Wireless communication apparatus

The present invention relates to a wireless communication system, a wireless communication device, and a wireless communication method, and more particularly to a wireless communication system composed of a plurality of wireless terminal devices and access points.

As a wireless LAN, a wireless LAN system based on IEEE802.11 (the IEEE802.11 system shall include an IEEE802.11a system, an IEEE802.11b system, etc.) is known in Non-Patent Document 1. In this wireless LAN system, a method called WEP (Wired Equivalent Privacy), which can ensure privacy in the same way as wired, is applied as an encryption method. Therefore, the security level of wireless LAN based on IEEE802.11 includes WEP mode to which WEP is applied and non-WEP mode to which WEP is not applied.

In the actual wireless LAN product conforming to IEEE 802.11, communication is possible in either WEP mode to which the encryption method called WEP is applied or non-WEP mode to which it is not applied, and WEP is applied. In the WEP mode, there are 64-bit and 128-bit encryption modes with different encryption levels, and one of them is applied to each communication or each connection link in the wireless LAN to realize communication. Here, the higher the encryption level, the higher the security level and the stronger the encryption.

As a form of wireless LAN in accordance with IEEE802.11, it is composed of one access point (hereinafter, also referred to as a base station) and a plurality of wireless clients (hereinafter, also referred to as terminals) connected to this access point. There is a configuration unit called BSS (Basic Service Set), and there is a system in which multiple BSSs are prepared and a network is constructed.

The structural element that connects the BSSs is called the DS (Distribution System). The base station, that is, the access point has a function of connecting to this DS, and information is transmitted between the BSS and the DS via the access point. Therefore, the terminal can also communicate with a terminal belonging to another BSS via the access point.

A terminal belongs to a BSS, and in order to communicate with a terminal belonging to another BSS via a base station, an authentication and association procedure is carried out with the base station. Also, when the terminal wirelessly reconnects to another access point, a reassociation procedure is executed.

In the wireless LAN defined by IEEE802.11, the types of frames to be exchanged are a control frame for access control, a management frame such as a beacon, and a data frame for data communication. There is (data frame). Here, a management frame is used for the processing of authentication, association, and association.

Whenever the terminal sends or receives a data frame to or from the access point, the authentication and association processing is executed before that.

In the wireless LAN defined by IEEE 802.11, the base station is inquired whether the terminal uses WEP, which is an encryption method. That is, in an authentication request, the terminal requests the base station to use WEP, and the base station that receives this request is between the base station and the terminal if WEP can be used. Authentication frame is sent and received at. WEP can be used based on the transmission and reception of such authentication frames.

As another form of wireless LAN defined by IEEE 802.11, there is BSS that exists independently of the existing infrastructure, and this is called IBSS (Independent Basic Service Set). In IBSS, no access point is prepared, and IBSS corresponds to a communication mode in which terminals communicate directly with each other. Further, in IBSS, the association processing is not executed, and similarly, the reassociation processing is not executed. With this IBSS, data frames can be sent and received between terminals without undergoing authentication processing.<nplcit num="1"><text>ISO / IEC 8802-11: 1999 (E) ANSI / IEEE Std 802.11, 1999 edition</text></nplcit>

<p> In this way, in the conventional wireless LAN, communication data is encrypted as one of the security measures. Whether or not to use the encryption function (WEP function) for communication is requested by the side that issued the connection request, for example, the side that received the connection request from the terminal, for example, the access point. The base station that receives this request accepts the request and encrypts the data communication with the terminal if the WEP function that meets the request can be used. In addition, the security level at which communication is performed is also determined by the side that issued the connection request.</p><p> In the future, in addition to WEP, it is presumed that multiple types of encryption methods with different levels of encryption, such as encryption methods with a higher security level than WEP, will be adopted for wireless LAN. Therefore, it is required that the security level can be finely set according to the type of encryption method, the encryption level, and the like.</p><p> However, with conventional wireless LANs, it is not possible to create a system in which the minimum encryption level is set in advance for each BSS to ensure security, and only communication with encryption having a higher level is allowed. During communication, there is a problem that a detailed security level cannot be set according to the type of encryption method, encryption strength, and the like.</p><p> Furthermore, since IBSS does not require authentication when transmitting a data frame, there is a problem that it is not possible to ensure the security in the system by transmitting an unencrypted data frame.</p><p> In addition, it is not possible to secure the security level defined for each BSS in the DS communication that communicates between a plurality of BSSs in the same way that the security level predetermined for each BSS cannot be ensured. There is a problem.</p><p> The present invention has been made in view of the above circumstances, and an object thereof is a wireless communication system and a wireless communication device capable of wireless communication while ensuring a minimum security level by encryption predetermined by a communication group. To provide a wireless communication method.</p>

<p> According to the present invention, a frame generator that generates a first MAC frame having a first frame control field and a data field, wherein the frame control field includes a type field and an encryption field, and the MAC frame is The fact that it is classified into a management frame is described in the type field, the presence / absence of encryption is described in the encryption field, the data field includes management data, and the management data of the first MAC frame is notification security. Provided is a wireless communication device comprising: a frame generator including a security level field in which a level is described, and a transmission device for transmitting the first transmission frame.</p>

<p> As described above, according to the present invention, for each basic wireless LAN group (communication group) such as BSS and IBSS, wireless communication that secures the minimum security level by encryption predetermined in each group. Can be done. Further, in communication between a plurality of wireless communication devices, at least one of the plurality of wireless communication devices has a communication group (for example, BSS) in which a minimum security level (minimum security level) is predetermined. And IBSS), the security level above the minimum level can always be ensured.</p>

Hereinafter, embodiments according to the wireless communication system of the present invention will be described with reference to the drawings. First, in the wireless LAN system according to the following embodiment, a plurality of types of encryption methods can be applied, the types of the encryption methods are distinguished, and the security level in which the encryption level is ranked is predetermined. If there are different levels for each of the multiple types of encryption, each encryption level for that type of encryption will be ranked according to the degree of encryption strength, and one for each. The security level is set. Therefore, even if they have the same encryption strength, different types of encryption methods are given different security levels. For example, it is assumed that there are n security levels such as enc.0, enc.1, enc.2, ..., enc. (N-1) in order from the one with the lowest encryption strength. Even if there are multiple types of encryption methods of the same strength, security levels with different ranks shall be set for each type. In this way, one type of encryption method corresponds to one security level, and even if the same type of encryption method has multiple levels due to the difference in encryption strength, each of them. The security level corresponding to the level of is determined.

By the way, in the current wireless LAN system specified in IEEE 802.11, the lowest security level corresponds to the level without encryption, that is, the level to which WEP (Wired Equivalent Privacy) is not applied.

In the current wireless LAN products that comply with the IEEE 802.11 regulations, even if WEP is applied, there are two levels, such as configuring WEP with 64 bits or 128 bits. Therefore, in the example of the following embodiment, 64-bit WEP with (1) "without WEP" and (2) "with WEP" is used as multiple security levels, as in the case of wireless LAN according to the current IEE802.11. The case where there are three levels of ", (3)" with WEP and using 128-bit WEP "will be described as an example. In this case, the highest security is (3) "Use 128-bit WEP with WEP", followed by (4) "Use 64-bit WEP with WEP". There is. That is, "enc.0" corresponds to (1) "without WEP", "enc.1" corresponds to (2) "with WEP and 64-bit WEP is used", and "enc.2" corresponds to ( 3) It shall correspond to "with WEP and using 128-bit WEP".

In the following description, the case of only one type of encryption method called WEP will be described. However, even if it is an encryption method other than WEP, if a plurality of levels can be set according to the difference in the type of encryption method and the strength of security, any encryption can be set as in the following embodiment. The present invention can be applied even in the case of the encryption method.

In the following embodiments of the present invention, the case where the present invention is applied to the wireless LAN system specified in IEE802.11 will be described. In particular, a case where the wireless communication device of the present invention is applied to a base station or a terminal constituting a wireless LAN system specified in IEE802.11 will be described.

(First Embodiment) First, as a wireless communication system, a plurality of terminals, for example, two terminals (WL11 to WL12) and the terminals (WL11 to WL12) are wirelessly connected to the first embodiment of the present invention. A communication system in which the base station AP1 constitutes one BSS (basic service set) will be described.

FIG. 1 schematically shows the first BSS (hereinafter, simply referred to as BSS1). The BSS1 is composed of a base station AP1 as an access point and a plurality of terminals connected to the base station AP1, for example, two wireless terminals (hereinafter referred to as terminals) WL11 and WL12 here.

Note that FIG. 1 also shows the base station AP2 belonging to the second BSS (hereinafter, simply referred to as BSS2) different from the first BSS1 and the terminal WL13 which is not subscribed to BSS1 and BSS2.

BSS1 has the lowest security level (enc_low) allowed there. In the wireless communication system according to this embodiment, the lowest security level (enc_low) allowed by BSS1 is the security level "enc.1". In Fig. 1, the fact that the minimum security level (enc_low) allowed is the security level "enc.1" is shown as enc_low = enc.1. It is assumed that the base station AP1 supports not only the security level "enc.1" but also the security level "enc.2" which is higher than the security level "enc.1". Therefore, the highest security level (enc_high) that can be used with BSS1 is "enc.2". In Fig. 1, the fact that the highest security level (enc_high) is "enc.2" is expressed as enc_high = enc.2. It is set in advance in the base station AP1 that the base station AP1 and the terminal or the base station connected to the base station AP1 communicate with each other at a security level of "enc.1" or higher. Similarly, it is set in advance in the base station AP1 that communication with the terminal or the base station for relaying the base station AP1 and communicating with other devices is performed at a security level of "enc.1" or higher. Has been done.

On the other hand, the security levels of the terminal WL11 are "enc.0" and "enc.1", and the security levels of the terminal WL12 are "enc.0", "enc.1" and "enc.2". To do.

