JP2015162880A - Communication system management device, information processing terminal, and communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To allow for more safe and efficient distribution of the specific key at each node of a wireless network.SOLUTION: A communication system includes a communication management device, nodes and communication system management device, arranged in each wireless network. The communication system management device has means for managing the node information containing the identification information of key information of each node, association determination means for determining the association of each node and each communication management device, and means for distributing the key information managed by the node information management means to a communication management device associated with the node related to the key information, on the basis of the content of association thus determined.

Description

  The present invention relates to a communication system management apparatus, an information processing terminal, and a communication system, and can be applied to, for example, a communication system including a system for distributing and authenticating key information.

  Conventionally, when a node that cannot expect an input / output interface, such as a sensor node, is newly added to a secure network to which encryption is applied, authentication information (encryption key information, etc.) for joining the network is added to the new node. Patent Document 1 is disclosed as a method of setting the above.

  Specifically, a network common key managed by a management terminal (a coordinator in a sensor network, an access point in a wireless LAN (Local Area Network), a terminal denoted as AP in Patent Document 1) managed by a wireless network is the new node. In order to set the new node, a unique encryption key is given to the new node at the time of manufacture, while the key management server on the Internet N2 also copies the unique key of the node and the network common key of the wireless network management terminal. And the node ID and the wireless network management terminal ID are sent from a third terminal such as a smartphone to the key management server, and the server receives this and encrypts it with the key of the node. To the wireless network management terminal, and the wireless network The network management terminal transfers the encrypted network common key to the node, and the node receives the encrypted network common key and decrypts the network common key with the node-specific encryption key. Set a common key and join the network.

JP 2009-71707 A

  By the way, when a wireless network management terminal and a node perform peer-to-peer encryption communication using the TLS-PSK (IETF RFC4279: Pre-Shared Key Ciphers for Transport Layer Security) protocol, the TLS-PSK Before performing handshake (hereinafter referred to as TLS-PSK handshake), common key information called PreShared Key (PSK) unique to each node is preliminarily transferred between the radio network management terminal and the node. Need to share.

  As one of the pre-sharing methods, there is a method in which the wireless network management terminal arbitrarily determines a pre-common key of each node and installs it on the node side. The prior art relating to such a pre-shared key is also described in Patent Document 1.

  On the other hand, a method of installing key information unique to a node at the time of manufacture and distributing a copy thereof to the wireless network management terminal is conceivable. In this method, it is difficult to apply Patent Document 1 as it is, but this method has an advantage that the node does not need to communicate at the time of pre-sharing.

  However, when this method is applied, when switching the wireless network management terminal to which the node is connected, if the unique key of the node is not updated, the wireless network management terminal before switching is switched between the switching-target wireless network management terminal and the node. It must be considered that the ciphertext exchanged between the two can be deciphered.

  In view of the above-described problems, a communication system management apparatus, an information processing terminal, and a communication system that can distribute a unique key of each node of a wireless network more safely and efficiently are desired.

  The first aspect of the present invention is a communication system management apparatus that manages one or a plurality of wireless networks in which communication management apparatuses are arranged. (1) A node that manages node information including identification information and key information of each of the above nodes. An information management means; (2) an association determination means for determining an association between each of the nodes and each of the communication management devices; and (3) based on the content of the association determined by the association determination means. And key distribution means for distributing the key information managed by the node information management means to the communication management apparatus associated with the node related to the key information.

  According to a second aspect of the present invention, there is provided a communication system including a communication management device disposed in each of one or more wireless networks, one or more nodes connected to the wireless network, and a communication system management device. The communication system management apparatus according to the first aspect of the present invention is applied as the system management apparatus.

  An information processing terminal according to a third aspect of the present invention includes: (1) association information generating means for generating association information for associating a user or a radio network management terminal arranged in a radio network and a node connected to the radio network; 2) The communication system management apparatus according to the first aspect of the present invention includes association information transmission means for transmitting association information generated by the association information generation means.

  According to the present invention, the unique key of each node of the wireless network can be distributed more safely and efficiently.

