Communication device, communication method and program

Abstract

To provide a method for exchanging an encryption key when the number of a plurality of frequency channels changes, via which a connection was established.SOLUTION: When a communication device 102 and another communication device 103, which have already established a connection via a first frequency channel over a first link 104, establish a connection via a second frequency channel over a second link 105, a first key for encrypting unicast communication using the second frequency channel is generated through key sharing processing executed with the other communication device 103 via the first frequency channel, a second key for encrypting broadcast communication or multicast communication using the second frequency channel is shared with the other communication device 103 via the first frequency channel, and the first key generated with the first frequency channel and the second key are set as an encryption key for the second frequency channel.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a communication device and a wireless communication method for performing wireless communication. [Background technology]

[0002] The IEEE802.11 series is known as a WLAN communication standard established by the IEEE (Institute of Electrical and Electronics Engineers). WLAN is an abbreviation for Wireless Local Area Network. The IEEE802.11 series standards include the IEEE802.11a / b / g / n / ac / ax standards.

[0003] The IEEE802.11ax standard described in Patent Document 1 discloses that wireless communication is performed using Orthogonal Frequency Division Multiple Access (OFDMA). The IEEE802.11ax standard achieves high peak throughput by performing wireless communication using OFDMA.

[0004] In order to further improve throughput and frequency utilization efficiency, IEEE is considering the formulation of the IEEE802.11be standard as a new standard in the IEEE802.11 series. The IEEE802.11be standard is considering technology that enables faster wireless communication by establishing a connection between one AP (Access Point) and one STA (Station) via multiple different frequency channels. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2018-50133 A Summary of the Invention [Problem to be solved by the invention]

[0006] Traditional communications over a single frequency channel are encrypted using a PTK, an encryption key that encrypts unicast transmissions, and a GTK, an encryption key that encrypts broadcast or multicast communications, where PTK stands for Pairwise Transient Key and GTK stands for Group Transient Key.

[0007] However, for example, when communication is performed via multiple frequency channels, there is no provision for a method of exchanging encryption keys when a connection between communication devices is established on a second frequency channel after a PTK and GTK are generated and shared on a first frequency channel, so there is a risk that encryption keys cannot be exchanged between communication devices that have established a connection on the second frequency channel.

[0008] Therefore, an object of the present invention is to provide a method for exchanging an encryption key when the number of frequency channels through which a connection is established changes when communication is performed via a plurality of frequency channels. [Means for solving the problem]

[0009] In order to achieve the above object, a communication device according to one aspect of the present invention comprises: A communication device, comprising: a first sharing means for sharing a first key, which is a key for encrypting unicast communication using the second frequency channel, with the first other communication device or the second other communication device through a first key sharing process executed when the communication device and the first other communication device or the second other communication device establish a connection through a second frequency channel in a state in which the communication device and the first other communication device have established a connection through a first frequency channel; a second sharing means for sharing a second key, which is generated by the communication device and is a key for encrypting broadcast communication or multicast communication using the second frequency channel, with the first other communication device or the second other communication device through the first frequency channel by a second key sharing process; a setting means for setting the first key and the second key as an encryption key to be used in communication via the second frequency channel; has. Effect of the Invention

[0010] According to the present invention, in communication via a plurality of frequency channels, it is possible to exchange encryption keys even when the number of frequency channels on which a connection is established changes. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram showing a configuration of a network to which a communication device 102 belongs. [Diagram 2] FIG. 2 is a diagram illustrating a hardware configuration of communication devices 102 and 103. [Diagram 3] FIG. 2 is a diagram illustrating the functional configuration of communication devices 102 and 103. [Figure 4] 11 is a sequence diagram showing a method in which the communication device 102 exchanges encryption keys when the number of frequency channels for establishing a connection changes. [Diagram 5] 10 is a flowchart executed by the communication device 102 in the present embodiment. [Figure 6] 11 is a sequence diagram showing a method in which the communication device 102 exchanges encryption keys when the number of frequency channels for establishing a connection changes. [Figure 7] 10 is a flowchart executed by the communication device 102 in the present embodiment. [Figure 8] 11 is a sequence diagram showing a method in which the communication device 102 exchanges encryption keys when the number of frequency channels for establishing a connection changes. [Figure 9]10 is a flowchart executed by the communication device 102 in the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings. Note that the configurations shown in the following embodiments are merely examples, and the present invention is not limited to the illustrated configurations.

[0013] FIG. 1 shows the configuration of a network constructed by a communication device 102 according to this embodiment. The communication device 102 is an access point (AP) that has a role of constructing a network 101. The network 101 is a wireless network. In this embodiment, when the communication device 102 constructs multiple networks, the BSSIDs of the networks are all the same. The BSSID is an abbreviation for Basic Service Set Identifier, and is an identifier for identifying a network. The SSIDs shown by the communication device 102 in each network are also all common. The SSID is an abbreviation for Service Set Identifier, and is an identifier for identifying an AP. In this embodiment, the communication device 102 uses one SSID even when multiple connections are established.