FIG. 2 shows a block of the circuit configuration of the base station AP1 shown in FIG. In the following description, when it is not necessary to distinguish between base station AP1 and base station AP2, or when the description is common to both, it is simply referred to as base station AP.

In FIG. 2, in the receiving unit 11, the transmitting signal from the terminal is received by the antenna 20, and the received signal is generated by a process including demodulation and decoding. The transmission unit 12 generates transmission signals to be transmitted to the terminal via the antenna 20, and these transmission signals are supplied to the antenna 20.

The received signal from the receiving unit 11 is input to the receiving control unit 13, for example, the IEEE802.11 system (in the following description, the IEEE802.11 system is the IEEE802.11a system, the IEEE802.11b system, and the IEEE802 to be formulated in the future. .11 The system shall also be included.) Prescribed reception processing, etc. shall be implemented. The reception control unit 13 executes decryption processing corresponding to each of the plurality of security levels supported by the base station, and the received signal is decrypted and converted into composite data. This complexed data is supplied to the information processing unit 15, divided into video, audio, text and other types of data, and is subjected to necessary processing.

Based on the data supplied from the information processing unit 15, the transmission control unit 14 generates data for broadcasting to the terminal or transmitting by unicast, and other predetermined transmission processing conforming to IEEE 802.11. To carry out. The transmission control unit 14 applies encryption processing corresponding to each of the plurality of security levels supported by the base station to the data to be transmitted. The data generated by the transmission control unit 14 is transmitted to the terminal as a transmission signal via the transmission unit 12. The security table 21 shown in FIG. 2 will be described later.

FIG. 3 schematically shows an example of the circuit configuration of the terminals WL11, WL12, and WL13 shown in FIG. 1 in blocks. In the following description, when it is not necessary to distinguish terminals WL11, WL12, WL13, etc., or when the description is common to all terminals, it is simply referred to as terminal WL.

The terminal WL includes an antenna 100, a receiving unit 101 that receives a received signal via the antenna 100, a receiving control unit 105 that controls the receiving unit 101, a transmitting unit 107 that transmits a transmitting signal via the antenna 100, and the transmitting unit 107. It is composed of a transmission control unit 106 for controlling the above, an information processing unit 108 for generating or processing received data, for example, displaying on a display unit (not shown), and a security table 110.

The information processing unit 108 receives data from the wired network 109 connected to the information processing unit 108, or creates transmission data based on the data generated by the user's operation. When the transmission of the transmission data is instructed by the user and a transmission request is generated, the transmission data receives the transmission request and passes the transmission data to the transmission unit 107. In the transmission unit 107, this transmission data is converted into digital data defined by the standard, for example, an IP packet is converted into a MAC frame (medium access control frame) specified by IEEE802.11, and the MAC frame as digital data is converted. It is converted into a radio signal of a predetermined frequency, for example, 2.4 GHz, and transmitted as radio waves from the antenna 100.

On the other hand, the received signal received by the antenna 100 is converted into a MAC frame as digital data by the receiving unit 101, and the received data is extracted from the information field in the MAC frame and sent to the information processing unit 108. The information processing unit 108 performs processing such as displaying received data on a display. The information processing unit 108 may perform various types of information processing in addition to the above. The security table 110 will be described later.

As shown in Fig. 4, the MAC frame specified by IEEE802.11 contains a maximum of 30 bytes of MAC header containing various control information, a data field (frame body) containing up to 2312 bytes of data, and data. It consists of a frame check sequence (FCS) field to check if it was sent correctly. In the MAC header, the frame control field that stores the information that controls the MAC frame, the waiting time (duration) until the terminal can send data, or the ID of the terminal called the association ID in IEEE 802.11 is described. Contains the Duration / ID field that has been created. If the BSS has a base station AP, the MAC address of the base station AP is described as the ID of this BSS. Further, in the MAC header, a field of address 1 to a field of address 4 and a sequence control field are prepared. When a data frame is sent from one access point to another, addresses 1 to 4 are assigned as follows. That is, the MAC address of the final destination (Destination Address) in the communication system is described in the field of address 1, and the MAC address of the source (Source Address) in the communication system is described in the field of address 2. In the field of address 3, the MAC address of the destination that directly sends the MAC frame is described, and in the field of address 4, the MAC address of the source that directly sends the MAC frame is described.

The frame control of the MAC frame is provided with a protocol version field that describes the protocol version, followed by a type field and a subtype field. There are three types of MAC frames, and these types are described in the type field (2 bits) in the frame control. Also, the subtypes of that type are shown in more detail in the subtype field (4 bits). That is, there are (1) management frame, (2) control frame for access control, and (3) data frame for data communication as types. (1) The management frame includes a beacon, an authentication frame, an association frame, an association request frame, an association response frame, and the like as subtypes. In addition, (2) control frames include ACK (Acknowledgment), RTS (Return To Send), and CTS (Clear To) as subtypes. There is a control frame such as Send). The subtype field (4 bits) shows in more detail the subtypes in a particular type of MAC frame as described above.

The frame control includes a To DS field (1 bit) and a From DS field (1 bit). These are used when the MAC frame is a data frame, and in other types of frames, for example, authentication or association frames, "0" is always written and used. Not done. When the MAC frame is a data frame, if the data destination is a wired LAN, access point or DS, 1 bit is described in this To DS field, and the data source is a wired LAN, access point or DS. If so, a bit of 1 is written in this From DS field. Frame controls include reserved fields, WEP fields, and order fields. Other fields such as field) are further prepared. Information can be written by the user to a reserve field that is not yet specified. As shown in FIG. 4, some fields are reserved according to either the frame type and subtype or the frame type and subtype. In the embodiment of the present invention, the encryption level may be described in this reserve field as described later. This encryption level is determined according to the attributes of the transmitted data. For content data that requires confidentiality, a high encryption level is set, and the encryption level is described in this reserve field. This reserve field encryption level may be used when handshaking between the access point and the terminal. If WEP is used, 1 bit is set in the WEP field.

BSS1 will be described again with reference to FIG.

In BSS1 shown in FIG. 1, it is predetermined that communication is executed at the minimum security level (here, "enc.1") predetermined for this BSS1. That is, each of the base station AP1 and the terminals WL11 to WL12 constituting BSS1 has a security level of "enc.1" or "enc.1" or higher within the range of the security level supported by the base station AP1. Communication is performed at the security level of.

Each of the base station AP1 and the terminals WL11 to WL12 is provided with a storage unit, and the storage unit is provided with a security table. In the security table of the base station AP1, which is the security level supported by the base station AP1 itself, which is the lowest security level in BSS1 among these security levels, and each of the terminals WL11 to WL12 supports it. What the security level is is memorized. Further, preferably, information necessary for encryption / decryption of each security level, such as an encryption key or seed information for generating an encryption key (information necessary for such encryption / decryption). Here, simply referred to as a cryptographic parameter) is also preferably stored in this security table. In addition, each of the terminals WL11 to WL12 also has a storage unit that stores the security table, the lowest security level among the security levels supported by BSS1, the security level supported by other terminals, and each. Cryptographic parameters and the like corresponding to the security level are stored in the security table.

As shown in FIG. 5, in the security table 21 of the base station AP1, the security level supported by the BSS1 to which the base station AP1 belongs and the security level possessed by all the terminals WL11 to WL12 belonging to the BSS1 are encrypted at each security level. -It is registered in advance together with the encryption parameters that are the data required for compounding. Further, in this security table 21, the security level set as the lowest security level in BSS1 to which the base station AP1 belongs is registered so as to be identifiable. In FIG. 5, a "" mark indicating the lowest level is recorded for the security level enc.1.

As an example, in the case of WEP, the encryption parameters are assumed to be the private key (key1, key2) and IV (Initialization Vector) specified in IEEE 802.11. In the following description, the security level and the cryptographic parameters corresponding to the security level may be referred to as security information.

FIG. 6 shows the registered contents of the security table 110 of the terminals WL11 to WL12 in BSS1. As shown in FIG. 6, the security information possessed by each terminal in BSS1 and the base station AP1 is registered in advance in the security table on the terminal side. As shown in FIG. 6, as the security information corresponding to the base station AP1, only the lowest level security information preset in the BSS1 to which the base station AP1 belongs may be registered. Further, the security table 110 on the terminal side may be exactly the same as the security table 21 on the base station side shown in FIG.

Further, the security level of the base station AP1 and each terminal registered in the security table shown in FIGS. 5 and 6 may be higher than the minimum level predetermined by BSS1. Further, as for the security information corresponding to each terminal, only the security level used in the actual communication may be registered in BSS1. That is, when each terminal is directly linked to the access point, it is security information about the access point, or when it is directly linked to the terminal, it is security information about the terminal, which is supported by the terminal in BSS. Each terminal can hold the security information in the security table.

The security tables shown in FIGS. 5 and 6 are set at the time of initial setting of BSS1. At the time of initial setting, for example, a table in the format shown in FIGS. 5 and 6 may be displayed as a setting screen, and setting items may be input on this screen. In the tables shown in FIGS. 5 and 6, AP1, WL1 and WL2 are identified by the MAC addresses of the base station AP1 and the terminals WL1 and WL2, respectively.

The security tables shown in FIGS. 5 and 6 do not have to have any information written at the time of initialization. However, if the access point AP1 and the terminals WL1 and WL2 are linked in the unencrypted mode as described later with reference to FIG. 7, security information can be written. That is, the access point AP1 and the terminals WL1 and WL2 acquire the security information about the access point AP1 and the terminals WL1 and WL2 and write them in their respective security tables. After that, BSS1 is established by the access point AP1 and the terminals WL1 and WL2, and BSS1 The lowest security level within is sufficient.

In the BSS1 shown in FIG. 1, communication is executed between the base station AP1 and the terminals WL11 to WL12 at a security level equal to or higher than the minimum security level "enc.1" set in advance for the BSS1.