It is the sequence diagram shown about operation | movement of the communication system which concerns on embodiment. 1 is a block diagram illustrating an overall configuration of a communication system according to an embodiment. It is the block diagram shown about the functional structure of the radio | wireless node which comprises the communication system which concerns on embodiment. It is the block diagram shown about the functional structure of the radio | wireless NW management terminal which comprises the communication system which concerns on embodiment. It is the block diagram shown about the functional structure of the center server which comprises the communication system which concerns on embodiment. It is the block diagram shown about the functional structure of the correlation terminal which comprises the communication system which concerns on embodiment. It is explanatory drawing shown about the structural example of the node table managed by the center server which concerns on embodiment. It is explanatory drawing shown about the structural example of the radio | wireless network management terminal table managed by the center server which concerns on embodiment. It is explanatory drawing shown about the structural example of the user table managed by the center server which concerns on embodiment. 4 is a flowchart illustrating an operation of a wireless node according to the embodiment. It is the flowchart shown about operation | movement of the center server which concerns on embodiment.

(A) Main Embodiment Hereinafter, an embodiment of a communication system management apparatus, an information processing terminal, and a communication system according to the present invention will be described in detail with reference to the drawings. Below, the example which applies the system management apparatus and information processing terminal of this invention to a center server and an association terminal is demonstrated.

(A-1) Configuration of Embodiment FIG. 2 is a block diagram showing the overall configuration of the communication system 1 of this embodiment.

  In the communication system 1, a plurality of wireless networks N1 and the Internet N2 are arranged.

  In each wireless network N1, a wireless NW management terminal 200 is arranged as a device (coordinator) that manages connection or the like of one or a plurality of nodes 100 and the node 100 in the wireless network N1. Note that the number of wireless networks N1 and the number of nodes 100 in the communication system 1 are not limited.

  Each wireless NW management terminal 200 is also connected to the Internet N2. One or more association terminals 400 are also connected to the Internet N2. Note that the number of association terminals 400 is not limited.

  Here, the wireless NW management terminal 200 will be described as functioning as an access point in each wireless network N1, but a communication device serving as an access point is provided separately, and the wireless NW management terminal 200 manages each node 100 (such as authentication). ) May be performed.

  The center server 300 holds a database, which manages various information of the wireless node 100, the wireless NW management terminal 200, and the user. A specific configuration of the database held by the center server 300 will be described later. The center server 300 has a function of distributing the key of each node 100 to the wireless NW management terminal 200.

  The association terminal 400 is a terminal serving as a user interface for notifying information on the wireless NW management terminal 200 and the node 100 associated with the center server 300. As the association terminal 400, for example, a smartphone or a tablet terminal connected to the Internet N2 can be applied.

  Next, the configuration of each node 100 will be described with reference to FIG. Each node 100 may have a different configuration, but here, it is assumed that all the nodes 100 have a configuration that can be shown in the block diagram of FIG.

  The node 100 includes a wireless communication unit 101, a connection destination determination unit 102, a connection destination candidate holding unit 103, a TLS-PSK handshake unit 104, a PSK holding unit 105, a PSK update unit 106, a PSK update key holding unit 107, and a PSK update. A control unit 108 is included. Each node 100 may be realized, for example, by installing a program (including the wireless communication program of the embodiment) corresponding to each component shown in FIG. 3 in an apparatus including a computer capable of wireless communication. Good.

  The wireless communication unit 101 is a communication interface for accessing the wireless network N1.

  The connection destination determination unit 102 arbitrarily selects a connection destination from a plurality of networks as connection destinations. However, the connection destination determination unit 102 does not limit the selection method.

  The connection destination candidate holding unit 103 temporarily stores information when a plurality of wireless networks N1 are detected. However, the connection destination candidate holding unit 103 excludes the wireless network N1 that has failed authentication from the candidates.

  The TLS-PSK handshake unit 104 establishes an encrypted communication path by performing a TLS-PSK handshake with the wireless network management terminal.

  The PSK holding unit 105 stores a pre-shared key (PSK) used in the TLS-PSK handshake. In the node 100 of this embodiment, it is assumed that the pre-shared key (PSK) is installed in advance (pre-installed at the time of manufacture), and a copy thereof is also stored in the database of the center server 300.

  The PSK update unit 106 updates the pre-shared key (PSK).

  The update method (pre-shared key update method) performed by the PSK update unit 106 is not necessarily one. The PSK update unit 106 of this embodiment uses a key update key, uses the current pre-shared key information and the key update key as input of a keyed hash function, and updates the output information to the updated pre-shared key Shall be obtained as As the keyed hash function, for example, a Keyed-Hashing for Message Authentication (HMAC) function defined in IETF RFC2104 can be used.

  The PSK update key holding unit 107 stores the key update key acquired by the PSK update unit 106.

