In a case where an association request frame has been received in a state where connection has been established with the communication apparatus 102 by the first link (YES in step S703), then in step S704, the communication apparatus 102 performs a connection process and a key exchange process via the second link (secondary link). After the PTK and GTK are shared via the secondary link in step S704, then in step S705, the communication apparatus 102 determines whether or not there is a third link (tertiary link). In a case where the communication apparatus 102 has not received an association request frame (NO in step S703), then in step S705, the communication apparatus 102 determines whether or not there is a tertiary link. The process in step S705 and subsequent steps is similar to the secondary link connection process.

[0088] After the GTK exchange process is performed via the tertiary link in step S706, then in step S707, the multi-link setup process ends.

[0089] According to the present exemplary embodiment, in a case where the communication apparatus 102 performs communication based on the WPA authentication method via a plurality of frequency channels, the exchange of encryption keys can be performed by a key sharing process each time the number of frequency channels in which connection is established with the communication apparatus 102 changes.

[0090]

Third Exemplary Embodiment

[0091] Figure 8is a sequence diagram showing an exchange process of an encryption key used in encrypting a newly established connection of a frequency channel when the communication apparatuses 102 and 103 perform communication via a plurality of frequency channels.

[0092] The present exemplary embodiment will be described below with focus on an example using two different links. In link 1 as a primary link, a communication process via a first frequency channel (e.g., channel 1 in the 2.4 GHz band) is performed. In link 2 as a secondary link, a communication process via a second frequency channel (e.g., channel 36 in the 5 GHz band) is performed. Although Figure 8 A third frequency channel is not shown in FIG. 8, but the number of links can be increased using, for example, the 6 GHz band as link 3 (tertiary link).

[0093] According to the present exemplary embodiment, the PTK shared by the communication apparatuses 102 and 103 via the first frequency channel is shared by each communication apparatus for the second frequency channel by using out-of-band communication.

[0094] When the power of the communication apparatuses 102 and 103 is turned on, the process in the sequence starts. Alternatively, at least either of the communication apparatuses 102 or 103 can start the sequence when an instruction for starting multi-link communication is issued by a user or an application. Alternatively, at least either of the communication apparatuses 102 and 103 can start the sequence when the amount of data to be communicated with a partner apparatus becomes a predetermined threshold or more.

[0095] First, the communication apparatuses 102 and 103 establish link 1 via the first frequency channel in the process of step F801. More specifically, the communication apparatus 103 transmits an authentication request frame to perform authentication, and then the communication apparatus 102 transmits an authentication response frame as a response to the request. Then, the communication apparatus 103 transmits an association request frame to establish a connection, and then the communication apparatus 102 transmits an association response frame as a response to the request.

[0096] Then, in order to share the PTK via the first frequency channel in the process of step F802, the communication apparatuses 102 and 103 perform a four-way handshake process defined by the IEEE 802.11 standard. The specific process in step F802 is similar to that in step F402.

[0097] Then, in step F803, in order to share the GTK via the first frequency channel in the process of step F803, the communication apparatuses 102 and 103 perform a group key handshake process defined by the IEEE 802.11 standard. The specific process in step F803 is similar to that in step F403.

[0098] Then the communication devices 102 and 103 establish a link 2 via the second frequency channel in the process of step F804. The specific process in step F804 is similar to the process in step F801.

[0099] Then, in step F805, each communication device shares the PTK by using out-of-band communication in a frequency channel different from the frequency channel used when the PTK is generated. The key sharing method using out-of-band communication is as described above.

[0100] Then, in order to share the GTK via the second frequency channel in the process of step F806, the communication devices 102 and 103 perform a group key handshake process defined by the IEEE 802.11 standard. In the case where the process in step F806 is performed via the first frequency channel, the group key handshake process is performed via the first frequency channel, and the shared GTK is shared for the second frequency channel by using out-of-band communication. The key sharing method using out-of-band communication is as described above.

[0101] Figure 9 The procedure of the exchange process of the encryption key when the number of the frequency channels on which the connection is established changes in the multi-link communication is shown. This process is realized when the control unit 202 executes the program stored in the storage unit 201 of the communication device 102.

[0102] In step S902, the connection process and the key exchange process shown in steps F801 to F803 are performed via the first link (primary link).

[0103] Then, in step S903, it is determined whether or not there is a second link (secondary link). In step S903, the determination of whether or not there is a secondary link is performed based on the determination in step F804 whether or not the communication device 102 has received the association request frame. In the case where the association request frame is received in a state where the connection with the communication device 102 has been established by the first link (Yes in step S903), then in step S904, the communication device 102 performs the connection process via the second link (secondary link). When the link of the secondary link is established in step S904, then in step S905, the communication device 102 shares the PTK used in the primary link by using out-of-band communication. The key sharing method using out-of-band communication is as described above. In the case where the communication device 102 does not receive the association request frame (No in step S903), then in step S907, the communication device 102 determines whether or not there is a tertiary link.

[0104] In step S905, the communication device 102 shares the PTK by using out-of-band communication, and in step S906, the communication device 102 performs the GTK exchange process via the secondary link.

[0105] Then, in step S907, the communication apparatus 102 determines whether or not there is a third link (third level link). The processes in steps S908 to S910 are similar to those in steps S904 to S906, respectively, as a secondary link connection process.

[0106] After the GTK exchange process is completed via the third level link, then in step S911, the multi-link setup process ends.

