Communication devices, communication methods, and programs

Abstract

To provide a method for exchanging an encryption key when the number of a plurality of frequency channels changes, via which a connection was established.SOLUTION: When a communication device 102 and another communication device 103, which have already established a connection via a first frequency channel over a first link 104, establish a connection via a second frequency channel over a second link 105, a first key for encrypting unicast communication using the second frequency channel is generated through key sharing processing executed with the other communication device 103 via the first frequency channel, a second key for encrypting broadcast communication or multicast communication using the second frequency channel is shared with the other communication device 103 via the first frequency channel, and the first key generated with the first frequency channel and the second key are set as an encryption key for the second frequency channel.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a communication device that performs wireless communication and a wireless communication method.

Background Art

[0002] As a WLAN communication standard formulated by IEEE (Institute of Electrical and Electronics Engineers), the IEEE 802.11 series is known. Note that WLAN is an abbreviation for Wireless Local Area Network. The IEEE 802.11 series standards include IEEE 802.11a / b / g / n / ac / ax standards and the like.

[0003] It is disclosed in Patent Document 1 that in the IEEE 802.11ax standard, wireless communication by OFDMA (Orthogonal Frequency Division Multiple Access) is executed. In the IEEE 802.11ax standard, high peak throughput is achieved by executing wireless communication by OFDMA.

[0004] IEEE is considering formulating the IEEE 802.11be standard as a new standard for the IEEE 802.11 series in order to further improve throughput and frequency utilization efficiency. In the IEEE 802.11be standard, a technique in which one AP (Access Point) establishes a connection with one STA (Station) via a plurality of different frequency channels and performs faster wireless communication is being considered.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

[0006] In conventional communication over a single frequency channel, encryption is performed using a PTK, which is an encryption key for unicast transmissions, and a GTK, which is an encryption key for broadcast transmissions or multicast communications. Here, PTK stands for Pairwise Transient Key, and GTK stands for Group Transient Key.

[0007] However, for example, when communicating via multiple frequency channels, there is no provision for how to exchange encryption keys when a connection between communication devices is established on a second frequency channel after the PTK and GTK keys have been generated and shared on the first frequency channel. Therefore, there is a risk that it may not be possible to exchange encryption keys with the communication device that has established a connection on the second frequency channel.

[0008] Therefore, the present invention aims to provide a method for exchanging encryption keys when the number of frequency channels on which a connection has been established changes, in the case of communication performed over multiple frequency channels. [Means for solving the problem]

[0009] To achieve the above objective, the communication device of the present invention is The system includes: establishment means for establishing a multilink with other communication devices, which includes a first link using a first frequency channel and a second link using a second frequency channel different from the first frequency channel; generation means for generating a PTK (Pairwise Transient Key) for encrypting unicast communication data by performing a 4-Way Handshake with the other communication device on the first frequency channel; and communication means for encrypting and communicating unicast communication data in the second link, which has the same SSID (Service Set Identifier) ​​as the SSID set in the first link, using the PTK generated by the generation means after the establishment of the multilink by the establishment means is completed. [Effects of the Invention]

[0010] According to the present invention, in communication over multiple frequency channels, it is possible to exchange encryption keys even when the number of frequency channels for which a connection has been established changes. [Brief explanation of the drawing]

[0011] [Figure 1] This diagram shows the network configuration to which the communication device 102 belongs. [Figure 2] This figure shows the hardware configuration of communication devices 102 and 103. [Figure 3] This diagram shows the functional configuration of communication devices 102 and 103. [Figure 4] This sequence diagram shows how the communication device 102 exchanges encryption keys when the number of frequency channels for establishing a connection changes. [Figure 5] This is a flowchart of the actions performed by the communication device 102 in this embodiment. [Figure 6] This sequence diagram shows how the communication device 102 exchanges encryption keys when the number of frequency channels for establishing a connection changes. [Figure 7] This is a flowchart of the actions performed by the communication device 102 in this embodiment. [Figure 8] This sequence diagram shows how the communication device 102 exchanges encryption keys when the number of frequency channels for establishing a connection changes. [Figure 9] This is a flowchart of the actions performed by the communication device 102 in this embodiment. [Modes for carrying out the invention]

[0012] Embodiments of the present invention will be described in detail below with reference to the attached drawings. Note that the configurations shown in the following embodiments are merely examples, and the present invention is not limited to the illustrated configurations.

[0013] Figure 1 shows the network configuration constructed by the communication device 102 according to this embodiment. The communication device 102 is an access point (AP) that plays a role in constructing network 101. Network 101 is a wireless network. In this embodiment, when the communication device 102 constructs multiple networks, the BSSID of each network is assumed to be the same. BSSID stands for Basic Service Set Identifier, and is an identifier used to identify a network. Furthermore, the SSID displayed by the communication device 102 in each network is also assumed to be the same. SSID stands for Service Set Identifier, and is an identifier used to identify an AP. In this embodiment, even when the communication device 102 establishes multiple connections, it uses one SSID.