Next, a case where the terminal WL13 not subscribed to the BSS1 is connected to the base station AP1 of the BSS1 shown in FIG. 1 will be described with reference to the flowchart shown in FIG.

The terminal WL13 receives the Beacon frame specified in IEEE 802.11, which is transmitted from the base station AP1. According to the provisions of IEEE 802.11, the reception of a beacon frame is followed by the authentication and association protocols, but during the frame for this authentication or association, the base. The security level of the terminal WL13 is written as the information to be notified to the station AP1.

Figure 7 shows the procedure for notifying the base station AP1 of the security level of the terminal WL13 in the authentication frame as an example. In this procedure, it is assumed that the security levels of the terminal WL13 are "enc.0" and "enc.1".

FIG. 8 (a) shows the format of the frame body in the frame of the authentication as the MAC frame shown in FIG. 4 defined in IEEE 802.11. In the authentication frame, an authentication algorithm that distinguishes between an open system that does not use a common encryption key and a common encryption key system that uses a common encryption key is described. For the authentication algorithm number, for example, "0" is described in the open system, and "1" is described in the common encryption key system. In the open system specified by the authentication algorithm number 0, ATSN (Authentication Transaction Sequence Number) = 1 and = 2 frames are prepared as the authentication request frames as shown in FIG. 8 (b). The authentication frame with ATSN = 1 is sent from the terminal WL to the base station AP1 and its Status Code field (Status Code). field) is considered to be a reserve. The authentication frame of ATSN = 2 is sent from the base station AP1 to the terminal WL, and the status code (Status Code) describes the connection refusal or connection permission code as the status. In the open system identified by the authentication algorithm number 0, the authentication frame does not have a challenge text to be encrypted. In a common encryption key system, ATSN (Authentication Transaction Sequence) is used as an authentication request frame (authentication request). Number) = 1 ~ 4 frames are prepared. The authentication frame of ATSN = 1 and ATSN = 3 is sent from the terminal WL to the base station AP1, and its status code is reserved. The authentication frame of ATSN = 2 and ATSN = 4 is sent from the base station AP1 to the terminal WL, and the status code describes the connection refusal or connection permission code as the status. In the common encryption system, the challenge text for encryption is prepared for the authentication frame of ATSN = 2 and 3, and the authentication frame of ATSN = 3 is encrypted. On the other hand, the challenge text for encryption is not prepared in the authentication frame of ATSN = 1 and 4.

The authentication frame specified by ATSN = 1 is transmitted from the side that issues the connection request. In this request frame, the status code field is reserved and is currently unused. Therefore, the security level "enc.1" or "enc.2" of the side issuing the connection request can be written in this status code field. In the following description of the embodiment, it is assumed that the security level "enc.1" or "enc.2" of the side issuing the connection request is written in the Status code field. In this ATSN = 1 authentication frame, the status code section contains data indicating the security level (for example, "enc. 1") that the transmitter 107 of the terminal WL13 wants to use for communication with the base station AP1. It is written and this ATSN = 1 authentication frame is transmitted to base station AP1 as shown in step S2 of FIG. Note that this security level may be written in any reserve field in the MAC frame shown in FIG.

The processing operation of the base station AP1 that has received the authentication frame of ATSN = 1 will be described. As already described, the beacon frame constantly emitted from the base station AP1 is detected by the terminal WL13 as shown in step S1. After this detection, the transmission control unit 106 of the terminal WL13 prepares an authentication frame with ATSN = 1, and refers to the security table 110 to set the security level at a predetermined position of the frame, for example, the status code in the frame body. Write "enc.1" or "enc.2". For the authentication frame in which the security level is written, specify the base station AP1 corresponding to the beacon frame detected by the transmission control unit 106 of the terminal WL13 as the destination to the address 2, and set the base station AP1 as shown in step S2. Will be sent. The base station AP1 receives the authentication frame, and the reception control unit 13 of the base station AP1 is written to a predetermined position of the received authentication frame of ATSN = 1, for example, a status code in the frame body. Take out the security level "enc.1" or "enc.2" of the terminal WL13 and compare it with the lowest level security level "enc_low" of BSS1 registered in the security table 21 of the base station AP1. As shown in step S3, the security level "enc.1" or "enc.2" of this terminal WL13 notified from the terminal WL13 is the security level "enc.1" or "enc.2" supported by the base station AP1.

In step S3, if the base station AP1 rejects the connection of the terminal WL13, an authentication frame with ATSN = 2 is prepared by the transmission control unit 12 according to the provisions of IEEE802.11, and the connection fails with the status code. A code to that effect is written, and an authentication frame with ATSN = 2 is returned to the terminal WL13 as shown in step S4. The terminal WL13 determines whether the ATSN = 2 authentication frame, which is described as rejecting the connection as shown in step S5, is received for the Nth time. This N times corresponds to the number of security levels (= N) written in the security table 110 on the terminal side. Initially, the terminal WL13 notifies the base station of this low level of security as the security level supported by the base station AP1 is low, and if rejected, raises the security level and raises it as shown in step S2. You will be notified of the security level. When the terminal WL13 receives the authentication frame of ATSN = 2 N times as shown in step S5 by notifying the N security levels supported by the security table 110 on the terminal side. It is determined that the connection is rejected by the base station AP1, and the connection procedure is interrupted at this stage as shown in step S15.

On the other hand, when permitting the connection of the terminal WL13, the base station AP1 complies with IEEE 802.11 as shown in step S6 in order to share the cryptographic parameters corresponding to the security level notified from the terminal WL13 with the terminal WL13. , Prepare an authentication frame with ATSN = 2 to send the challenge text, write the code indicating that the authentication frame with ATSN = 1 was successfully received in the status code of this authentication frame, and step. Reply to terminal WL13 as shown in S6.

When the terminal WL13 receives an authentication frame with ATSN = 2, the security level between the base station AP1 and the terminal WL13, for example, the security level "enc.1" is determined. In addition, the terminal WL13 uses the IV and private key acquired in advance by the user as the encryption parameters corresponding to the security level, and the frame body including the challenge text etc. is shown in step S7 in accordance with the provisions of IEEE 802.11. Encrypt using the WEP function of the terminal WL13. Further, the terminal WL13 prepares an authentication frame with ATSN = 3, and copies the challenge text from the authentication frame with ATSN = 2 into the frame body. The terminal WL13 encrypts the frame and transmits it to the base station AP1 as shown in step S8.

In the base station AP1 that received the authentication frame of ATSN = 3, the secret key of the base station AP1 shared with the terminal WL13 is also in accordance with the provisions of IEEE802.11, and the ATSN received as shown in step S9. The authentication challenge frame of = 3 is decrypted and the stored encryption challenge text is retrieved. This decrypted challenge text is compared with the transmitted challenge text, and encryption / decryption is verified based on the comparison result as shown in step S10.

If the verification result is "failure", an authentication frame with ATSN = 4 is prepared to notify that fact in accordance with the provisions of IEEE802.11, and the status code indicates that the verification result is "failure". The code is written and an authentication frame with ATSN = 4 is returned to terminal WL13 as shown in step S11. "Failure" in the verification result means that the encryption method is different between the base station AP1 and the terminal WL13. Therefore, as shown in step S14, it is confirmed that the authentication frame of ATSN = 4 is within M times, the encryption method in the terminal WL13 is changed and returned to step S2, and steps S2 to S10 are repeated. Is done. Here, M times corresponds to the number of encryption methods prepared by the terminal WL13, and the terminal WL13 can receive the authentication frame of M times ATSN = 4. If the encryption method does not match even if the terminal WL13 receives the authentication frame of ATSN = 4 M times in this way, it is determined that the terminal WL13 is denied the connection with the base station AP1. Therefore, it is assumed that the terminal side does not prepare the encryption method provided by the base station AP1, and the connection procedure is completed as shown in step S15.

On the other hand, if the verification result in step S10 is "successful", the base station AP1 also complies with IEEE802.11 as shown in step S12, and sets an ATSN = 4 authentication frame to notify the terminal WL13. Send to. When the terminal WL13 receives this frame, it starts the association specified in IEEE 802.11, which is the next procedure, as shown in step S12. That is, the terminal WL13 sends an association request frame as shown in step S13 to the base station AP1, and in response to this request, the base station AP1 returns to the association response terminal WL13 according to the rules of IEEE 802.11. The action is performed. After the association is completed normally, data frames are sent and received between the terminal WL13 and the base station AP1. The transmitted / received data frame is encrypted by the encryption predetermined by the above procedure, for example, the 64-bit WEP function corresponding to the security level of "enc.1 = enc.low".

In the terminal WL13 and the base station AP1, when the security level and the encryption parameter of the communication between the terminal WL13 and the base station AP1 are determined, the mutual security information is registered in the security tables 21, 110. That is, in the terminal WL13, the security information of the base station AP1 is registered in the security table 110 after the encryption parameters are acquired in step S7 shown in FIG. Further, in the base station AP1, the security information of the terminal WL13 is registered in the security table 21 after the verification is successful in step S10 of FIG. That is, by selecting an appropriate address field indicating the address of the terminal WL13 in the MAC frame shown in FIG. 4, security information is registered in the security table 21 of the access point AP1 in relation to this address. As shown in FIG. 10, security information whose "connection destination" is the terminal WL13 is newly registered in the security table of the base station AP1. Similarly, the security information whose "connection destination" is the base station AP1 is newly registered in the security table of the terminal WL13. That is, by selecting an appropriate address field indicating the address 1 of the base station AP1 in the MAC frame shown in FIG. 4, security information is registered in the security table 110 of the terminal WL13 in relation to this address. The security level of the security information in the newly added terminal WL13 corresponds to the security level requested by the terminal WL13 in step S2 of FIG.