[0107] According to the present exemplary embodiment, in a case where the communication apparatus 102 performs communication via a plurality of frequency channels, the communication apparatus 102 can exchange encryption keys even if the number of frequency channels of the connection established with the communication apparatus 102 changes. Further, by sharing encryption keys using out-of-band communication, it is possible to exchange encryption keys with ensured security, as compared with a case where encryption keys are shared via wireless communication.

[0108] Although GTK is used as an example of a group key in the present exemplary embodiment, the present application is not limited to this. As defined in the IEEE 802.11 standard, when a control frame (management frame) is also encrypted, the communication apparatuses 102 and 103 share not only GTK but also an integrity group transient key (IGTK). IGTK is an abbreviation of Integrity Group Transient Key. In the exchange of an association request frame and an association response frame, a determination is made in negotiation between the communication apparatuses 102 and 103 as to whether only GTK is to be shared or both GTK and IGTK are to be shared.

[0109] A recording medium that stores program codes of software used to realize the functions described above can be provided to a system or an apparatus, and a computer (CPU or MPU) in the system or the apparatus can read and execute the program codes stored in the recording medium. In this case, the program codes read from the storage medium realize the functions described above when the program codes are executed by the computer, and the storage medium that stores the program codes configures the above-described apparatus.

[0110] Examples of the available storage medium that provides the program codes include a floppy disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, a non-volatile memory card, a ROM, and a DVD.

[0111] The functions described above can be realized not only when a computer executes the program codes read, but also when an operating system (OS) operating on the computer performs part or all of the actual processing based on instructions of the program codes. OS is an abbreviation of Operating System.

[0112] Further, the program code read by the storage medium is written in the memory included in the function expansion board inserted into the computer or the function expansion unit connected to the computer. The CPU included in the function expansion board or the function expansion unit can realize the above-described functions by performing part or all of the actual processing based on the instructions of the program code.

[0113] The present application can also be implemented when a program for realizing at least one function of the above-described exemplary embodiments is provided to a system or an apparatus via a network or a storage medium, and at least one processor in a computer of the system or the apparatus reads and executes the program. Further, the present application can also be implemented by a circuit (for example, an application specific integrated circuit (ASIC)) for realizing at least one function.

[0114] The present application is not limited to the above-described exemplary embodiments, but can be variously changed and modified within the spirit and scope thereof. Accordingly, the following additional claims disclose the scope of the present application.

[0115] This application claims the benefit of Japanese Patent Application No. 2020-096833, filed June 3, 2020, which is hereby incorporated by reference in its entirety.

Claims

1. A communication apparatus capable of performing multi-link communication conforming to IEEE 802.11 standards, the communication apparatus comprising: an establishing unit configured to establish a multi-link with another communication apparatus, the multi-link including a first link using a first frequency channel and a second link using a second frequency channel different from the first frequency channel; and a first sharing unit configured to share, after communicating an association request frame and an association response frame in the first frequency channel, a pairwise transient key (PTK) for encrypting unicast communication data in the first frequency channel through a four-way handshake process performed with the other communication apparatus, a communication unit configured to encrypt and communicate unicast communication data in the second link using the PTK shared by the first sharing unit after the establishing unit completes establishment of the multi-link, wherein a service set identifier (SSID) identical to that set in the first link is set in the second link, wherein in the second link, the PTK is used to encrypt unicast communication in the second link without performing the four-way handshake process.

2. The communication apparatus according to claim 1, further comprising: a second sharing unit configured to share a GTK (group transient key) or IGTK (intact group transient key) for encrypting broadcast communication or multicast communication through a group key handshake process.

3. The communication apparatus according to claim 2, wherein The communication apparatus controls the second sharing unit to perform the group key handshake process in each of the first link and the second link.

4. The communication device of claim 1, wherein, The communication apparatus notifies the PTK in each communication apparatus by using a method other than wireless communication to set the PTK as the PTK to be used in the second link.

5. The communication apparatus according to claim 4, wherein, The method other than wireless communication is a notification method using a wired connection in each communication apparatus or a wired connection between the communication apparatuses forming a multi-link device (MLD).

6. The communication apparatus according to claim 1, wherein The establishing unit also establishes a third link different from the first link and the second link with the other communication apparatus.

7. The communication apparatus according to claim 1, further comprising a management unit configured to manage the PTK shared by the first sharing unit as the PTK for encrypting unicast communication data in the second link.

8. The communication apparatus according to claim 1, wherein The communication unit performs multi-link communication to transmit second data to the other communication apparatus via the second link while transmitting first data to the other communication apparatus via the first link.

9. The communication apparatus according to claim 8, wherein, The first data and the second data are identical to each other.

10. The communication apparatus according to claim 8, wherein The first data and the second data are different from each other.

11. The communication device of claim 8, wherein, The first data and the second data are obtained by dividing third data.

12. A communication method of a communication apparatus for performing communication conforming to IEEE 802.11 standards, the method comprising: establishing a multi-link with another communication apparatus, the multi-link including a first link using a first frequency channel and a second link using a second frequency channel different from the first frequency channel; and first sharing, after communicating an association request frame and an association response frame in the first frequency channel, sharing a pairwise transient key (PTK) for encrypting unicast communication data in the first frequency channel through a four-way handshake process performed with the other communication apparatus, After the establishment of the multiple links is completed, the unicast communication data is encrypted and communicated in the second link using the shared PTK, wherein the same service set identifier (SSID) as that set in the first link is set in the second link, wherein in the second link, the PTK is used for unicast communication in the second link without performing a four-way handshake process.

13. A non-transitory computer-readable storage medium storing a program for causing a computer to function as each unit of the communication apparatus according to any one of claims 1 to 11.

Images