[0014] Furthermore, communication device 103 is a station (STA) that participates in network 101. Each communication device complies with the IEEE 802.11be standard and can perform wireless communication compliant with the IEEE 802.11be standard via network 101. IEEE stands for Institute of Electrical and Electronics Engineers. Each communication device can communicate in the 2.4GHz, 5GHz, and 6GHz frequency bands. The frequency band used by each communication device is not limited to these, and different frequency bands, such as the 60GHz band, may be used. In addition, each communication device can communicate using bandwidths of 20MHz, 40MHz, 80MHz, 160MHz, and 320MHz.

[0015] Communication devices 102 and 103 can implement multi-user (MU) communication by multiplexing signals from multiple users by performing OFDMA communication compliant with the IEEE 802.11be standard. OFDMA stands for Orthogonal Frequency Division Multiple Access. In OFDMA communication, a portion of the divided frequency band (RU, Resource Unit) is allocated to each STA so as not to overlap, and the carrier waves allocated to each STA are orthogonal. Therefore, an AP can communicate with multiple STAs in parallel.

[0016] Furthermore, communication devices 102 and 103 establish links and communicate via multiple frequency channels, performing multilink communication. Here, a frequency channel refers to a frequency channel defined in the IEEE 802.11 series standard that can perform wireless communication compliant with the IEEE 802.11 series standard. The IEEE 802.11 series standard defines multiple frequency channels in each of the 2.4GHz, 5GHz, and 6GHz frequency bands. The IEEE 802.11 series standard also defines the bandwidth of each frequency channel as 20MHz. However, by bonding with adjacent frequency channels, a bandwidth of 40MHz or more may be used in a single frequency channel. By channel bonding, communication devices 102 and 103 can communicate using bandwidths of 40MHz, 80MHz, 160MHz, and 320MHz. For example, communication device 102 can establish a first link 104 via a first frequency channel in the 2.4GHz band and a second link 105 via a second frequency channel in the 5GHz band, and communicate via both links. In this case, communication device 102 maintains the second link 105 via the second frequency channel in parallel with the first link 104 via the first frequency channel. In this way, communication device 102 can improve the throughput of communication with communication device 103 by establishing links via multiple frequency channels with communication device 103. Note that communication devices 102 and 103 may establish multiple links in different frequency bands in multilink communication. For example, communication devices 102 and 103 may establish a first link 104 in the 2.4GHz band, a second link 105 in the 5GHz band, and a third link in the 6GHz band. Alternatively, they may establish links via multiple different channels included in the same frequency band. For example, a first link 104 may be established via channel 1 in the 2.4GHz band, and a second link 105 may be established via channel 5 in the 2.4GHz band. It is also acceptable for links with the same frequency band and links with different frequency bands to be mixed together.For example, in addition to the first link 104 via channel 1 in the 2.4 GHz band and the second link 105 via channel 5 in the 2.4 GHz band, the communication devices 102 and 103 may establish a third link via channel 36 in the 5 GHz band. By establishing a plurality of connections with different frequency bands with the communication device 103, the communication device 102 can communicate with the communication device 103 in another band even when a certain band is congested, thereby preventing a decrease in throughput in the communication with the communication device 103.

[0017] In multi-link communication, it is sufficient that at least the respective frequency channels of the plurality of links established by the communication devices 102 and 103 are different. In multi-link communication, the channel interval of the frequency channels of the plurality of links established by the communication devices 102 and 103 may be at least greater than 20 MHz. In this embodiment, it is assumed that the communication devices 102 and 103 establish the first link 104 and the second link 105, but three or more links may be established.