Further, if the security information of the base station is registered in the security table on the terminal side, the terminal can select the security level equal to or higher than the minimum level of the base station in advance, and as a result, in step S3, the relevant The connection will not be rejected by the base station. Here, the security information of the base station has at least a security level of at least a minimum level predetermined for the BSS to which the base station belongs. In other words, when the terminal reconnects to the base station, the security level specified by the base station is selected from the security levels supported by the terminal itself to the base station, and the step in FIG. 7 is performed. Notify the base station of this security level as shown in S2.

Further, it is preferable that at least the security information of the security level equal to or higher than the minimum level enc_low predetermined in the BSS to which the base station belongs is registered as the security information regarding the terminal WL in the security table of the base station AP. In this registration, regarding the BSS to which the base station belongs, the BSS is specified by the address described in the appropriate address field in the MAC frame shown in FIG. 4, and this address and the security level are described in the security table. If there is such a registration regarding BSS, the security level used for unicast communication from the base station to the terminal can be selected in advance at the minimum level or higher and the security level that the terminal can support. .. In addition, the security level for multicast communication and broadcast communication to the terminal WL in the BSS to which the base station AP belongs is also the minimum level enc_low or higher, and the security level supported by all terminals that should receive it. You can preselect things. That is, as shown in step S5 of FIG. 7, when the connection is rejected by the base station AP1, a security level different from the previously notified security level, preferably a higher level is notified, and the connection is reconnected. Can be requested. While notifying the security level of the terminal WL13 one by one, connection requests can be made up to a predetermined number of times M.

The base station AP1 should notify the connection requesting terminal WL13 of all security levels equal to or higher than the lowest security level enc_low preset in BSS1 or the lowest level enc_low supported by the base station AP1. You can do it. This notification may be notified using a currently unused frame among the management frame and control frame of the MAC frame specified in IEEE 802.11. For example, the management frame corresponds to a frame having a subtype of "0110" to "0111", and the control frame corresponds to a frame having a subtype such as "0000" to "1001". In step S4 shown in FIG. 7, when the base station AP1 refuses to connect to the terminal, after transmitting an authentication frame with ATSN = 2, this unused frame is transmitted to provide security of the minimum level enc_low or higher. You may want to notify the terminal WL13 of all the levels. Further, in step S4 or step S6, an unused frame may be transmitted before the authentication frame with ATSN = 2 is transmitted to notify the terminal WL13 of all the security levels equal to or higher than the minimum level enc_low. In addition, the access point AP1 sends unused frames at an appropriate time, such as during authentication or association processing, or before the start of data frame transmission / reception, and the security level is at least the lowest level enc_low. You may notify the terminal WL13 of everything.

As shown in Fig. 9 (a), Fig. 9 (b) and Fig. 9 (c), the frame of the MAC frame association specified in IEEE 802.11 is the "Capability information (Capability) of the frame body. A reserve field is provided as an unused area in "information)". Utilizing this unused area, the base station AP1 sends the connection requesting terminal WL13 to the lowest security level enc_low of BSS1 or all the security levels higher than the lowest level enc_low supported by the base station AP1. May be notified to the terminal WL13.

As described above, in the first embodiment, when a terminal WL11 belonging to BSS1 and a terminal WL13 not belonging to BSS1 other than Wl12 try to connect to the base station AP1, first (1) this terminal WL13 , Notify the base station AP1 of the security level of the terminal WL13 itself. In the flow shown in Figure 7, this notification utilizes an authentication frame.

(2) In the base station AP1, when the security level notified from this terminal WL13 is the security level supported by the base station AP1 and is equal to or higher than the security level of the minimum level enc_low predetermined in BSS1. Allow the connection of terminal WL13 and continue the processing operation for connection. However, when the security level notified from the terminal WL13 is less than the minimum security level predetermined in BSS1, the connection of the terminal WL13 is rejected.

(3) When the connection from the terminal WL13 is permitted, the recognition process for sharing the information for encryption / decryption, that is, the encryption parameter is executed as necessary.

As described above, according to the first embodiment described above, wireless communication that secures the minimum security level by encryption predetermined by each group is realized for each basic group of wireless LAN such as BSS. ..

Preferably, in the case of (1) above, if the terminal WL13 notifies the base station AP1 of the security level of the highest level enc_high among the security levels supported by the terminal WL13 itself, the base station AP1 connects to the terminal WL13. There are fewer opportunities to refuse. Further, if the security level of the highest level enc_high is notified to the base station AP1, it is possible to determine whether or not the connection with the base station AP1 is possible with one connection request, and as a result, unnecessary traffic can be reduced.

In addition, each base station or terminal in BSS1 should register security information with a security level equal to or higher than the minimum level enc_low predetermined in BSS1 used when communicating with the base station or terminal in BSS1 in the security table. Is preferable. The base station or each terminal refers to this security table and selects in advance the minimum security level at which the connection is not denied as the security level to be notified when the connection request is made to the desired terminal or base station specified by the address. be able to.

In the first embodiment described above, in step S2, the terminal WL13 notifies the base station AP1 of only one security level that the terminal WL13 wants to use in communication with the base station AP1, but this is limited to this case. It is clear that this is not the case. The terminal WL13 may notify the base station AP1 of all, or if not all, security levels of the terminal WL13 itself. Further, among the security levels supported by the terminal WL13, only the highest security level enc_high may be notified from the terminal WL13 to the base station AP1.

In step S2, the processing operation of the base station AP1 in the case of notifying all, if not all, of the security levels of the terminal WL13 itself will be described.

In step S2 shown in FIG. 7, a plurality of security levels possessed by the terminal WL13 itself are transmitted to the base station. In base station AP1, in step S3, whether this security level includes the security level enc_low or higher, which is equivalent to the lowest level in BSS1, and the security level supported by the own device. to decide. The base station AP1 determines that the connection of the terminal WL13 is permitted when the supported security level is included. In addition, the base station AP1 determines that the connection of the terminal WL13 is rejected when the supported security level is not included. If the connection of the terminal WL13 is rejected, the process proceeds to step S4. When permitting the connection of the terminal WL13, the base station AP1 then selects a security level equal to or higher than the lowest level enc_low in BSS1 among the security levels supported by both the terminal WL13 and the base station AP1. When there are multiple security levels equal to or higher than the minimum level enc_low in BSS1, the base station AP1 selects one of them. Regarding this selection, there are the lowest, the highest, and various other selection criteria, but any one of them may be selected. The base station AP1 uses one selected security level as the security level used for communication with the terminal WL13. For example, if the security levels notified from the terminal WL13 are "enc. 0" and "enc. 1", the connection of the terminal WL13 to the base station AP1 is permitted, and the connection between the terminal WL13 and the base station AP1 is permitted. The communication security level is selected as "enc. 1".

When it is necessary to notify the terminal WL13 of this selected security level, for example, in step S6 of FIG. 7, before transmitting the authentication frame of ATSN = 2, the above-mentioned IEEE 802.11 is notified. Of the specified MAC frame management frames and control frames, currently unused frames may be used.

The terminal WL13 is notified of the selected security level and can prepare for the subsequent processing.

Within BSS1, if the security level is equal to or higher than the minimum level enc_low predetermined for BSS1, it is not always necessary to communicate at the same security level.

Further, in BSS1, communication may be performed at different security levels depending on the connection partner. That is, here, as long as the base station AP1 has a security level equal to or higher than the minimum level enc_low predetermined in BSS1, there is no particular limitation on communicating with which terminal at which security level. By communicating with the base station AP1 at a different security level for each terminal, the confidentiality of wireless communication can be improved.

Figure 7 has been described as the operation when connecting between terminals WL13 that are not subscribed to BSS1 and base station AP1, but the terminals WL13 described above are replaced with terminals WL11 to WL12 that are subscribed to BSS1 respectively. You may. When each of the terminals WL11 to WL12 tries to connect to the base station AP1, if the procedure shown in FIG. 7 is followed, in step S2 of FIG. 7, a different security level is notified each time, and each connection is made. , The security level can be changed according to the purpose. In this case, since the lowest security level of BSS1 is registered in the security table of each terminal, the security level higher than this lowest level is selected from the security levels supported by each terminal, and that step is taken. Notified by S2. It is also possible to change the cryptographic parameters (in the case of WEP, such as private key and IV) during subsequent authentication without changing the security level.

Similarly, the procedure for requesting a connection from a terminal to a base station described in FIG. 7 can also be applied as a procedure for requesting a connection from a base station to a base station belonging to different BSSs. That is, the terminal WL13 described in FIG. 7 can be replaced with the base station AP1, and the base station AP2 can be replaced with a base station belonging to another BSS different from BSS1, for example, here, the base station AP2 of BSS2. As described above, according to the first embodiment, even in the communication between base stations, that is, the DS communication, the communication is realized at the minimum security level or higher of each.

When a terminal in BSS1, for example, terminal WL11 communicates with another terminal in the same BSS1, for example, terminal WL12, it may always connect to and communicate with base station AP1 via base station AP1. , Direct communication may be performed between terminals without going through the base station AP1.

When the terminals WL11 to WL12 and the base station AP1 try to connect to the other party registered in their respective security tables, the authentication for sending and receiving the security level and the encryption parameter may be omitted. On the side receiving the connection request, if the source of the frame is registered in its own security table, the security table is referred to and the security level is higher than the predetermined minimum level in BSS1. You just have to communicate with the requester.

Only the security level security information used in the communication between them in the past may be registered for each connection partner in the security tables of the base station AP1 and the terminals WL11 to WL12. This registered security information corresponds to the security level equal to or higher than the lowest level enc_low in BSS1.

At the time of initial setting, the security tables of the base station AP1 and terminals WL11 to WL12 in BSS1 all have the same contents, and each device that constitutes BSS1 is supported as shown in Fig. 5. The security information of all the security levels to be used and the security level set as the minimum level in BSS1 may be registered.