[0014] Moreover, the communication device 103 is a station (STA) that has a role of participating in the network 101. Each communication device is compatible with the IEEE802.11be standard and can execute wireless communication conforming to the IEEE802.11be standard via the network 101. Note that IEEE is an abbreviation for the Institute of Electrical and Electronics Engineers. Each communication device can communicate in the frequency bands of 2.4 GHz, 5 GHz, and 6 GHz. The frequency bands used by each communication device are not limited to these, and a different frequency band such as the 60 GHz band may be used. Furthermore, each communication device can communicate using bandwidths of 20 MHz, 40 MHz, 80 MHz, 160 MHz, and 320 MHz.

[0015] The communication devices 102 and 103 can realize multi-user (MU) communication in which signals of multiple users are multiplexed by performing OFDMA communication conforming to the IEEE802.11be standard. OFDMA communication is an abbreviation for Orthogonal Frequency Division Multiple Access. In OFDMA communication, a part of the divided frequency band (RU, Resource Unit) is assigned to each STA so as not to overlap, and the carriers assigned to each STA are orthogonal. Therefore, the AP can communicate with multiple STAs in parallel.

[0016] Moreover, the communication devices 102 and 103 perform multi-link communication by establishing links and communicating via multiple frequency channels. Here, the frequency channel is a frequency channel defined in the IEEE 802.11 series standard, and refers to a frequency channel capable of performing wireless communication conforming to the IEEE 802.11 series standard. In the IEEE 802.11 series standard, multiple frequency channels are defined in each of the 2.4 GHz, 5 GHz, and 6 GHz frequency bands. In addition, in the IEEE 802.11 series standard, the bandwidth of each frequency channel is defined as 20 MHz. Note that a bandwidth of 40 MHz or more may be used in one frequency channel by bonding with adjacent frequency channels. By channel bonding, the communication devices 102 and 103 can communicate using bandwidths of 40 MHz, 80 MHz, 160 MHz, and 320 MHz. For example, the communication device 102 103 can establish a first link 104 via a first frequency channel in the 2.4 GHz band and a second link 105 via a second frequency channel in the 5 GHz band, and communicate via both links. In this case, the communication device 102 maintains the second link 105 via the second frequency channel in parallel with the first link 104 via the first frequency channel. In this way, the communication device 102 can improve the throughput in the communication with the communication device 103 by establishing links with the communication device 103 via multiple frequency channels. Note that the communication devices 102 and 103 may establish multiple links of different frequency bands in the multi-link communication. For example, the communication devices 102 and 103 may establish a third link in the 6 GHz band in addition to the first link 104 in the 2.4 GHz band and the second link 105 in the 5 GHz band. Alternatively, links may be established via multiple different channels included in the same frequency band. For example, a first link 104 may be established via 1ch in the 2.4GHz band, and a second link 105 may be established via 5ch in the 2.4GHz band. Note that links in the same frequency band and links in different frequency bands may be mixed.For example, communication devices 102 and 103 may establish a first link 104 via ch 1 in the 2.4 GHz band, a second link 105 via ch 5 in the 2.4 GHz band, and a third link via ch 36 in the 5 GHz band. By establishing multiple connections with communication device 103 using different frequency bands, communication device 102 can communicate with communication device 103 using the other band even when one band is congested, thereby preventing a decrease in throughput in communication with communication device 103.

[0017] In multi-link communication, the multiple links established by the communication devices 102 and 103 need only have different frequency channels. Note that in multi-link communication, the channel spacing of the frequency channels of the multiple links established by the communication devices 102 and 103 needs only to be at least greater than 20 MHz. Note that, in this embodiment, the communication devices 102 and 103 establish the first link 104 and the second link 105, but three or more links may be established.

[0018] When performing multi-link communication, the communication devices 102 and 103 can divide one piece of data and transmit it to the other device via multiple links. Alternatively, the communication devices 102 and 103 may transmit the same data via each of the multiple links, so that the communication via one link serves as a backup communication for the communication via the other link. Specifically, the communication device 102 transmits the same data to the communication device 103 via a first link via a first frequency channel and a second link via a second frequency channel. In this case, even if an error occurs in the communication via the first link, for example, the communication device 103 can receive the data transmitted from the communication device 102 because the same data is transmitted via the second link. Alternatively, the communication devices 102 and 103 may use different links depending on the type of frame or the type of data to be communicated. For example, the communication devices 102 and 103 may transmit a management frame via the first link and a data frame including data via the second link. Specifically, management frames refer to Beacon frames, Probe Request frames / Response frames, and Association Request frames / Response frames. In addition to these frames, Disassociation frames, Authentication frames, De-Authentication frames, and Action frames are also called management frames. Beacon frames are frames that report network information. Probe Request frames are frames that request network information, and Probe Response frames are the corresponding responses, providing network information. Association Request frames are frames that request a connection, and Association Response frames are the corresponding responses, indicating permission for connection or an error. Disassociation frames are frames that cut off a connection.An authentication frame is a frame that authenticates a partner device, and a de-authentication frame is a frame that interrupts authentication of a partner device and disconnects the connection. An action frame is a frame for performing additional functions other than those described above. The communication devices 102 and 103 transmit and receive management frames that comply with the IEEE802.11 series standards. Alternatively, when the communication device 102 transmits data related to a captured image, for example, the communication device 102 may transmit meta-information such as date, parameters at the time of capturing an image (aperture value and shutter speed), and location information via a first link, and transmit pixel information via a second link.