[0018] When performing multilink communication, communication devices 102 and 103 can divide a single piece of data and transmit it to the other device via multiple links. Alternatively, communication devices 102 and 103 may transmit the same data via each of the multiple links, so that communication via one link serves as a backup for communication via the other link. Specifically, suppose communication device 102 transmits the same data to communication device 103 via a first link via a first frequency channel and a second link via a second frequency channel. In this case, even if an error occurs in communication via the first link, for example, communication device 103 can receive the data transmitted from communication device 102 because the same data is being transmitted via the second link. Alternatively, communication devices 102 and 103 may use different links depending on the type of frame or data being communicated. For example, communication devices 102 and 103 may transmit management frames via the first link and data frames containing data via the second link. Specifically, management frames refer to Beacon frames, Probe Request frames / Response frames, and Association Request frames / Response frames. In addition to these frames, Disassociation frames, Authentication frames, De-Authentication frames, and Action frames are also called management frames. Beacon frames are frames that broadcast network information. Probe Request frames are frames that request network information, and Probe Response frames are the responses that provide network information. Association Request frames are frames that request a connection, and Association Response frames are the responses that indicate whether the connection is permitted or an error occurs. Disassociation frames are frames that disconnect a connection.An Authentication frame is a frame for authenticating a peer device, and a De-Authentication frame is a frame for interrupting the authentication of a peer device and disconnecting the connection. An Action frame is a frame for performing additional functions other than the above. The communication devices 102 and 103 transmit and receive management frames compliant with the IEEE802.11 series standards. Alternatively, when the communication device 102 transmits data related to, for example, a captured image, meta-information such as a date, parameters at the time of imaging (aperture value and shutter speed), and location information may be transmitted via the first link, and pixel information may be transmitted via the second link.

[0019] Also, the communication devices 102 and 103 may be able to perform MIMO (Multiple-Input Multiple-Output) communication. In this case, the communication devices 102 and 103 have a plurality of antennas, and one transmits different signals from each antenna using the same frequency channel. The receiving side simultaneously receives all the signals arriving from multiple streams using a plurality of antennas, separates and decodes the signals of each stream. By performing MIMO communication in this way, the communication devices 102 and 103 can communicate more data in the same time compared to the case where MIMO communication is not performed. Also, when the communication devices 102 and 103 perform multi-link communication, they may perform MIMO communication in some links.

[0020] The communication devices 102 and 103 manage operation parameters used for wireless communication, such as the number of spatial streams and communication bandwidth when communicating using MIMO communication in each link. These operation parameters are determined when establishing a connection, but it is possible to change the operation parameters after the connection. For example, it is assumed that the operation parameter of the communication bandwidth is narrowed because the surrounding channels are becoming congested. When changing the operation parameters, it is necessary to immediately notify the peer device.

[0021] Although communication devices 102 and 103 are said to be compliant with the IEEE 802.11be standard, they may also be compliant with at least one of the legacy standards that precede the IEEE 802.11be standard. Legacy standards refer to the IEEE 802.11a / b / g / n / ac / ax standards. In this embodiment, at least one of the IEEE 802.11a / b / g / n / ac / ax / be standards and their successors is referred to as the IEEE 802.11 series standard.

[0022] Specific examples of communication device 102 include, but are not limited to, wireless LAN routers and PCs. Communication device 102 can be any communication device capable of performing multilink communication with other communication devices. Furthermore, communication device 102 may also be an information processing device such as a wireless chip capable of performing wireless communication compliant with the IEEE 802.11be standard. Similarly, specific examples of communication device 103 include, but are not limited to, cameras, tablets, smartphones, PCs, mobile phones, and video cameras. Communication device 103 can be any communication device capable of performing multilink communication with other communication devices. Furthermore, communication device 103 may also be an information processing device such as a wireless chip capable of performing wireless communication compliant with the IEEE 802.11be standard. Also, while the network in Figure 1 consists of one AP and one STA, the number of APs and STAs is not limited to this.

[0023] For example, if one AP holds three different wireless communication links, the opposing STA may consist of one to three units. Similarly, if one STA holds three different wireless communication links, the opposing AP may consist of one to three units. Other possible configurations include a one-to-one AP-STA relationship, or a configuration where two STAs communicate via multilink with one AP. Information processing devices such as wireless chips have antennas for transmitting the generated signals.

[0024] Figure 2 shows the hardware configuration of the communication devices 102 and 103 in this embodiment. The communication device 102 includes a storage unit 201, a control unit 202, a function unit 203, an input unit 204, an output unit 205, a communication unit 206, and an antenna 207.

[0025] The memory unit 201 is composed of one or more memories such as ROM and RAM, and stores various information such as computer programs for performing various operations described later, and communication parameters for wireless communication. ROM stands for Read Only Memory, and RAM stands for Random Access Memory. In addition to memories such as ROM and RAM, the memory unit 201 may also use storage media such as flexible disks, hard disks, optical disks, magneto-optical disks, CD-ROMs, CD-Rs, magnetic tapes, non-volatile memory cards, and DVDs. Furthermore, the memory unit 201 may have multiple memories.

[0026] The control unit 202 is composed of one or more processors, such as a CPU or MPU, and controls the entire communication device 102 by executing a computer program stored in the memory unit 201. Alternatively, the control unit 202 may control the entire communication device 102 in cooperation with the computer program stored in the memory unit 201 and the OS (Operating System). The control unit 202 also generates data and signals (wireless frames) to be transmitted in communication with other communication devices. Note that CPU stands for Central Processing Unit, and MPU stands for Micro Processing Unit. Furthermore, the control unit 202 may have multiple processors, such as a multi-core processor, and control the entire communication device 102 using multiple processors.