In BSS1, the base station AP1 and terminals WL11 to 12 also support "enc. 1", which is the lowest security level allowed by BSS1. Therefore, when any of the terminals WL11 to WL12 multicasts or broadcasts a data frame or the like within BSS1, the frame body of that frame shall be encrypted with the lowest security level allowed. As a result, the lowest security level that BSS1 allows can be ensured.

Further, in the first embodiment described above, IEEE 802.11 defines a check of the security level supported by the connection request source and a recognition process for sharing the encryption parameter between the connection request source and the connection request destination. It is done collectively at the time of authentication. However, these two processes can be separated and the former can be executed at the time of association specified in IEEE 802.11. It is also conceivable that the association is performed first, and then the authentication is performed. In this case, the above two processes may be performed together at the time of authentication, or may be performed separately at the time of association and at the time of authentication. However, when the above two processes are separated, it is preferable to perform the security level check prior to the recognition process for sharing the cryptographic parameters in order to ensure security.

(Second Embodiment) Communication relating to the second embodiment in which the base station of BSS1 as shown in FIG. 1 in which the minimum security level is predetermined broadcasts the minimum security level defined in the BSS1. The system will be described. In this description, in the communication system according to the second embodiment, the same description as that of the first embodiment will be omitted, and the differences thereof will be described with reference to FIG.

In the communication system according to the second embodiment, the minimum security level of the BSS is written in the beacon frame specified in IEEE 802.11, and the beacon frame is transmitted. FIG. 11 is specified in IEEE 802.11. The format of the frame body of the beacon frame having the structure of the MAC frame is shown. A reserve field is provided as an unused area in the "Capability information" of this beacon frame. Base station AP1 writes to this reserve field the lowest security level of BSS1 or all, or if not all, security levels above the lowest level supported by base station AP1, and that security level. Is notified to the terminal WL.

The transmission control unit 14 of the base station AP1 applies the lowest security level of BSS1 or all the security levels of the lowest level or higher supported by the base station AP1 to the beacon frame, or a plurality of security levels if not all. Write and broadcast. As shown in step S21 of FIG. 12, the terminal receives this beacon frame. The beacon frame can also receive a terminal that does not subscribe to BSS1, for example, the terminal WL13 shown in FIG.

The receiver 101 of the terminal WL13 extracts the lowest security level of BSS1 written in the received beacon frame as shown in step S22, and sets the security level supported by the terminal WL13 to the security level BSS1 as shown in step S23. Check if there is anything above the minimum level of. Here, all the security levels supported by the terminal WL13 may be registered in the security table of the terminal WL13 in advance. If the security level of the terminal WL13 is not higher than the minimum level of BSS1, the connection with the base station AP1 is stopped and the connection process is terminated.

Here, the lowest security level of BSS1 is "enc.1", and the terminal WL13 supports "enc.0" and "enc.1", so the terminal WL13 connects to the base station AP1. It is possible. Since the security level of the terminal WL13 is higher than the minimum level of BSS1, the terminal WL13 selects this security level of "enc.1" and starts a connection request to the base station AP1. That is, the process proceeds to step S2 of FIG. 7, the selected security level is notified, and the same operation as the description of the first embodiment is performed below.

However, in this case, since it can be expected that the security level equal to or higher than the minimum level is always notified from the terminal WL side, step S3 in FIG. 7 may be omitted in the base station AP1. Further, in step S2, the terminal WL13 selects a security level equal to or higher than the minimum level of BSS1 notified by the beacon frame from the security levels of the terminal WL13 itself (when there are a plurality of such security levels). , All of them, or some of them, or one of them may be selected, for example, the one with the highest security level, the one with the lowest security level, or the desired one.) Notify the base station AP1.

In this way, the base station AP1 of BSS1 whose minimum security level is predetermined broadcasts the minimum security level of the BSS, so that the terminal WL13 can connect to the other party at the security level supported by itself. Since the connection is started after selecting in advance, unnecessary traffic can be reduced.

In addition, the terminal WL13 can send a probe request frame to the base station AP1, and the base station AP1 can notify the security level by the probe response frame.

(Third Embodiment) In the first embodiment described above, the case where the authentication and the association specified in IEEE802.11 are carried out in this order has been described, but the association is first performed and then the authenticity is performed. It is also expected that the application will be implemented. In the third embodiment, this case will be described by taking the case of BSS1 shown in FIG. 1 as an example and referring to the flowchart shown in FIG.

Here, as in the first embodiment, the case where the terminal WL13 which is not subscribed to the BSS1 requests the connection to the base station AP1 of the BSS1 will be described, and only the part different from the first embodiment will be described.

The terminal WL13 receives the beacon frame transmitted from the base station AP1 as shown in step S31, and then transmits the association request frame to the base station AP1 as shown in step S32 in order to connect to the base station AP1. ..

As described above, the frame of the MAC frame association specified in IEEE 802.11 is the "capacity" of the frame body as shown in FIGS. 9 (a), 9 (b) and 9 (c). An unused area, that is, a reserve field, is prepared in "Capability information". The transmitter 107 of the terminal WL13 writes at least one desired security level supported by the terminal WL13 to this reserve field and transmits it to the base station AP1 as shown in step S32. For example, here, the transmitter 107 of the terminal WL13 writes data indicating "enc.1" of one of all the security levels ("enc.0" "enc.1") of the terminal WL13 to the reserve field. , Shall be transmitted to the base station AP1.

The processing operation of the base station AP1 that has received this is the same as that of the first embodiment. That is, the reception control unit 13 of the base station AP1 takes out the security level of the terminal WL13 written in the request frame (Association Request) of the received association, and registers this security level in the security table 21 of the base station AP1. Compare with the lowest security level of BSS1. When the security level of this terminal WL13 notified from the terminal WL13 is the security level supported by the base station AP1 and is higher than the lowest security level in BSS1, the connection of the terminal WL13 is performed as shown in step S33. Judge to allow. If the security level is lower than the minimum security level of BSS1, it is determined that the connection of the terminal WL13 is rejected as shown in step S33. That is, when rejecting the connection of the terminal WL13, for example, according to the provisions of IEEE802.11, as shown in step S34, the association response frame (Association Response Status). Write a code indicating that the connection has failed in code) and reply to the terminal WL13. Upon receiving this frame, the terminal WL13 determines that the connection has been rejected by the base station AP1 and interrupts the connection procedure at this stage.

On the other hand, when the connection of the terminal WL13 is permitted, the association responds in accordance with the provisions of IEEE 802.11 for communication using "enc. 1", which is the lowest security level of BSS1 notified from the terminal WL13. Write a code indicating that the connection is successful in the frame (Status code of Association Respose), and reply to the terminal WL13 as shown in step S36.

In response to this, the terminal WL13 transmits an authentication frame as shown in step S37 for the authentication process for sharing the cryptographic parameters between the terminal WL13 and the base station AP1 in accordance with the provisions of IEEE 802.11. To do. The processing of the authentication after the transmission of the authentication frame is executed in accordance with the provisions of IEEE 802.11. Since this process complies with the provisions of IEEE 802.11, its description will be omitted.

It should be noted that, in the case of this third embodiment, the same effect as in the case of the first embodiment can be expected, and it goes without saying that a number of variations as described in the first embodiment can be applied. Nor.

(Fourth Embodiment) Next, when a terminal communicates while moving between the areas of a plurality of base stations, FIG. 1 shows a method for ensuring the security level for each area, that is, for each BSS. A wireless LAN system will be described as an example. This fourth implementation is a method for ensuring a predetermined minimum security level for each BSS to which each base station belongs, even in a situation where the terminal WL is moved, that is, in a so-called mobile environment. It will be described in the form. Basically, as described in the first embodiment above, each BSS base station receives a connection request from a terminal and is notified of the security level by the terminal, which is then sent to its own BSS. It is the same in that the connection of the terminal is permitted and the authentication process for sharing the encryption parameter is executed between the base station and the terminal only when the security level is equal to or higher than the predetermined minimum security level.

For example, in the wireless LAN system specified in IEEE 802.11, if the terminal WL13 in Fig. 1 was connected to the base station AP2 and moved into the area of the base station AP1, the terminal WL13 and the base station Reassociation is executed with AP1. Then, when this reassociation procedure is completed normally, data frames are transmitted and received.

In this fourth embodiment, the security level of the terminal WL13 is notified from the terminal WL13 to the base station AP1 by using the unused area in the reassociation request frame (Reassociation Request).

Hereinafter, in the wireless LAN system shown in FIG. 1, the flowchart shown in FIG. 15 is shown for the case where the terminal WL13 moves from the area of the base station AP2 to the area of the base station AP1 and the reassociation is performed for the base station AP1. It will be explained with reference to. In FIG. 15, the same parts as those in FIG. 13 are designated by the same reference numerals, the description thereof will be omitted, and different procedures will be described.

After receiving the beacon frame transmitted from the base station AP1 as shown in step S31, the terminal WL13 transmits a reassociation request frame to the base station AP1 as shown in step S51 in order to connect to the base station AP1. ..

As shown in FIGS. 14 (a) to 14 (c), an unused area, that is, a reserve field, is included in the "Capability information" of the frame body of the MAC frame association frame specified in IEEE 802.11. Is prepared.

As shown in step S51, the transmission unit 107 of the terminal WL13 writes at least one desired security level supported by the terminal WL13 to this reserve field and transmits it to the base station AP1. For example, here, the transmitter 107 of the terminal WL13 writes the data indicating enc.1 among all the security levels (enc. 0 and enc.1) that it has, and writes the data indicating enc.1 to the base station AP1. Send.

The processing operation of the base station AP1 that has received the frame of this association is the same as the description of FIG. 13, so refer to the description of step S33 of FIG. However, if the connection of the terminal WL13 is rejected in step S33, a code indicating that the connection has failed is written in the status code of the reassociation response frame in accordance with the provisions of IEEE802.11, and as shown in step S52. It is returned to the terminal WL13. Also, to allow the connection to the terminal WL13 If that, according to the specification of the IEEE802.11, the status code of the reassociation response frame, connection is written code that is successful, the terminal WL13 as shown in step S53 Will be replied.