[0019] Furthermore, the communication devices 102 and 103 may be capable of performing MIMO (Multiple-Input Multiple-Output) communication. In this case, the communication devices 102 and 103 have multiple antennas, and one of them transmits different signals from each antenna using the same frequency channel. The receiving side simultaneously receives all signals arriving from multiple streams using multiple antennas, and separates and decodes the signals of each stream. In this way, by performing MIMO communication, the communication devices 102 and 103 can communicate more data in the same time compared to when not performing MIMO communication. Furthermore, the communication devices 102 and 103 may perform MIMO communication in some links when performing multi-link communication.

[0020] The communication devices 102 and 103 manage operational parameters used for wireless communication, such as the number of spatial streams and communication bandwidth when communicating using MIMO communication in each link. These operational parameters are determined when establishing a connection, but the operational parameters can be changed after the connection is established. For example, it is assumed that the operational parameter of the communication bandwidth will be narrowed because the surrounding channels are congested. When changing the operational parameters, it is necessary to immediately notify the other device.

[0021] Although the communication devices 102 and 103 are described as being compatible with the IEEE 802.11be standard, they may also be compatible with at least one of the legacy standards that predate the IEEE 802.11be standard. The legacy standards are the IEEE 802.11a / b / g / n / ac / ax standards. In this embodiment, at least one of the IEEE 802.11a / b / g / n / ac / ax / be standards and their successor standards is referred to as the IEEE 802.11 series standard.

[0022] Specific examples of the communication device 102 include, but are not limited to, a wireless LAN router and a PC. The communication device 102 may be any communication device capable of performing multi-link communication with other communication devices. The communication device 102 may be an information processing device such as a wireless chip capable of performing wireless communication conforming to the IEEE802.11be standard. Specific examples of the communication device 103 include, but are not limited to, a camera, a tablet, a smartphone, a PC, a mobile phone, a video camera, and the like. The communication device 103 may be any communication device capable of performing multi-link communication with other communication devices. The communication device 103 may be an information processing device such as a wireless chip capable of performing wireless communication conforming to the IEEE802.11be standard. The network in FIG. 1 is a network configured by one AP and one STA, but the number of APs and STAs is not limited to this.

[0023] For example, when one AP has three different wireless communication links, the opposing STA may be composed of one to three units. Similarly, when one STA has three different wireless communication links, the opposing AP may be composed of one to three units. In addition, for example, a one-to-one configuration between an AP and a STA, or a configuration in which two STAs communicate with one AP via multi-links, etc. are possible. Note that the information processing device such as a wireless chip has an antenna for transmitting the generated signal.

[0024] 2 shows the hardware configuration of the communication devices 102 and 103 in this embodiment. The communication device 102 has a storage unit 201, a control unit 202, a function unit 203, an input unit 204, an output unit 205, a communication unit 206, and an antenna 207.

[0025] The storage unit 201 is composed of one or more memories such as a ROM and a RAM, and stores various information such as computer programs for performing various operations described below and communication parameters for wireless communication. ROM stands for Read Only Memory, and RAM stands for Random Access Memory. Note that, in addition to memories such as ROM and RAM, storage media such as flexible disks, hard disks, optical disks, magneto-optical disks, CD-ROMs, CD-Rs, magnetic tapes, non-volatile memory cards, and DVDs may be used as the storage unit 201. Furthermore, the storage unit 201 may include multiple memories.

[0026] The control unit 202 is configured with one or more processors such as a CPU or an MPU, and controls the entire communication device 102 by executing a computer program stored in the storage unit 201. The control unit 202 may control the entire communication device 102 in cooperation with the computer program stored in the storage unit 201 and an OS (Operating System). The control unit 202 also generates data and signals (radio frames) to be transmitted in communication with other communication devices. The CPU stands for Central Processing Unit, and the MPU stands for Micro Processing Unit. The control unit 202 may also include multiple processors such as multi-core processors, and the entire communication device 102 may be controlled by the multiple processors.

[0027] Furthermore, the control unit 202 controls the functional unit 203 to execute predetermined processes such as wireless communication, imaging, printing, projection, etc. The functional unit 203 is hardware that enables the communication device 102 to execute predetermined processes.