[0027] Furthermore, the control unit 202 controls the functional unit 203 to perform predetermined processes such as wireless communication, imaging, printing, and projection. The functional unit 203 is the hardware that enables the communication device 102 to perform predetermined processes.

[0028] The input unit 204 receives various operations from the user. The output unit 205 provides various outputs to the user via a monitor screen or speaker. Here, the output from the output unit 205 may be a display on the monitor screen, audio output via a speaker, vibration output, etc. The input unit 204 and the output unit 205 may be implemented in a single module, such as a touch panel. The input unit 204 and the output unit 205 may be integrated with the communication device 102, or they may be separate units.

[0029] The communication unit 206 controls wireless communication compliant with the IEEE 802.11be standard. In addition to the IEEE 802.11be standard, the communication unit 206 may also control wireless communication compliant with other IEEE 802.11 series standards, or wired communication such as wired LAN. The communication unit 206 controls the antenna 207 to transmit and receive signals for wireless communication generated by the control unit 202. If the communication device 102 supports the NFC standard, Bluetooth standard, etc., in addition to the IEEE 802.11be standard, it may also control wireless communication compliant with these communication standards. Here, NFC is an abbreviation for Near Field Communication. Furthermore, if the communication device 102 can perform wireless communication compliant with multiple communication standards, it may be configured to have separate communication units and antennas corresponding to each communication standard. The communication device 102 communicates data such as image data, document data, and video data with the communication device 103 via the communication unit 206. The antenna 207 may be configured separately from the communication unit 206, or it may be configured as a single module together with the communication unit 206.

[0030] Antenna 207 is an antenna capable of communication in the 2.4GHz, 5GHz, and 6GHz bands. In this embodiment, the communication device 102 is assumed to have one antenna, but it may have different antennas for each frequency band. Also, if the communication device 102 has multiple antennas, it may have a communication unit 206 corresponding to each antenna.

[0031] Figure 3 shows the functional configuration of the communication devices 102 and 103 in this embodiment. The communication devices 102 and 103 consist of an operation parameter change unit 301, an operation parameter acquisition unit 302, a link selection unit 303, a power save management unit 304, a MAC frame generation unit 305, and a data transmission / reception unit 306.

[0032] The operational parameter change unit 301 is a block that manages changes to the operational parameters of each link that constitutes the multilink of communication devices 102 and 103. Operational parameters may be dynamically changed after the link is established. For example, if surrounding channels become congested, the operational parameters for communication bandwidth may be changed to narrow it. Changes to operational parameters may be decided by the device itself or based on notifications from the other device. If there is a notification from the other device, the changes are made using the operational parameters acquired by the operational parameter acquisition unit 302.

[0033] The operational parameter acquisition unit 302 is a block that acquires operational parameters included in the MAC frame received from the remote device. Operational parameters can be included in the header portion of the MAC frame.

[0034] The link selection unit 303 is a block that determines which of the multiple links to use to notify the other device of changes in operational parameters.

[0035] The encryption key management unit 304 is a block responsible for managing the encryption keys for each link. This unit performs encryption key exchange processing for each link. For example, it performs 4-way handshake and group key handshake processing based on the IEEE 802.11 standard, and also manages various encryption keys such as PMK, PTK, GMK, and GTK. Here, PMK stands for Pairwise Master Key, PTK for Pairwise Transient Key, GMK for Group Master Key, and GTK for Group Transient Key.

[0036] The MAC frame generation unit 305 is a block that generates MAC frames containing the operational parameters generated by the operational parameter change unit 301. The MAC frames generated by the MAC frame generation unit 305 are expected to include various management frames such as Beacon frames and Probe Response frames, as well as data frames. The operational parameters included in the MAC frames generated by the MAC frame generation unit 305 are shown in Figure 5, which will be described later.

[0037] The data transmission / reception unit 306 transmits wireless frames, including MAC frames, generated by the MAC frame generation unit 305, and receives wireless frames from the receiving device.

[0038] [First Embodiment] Figure 4 shows a sequence diagram illustrating the exchange of encryption keys for encrypting newly established frequency channels when communication devices 102 and 103 communicate via multiple frequency channels.

[0039] This embodiment shows an example using two links. Link 1 (primary link) processes communication via a first frequency channel (e.g., channel 1 in the 2.4 GHz band), and Link 2 (secondary link) processes communication via a second frequency channel (e.g., channel 36 in the 5 GHz band). Although a third frequency channel is not shown in Figure 4, it is possible to further increase the number of links and communicate by using, for example, the 6 GHz band as Link 3 (tertiary link).