  The PSK update control unit 108 controls timing for operating the PSK update unit 106. In this embodiment, the timing at which the PSK update control unit 108 performs the key update will be described as connecting to a new wireless network N1, but the key update timing is not limited.

  Next, the configuration of the wireless NW management terminal 200 will be described using FIG.

  The wireless NW management terminal 200 includes a wireless communication unit 201, a TLS-PSK handshake unit 202, a PSK holding unit 203, an Internet communication unit 204, and a network management unit 205. Note that the wireless NW management terminal 200 is realized, for example, by installing a program (including the communication management program of the embodiment) corresponding to each component shown in FIG. 4 in an apparatus including a computer capable of wireless communication. It may be.

  The wireless communication unit 201 is a communication interface for communicating with a node of the wireless network N1.

  The TLS-PSK handshake unit 202 establishes an encrypted communication path by performing a TLS-PSK handshake with the node 100.

  The PSK holding unit 203 stores pre-shared key information of each subordinate node 100.

  The Internet communication unit 204 is an interface for accessing the Internet N2, and is used for communicating with the center server 300. In this embodiment, it is assumed that all communications performed by the wireless NW management terminal 200 with the center server 300 are encrypted. As means for establishing an encrypted communication path between the wireless NW management terminal 200 and the center server 300, various means such as SSL (Secure Socket Layer) and IPSec can be applied, for example.

  The network management unit 205 is a part in which the coordinator function of the wireless network N1 is installed. In this embodiment, the network management unit 205 treats the node 100 that has established the TLS-PSK encrypted communication path as participating in the network managed by the wireless NW management terminal 200.

  Next, the configuration of the center server 300 will be described with reference to FIG.

  The center server 300 includes an Internet communication unit 301, a login management unit 302, an association determination unit 303, an association reference child holding unit 304, a table operation unit 305, a database 306, a key distribution unit 307, a PSK update unit 308, and a PSK update control unit. 309. Note that the center server 300 is realized, for example, by installing a program (including the communication system management program of the embodiment) corresponding to each component shown in FIG. 5 in an apparatus including a computer that can be connected to a network. May be.

  The Internet communication unit 301 is an interface for accessing the Internet N2 and communicating with each wireless NW management terminal and each association terminal 400.

  The login management unit 302 accesses the database 306 with respect to login information sent from the association terminal 400 by the user, verifies whether the user ID / password pair is correct, and manages the login state.

  Note that the login method managed by the login management unit 302 is not limited to the above-described example, and the same configuration as various account management can be applied.

  The association determination unit 303 receives the association information from the association terminal 400, interprets the association information, associates the user operating the association terminal 400 with the wireless NW management terminal 200 and the node 100, and the association reference child holding unit 304. The wireless NW management terminal ID and the node ID are sent to. The association determination unit 303 also sends the device ID of the node 100 to the key distribution unit 307. As an example of the association information, information obtained by concatenating the device IDs of the node 100 and the wireless NW management terminal 200 can be considered. However, if the user ID and the wireless NW management terminal 200 correspond to each other one by one, the user It may be a concatenation of ID and node ID. In this embodiment, the configuration of the association information processed by the association determination unit 303 is not limited to a specific configuration.

  The association reference holding unit 304 receives the ID of the wireless NW management terminal 200 and the ID of the node 100 from the association determination unit 303, and uses this as a key for the database 306, the IP address of the wireless NW management terminal 200, the node Queries 100 pre-shared key information. The association reference child holding unit 304 supplies the inquiry result to the association determination unit 303.

  The table operation unit 305 accesses the database 306 to search and register information.

  The database 306 includes a node table 306a, a wireless network management terminal table 306b, and a user table 306c.

  The node table 306a is a table for managing each node 100 as shown in FIG. The node table 306a illustrated in FIG. 7 includes, for each node 100, a device ID (node ID) as an identifier, pre-shared key information preinstalled in each node 100, and an update key corresponding to the pre-shared key information. This information is a table using the information (PSK update key information) as a key.

  In this embodiment, PSK update key information will be described assuming that the wireless node 100 and the center server 300 share the same content.

  The wireless network management terminal table 306b is a table for managing each wireless NW management terminal 200 as shown in FIG. The wireless network management terminal table 306b shown in FIG. 8 is a table for managing information on the device ID (wireless NW management terminal ID) of the wireless NW management terminal 200 and its global IP address for each wireless NW management terminal 200. .