[0028] The input unit 204 receives various operations from the user. The output unit 205 performs various outputs to the user via a monitor screen or a speaker. Here, the output by the output unit 205 may be a display on a monitor screen, a voice output by a speaker, a vibration output, or the like. Note that both the input unit 204 and the output unit 205 may be realized by one module, such as a touch panel. Also, the input unit 204 and the output unit 205 may be integrated with the communication device 102, or may be separate from it.

[0029] The communication unit 206 controls wireless communication in accordance with the IEEE802.11be standard. The communication unit 206 may control wireless communication in accordance with other IEEE802.11 series standards in addition to the IEEE802.11be standard, or control wired communication such as wired LAN. The communication unit 206 controls the antenna 207 to transmit and receive signals for wireless communication generated by the control unit 202. If the communication device 102 supports the NFC standard, Bluetooth standard, or the like in addition to the IEEE802.11be standard, the communication unit 206 may control wireless communication in accordance with these communication standards. Here, NFC is an abbreviation for Near Field Communication. If the communication device 102 can perform wireless communication in accordance with multiple communication standards, the communication unit 206 may have a communication unit and an antenna that are compatible with each communication standard. The communication device 102 communicates data such as image data, document data, and video data with the communication device 103 via the communication unit 206. The antenna 207 may be configured as a separate unit from the communication unit 206, or may be configured together with the communication unit 206 as a single module.

[0030] The antenna 207 is an antenna capable of communication in the 2.4 GHz band, the 5 GHz band, and the 6 GHz band. In this embodiment, the communication device 102 has one antenna, but may have a different antenna for each frequency band. In addition, when the communication device 102 has multiple antennas, it may have a communication unit 206 corresponding to each antenna.

[0031] 3 shows the functional configuration of the communication devices 102 and 103 in this embodiment. The communication devices 102 and 103 are made up of an operation parameter changing section 301, an operation parameter acquiring section 302, a link selecting section 303, a power save managing section 304, a MAC frame generating section 305, and a data transmitting / receiving section 306.

[0032] The operational parameter change unit 301 is a block that manages changes to the operational parameters of each link constituting the multilink of the communication devices 102 and 103. The operational parameters may be dynamically changed after the link is established; for example, if the surrounding channels become congested, the operational parameters of the communication bandwidth may be changed to narrow it. The operational parameters may be changed either by the device itself or based on a notification from the other device. If there is a notification from the other device, the operational parameters acquired by the operational parameter acquisition unit 302 are used to make the change.

[0033] The operational parameter acquisition unit 302 is a block that acquires operational parameters contained in a MAC frame received from a partner device. The operational parameters can be included in the header portion of the MAC frame.

[0034] The link selection unit 303 is a block that determines which of a plurality of links is to be used when notifying a partner device of a change in an operational parameter.

[0035] The encryption key management unit 304 is a block that manages the encryption keys of each link. This encryption key management unit performs encryption key exchange processing for each link. For example, it performs 4-way handshake and group key handshake processing based on the IEEE802.11 standard, and also manages various encryption keys such as PMK, PTK, GMK, and GTK. Here, PMK is an abbreviation for Pairwise Master Key, PTK is an abbreviation for Pairwise Transient Key, GMK is an abbreviation for Group Master Key, and GTK is an abbreviation for Group Transient Key.

[0036] The MAC frame generating unit 305 is a block that generates a MAC frame including the operational parameters generated by the operational parameter changing unit 301. The MAC frames generated by the MAC frame generating unit 305 are assumed to be various management frames such as a Beacon frame and a Probe Response frame, and data frames. The operational parameters included in the MAC frames generated by the MAC frame generating unit 305 are shown in FIG. 5, which will be described later.

[0037] The data transmitter / receiver 306 transmits wireless frames including the MAC frames generated by the MAC frame generator 305, and receives wireless frames from a partner device.

[0038] [First embodiment] FIG. 4 shows a sequence diagram of exchanging encryption keys for encrypting a newly established frequency channel when communication device 102 and communication device 103 communicate via a plurality of frequency channels.

[0039] In this embodiment, an example using two links is shown. Link 1 (primary link) processes communication via a first frequency channel (e.g., ch 1 in the 2.4 GHz band), and link 2 (secondary link) processes communication via a second frequency channel (e.g., ch 36 in the 5 GHz band). Although a third frequency channel is not shown in FIG. 4, it is also possible to increase the number of links and perform communication, for example, by using the 6 GHz band as link 3 (tertiary link).

[0040] In this embodiment, when the number of frequency channels on which connections are established changes, the 4-way handshake and group key handshake are performed again on the first frequency channel on which the connection was already established. An example is shown in which the PTK and GTK generated on the first frequency channel are shared on the second frequency channel between the respective communication devices using out-of-band.