[0040] In this embodiment, when the number of frequency channels with established connections changes, the 4-Way Handshake and GroupKey Handshake are performed again on the first frequency channel where a connection had already been established. An example is shown in which the PTK and GTK generated on the first frequency channel are shared between the respective communication devices to the second frequency channel using outband.

[0041] The processing of this sequence begins when the power to each of the communication devices 102 and 103 is turned on. Alternatively, at least one of the communication devices 102 and 103 may begin when instructed by a user or application to start multilink communication. Alternatively, at least one of the communication devices 102 and 103 may begin when the amount of data to be communicated with the other device exceeds a predetermined threshold.

[0042] First, communication devices 102 and 103 establish link 1 in the first frequency channel using the F401 process. More specifically, communication device 103 sends an Authentication Request frame for authentication, and communication device 102 sends an Authentication Response frame in response. Subsequently, communication device 103 sends an Association Request frame for connection, and communication device 102 sends an Association Response frame in response.

[0043] Next, communication devices 102 and 103 perform a 4-way handshake process, which is a key sharing process specified in the IEEE 802.11 specification, in order to share the PTK, which is a unicast key, in the F402 processing on the first frequency channel.

[0044] First, a PMK (Primary Key Key) is generated for encryption of communication between communication device 102 and communication device 103, and this PMK is notified to communication device 102 from the authentication server. The PMK is used to generate the PTK (Primary Key Key) in the 4-Way Handshake. Next, communication device 102 exchanges random numbers called Anonce and Snonce with communication device 103 in 4-Way Handshake Messages 1 and 2, and generates the PTK based on the PMK and these random numbers. The PTK consists of three parts: KEK (Key Encryption Key), KCK (Key Confirmation Key), and TK (Temporary Key). The TK is used for encryption of unicast communication, and the KCK is used for encryption of broadcast or multicast communication.

[0045] When communicating using WPA authentication or WPA-PSK authentication, the PTK is sent in the 4-Way Handshake Message 3 of the F402 and shared with the communication device 103. However, when communicating using WPA2 authentication, it is also possible to send the GTK generated by the communication device 102.

[0046] Next, communication devices 102 and 103 perform the GroupKeyHandshake process, which is a key sharing process defined in the IEEE802.11 specification, in order to share GTK for the F403 process on the first frequency channel. Note that when operating with the WPA2 authentication method, the GTK sharing process can also be performed with 4WayHandshake, in which case F403 is not performed.

[0047] Next, communication devices 102 and 103 establish link 2 in the second frequency channel using the processing of F404. The specific processing of F404 is the same as that of F401.

[0048] In the F405 process, communication devices 102 and 103 perform a 4-way handshake, which is a key sharing process defined in the IEEE 802.11 specification, on the first frequency channel in order to generate a PTK to be used for communication on the second frequency channel. The specific processing of F405 is the same as that of F402.

[0049] Next, communication devices 102 and 103 perform a GroupKeyHandshake, a key sharing process specified in the IEEE 802.11 specification, on the first frequency channel in order to share the GTK, which is the group key, in the processing of F403. The specific processing of F406 is the same as that of F403.

[0050] Next, within each communication device, the PTK and GTK are shared in an out-of-band connection different from the wireless LAN link (F807). Here, out-of-band refers to a method other than wireless communication; for example, the PTK and GTK generated by communication devices 102 and 103 on a first frequency channel can be notified to a second frequency channel using wires within each communication device. Here, the encryption key is managed by the encryption key management unit 304. Furthermore, if communication device 102 is connected to multiple communication devices using wires to form a single MLD (Multi-Link Device), the PTK is shared using the wires between the communication devices. In this embodiment, since the PTK and GTK are shared between each communication device using wired communication rather than wireless communication, it is possible to share encryption keys with greater security compared to when the PTK and GTK are shared using wireless communication.

[0051] Figure 5 illustrates the process flow for exchanging encryption keys when the number of frequency channels for which a connection has been established in multilink communication changes, by having the control unit 202 execute a program stored in the memory unit 201 of the communication device 102.

[0052] The process shown in this flowchart begins when the communication device is powered on. Alternatively, it may begin when the communication device is instructed by a user or application to start multilink communication. Or, it may begin when the amount of data to be communicated with the other device exceeds a predetermined threshold. The multilink setup process begins based on these triggers (S501).

[0053] In S502, the connection process and key exchange process shown in F401 to F403 are performed on the first link (primary link).