  As shown in FIG. 9, the user table 306c is a table for managing information related to each user (user of the wireless node 100). The user table 306c shown in FIG. 9 includes, for each user, a user ID of the user, a password corresponding to the user ID, a list of wireless NW management terminals 200 owned by the user (a list of device IDs as identifiers), This is a table for managing information of a list of wireless nodes 100 owned by a user (a list of device IDs as identifiers).

  The key distribution unit 307 receives the device ID of the node 100 from the association determination unit 303 and receives the IP address of the wireless NW management terminal 200 and the pre-shared key information of the node 100 from the database 306. Then, the key distribution unit 307 distributes the device ID information and key information of the node 100 to the IP address of the wireless NW management terminal 200 via the Internet communication unit 301.

  The PSK update unit 308 updates the pre-shared key (PSK) of each node 100. The update method is the same procedure as the pre-shared key update (PSK update) in the node 100. In this embodiment, as an example, PSK and PSK update key information (key update key information) are read from the node table 306a and are keyed. Information obtained as a result of applying the hash function is used as new pre-shared key information.

  The PSK update control unit 309 controls the timing for operating the PSK update unit 308. In this embodiment, as an example, the PSK update control unit 309 assumes that the key update timing is determined when association is determined.

  Next, the configuration of the association terminal 400 will be described with reference to FIG.

  The association terminal 400 includes an Internet communication unit 401, a center server address holding unit 402, an authentication information input unit 403, a device ID acquisition unit 404, and an association designation unit 405. The associating terminal 400 is a program (including the information processing program of the embodiment) corresponding to each component shown in FIG. 6 in an apparatus (for example, a smart phone, a tablet PC, or the like) including a computer that can be connected to a network. You may make it implement | achieve by installing.

  The Internet communication unit 401 is an interface for accessing the Internet N2, and is used for communicating with the center server 300. In this embodiment, it is assumed that all communication with the center server 300 is encrypted. As means for establishing the encrypted communication path, SSL, IPSec, etc., which are encryption techniques widely used in the Internet N2, can be applied.

  The center server address holding unit 402 holds the global IP address of the center server 300.

  The authentication information input unit 403 is a means for the user to input authentication information for logging in to the center server 300. In this embodiment, the authentication information input unit 403 is not limited to a specific method, but is input directly from a touch key, for example. The method of doing is conceivable.

  The device ID acquisition unit 404 is a means for a user to input the device ID of the wireless NW management terminal 200 or the node 100 to the association terminal 400. For example, the device ID acquisition unit 404 may accept an ID input by a user input interface such as a touch key or a method of capturing and decoding a QR code (registered trademark) with a camera.

  The association designation unit 405 notifies the center server 300 via the Internet communication unit 401 that the wireless NW management terminal 200 and the node 100 are associated with each other. In this embodiment, the description will be made assuming that the association designation unit 405 designates the association using the device IDs of the wireless NW management terminal 200 and the node 100. Note that the association designation unit 405 may acquire the device ID by inputting the device ID from the device ID acquisition unit 404. Further, the association designation unit 405 may acquire the device ID of the wireless NW management terminal 200 by, for example, downloading the ID of the wireless NW management terminal 200 owned by the user when logging in.

(A-2) Operation | movement of embodiment Next, operation | movement of the communication system 1 of this embodiment which has the above structures is demonstrated.

  FIG. 1 is a sequence diagram illustrating the operation of the communication system 1.

  Here, first, a pre-shared key (PSK) is initially set in the PSK holding unit 105 of any node 100, and a copy thereof is also stored in the database 306 of the center server 300 (S101). . This presetting can be realized, for example, by installing a bit string randomly generated at the time of manufacture in the node 100 as a pre-shared key and securely sending a copy to the center server 300, but is not limited to this presetting method. .

  Next, an operation (steps S102 to S105 to be described later) registered in the center server 300 and the wireless NW management terminal 200 for information related to the arbitrary node 100 in which the initial PSK is preset in step S101 will be described.

  First, it is assumed that the user of the node 100 logs in to the center server 300 using the association terminal 400 in order to associate the node 100 with the wireless NW management terminal 200 related to the desired wireless network N1 (S102). .