[0041] The process of this sequence is started in response to the power being turned on for each of the communication devices 102 and 103. Alternatively, at least one of the communication devices 102 and 103 may start the process in response to an instruction to start multilink communication from a user or an application. Alternatively, at least one of the communication devices 102 and 103 may start the process in response to the amount of data to be communicated with the other device reaching or exceeding a predetermined threshold.

[0042] First, the communication device 102 and the communication device 103 establish a link 1 in the first frequency channel by processing F401. More specifically, the communication device 103 transmits an Authentication Request frame for authentication, and in response to that, the communication device 102 transmits an Authentication Response frame. After that, the communication device 103 transmits an Association Request frame for connection, and in response to that, the communication device 102 transmits an Association Response frame.

[0043] Next, the communication device 102 and the communication device 103 perform 4-way handshake processing, which is a key sharing processing defined in the IEEE802.11 specifications, in order to share a PTK, which is a unicast key, in the processing of F402, on the first frequency channel.

[0044] First, a PMK used to encrypt communications between communication device 102 and communication device 103 is generated and notified to communication device 102 by the authentication server. The PMK is used to generate a PTK in a 4-way handshake. Next, communication device 102 exchanges random numbers called Anonce and Snonce with communication device 103 in 4-way handshake Messages 1 and 2, and generates a PTK based on the PMK and this random number. The PTK consists of three components: a KEK (Key Encryption Key), a KCK (Key Confirmation Key), and a TK (Temporary Key). TK is used to encrypt unicast communications, and KCK is used to encrypt broadcast or multicast communications.

[0045] When communication is performed using the WPA authentication method or the WPA-PSK authentication method, the PTK is transmitted in 4-Way Handshake Message 3 of F402 and shared with the communication device 103. However, when communication is performed using the WPA2 authentication method, the GTK generated by the communication device 102 can be transmitted in addition to this.

[0046] Next, the communication device 102 and the communication device 103 perform Group Key Handshake processing, which is a key sharing processing defined in the IEEE802.11 specifications, in order to share the GTK in the processing of F403 on the first frequency channel. Note that when operating in the WPA2 authentication method, the GTK sharing processing can also be performed by 4-way handshake, in which case F403 is not performed.

[0047] Next, the communication device 102 and the communication device 103 establish a link 2 in the second frequency channel by the process of F404. The specific process of F404 is similar to that of F401.

[0048] In the process of F405, the communication device 102 and the communication device 103 execute a 4-way handshake, which is a key sharing process defined in the IEEE802.11 specifications, in the first frequency channel in order to generate a PTK to be used in communication in the second frequency channel. The specific process of F405 is the same as that of F402.

[0049] Next, the communication device 102 and the communication device 103 perform a GroupKeyHandshake, which is a key sharing process defined in the IEEE802.11 specifications, in order to share a group key GTK in the process of F403 on the first frequency channel. The specific process of F406 is the same as that of F403.

[0050] Next, the PTK and GTK are shared in the out-band different from the wireless LAN link in each communication device (F807). Here, out-band refers to a method other than wireless communication. For example, the communication devices 102 and 103 can notify the PTK generated in the first frequency channel to the second frequency channel using wires inside the communication devices. Here, the encryption key is managed by the encryption key management unit 304. Also, when the communication device 102 is connected to multiple communication devices using wires to form one MLD (Multi Link Device), the PTK is shared using the wires between the communication devices. In this embodiment, the PTK and GTK are shared between the communication devices using wired communication instead of wireless communication, so that it is possible to share the encryption key with higher security than when the PTK and GTK are shared using wireless communication.

[0051] FIG. 5 illustrates the process flow for exchanging encryption keys when the number of frequency channels for which connections have been established in multi-link communication changes, as a result of control unit 202 executing a program stored in memory unit 201 of communication device 102.

[0052] The process of this flow chart is started in response to the power being turned on of the communication device. Alternatively, the process may be started in response to the communication device receiving an instruction to start multilink communication from a user or an application. Alternatively, the process may be started in response to the communication device receiving an instruction to start multilink communication from a user or an application. Alternatively, the process may be started in response to the amount of data that the communication device wishes to communicate with the other device reaching or exceeding a predetermined threshold. The multilink setting process is started in response to such an opportunity (S501).

[0053] In S502, the connection process and key exchange process shown in F401 to F403 are carried out in the first link (primary link).

[0054] Thereafter, in S503, the presence or absence of a second link (secondary link) is confirmed. In S503, the presence or absence of a secondary link is determined based on whether the communication device 102 has received an Association Request frame in F404. In S503, when an Association Request frame is received in a state where a connection with the communication device 102 has been established in the first link, a connection process is performed in the second link (secondary link) (S504). After the secondary link is established in S504, a key exchange process is performed in the primary link for the PTK and GTK required in the secondary link (S505). In S506, the PTK and GTK generated in the primary link are shared in the secondary link using out-of-band. The method of sharing using out-of-band is as described above. After the PTK and GTK are shared in the secondary link in S506, the presence or absence of a third link (tertiary link) is confirmed in S507. If the communication device 102 has not received an Association Request frame in S503, the process similarly proceeds to S507, but the processes in S508 to S510 are the same as the processes in S504 to S506 which are connection processes in the secondary link in this embodiment.