[0054] Subsequently, in S503, the presence or absence of a second link (secondary link) is checked. In S503, the presence or absence of a secondary link is determined by whether or not the communication device 102 received an Association Request frame in F404. In S503, if an Association Request frame is received while a connection has been established with the communication device 102 on the first link, connection processing is performed on the second link (secondary link) (S504). After the secondary link is established in S504, key exchange processing is performed on the primary link to obtain the PTK and GTK required for the secondary link (S505). In S506, the PTK and GTK generated on the primary link in S505 are shared with the secondary link using outband. The method of sharing using outband is as described above. In S506, after sharing the PTK and GTK with the secondary link, the presence or absence of a third link (tertiary link) is checked in S507. Similarly, if the communication device 102 has not received an Association Request frame in S503, the process proceeds to S507, but the processing in S508 to S510 is the same as the processing in S504 to S506, which is the connection processing for the secondary link in this embodiment.

[0055] Once the GTK replacement process is complete in the tertiary link, the multilink setup process is complete (S511).

[0056] According to this embodiment, when the communication device 102 performs communication via multiple frequency channels, it becomes possible to exchange encryption keys even when the number of frequency channels with which the communication device 102 has established a connection changes. Furthermore, by sharing encryption keys using outband communication, it is possible to perform encryption key exchange with greater security compared to sharing encryption keys via wireless communication.

[0057] [Second Embodiment] Figure 6 shows a sequence diagram illustrating the exchange of encryption keys for encrypting newly established frequency channels when communication devices 102 and 103 communicate via multiple frequency channels.

[0058] This embodiment shows an example using two links. Link 1, the primary link, processes communication via a channel (e.g., 1 channel in the 2.4 GHz band), and Link 2, the secondary link, processes communication via a channel (e.g., 36 channels in the 5 GHz band). Although a third frequency channel is not shown in Figure 6, it is also possible to add more links, for example, using the 6 GHz band as a tertiary link (Link 3), to facilitate communication.

[0059] In this embodiment, a 4-Way Handshake and a GroupKey Handshake are always performed when the number of frequency channels for which a connection has been established changes, and an example is shown in which PTK and GTK are shared between communication device 102 and communication device 103.

[0060] The processing of this sequence begins when the power to each of the communication devices 102 and 103 is turned on. Alternatively, at least one of the communication devices 102 and 103 may begin when instructed by a user or application to start multilink communication. Alternatively, at least one of the communication devices 102 and 103 may begin when the amount of data to be communicated with the other device exceeds a predetermined threshold.

[0061] First, communication devices 102 and 103 establish link 1 in the first frequency channel using the F601 process. More specifically, communication device 103 sends an Authentication Request frame for authentication, and communication device 102 sends an Authentication Response frame in response. Subsequently, communication device 103 sends an Association Request frame to establish the connection, and communication device 102 sends an AssociationResponse frame in response.

[0062] Next, communication devices 102 and 103 perform a 4-way handshake process as defined in the IEEE 802.11 specification in order to share the PTK in the processing of F602 on the first frequency channel. The specific processing of F602 is the same as that of F402.

[0063] Next, communication devices 102 and 103 perform the GroupKeyHandshake process specified in the IEEE802.11 specification in order to share the GTK, which is the group key, in the F603 process on the first frequency channel. The specific processing of F603 is the same as that of F403.

[0064] Next, communication devices 102 and 103 establish link 2 in the second frequency channel during the processing of F604. The specific processing of F604 is the same as that of F601.

[0065] Next, communication devices 102 and 103 perform a 4-way handshake process as defined in the IEEE 802.11 specification in order to share the PTK in the processing of F802 on the first frequency channel. The specific processing of F606 is the same as that of F402.

[0066] Using Figure 7, we will explain the process flow for exchanging encryption keys when the number of frequency channels for which a connection has been established in multilink communication changes, by having the control unit 202 execute a program stored in the memory unit 201 of the communication device 102.

[0067] The process shown in this flowchart begins when the communication device is powered on. Alternatively, it may begin when the communication device is instructed by a user or application to start multilink communication. Or, it may begin when the amount of data to be communicated with the other device exceeds a predetermined threshold. The multilink setup process begins based on these triggers (S701).

[0068] In S702, the connection process and key exchange process shown in F601 to F603 are performed on the first link (primary link).

[0069] Subsequently, in S703, the presence or absence of a second link (secondary link) is checked. In S703, the presence or absence of a secondary link is determined by whether or not the communication device 102 received an Association Request frame in F604. In S703, if an Association Request frame is received while a connection has been established with the communication device 102 on the first link, connection processing and key exchange processing are performed on the second link (secondary link) (S704). In S704, after sharing the PTK and GTK on the secondary link, the presence or absence of a third link (tertiary link) is checked in S705. If the communication device 102 did not receive an Association Request frame in S703, the presence or absence of a tertiary link is checked in S705. The processing from S705 onward is the same as the secondary link connection processing.