  Here, it is assumed that the user logs in by inputting the user ID and password to the association terminal 400 (authentication information input unit 403). Then, association terminal 400 (Internet communication unit 401) establishes an encrypted communication session using SSL or the like for the address of center server 300 stored in center server address holding unit 402. Then, association terminal 400 (Internet communication unit 401) sends the input user ID and password to center server 300. Then, the center server 300 operates the table operation unit 305 in the login management unit 302 to read the password corresponding to the corresponding user ID from the user table of the database 306, and collates the received user ID and password. In this case, the authentication success is returned to the wireless NW management terminal 200, and management is performed assuming that the user is logged in.

  Then, the login is successful at the association terminal 400, and the device IDs of the wireless NW management terminal 200 and the node 100 are input to the device ID acquisition unit 404 by the operation of the person in charge of operation. It is assumed that it has been generated and transmitted to the center server 300 (S103).

  The center server 300 (association determining unit 303) interprets the association information based on the control from the association terminal 400, and associates the device IDs of the node 100 and the wireless NW management terminal 200 with the association reference child holding unit 304. send. The association reference child holding unit 304 operates the table operation unit 305 to read the pre-shared key of the node 100 from the node table 306a and the IP address of the wireless NW management terminal 200 from the wireless network management terminal table 306b, respectively. 307 to output.

  In the center server 300, after the login in step S102 described above, the PSK update control unit 309 instructs the PSK update unit 308 to update the pre-shared key (PSK) at the timing when the association information is sent from the association terminal 400. . As a result, the PSK update unit 308 of the center server 300 controls the table operation unit 305 to read the PSK update key information of the node from the node table 306a of the database 306 and update the pre-shared key (PSK) (S104).

  Next, the key distribution unit 307 of the center server 300 securely connects to the IP address of the wireless NW management terminal 200 via the Internet communication unit 301, and obtains the device ID of the node 100 and the pre-shared key (PSK). Distribute (S105).

  Through the operation as described above, the device ID and the pre-shared key (PSK) related to each wireless node 100 are distributed to the wireless NW management terminal 200.

  Next, when the node 100 to which the device ID and the pre-shared key (PSK) are distributed to the wireless NW management terminal 200 connects to the wireless network N1 (the wireless NW management terminal 200 to which the device ID and the pre-shared key are distributed). Will be described (steps S106 to S111 described later).

  First, it is assumed that the node 100 is turned on by the user (S106).

  As soon as the node 100 starts up, it waits for a candidate for the wireless network N1 to which it is connected and receives a beacon (a beacon from the wireless NW management terminal 200) (S107).

  When receiving the beacon, the node 100 transmits a connection request to the wireless NW management terminal 200 from the beacon information (the transmission source information included in the beacon) (S108).

  Then, the wireless NW management terminal 200 transmits a temporary connection permission to the node 100 (S109).

  This connection is a temporary connection for executing the TLS-PSK handshake. When the TLS-PSK handshake fails, the wireless NW management terminal 200 forcibly disconnects the temporary connection.

  When the temporary connection is established, the node 100 (PSK update control unit 108) updates the pre-shared key information to the PSK update unit 106 when the wireless NW management terminal 200 is different from the partner that executed the previous TLS-PSK. The PSK update unit 106 reads the PSK update key information from the PSK update key holding unit 107 and updates the pre-shared key (PSK) (S110).

  Next, the node 100 (TLS-PSK handshake unit 104) uses the pre-shared key (PSK) stored in the PSK holding unit 105 to use the wireless NW management terminal 200 and the TLS-PSK using the pre-shared key. Execute. The wireless NW management terminal 200 sends the pre-shared key corresponding to the node 100 stored in the PSK holding group 203 to the TLS-PSK handshake unit 202 as the pre-shared key of the TLS-PSK handshake, and the node 100 and the TLS- A TLS encryption communication session is established by executing the PSK handshake (S111).

  Next, the operation when the power is turned on in the wireless node 100 (the operation after step S106 described above) will be described with reference to the flowchart in FIG.

  When the wireless node 100 is powered on (S201) and the communication unit 101 receives a beacon after activation, the wireless node 100 transmits a connection request to the beacon transmission source (wireless NW management terminal 200) (S202).

  The wireless node 100 confirms the response from the wireless NW management terminal 200 that has transmitted the connection request (S203). If there is a connection OK response, the wireless node 100 operates from step S204 described later. The previous wireless NW management terminal 200 is changed (the wireless NW management terminal 200 that has received another beacon is selected), and the operation starts from step S202 described above.