[0055] When the GTK exchange process is completed in the tertiary link, the multi-link setting process is completed (S511).

[0056] According to this embodiment, when the communication device 102 communicates via a plurality of frequency channels, it is possible to exchange encryption keys even if the number of frequency channels that have established a connection with the communication device 102 changes. Furthermore, by sharing encryption keys using out-of-band, it is possible to exchange encryption keys with higher security than when encryption keys are shared via wireless communication.

[0057] [Second embodiment] FIG. 6 shows a sequence diagram of exchanging encryption keys for encrypting a frequency channel in which a new connection is established when the communication device 102 and the communication device 103 communicate with each other via a plurality of frequency channels.

[0058] In this embodiment, an example is shown in which two links are used. A primary link, link 1, processes communication via (e.g., 1ch in the 2.4 GHz band), and a secondary link, link 2, processes communication via (e.g., 36ch in the 5 GHz band). Although a third frequency channel is not shown in Fig. 6, it is also possible to increase the number of links and perform communication, for example, by using the 6 GHz band as a tertiary link, link 3.

[0059] In this embodiment, an example will be shown in which a 4-way handshake and a group key handshake are always performed and a PTK and a GTK are shared between the communication device 102 and the communication device 103 whenever the number of frequency channels for which a connection has been established changes.

[0060] The process of this sequence is started in response to the power being turned on for each of the communication devices 102 and 103. Alternatively, at least one of the communication devices 102 and 103 may start the process in response to an instruction to start multilink communication from a user or an application. Alternatively, at least one of the communication devices 102 and 103 may start the process in response to the amount of data to be communicated with the other device reaching or exceeding a predetermined threshold.

[0061] First, the communication device 102 and the communication device 103 establish a link 1 in the first frequency channel by processing F601. More specifically, the communication device 103 transmits an Authentication Request frame for authentication, and in response to that, the communication device 102 transmits an Authentication Response frame. After that, the communication device 103 transmits an Association Request frame to establish a connection, and in response to that, the communication device 102 transmits an Association Response frame.

[0062] Next, the communication device 102 and the communication device 103 perform 4-way handshake processing defined in the IEEE 802.11 specifications in order to share the PTK in the processing of F602 in the first frequency channel. The specific processing of F602 is similar to that of F402.

[0063] Next, the communication device 102 and the communication device 103 perform Group Key Handshake processing defined in the IEEE 802.11 specifications in order to share the group key GTK in the processing of F603 in the first frequency channel. The specific processing of F603 is similar to that of F403.

[0064] Next, the communication device 102 and the communication device 103 establish a link 2 in the process of F604 in the second frequency channel. The specific process of F604 is similar to that of F601.

[0065] Next, the communication device 102 and the communication device 103 perform 4-way handshake processing defined in the IEEE 802.11 specifications in order to share the PTK in the processing of F802 in the first frequency channel. The specific processing of F606 is similar to that of F402.

[0066] Using Figure 7, we will explain the process flow of exchanging encryption keys when the number of frequency channels for which connections have been established in multi-link communication changes, by the control unit 202 executing a program stored in the memory unit 201 of the communication device 102.

[0067] The process of this flow chart is started in response to the power being turned on of the communication device. Alternatively, the process may be started in response to the communication device receiving an instruction to start multilink communication from a user or an application. Alternatively, the process may be started in response to the communication device receiving an instruction to start multilink communication from a user or an application. Alternatively, the process may be started in response to the amount of data that the communication device wishes to communicate with the other device reaching or exceeding a predetermined threshold. The multilink setting process is started in response to such an opportunity (S701).

[0068] In S702, the connection process and key exchange process shown in F601 to F603 are performed in the first link (primary link).

[0069] Thereafter, in S703, the presence or absence of a second link (secondary link) is confirmed. In S703, the presence or absence of a secondary link is determined based on whether the communication device 102 has received an Association Request frame in F604. In S703, if an Association Request frame is received while a connection with the communication device 102 has been established in the first link, connection processing and key exchange processing are performed in the second link (secondary link) (S704). In S704, after the PTK and GTK are shared with the secondary link, the presence or absence of a third link (tertiary link) is confirmed in S705. If the communication device 102 has not received an Association Request frame in S703, the presence or absence of a tertiary link is confirmed in S705. The processing from S705 onwards is the same as the secondary link connection processing.

[0070] When the GTK exchange process in the tertiary link in S706 is completed, the multi-link setting process is completed (S707).