When the base station AP1 allows the connection of the terminal WL13, it is required that the encryption parameters are shared between the base station AP1 and the terminal WL13. Therefore, as shown in steps S37 to S44 of FIG. 15, the authentication process for sharing the encryption parameters between the terminal WL13 and the base station AP1 in accordance with the provisions of IEEE802.11, as in FIG. That is, the procedure for authentication may be taken.

Further, in the request frame for the association from the terminal WL13, the address of the base station to which the terminal WL13 is currently connected, that is, the base station AP2 is described. This address corresponds to the "Current AP address" shown in FIGS. 14 (a) to 14 (c). Therefore, as shown in Fig. 15, the authentication procedure was not taken and the "current AP address (Current AP)" was not taken. Based on "address)", the base station AP1 connects to the base station AP2. Then, the base station AP1 requests the transfer of the security information about the terminal WL13 registered in the security table of the base station AP2, and after the transfer of the security information, the security information is registered in the security table. good. As a result, the encryption parameters are shared between the base station AP1 and the terminal WL13. Therefore, after the terminal WL13 is allowed to connect from the base station AP1 shown in step S53, the terminal WL13 is encrypted at the same security level, similar to the communication between this terminal WL13 and the base station AP2. Data frames can be sent and received to and from the base station AP1.

In the communication system according to the fourth embodiment, the same effect as in the first embodiment can be expected, and many variations as described in the first embodiment can be applied. Needless to say.

(Fifth Embodiment) As described above, in the communication system according to the first to fourth embodiments, the terminal WL13 is equal to or higher than the minimum level predetermined for the BSS1 to which the base station AP1 belongs with the base station AP1. Communication can be realized at the security level. However, when the terminal WL13 communicates with the base station AP1 and at the same time the terminal WL13 communicates with a terminal other than the base station AP1 that is not subscribed to BSS1 or another radio station, the security level of communication between them is set in advance in BSS1. If it is lower than the minimum level set, it cannot be said that the minimum level of security of BSS1 is secured as a result. Therefore, in the communication system according to the fifth embodiment, as shown in FIG. 16, when the terminal WL13 is already wirelessly connected to a certain terminal WL14, even if the terminal WL13 requests the base station AP1 to connect. , The minimum level of security set in advance for BSS1 can be ensured by following the procedure described below.

When the terminal WL13 is wirelessly connected to another terminal or base station at a security level less than the minimum security level predetermined in BSS1, the terminal WL13 is connected to the base station or terminal in BSS1. Is basically disabled. Therefore, in order to connect to a terminal or base station in BSS1, such a low security level wireless connection must be disconnected in advance, or the security level of the wireless connection must be raised to the minimum level of BSS1 or higher. Is required.

Hereinafter, the procedure for that purpose will be described by omitting the description of the common procedure described in the first to fourth embodiments and explaining different procedures.

In FIG. 16, the same parts as those in FIG. 1 are designated by the same reference numerals, and the description thereof will be omitted. It is assumed that the security level supported by the terminal WL14 shown in FIG. 16 is only "enc. 0". When the terminal WL13 initiates a request for connection to the base station AP1, it is assumed that the terminal WL13 is already wirelessly connected to the terminal WL14 and the communication security level during that time is "enc.0".

In such a state, a case where the terminal WL13 starts a connection request to the base station AP1 of BSS1 will be described.

First, as described in the second embodiment, the case where the BSS1 is notified of the minimum security level predetermined by the beacon frame will be described with reference to the flowchart shown in FIG. In this case, the terminal WL13 knows that the lowest security level that can wirelessly connect to the base station AP1 from the received beacon frame is "enc.1". Therefore, the terminal WL13 executes the processing operation shown in FIG. 17 before proceeding to step S32 in FIG.

In step S61 of FIG. 17, it is confirmed whether the security level of the terminal WL13 has a security level equal to or higher than the minimum level enc.1 allowed by BSS1. If the terminal WL13 has a security level of "enc.1" or higher, the process proceeds to step S62. In this step S62, whether or not the security level of communication between the terminal WL13 is currently wirelessly connected, that is, the terminal WL14 and the terminal WL13 is equal to or higher than the minimum level "enc.1" allowed by BSS1. Is checked. If the security level of communication between the terminal WL13 and the terminal WL14 is equal to or higher than the minimum level "enc.1" allowed by BSS1, the process proceeds to step S64 and the connection procedure between the terminal WL13 and the base station AP1 is started. Will be done. That is, in the terminal WL13, the processes after step S32 in FIG. 13 are executed. On the other hand, if the security level between the terminal WL13 and the terminal WL14 is less than the minimum level allowed by BSS1 (enc.1), the process proceeds to step S63 and the wireless connection between the terminal WL13 and the terminal WL14. Is disconnected, and the process proceeds to step S64.

As described above, since the security level of the communication between the terminal WL13 and the terminal WL14 is "enc.0", the process proceeds from step S62 to step S63, and the wireless connection between the terminal WL13 and the terminal WL14 is disconnected. To. After that, the terminal WL13 ends the deauthentication specified in IEEE 802.11 and proceeds to step S64.

In this way, when the security level between the terminal WL13 and the currently connected terminal WL14 is lower than the security level broadcast from the base station AP1 that is required to be connected, the terminal WL13 and the terminal WL14 are connected in advance by wireless connection. It is disconnected and a connection request is made from the terminal WL13 to the base station AP1. Therefore, the wireless connection between the terminal WL13 and the base station AP1 is surely executed while maintaining the minimum security level of BSS1.

In step S63, after the wireless connection between the terminal WL13 and the terminal WL14 is temporarily disconnected, the terminal WL13 and the terminal WL14 may be wirelessly connected again at a security level equal to or higher than the minimum level of BSS1.

In the above description, the case where the terminal WL13 is wirelessly connected to only one of the terminals WL14 has been described, but when the terminal WL13 is wirelessly connected to a plurality of terminals or a plurality of base stations, the same procedure as described above is performed. The security level of each one is checked. If the security level is not higher than the minimum level of BSS1, the connection between the terminal WL13 and other terminals is temporarily disconnected, the terminal WL13 is set to the minimum level of BSS1 or higher, and the connection to the base station AP1 is started. You may.

In the above explanation, the case of the terminal WL13 wirelessly connected to the terminal WL14 has been described as an example, but the above series of procedures may be applied to the processing operation of the base station AP2 of another BSS2 different from the BSS1. it can. In this way, when both the side that issued the connection request and the side that received the connection request are base stations instead of terminals, DS communication in which the minimum security level is ensured in each of a plurality of BSSs becomes possible. When the side that issued the connection request is a base station, the base station may be wirelessly connected to multiple terminals or base stations. In such a case, the security level of each of them may be the same as above. If the level is not higher than the minimum level of BSS to be connected, the access point may temporarily disconnect from the terminal WL and other access points. After that, if necessary, the security level of the access point may be set to the minimum level or higher of the BSS to be connected, and then the connection to the desired base station may be started.

Next, as described in the first, third, and fourth embodiments, the flowchart shown in FIG. 18 is shown for the case of checking the security level of the terminal WL13 at the time of authentication, association, and reassociation. It will be explained with reference to. The processing operation shown in FIG. 18 corresponds to step S3 in FIG. 7, step S33 in FIGS. 13 and 15, and the like.

When checking the security level of the terminal WL13, as described above, the terminal WL13 writes the security level of the terminal WL13 in the unused area on the request frame of the authentication or the request frame of the association or the association. , At least one of the following items (1) to (2) is written to the unused area or the other unused area.

(1) Whether or not there is a terminal or base station to which the terminal WL13 is currently wirelessly connected.

(2) Security level between the terminal WL13 and the terminal or base station currently wirelessly connected Here, if the terminal WL13 is wirelessly connected to a plurality of terminals or base stations, the security level for all of them. Is written to the unused area.

The base station AP1 receives the frame as shown in step S71, and first checks the security level of the terminal WL13 as shown in step S72. If the security level of terminal WL13 does not meet the minimum security level specified in BSS1, the process proceeds to step S73 and the connection is refused. That is, as described in the first, third, and fourth embodiments, the connection refusal is notified to the terminal WL13 in the frames of authentication, association, and reassociation.

On the other hand, if the security level of the terminal WL13 is the security level supported by the base station AP1 and is equal to or higher than the minimum security level defined in BSS1, the next step is to proceed to step S74. If it is determined from the information in (1) or (2) above that there is no terminal or base station currently wirelessly connected to the terminal WL13, the process proceeds to step S75, and the wireless connection of the terminal WL13 is permitted. That is, as described in the first, third, and fourth embodiments, in the frames of authentication, association, and reassociation, the permission of wireless connection is notified to the terminal WL13, and the subsequent processing is described above. Is executed in the same way as. This process corresponds to step S6 in FIG. 7, step S36 in FIG. 13, step S53 in FIG. 15, and the like. If it is determined from the information in (1) or (2) above that there is a terminal or base station currently wirelessly connected to the terminal WL13, the process proceeds to step S76.

In step S76, if the information received in step S71 includes the "security level between the terminal WL13 and the terminal WL14 currently wirelessly connected" shown in (2), the security level is Checked. If the security level with the terminal WL14 is higher than the minimum security level specified in BSS1, the process proceeds to step S75, and the wireless connection of the terminal WL13 is permitted. On the other hand, when the security level with the terminal WL14 is less than the minimum security level defined in BSS1, or when the information received in step S71 does not include the information shown in (2) above. That is, when the security level with the terminal WL14 is unknown, the process proceeds to step S77, and the connection request from the terminal WL13 is rejected. As described in the first, third, and fourth embodiments, the rejection of this connection request is notified to the terminal WL13 in the frames of authentication, association, and reassociation.