[0070] Once the GTK replacement process is completed in the S706 tertiary link, the multilink setup process is complete (S707).

[0071] According to this embodiment, when the communication device 102 communicates using the WPA authentication method and communicates via multiple frequency channels, the encryption key can be exchanged by executing a key sharing process each time the number of frequency channels on which the connection with the communication device 102 is established changes.

[0072] [Third Embodiment] Figure 8 shows a sequence diagram illustrating the exchange of encryption keys for encrypting newly established frequency channels when communication devices 102 and 103 communicate via multiple frequency channels.

[0073] This embodiment shows an example using two links. Link 1, the primary link, processes communication via a first frequency channel (e.g., channel 1 in the 2.4 GHz band), and Link 2, the secondary link, processes communication via a second frequency channel (e.g., channel 36 in the 5 GHz band). Although a third frequency channel is not shown in Figure 8, it is possible to further increase the number of links and communicate using, for example, the 6 GHz band as a tertiary link, Link 3.

[0074] In this embodiment, an example is shown in which the PTK shared by communication device 102 and communication device 103 on the first frequency channel is shared by each communication device on the second frequency channel using outband.

[0075] The processing of this sequence begins when the power to each of the communication devices 102 and 103 is turned on. Alternatively, at least one of the communication devices 102 and 103 may begin when instructed by a user or application to start multilink communication. Alternatively, at least one of the communication devices 102 and 103 may begin when the amount of data to be communicated with the other device exceeds a predetermined threshold.

[0076] First, communication devices 102 and 103 establish link 1 on the first frequency channel using the processing of F801. More specifically, communication device 103 sends an Authentication Request frame for authentication, and communication device 102 sends an Authentication Response frame in response. Subsequently, communication device 103 sends an Association Request frame for connection, and communication device 102 sends an Association Response frame in response.

[0077] Next, communication devices 102 and 103 perform a 4-way handshake process as defined in the IEEE 802.11 specification in order to share the PTK in the processing of F802 on the first frequency channel. The specific processing of F802 is the same as that of F402.

[0078] Next, in the F803 process, communication devices 102 and 103 perform the GroupKeyHandshake process specified in the IEEE802.11 specification in order to share GTK in the first frequency channel in the F603 process. The specific processing of F803 is the same as that of F403.

[0079] Next, communication devices 102 and 103 establish link 2 in the second frequency channel using the processing of F804. The specific processing of F804 is the same as that of F801.

[0080] Next, within each communication device, the PTK signal is shared out-of-band to a frequency channel different from the one on which it was generated (F805). The method for out-of-band sharing is as described above.

[0081] Next, communication devices 102 and 103 perform the GroupKeyHandshake process specified in the IEEE 802.11 specification in order to share the GTK for F806 processing on the second frequency channel. If F806 is performed on the first frequency channel, the GroupKeyHandshake process is performed on the first frequency channel, and the shared GTK is shared to the second frequency channel using outband. The method of sharing using outband is as described above.

[0082] Using Figure 9, the process flow for exchanging encryption keys when the number of frequency channels for which a connection has been established in multilink communication changes will be explained, as the control unit 202 executes a program stored in the memory unit 201 of the communication device 102.

[0083] The process shown in this flowchart begins when the communication device is powered on. Alternatively, it may begin when the communication device is instructed by a user or application to start multilink communication. Or, it may begin when the amount of data to be communicated with the other device exceeds a predetermined threshold. The multilink setup process begins based on these triggers (S901).

[0084] In S902, the connection process and key exchange process shown in F801 to F803 are performed on the first link (primary link).

[0085] Subsequently, in S903, the presence or absence of a second link (secondary link) is checked. In S903, the presence or absence of a secondary link is determined by whether or not the communication device 102 received an Association Request frame in F804. In S903, if an Association Request frame is received while a connection has been established with the communication device 102 on the first link, connection processing is performed on the second link (secondary link) (S904). In S904, once the secondary link is established, in S905, the PTK used on the primary link is shared using outband. The method of sharing using outband is as described above. In S903, if the communication device 102 has not received an Association Request frame, the presence or absence of a third link (tertiary link) is checked in S907.

[0086] In S905, the PTK is shared via the outband, and in S906, the GTK exchange process is performed on the secondary link.

[0087] Next, the presence or absence of a third link (tertiary link) is checked (S907). The processing in S908-S910 is the same as the secondary link connection processing in S904-S906.

[0088] Once the GTK replacement process is complete in the tertiary link, the multilink configuration process is finished (S911).