[0071] According to this embodiment, when the communication device 102 communicates using the WPA authentication method via multiple frequency channels, encryption keys can be exchanged by executing a key sharing process each time the number of frequency channels for establishing a connection with the communication device 102 changes.

[0072] [Third embodiment] FIG. 8 shows a sequence diagram of exchanging encryption keys for encrypting a newly established frequency channel when the communication device 102 and the communication device 103 communicate with each other via a plurality of frequency channels.

[0073] In this embodiment, an example is shown in which two links are used. A primary link, which is link 1, processes communication via a first frequency channel (e.g., 1ch in the 2.4 GHz band), and a secondary link, which is link 2, processes communication via a second frequency channel (e.g., 36ch in the 5 GHz band). Although a third frequency channel is not shown in Fig. 8, it is also possible to increase the number of links and perform communication, for example, by using the 6 GHz band as a tertiary link, which is link 3.

[0074] In this embodiment, an example will be shown in which the communication device 102 and the communication device 103 share a PTK shared on a first frequency channel, and each of the communication devices shares the PTK on a second frequency channel using out-of-band.

[0075] The process of this sequence is started in response to the power being turned on for each of the communication devices 102 and 103. Alternatively, at least one of the communication devices 102 and 103 may start the process in response to an instruction to start multilink communication from a user or an application. Alternatively, at least one of the communication devices 102 and 103 may start the process in response to the amount of data to be communicated with the other device reaching or exceeding a predetermined threshold.

[0076] First, the communication device 102 and the communication device 103 establish a link 1 in the first frequency channel by processing F801. More specifically, the communication device 103 transmits an Authentication Request frame for authentication, and in response to that, the communication device 102 transmits an Authentication Response frame. After that, the communication device 103 transmits an Association Request frame for connection, and in response to that, the communication device 102 transmits an Association Response frame.

[0077] Next, the communication device 102 and the communication device 103 perform 4-way handshake processing defined in the IEEE802.11 specifications in order to share the PTK in the processing of F802 in the first frequency channel. The specific processing of F802 is similar to that of F402.

[0078] Next, in the process of F803, the communication device 102 and the communication device 103 perform Group Key Handshake processing defined in the IEEE 802.11 specifications in order to share the GTK in the process of F603 on the first frequency channel. The specific process of F803 is similar to that of F403.

[0079] Next, the communication device 102 and the communication device 103 establish a link 2 in the second frequency channel by the process of F804. The specific process of F804 is similar to that of F801.

[0080] Next, in each communication device, the PTK is shared out-of-band on a frequency channel different from the frequency channel on which it was generated (F805). Note that the method of sharing out-of-band is as described above.

[0081] Next, the communication device 102 and the communication device 103 perform Group Key Handshake processing defined in the IEEE802.11 specifications in order to share the GTK in the processing of F806 in the second frequency channel. When F806 is performed in the first frequency channel, the Group Key Handshake processing is performed in the first frequency channel, and the shared GTK is shared in the second frequency channel using out-of-band. The method of sharing using out-of-band is as described above.

[0082] Using Figure 9, we will explain the process flow of exchanging encryption keys when the number of frequency channels for which connections have been established in multi-link communication changes, by the control unit 202 executing a program stored in the memory unit 201 of the communication device 102.

[0083] The process of this flow chart is started in response to the power being turned on of the communication device. Alternatively, the process may be started in response to the communication device receiving an instruction to start multilink communication from a user or an application. Alternatively, the process may be started in response to the communication device receiving an instruction to start multilink communication from a user or an application. Alternatively, the process may be started in response to the amount of data that the communication device wishes to communicate with the other device reaching or exceeding a predetermined threshold. The multilink setting process is started in response to such an opportunity (S901).

[0084] In S902, the connection process and key exchange process shown in F801 to F803 are performed in the first link (primary link).

[0085] Thereafter, in S903, the presence or absence of a second link (secondary link) is confirmed. In S903, the presence or absence of a secondary link is determined based on whether the communication device 102 has received an Association Request frame in F804. In S903, when an Association Request frame is received in a state where a connection with the communication device 102 has been established in the first link, a connection process is performed in the second link (secondary link) (S904). When the secondary link is established in S904, the PTK used in the primary link is shared using out-of-band in S905. The sharing method using out-of-band is as described above. If the communication device 102 has not received an Association Request frame in S903, the presence or absence of a third link (tertiary link) is confirmed in S907.

[0086] In S905, the PTK is shared out-of-band, and in S906, the GTK is exchanged on the secondary link.

[0087] Thereafter, the presence or absence of a third link (tertiary link) is confirmed (S907). The processes of S908 to S910 are the same as the processes of S904 to S906, which are the secondary link connection processes.

[0088] When the GTK exchange process is completed in the tertiary link, the multi-link setting process is completed (S911).

[0089] According to this embodiment, when the communication device 102 communicates via a plurality of frequency channels, it is possible to exchange encryption keys even if the number of frequency channels that have established a connection with the communication device 102 changes. Furthermore, by sharing encryption keys using out-of-band, it is possible to exchange encryption keys with higher security than when encryption keys are shared via wireless communication.