In step S77, instead of notifying that the connection request is rejected, the request for instructing the disconnection of the wireless connection with the terminal WL14 is made in the same manner in the frame of the authentication, association or reassociation. You may notify by. In this case, the terminal WL13 can immediately determine that it can connect to the base station AP1 by disconnecting the wireless connection with the terminal WL14. Therefore, the terminal WL13 can request the connection to the base station AP1 again after disconnecting the wireless connection with the terminal WL14, for example, after terminating the deauthentication specified in IEEE 802.11. ..

In addition, after rejecting the connection request in step S77, the subtype is the management frame of the MAC frame specified in IEEE802.11 and the currently unused frame among the control frames, for example, the management frame. For frames such as "0110" to "0111" and control frames, use frames with subtypes such as "0000" to "1001" to notify the lowest security level allowed by BSS1. Is also good. If there is a notification of the lowest security level allowed by BSS1, if terminal WL14 can support the lowest security level, terminal WL13 reconnects to that security level and then makes a connection request to base station AP1 again. It can be carried out.

Further, in the above description, the case where the terminal WL13 is wirelessly connected to only one of the terminals WL14 is described as an example. However, even when wirelessly connected to a plurality of terminals and base stations, the terminal WL13 has the presence or absence of already connected terminals and base stations, preferably one by one, in the same manner as described above. You may notify the security level. When a plurality of security levels of wireless communication already connected are notified from the terminal WL13, the base station AP1 may check the security levels for each of them in step S76.

As described above, even if the side that issued the connection request is already wirelessly connected to another terminal or base station, when the security level of this wireless connection is unknown, or the side that received the connection request. When the minimum security level of is not met, the minimum security level of the side receiving the connection request can be ensured by rejecting the connection request. Although the above description has been given by taking the case of the terminal WL13 wirelessly connected to the terminal WL14 as an example, it can also be applied to the processing operation of the base station AP2 of another BSS2 different from the BSS1. In this way, when both the side that issued the connection request and the side that received the connection request are base stations instead of terminals, DS communication in which the minimum security level of each is ensured is possible in a plurality of BSSs. When the side issuing the connection request is a base station, the base station may be wirelessly connected to a plurality of terminals or base stations. In such a case as well, it is preferable that the side issuing the connection request notifies the presence / absence of the terminal or base station already connected, preferably the security level of each of them, in the same manner as described above. When the side that received the connection request notifies the side that issued the connection request of multiple security levels of the wireless communication that is already connected, in step S76, the security level for each of them may be checked. ..

(Sixth Embodiment) In the wireless system according to the first embodiment, the case where the connection request is made to the base station has been described, but the same method is applied to the case where the connection request is made from the terminal to the terminal. Can be done. Here, as shown in FIG. 19, a case where a terminal WL12 belonging to BSS1 is requested to be connected by a terminal WL15 not subscribed to BSS1 will be described as an example. The only security level that the terminal WL15 can support is "enc. 0". Since the terminal WL12 is subscribed to BSS1, it is necessary to ensure the minimum security level predetermined for BSS1 when the terminal WL12 communicates. Therefore, the same processing operation as that shown in FIG. 7 between the terminal and the base station is performed between the terminal WL12 and the terminal WL15.

FIG. 20 shows a processing procedure between the terminal WL12 and the terminal WL15 when a connection request is made from the terminal WL15 to the terminal WL12. In FIG. 20, the same parts as those in FIG. 7 are designated by the same reference numerals, the description thereof will be omitted, and the differences will be described below.

In FIG. 20, the processing operation at the base station shown in FIG. 7 corresponds to the processing operation at the terminal WL12. Therefore, step S1 of transmitting the beacon frame is not required. The other steps S2 to S12 are the same as those in FIG. 7. The association procedure is not required.

As shown in FIG. 20, when setting the connection between the terminal WL12 and the terminal WL15, the terminal WL12 on the side receiving the connection request checks the security level of the terminal WL15 on the side issuing the connection request. .. Here, the security level of the terminal that issued the connection request is the security level supported by the device that received the connection request, and moreover, it is equal to or higher than the lowest security level of BSS1 to which the terminal that received the connection request belongs. If so, the connection of the terminal WL15 is permitted. If the security level of the terminal that issued the connection request is not the security level supported by the device that received the connection request, or if it is below the lowest security level of BSS1 to which the terminal that received the connection request belongs. , The connection of terminal WL15 is rejected. If the connection is allowed, a manual operation is performed to share the cryptographic parameters corresponding to the security level.

When the terminal WL12 receives a connection request from the terminal WL13, the terminal WL12 executes the processing operation as shown in FIG. 20 regardless of whether or not the terminal WL12 is wirelessly connected to the base station AP1. ..

In FIG. 19, the terminal WL15 may be subject to a mode of directly transmitting a data frame to the terminal WL12. This mode is called ad hoc mode. This ad hoc mode can be executed without going through authentication. The ad hoc mode and the processing operation on the terminal WL12 will be described with reference to the flowchart shown in FIG.

The terminal WL12 receives a data frame directly addressed to the terminal WL12 from the terminal WL15 without going through the base station as shown in step S81). For such a data frame, for example, according to the specification of IEEE802.11, "To DS" and "From DS" in the frame control of the MAC frame shown in FIG. 4 are both "0", so that it is easy. I can judge.

When this data frame is received, the receiving unit 101 of the terminal WL12 checks whether the security information corresponding to the source address is registered in the security table 110 of the terminal WL12 as shown in step S82. Will be done.

The fact that the security information of the terminal WL15 is registered in the security table means that the terminal WL15 has communicated with the terminal WL12 in the past at a security level equal to or higher than the minimum level predetermined in BSS1 registered in the security table. It means that there is something or that it is predetermined to communicate at such a security level. Therefore, the process proceeds to step S83, and the terminal WL12 transmits, for example, an ACK frame for the received data frame specified in EEE802.11 to the terminal WL15, and starts transmitting / receiving data to / from the terminal WL15.

On the other hand, in step S82, when the security information of the terminal WL15 is not registered in the security table, the security level of the terminal WL15 is unknown as it is, so that the terminal WL12 cannot communicate with the terminal WL15. Therefore, the process proceeds to step S84, and the terminal WL15 is notified that the authentication is requested without transmitting the ACK frame. This notification is for the management frame of the MAC frame specified in IEEE 802.11, and the currently unused frame among the control frames, for example, in the case of the management frame, the subtype is "0110" to "0111". In the case of a frame or a control frame, the notification may be made using a frame whose subtype is "0000" to "1001".

Upon receiving this notification, the terminal WL15 may start the processing operation after step S2 shown in FIG. In step 84 described above, the terminal WL12 may transmit an ACK frame, the terminal WL15 may start the process of step S2, and then the step shown in FIG. 20 may be executed.

In the communication procedure according to the fifth embodiment, as shown in FIG. 16, when the terminal WL13 is already wirelessly connected to a certain terminal WL14 and requests the base station AP1 to connect, the base station AP1 I explained the method to ensure the minimum level of security predetermined in BSS1 of. Correspondingly, next, as shown in FIG. 22, when the terminal WL15 is wirelessly connected to the existing terminal WL16, the case where the terminal WL15 requests the connection to the terminal WL12 will be described.

Here, the security level that can be supported by the terminal WL16 is only "enc. 0". Since the terminal WL12 is subscribed to BSS1, it is necessary to ensure the minimum security level predetermined for BSS1 when the terminal WL12 starts communication. For that purpose, the same processing operation as that shown in FIG. 18 may be performed on the terminal WL12.

FIG. 23 shows a processing procedure between the terminal WL12 and the terminal WL15 when a connection request is made from the terminal WL15 to the terminal WL12. In FIG. 23, the same parts as those in FIG. 18 are designated by the same reference numerals, the description thereof will be omitted, and different parts will be described. That is, in FIG. 23, the processing operations of the base station and the terminal WL13 of FIG. 18 correspond to the processing operations of the terminal WL12 and the terminal WL15, respectively, and substantially the same processing as the processing procedure shown in FIG. 18 is performed. Therefore, the explanation with reference to FIG. 23 can be understood without any particular explanation if the base station and the terminal WL13 in the above explanation in FIG. 18 are replaced with the terminal WL12 and the terminal WL15, respectively.

Further, in FIG. 22, when the terminal WL15 tries to directly transmit the data frame to the terminal WL12 without going through the authentication, the terminal WL12 performs the processing operation of the flowchart of FIG. The processing operation as shown may be performed. Preferably, when the terminal WL12 receives a data frame directly addressed to the terminal WL12 from the terminal WL15 in step S81 of FIG. 21 without going through the base station, the terminal WL12 immediately proceeds to step S84 and proceeds to the terminal WL15. In order to ensure security, it is desirable to notify the user that an authentication is requested and always perform the processing operation shown in FIG. 23. Since the security information of the terminal WL15 is registered in the security table of the terminal WL12, the terminal WL15 does not always communicate with a terminal other than the terminal WL12 at the minimum security level of BSS1 to which the terminal WL12 belongs. Because there isn't.

In the above description, the case where the terminal WL15 is wirelessly connected to only one of the terminals WL16 has been described as an example, but when the terminal is wirelessly connected to a plurality of terminals or base stations, the terminals are similarly connected in the same manner as described above. The WL15 notifies the presence or absence of terminals and base stations that are already connected, preferably the security level of each one. When a plurality of security levels of wireless communication already connected are notified from the terminal WL15, the terminal WL12 may check the security level for each of them in step S76.

As described above, according to the sixth embodiment, even in communication between a plurality of terminals, when one of them is a terminal in the BSS in which the minimum security level to be protected is predetermined. The security level can be ensured.

(7th Embodiment) In the 1st to 6th embodiments described above, the case of ensuring the security level of BSS has been described. A similar method can be applied to ensure the security level in IBSS.