  When the connection OK is received, the wireless node 100 determines whether or not the connection-target wireless NW management terminal 200 is a wireless network N1 different from the previous one (whether or not the identifier of the transmission-source wireless NW management terminal 200 is different from the previous time). Is confirmed (S204). That is, each wireless node 100 holds a pre-shared key (PSK) backup corresponding to the previously connected wireless network N1 (wireless NW management terminal 200).

  When connecting to the wireless network N1 different from the previous time, the wireless node 100 establishes communication by the TLS-PSK handshake after executing a sequence for updating the pre-shared key (PSK) with the wireless NW management terminal 200 (S205, S206).

  On the other hand, when connecting to the same wireless network N1 as the previous time, the wireless node 100 proceeds to step S206 using the current pre-shared key (PSK) without performing key update, and performs TLS-PSK handshake. Establish communication.

  Next, an operation based on a request from the association terminal 400 in the center server 300 will be described using the flowchart of FIG.

  First, while the center server 300 is in a waiting state, there is a login request (connection request) from the association terminal 400, and login authentication is performed (S302, S303). If the login authentication fails, the center server 300 returns to step S301 described above and enters a standby state.

  On the other hand, if the login authentication is successful, the center server 300 receives a message (for example, association information) transmitted from the association terminal 400 and confirms the content (S304). If the received message is association information, the center server 300 will be described later. The operation starts from step S305. If not, the process corresponding to the received message is performed (S307), and the process returns to the above-described step S301.

  When the association message is received, the center server 300 updates the pre-shared key (PSK) related to the corresponding wireless node 10 based on the association information (S305), and the corresponding wireless NW management terminal 200 together with the node ID. The process is terminated, and the operation returns to step S301 described above.

(A-3) Effects of Embodiment According to this embodiment, the following effects can be achieved.

  In the communication system 1, when the pre-shared key (PSK) is shared between the wireless node 100 and the wireless NW management terminal 200, the pre-shared key (PSK) can be shared without the wireless node 100 performing communication. It becomes like this.

  Further, when switching the wireless NW management terminal 200 (wireless network N1) to which the wireless node 100 is connected, the pre-shared key (PSK) is updated offline, so that the node does not perform communication for each wireless network N1 in advance. A shared key (PSK) can be used.

(B) Other Embodiments The present invention is not limited to the above-described embodiments, and may include modified embodiments as exemplified below.

(B-1) In the communication system 1, in addition to TLS-PSK, a protocol that needs to share a key in advance can be applied to authentication of the wireless node 100.

(B-2) In the above embodiment, when the center server 300 receives the association information, the center server 300 immediately distributes the node ID and the pre-shared key (PSK) to the wireless NW management terminal 200. In this case, The wireless NW management terminal 200 needs to open a communication boat of the Internet N2, and it becomes easy to create a security vulnerability.

  Therefore, the wireless NW management terminal 200 connects to the center server at the timing when the wireless node 100 connects to the wireless NW management terminal 200, and at this timing, based on the association information, the node ID and the pre-shared key (PSK) ) May be acquired.

  In this case, the center server 300 side receives the request from the wireless NW management terminal 200 without receiving the node ID and the pre-shared key (PSK) immediately after receiving the association information. It will be delivered at the timing according to the. Further, in this case, the center server 300 does not need to know the IP address information of the wireless NW management terminal 200.

(B-3) In the above embodiment, the update timing of the pre-shared key (PSK) in the center server 300 is performed immediately before distribution to the wireless NW management terminal 200 (step S104 immediately before step S105). , Executed immediately after distribution (step S104 is executed after step S105), and on the wireless node 100 side, key update is executed after the communication path is established by the TLS-PSK handshake with the wireless NW management terminal 200 (step S111). You may make it perform the process of step 110 later).

  Further, the center server 300 updates the key at an arbitrary timing, and then issues a key update command from the center server 300 to the wireless node 100 via the wireless NW management terminal 200, and the wireless node 100 side issues the command. Key update may be performed at the received timing.

(B-5) Prior to distributing the pre-shared key (PSK) of the wireless node 100 to the wireless NW management terminal 200, the center server 300 may authenticate the wireless NW management terminal. The authentication method of the wireless NW management terminal is not particularly limited, but for example, existing EAP-TLS can be used.