[0090] In this embodiment, GTK is used as an example of the group key, but the present invention is not limited to this. As defined in the IEEE802.11 specification, when encrypting a control frame (Management Frame), the IGTK is also shared between the communication device 102 and the communication device 103 in addition to the GTK. Here, IGTK is an abbreviation for Integrity Group Transient Key. Whether only the GTK is shared or the IGTK is shared in addition to the GTK is determined by negotiation between the communication device 102 and the communication device 103 during the exchange of an Association Request frame and an Association Response frame, and the case is determined.

[0091] A recording medium on which the program code of the software for realizing the above-mentioned functions is recorded may be supplied to the system or device, and the computer (CPU, MPU) of the system or device may read and execute the program code stored in the recording medium. In this case, the program code itself read from the storage medium will realize the functions of the above-mentioned embodiments, and the storage medium on which the program code is stored will constitute the above-mentioned device.

[0092] Examples of storage media for supplying the program code include flexible disks, hard disks, optical disks, magneto-optical disks, CD-ROMs, CD-Rs, magnetic tapes, non-volatile memory cards, ROMs, and DVDs.

[0093] In addition, the above-mentioned functions may be realized not only by the computer executing the read program code, but also by the OS running on the computer performing all or part of the actual processing based on the instructions of the program code. OS is an abbreviation for Operating System.

[0094] Furthermore, the program code read from the storage medium may be written to a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer, and a CPU provided in the function expansion board or function expansion unit may perform part or all of the actual processing based on instructions in the program code to realize the above-mentioned functions.

[0095] The present invention can also be realized by a process in which a program for implementing one or more of the functions of the above-described embodiments is supplied to a system or device via a network or a storage medium, and one or more processors in a computer of the system or device read and execute the program. The present invention can also be realized by a circuit (e.g., ASIC) that implements one or more of the functions. [Explanation of symbols]

[0096] 201 Storage section 202 Control section 203 Functional Department 204 Input section 205 Output section 206 Communications Department 207 Antenna

Claims

1. A communication device capable of performing wireless communication compliant with the IEEE (Institute of Electrical and Electronics Engineers) 802.11 standard, comprising: establishing means for establishing a multi-link including a first link using a first frequency channel and a second link using a second frequency channel different from the first frequency channel with another communication device; generating means for generating a PTK (Pairwise Transient Key) for encrypting data of unicast communication by performing a 4Way Handshake with the other communication device in the first frequency channel; communication means for encrypting and communicating data of unicast communication in the second link set with the same SSID (Service Set Identifier) as the SSID set in the first link using the PTK generated by the generating means after the establishment of the multi-link by the establishing means is completed; A communication device, characterized by comprising the above.

2. The establishing means further: establishes a third link different from the first link and the second link with the other communication device The communication device according to claim 1, characterized by the above.

3. The communication device according to claim 1 or 2, further comprising management means for managing the PTK as a PTK for encrypting data of unicast communication in the second link using the PTK generated by the generating means. The communication device according to claim 1 or 2, characterized by the above.

4. The communication device according to any one of claims 1 to 3, further comprising sharing means for sharing a key for encrypting data of multicast communication by performing a GroupKey Handshake with the other communication device. The communication device according to any one of claims 1 to 3, characterized by the above.

5. The communication device according to claim 4, characterized in that the communication device controls the sharing means to perform the GroupKey Handshake in each of the first link and the second link. The communication device according to claim 4, characterized by the above.

6. The communication device according to any one of claims 1 to 5, characterized in that the communication means performs multi-link communication for transmitting second data to the other communication device via the second link while transmitting first data to the other communication device via the first link. The communication device according to any one of claims 1 to 5, characterized by the above.

7. The first data and the second data are the same data The communication device according to claim 6, characterized in that.

8. The first data and the second data are different data The communication device according to claim 6, characterized in that.

9. The first data and the second data are data obtained by dividing third data The communication device according to claim 6 or 8, characterized in that.

10. A communication method in a communication device capable of performing wireless communication conforming to the IEEE (Institute of Electrical and Electronics Engineers) 802.11 standard, comprising: An establishing step of establishing a multi-link including a first link using a first frequency channel and a second link using a second frequency channel different from the first frequency channel with another communication device; A generating step of generating a PTK (Pairwise Transient Key) for encrypting data of unicast communication by performing a 4WayHandshake executed with the other communication device in the first frequency channel; A communication step of encrypting and communicating data of unicast communication in the second link set with the same SSID (Service Set Identifier) as the SSID set in the first link using the PTK generated by the generating step after the establishment of the multi-link is completed by the establishing step; A communication method, characterized by comprising.

11. A program for causing a computer to function as each means of the communication device according to any one of claims 1 to 9.

Images