In this seventh embodiment, IBSS1 having a configuration as shown in FIG. 24 will be described as an example.

In FIG. 24, IBSS1 is composed of a plurality of terminals, for example, three terminals WL31 to WL33. Terminal WL31 supports security levels "enc.0", "enc.1", terminal WL32 supports security levels "enc.0", "enc.1", "enc.2", terminal WL33 Shall support security levels "enc.0" and "enc.1".

According to the provisions of IEEE 802.11, IBSS can directly send and receive data frames between multiple terminals in IBSS without going through a base station and without going through the authentication authentication process. If each terminal in IBSS1 has a security table and the security information of each terminal that composes IBSS1 is registered in this security table, communication can be performed at a predetermined minimum security level or higher in IBSS1. , The minimum security level can be ensured between the terminals in IBSS1.

Therefore, regarding the processing operation when a connection request is received from one of the plurality of terminals constituting IBSS1, for example, terminal WL31, from terminal WL34 which is not subscribed to IBSS1, that is, is not registered in the security table. explain.

In this processing operation as well, similarly to the sixth embodiment, the terminal WL31 preferably performs the processing operation as shown in FIG. 21, and the security information of the source of the received data frame is its own security table. When it is not registered in, a notification to the effect that authentication is requested is transmitted to the source of the data frame, that is, the terminal WL34. After that, when the authentication frame is transmitted from the terminal WL34, the processing operation as shown in FIG. 23 is preferably performed. However, the terminal WL15 shown in FIG. 23 may be replaced with the terminal WL34. That is, the terminal WL34 writes the security level of the terminal WL34 in the frame of the authentication, writes at least one of the above (1) to (2), and transmits it to the terminal WL31. The terminal WL31 may receive such an authentication frame from the terminal WL34 and perform the same processing operation as the terminal WL12 shown in FIG. 23.

In this way, even in the IBSS, the minimum security level predetermined for the IBSS can be ensured.

Also, in communication between a plurality of terminals, if one of them is a terminal in IBSS in which the minimum security level to be protected is predetermined, the security level can be ensured.

As described in the first to seventh embodiments above, each of the wireless communication devices constituting the wireless LAN, such as a base station and a terminal, has at least one (preferably a plurality) security levels, and has the following (preferably a plurality of) security levels. By providing the features shown in x1) to (x8), for example, wireless communication that secures the minimum security level by the basic group of wireless LAN such as BSS and IBSS, that is, the encryption predetermined for each communication group. Can be realized. Further, in communication between a plurality of wireless communication devices, at least one of the plurality of wireless communication devices is a communication group having a predetermined minimum security level, in other words, a minimum security level, for example. When it is a wireless communication device in BSS or IBSS, the security level above the above minimum level can always be ensured. Of the following (x1) to (x8), the features that are not specified as being a base station are preferably functions that both the base station and the terminal should have in common.

(x1) When a connection request is made from the own device to the first wireless communication device which is another wireless communication device, the first radio among the security levels of the own device is sent to the first wireless communication device. Notify at least one first security level, which is the security level used for communication with the communication device.

(x2) When requesting a connection to the first wireless communication device, the own device is already connected to a second wireless communication device which is another wireless communication device different from the first wireless communication device. Occasionally, the second security level, which is the security level used for communication with the second wireless communication device, is notified.

(x3) When the first wireless communication device is a base station and the lowest security level that can be connected to the first wireless communication device is broadcast, the lowest security level of the own device is broadcast. A security level equal to or higher than the level is selected, and the first wireless communication device is notified when a connection request is made.

(x4) When the first wireless communication device is a base station and a plurality of security levels connectable to the first wireless communication device are broadcast, the broadcast among the security levels of the own device is broadcast. A security level that matches any of the plurality of security levels selected is selected, and the selected security level is notified when a connection request is made to the first wireless communication device.

(x5) When the own device receives a connection request from a fourth wireless communication device which is another wireless communication device, (a) at least the fourth wireless communication notified by the fourth wireless communication device. The third security level, which is the security level used for communication between the device and the own device, is the security level of the own device, and is predetermined to the communication group to which the own device belongs (that is, for example, BSS or IBSS). When the level is above the minimum level, the connection of the fourth wireless communication device is permitted, and (b) at least when the third security level is less than the minimum level, the connection with the fourth wireless communication device is permitted. Provide a third means of denying the connection.

(x5 ́) The third means is as follows: (a) The third security level is equal to or higher than the minimum level predetermined for the communication group to which the own device belongs, and the fourth wireless communication device is the third. At the security level used for communication with the fifth wireless communication device when it is already connected to the fifth wireless communication device, which is another wireless communication device other than the wireless communication device of 4. When a fourth security level is equal to or higher than the minimum level, connection with the fourth wireless communication device is permitted, and (b) when the third security level is less than or equal to the minimum level, or The fourth security level is unknown when the fourth security level is less than the minimum level, or when the fourth wireless communication device is already connected to the fifth wireless communication device. Occasionally, the connection with the fourth wireless communication device is refused.

(x7) When the own device is a base station, the communication group to which the own device belongs is provided with a predetermined lowest security level or a fourth means for broadcasting a plurality of security levels above the lowest level.

(x8) When a plurality of security levels are notified from the fourth wireless communication device, if the plurality of security levels are equal to or higher than the predetermined minimum level in the communication group to which the own device belongs, among them. It comprises a fifth means of selecting one of the above and notifying the fourth wireless communication device of it.

The method of the present invention described in the embodiment of the present invention is a program that can be executed by a computer, such as a magnetic disk (floppy (registered trademark) disk, hard disk, etc.), an optical disk (CD-ROM, DVD, etc.), or a semiconductor. It can also be stored and distributed on a recording medium such as a memory.

<figref num="1">It is a schematic diagram which shows typically the communication system which concerns on embodiment of this invention.</figref><figref num="2">It is a block diagram which shows an example of the circuit structure of the base station shown in FIG.</figref><figref num="3">It is a block diagram which shows an example of the circuit structure of the wireless terminal shown in FIG.</figref><figref num="4">It is a schematic diagram which shows the structure of the MAC frame defined in IEEE802.11 which is transferred between the base station and the terminal in the communication system shown in FIG.</figref><figref num="5">This is a table showing a specific example of a security table provided in a base station or terminal in the communication system shown in FIG.</figref><figref num="6">The base station or terminal in the communication system shown in FIG. 1 is a table showing another specific example of the security table.</figref><figref num="7">It is a flowchart for demonstrating an example of the processing operation of a base station and a terminal in the communication system shown in FIG.</figref><figref num="8">(a) is a schematic diagram showing the frame structure of authentication specified in IEEE 802.11, which is transferred between the base station and the terminal in the communication system shown in FIG. 1, and (b) is (a). It is a table showing the contents described in the item of the frame shown in).</figref><figref num="9">(a) to (c) are schematic diagrams showing the structures of the association request frame and the association response frame specified in IEEE 802.11, which are transferred between the base station and the terminal in the communication system shown in FIG. is there.</figref><figref num="10">This is a table showing a specific example of the updated security table provided in the base station or terminal in the communication system shown in FIG.</figref><figref num="11">It is a schematic diagram which shows the structure of the beacon frame defined in IEEE802.11 which is directed from the base station to the terminal in the communication system shown in FIG.</figref><figref num="12">FIG. 5 is a flowchart showing a processing procedure in which a base station in the communication system shown in FIG. 1 notifies the BSS to which the base station belongs to a terminal and requests a connection to the base station.</figref><figref num="13">FIG. 5 is a flowchart showing a processing procedure in which a security level is notified using an association response frame transferred between a base station and a terminal in the communication system shown in FIG. 1 and the security level is checked.</figref><figref num="14">(a) to (c) are schematics showing the structures of the reassociation request frame and the reassociation response frame specified in IEEE 802.11, which are transferred between the base station and the terminal in the communication system shown in FIG. It is a figure.</figref><figref num="15">FIG. 5 is a flowchart showing a processing procedure in which a security level is notified using a reassociation response frame transferred between a base station and a terminal in the communication system shown in FIG. 1 and the security level is checked.</figref><figref num="16">It is a block diagram which shows schematic the communication system which concerns on other embodiment of this invention.</figref><figref num="17">In order to explain an example of the processing procedure of the side that issued the connection request when the wireless communication device connected to the other wireless communication device further requests the connection to the other wireless communication device in the communication system shown in FIG. It is a flowchart of.</figref><figref num="18">In order to explain an example of the processing procedure of the side that issued the connection request when the wireless communication device connected to the other wireless communication device further requests the connection to the other wireless communication device in the communication system shown in FIG. It is a flowchart of.</figref><figref num="19">It is a block diagram which shows schematic the communication system which concerns on still another Embodiment of this invention.</figref><figref num="20">It is a flowchart for demonstrating the processing procedure for wireless connection between terminals in the communication system shown in FIG.</figref><figref num="21">It is a flowchart for demonstrating an example of the processing operation in a terminal at the time of wireless connection between terminals in the communication system shown in FIG.</figref><figref num="22">It is a block diagram which shows schematic the communication system which concerns on still another Embodiment of this invention.</figref><figref num="23">It is a flowchart for demonstrating another example of the processing operation in a terminal for wirelessly connecting between terminals in the communication system shown in FIG. 22.</figref><figref num="24">It is a block diagram which shows schematic the communication system which concerns on still another Embodiment of this invention.</figref>

Code description

AP1, AP2 ... Base station (wireless base station device) WL11 ~ WL16, WL31 ~ WL34 ... Terminal (wireless terminal device) 11 ... Receiver 12 ... Transmitter 13 ... Reception control unit 14 ... Transmission control unit 20, 100 ... Antenna 21, 110 ... Security table 101 ... Receiver unit 107 ... Transmitter unit 108 ... Information processing unit