(B-6) One user login information may be created for one wireless NW management terminal. In this case, since the associated wireless NW management terminal is uniquely specified, the wireless NW management terminal information can be omitted from the association information. In this case, the wireless NW management terminal table and the user table can be integrated. For example, the ID information of the user table is replaced with the ID of the wireless NW management terminal, and the owned wireless NW management terminal list is integrated as a deleted table. It is done.

  DESCRIPTION OF SYMBOLS 1 ... Communication system, N1 ... Wireless network, N2 ... Internet, 100 ... Wireless node, 101 ... Communication part, 102 ... Connection destination determination part, 103 ... Connection destination candidate holding part, 104 ... TLS-PSK handshake part, 105 ... PSK holding unit 106 ... PSK updating unit 107 ... PSK update key holding unit 108 ... PSK update control unit 200 ... Wireless NW management terminal 201 ... Wireless communication unit 202 ... TLS-PSK handshake unit 203 ... PSK Holding unit, 204 ... Internet communication unit, 205 ... Network management unit, 300 ... Center server, 301 ... Internet communication unit, 302 ... Login management unit, 303 ... Association determination unit, 304 ... Association reference holding unit, 305 ... Table operation Part, 306 ... database, 306a ... node table, 306b ... Line network management terminal table, 306c ... user table, 307 ... key distribution unit, 308 ... PSK update unit, 309 ... PSK update control unit, 400 ... association terminal, 401 ... internet communication unit, 402 ... center server address holding unit, 403 ... authentication information input unit, 404 ... device ID acquisition unit, 405 ... association designation unit.

Claims (13)

In a communication system management apparatus that manages one or more wireless networks in which communication management apparatuses are arranged,
Node information management means for managing node information including identification information and key information of each of the above nodes;
Association determining means for determining an association between each of the nodes and each of the communication management devices;
A key distribution unit that distributes key information managed by the node information management unit to the communication management device associated with the node related to the key information based on the contents of the association determined by the association determination unit; A communication system management apparatus comprising: For each user, it further comprises user information management means for managing the node identifier of the corresponding node and the management device identifier of the corresponding communication management device,
The communication system according to claim 1, wherein the association determination unit determines an association between each of the nodes and each of the communication management devices based on information managed by the user information management unit. Management device. Each communication management device further comprises a communication management device information management means for managing the node identifier of the corresponding node,
The communication system management according to claim 1, wherein the association determination unit determines an association between the node and the communication management device based on information managed by the communication management device information management unit. apparatus. Further comprising association information receiving means for acquiring association information for associating the user or the communication management device with the node from an external information processing terminal;
The communication system management apparatus according to claim 2 or 3, wherein the user information management unit updates information to be managed based on the acquired association information. Association information generating means for generating association information for associating a user or a wireless network management terminal arranged in a wireless network and a node connected to the wireless network;
An information processing terminal comprising: an association information transmitting unit that transmits the association information generated by the association information generating unit to the communication system management device according to claim 3.   The information processing terminal according to claim 5, wherein the association information generation unit generates association information in response to an input operation from a user. In a communication system comprising a communication management device disposed in each of one or more wireless networks, one or more nodes connected to the wireless network, and a communication system management device,
A communication system, wherein the communication system management device according to claim 1 is applied as the communication system management device. Applying the communication system management device according to claim 3 as the communication system management device,
Furthermore, it has an information processing terminal of Claim 5, The communication system characterized by the above-mentioned. The communication system management apparatus further includes key update means for updating key information held by the node information management means by a predetermined method. The key distribution means corresponds to the key information updated by the key update means. The communication system according to claim 8, wherein the communication system is distributed to the communication management device.   The communication system according to claim 9, wherein the node updates the key information held in the same manner as the communication system management apparatus when the communication management apparatus of the connection destination is switched. The communication system management apparatus further includes a command transmission unit that transmits a key update command to the node corresponding to the updated key information when the key update is performed by the key update unit.
The communication system according to claim 10, wherein the node updates key information held at a timing when a key update command is received from the communication system management apparatus. The communication management device further includes key information requesting means for requesting the communication system management device to distribute key information of the node at a timing when the node is connected to a wireless network managed by the communication management device.
The communication system according to claim 11, wherein the communication system management device distributes key information of a node corresponding to the request to the communication management device in response to a request from the communication management device.   Before the node changes the connected wireless network management terminal from the first wireless network management terminal to the second wireless network management terminal, it holds pre-key information shared with the first wireless network management terminal, 13. The communication system according to claim 12, wherein when connecting to the first wireless network management terminal again, key information that is held is used instead of key update.

Images