[0089] According to this embodiment, when the communication device 102 performs communication via multiple frequency channels, it becomes possible to exchange encryption keys even when the number of frequency channels with which the communication device 102 has established a connection changes. Furthermore, by sharing encryption keys using outband communication, it is possible to perform encryption key exchange with greater security compared to sharing encryption keys via wireless communication.

[0090] In this embodiment, GTK is used as an example of a group key, but it is not limited to this. As defined in the IEEE 802.11 specification, when the management frame is also encrypted, IGTK is shared between communication device 102 and communication device 103 in addition to GTK. Here, IGTK is an abbreviation for Integrity Group Transient Key. Whether to share only GTK or to share both GTK and IGTK is determined through negotiation between communication device 102 and communication device 103 during the exchange of Association Request frames and Association Response frames.

[0091] Alternatively, a recording medium containing program code for software that implements the above-described functions may be supplied to a system or device, and the computer (CPU, MPU) of the system or device may read and execute the program code stored on the recording medium. In this case, the program code read from the storage medium itself will implement the functions of the above-described embodiment, and the storage medium containing that program code will constitute the above-described device.

[0092] For storing program code, storage media such as flexible disks, hard disks, optical disks, magneto-optical disks, CD-ROMs, CD-Rs, magnetic tapes, non-volatile memory cards, ROMs, and DVDs can be used.

[0093] Furthermore, the above-mentioned functions may be realized not only by the computer executing the program code it reads, but also by the operating system (OS) running on the computer performing some or all of the actual processing based on the instructions of that program code. OS stands for Operating System.

[0094] Furthermore, the program code read from the storage medium is written to the memory of a function expansion board inserted into the computer or a function expansion unit connected to the computer. Then, based on the instructions of that program code, the CPU of the function expansion board or function expansion unit may perform some or all of the actual processing to realize the above-mentioned functions.

[0095] The present invention can also be realized by supplying a program that implements one or more of the functions of the above-described embodiments to a system or device via a network or storage medium, and by having one or more processors in the computer of that system or device read and execute the program. It can also be realized by a circuit (e.g., an ASIC) that implements one or more functions. [Explanation of Symbols]

[0096] 201 Storage section 202 Control Unit 203 Functional Section 204 Input section 205 Output section 206 Communications Department 207 Antenna

Claims

1. A communication device capable of performing wireless communication in accordance with the IEEE (Institute of Electrical and Electronics Engineers) 802.11 standard, Establishment means for establishing a multilink with other communication devices, including a first link using a first frequency channel and a second link using a second frequency channel different from the first frequency channel, A generation means for generating a PTK (Pairwise Transient Key) for encrypting unicast communication data by performing a 4-Way Handshake with the other communication device on the first frequency channel, After the establishment of the multilink is completed by the establishment means, a communication means that encrypts and communicates unicast communication data in the second link, which has the same SSID (Service Set Identifier) ​​as the SSID set in the first link, using the PTK generated by the generation means. A communication device characterized by having the following features.

2. The aforementioned establishment means further, A third link is established between the aforementioned other communication device and the first link and the second link, which is different from the first link and the second link. The communication device according to feature 1.

3. The system further includes a management means for managing the PTK generated by the generation means as a PTK for encrypting data of unicast communication in the second link. A communication device according to claim 1 or 2.

4. The system further includes a sharing means for sharing a key for encrypting multicast communication data via GroupKeyHandshake, which is performed with the aforementioned other communication devices. A communication device according to any one of claims 1 to 3.

5. The communication device controls the sharing means in each of the first and second links to execute the GroupKeyHandshake. The communication device according to feature 4.

6. The communication means performs multilink communication, transmitting first data to the other communication device via the first link while simultaneously transmitting second data to the other communication device via the second link. A communication device according to any one of claims 1 to 5.

7. The first data and the second data are the same data. The communication device according to feature 6.

8. The first data and the second data are different data. The communication device according to feature 6.

9. The first and second data mentioned above are data obtained by dividing the third data. The communication device according to claim 6 or 8.

10. A communication method in a communication device capable of performing wireless communication in accordance with the IEEE (Institute of Electrical and Electronics Engineers) 802.11 standard, A process for establishing a multilink with other communication devices, including a first link using a first frequency channel and a second link using a second frequency channel different from the first frequency channel. A generation step of generating a PTK (Pairwise Transient Key) for encrypting unicast communication data by performing a 4-Way Handshake with the other communication device on the first frequency channel, After the establishment of the multilink is completed by the establishment step, a communication step is performed in which the PTK generated by the generation step is used to encrypt and communicate data for unicast communication on the second link, which has the same SSID (Service Set Identifier) ​​as the SSID set on the first link. A communication method characterized by having the following features.

11. A program for causing a computer to function as one of the means of a communication device according to any one of claims 1 to 9.

Images