Communication apparatus and method

• US 7,443,983 B2
• Filed: 10/27/2004
• Issued: 10/28/2008
• Est. Priority Date: 12/19/2003
• Status: Expired due to Fees

• Current Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Original Assignee: Kabushiki Kaisha Toshiba (Toshiba Corporation)
• Inventors: Takagi, Masahiro, Goto, Masataka, Shibuya, Naohisa, Tanizawa, Yoshimichi, Kashio, Yoshihiko
• Primary Examiner(s): Truong; Thanhnga B
• Application Number:
  US10/973,472
• Publication Number:
  US 20050135625A1
• Time in Patent Office: 1,462 Days
• Field of Search: 380/270, 380/277, 455410-411, 370/392, 370/338, 726/14, 726/3
• US Class Current: 380/270
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/162 at the data link layer

Abstract

A communication apparatus which is connected to networks including first network of first security level which is lowest security level and second network of second security level, and is wirelessly connected to terminal receiving terminal identifier and password which designates one of networks, from terminal, selecting one of first security level and second security level based on an authentication result of terminal, terminal identifier, and password, forwarding, when second security level is selected, data item which is transmitted from terminal and is encrypted using cryptographic algorithm and cryptographic key to second network, and forwarding, to terminal, data item which is transmitted from second network and addressed to terminal, and forwarding, when first security level is selected, data item transmitted from terminal to first network, and forwarding, to terminal, data item which is transmitted from first network and addressed to terminal.

Claims

1. A communication apparatus which is wirelessly connected to a first terminal and is connected to a plurality of networks corresponding to different security levels and including a first network of a first security level which is a lowest security level of the security levels and a second network of a second security level of the security levels, the communication apparatus comprising:

a wireless LAN control unit configured to connect to the first terminal and communicate with the first terminal; and

an authentication unit configured to (a) authenticate the first terminal, to (b) select one of the first security level and the second security level based on an authentication result of the first terminal, a first terminal identifier and a first password corresponding to one of the networks, the first terminal identifier and the first password being transmitted from the first terminal and received by the wireless LAN control unit, and to (c) generate, when the second security level is selected, a cryptographic key used in a first cryptographic algorithm corresponding to the second security level, wherein

the wireless LAN control unit (a) transmits when the second security level is selected, the cryptographic key and an identifier of the first cryptographic algorithm to the first terminal, (b) transfers, when the second security level is selected, a first data item to the second network and a second data item to the first terminal, the first data item obtained by being encrypted by the first terminal using the first cryptographic algorithm and the cryptographic key, and received from the first terminal, and the second data item addressed to the first terminal and received from the second network; and

(c) transfers, when the first security level is selected, a third data item to the first network and a fourth data item to the first terminal, the third data item received from the first terminal, and the fourth data item addressed to the first terminal and received from the first network.

2. The communication apparatus according to claim 1, wherein the wireless LAN control unit comprises:

a memory to store the first cryptographic algorithm corresponding to the second security level, and the identifier of the first cryptographic algorithm;

a decrypting unit configured to decrypt the first data item by using the first cryptographic algorithm and the cryptographic key;

a transfer unit configured to transfer the first data item decrypted to the second network;

an encrypting unit configured to encrypt the second data item by using the first cryptographic algorithm and the cryptographic key; and

a transfer unit configured to transfer the second data item encrypted to the first terminal.

3. The communication apparatus according to claim 1, wherein the authentication unit comprises:

a memory to store a plurality of registration data items including a first registration data item having the first terminal identifier, the first registration data item including the second security level and a password necessary to access the second network, wherein

the authentication unit selects the second security level included in the first registration data item, when the authentication result is successful and the first password corresponds to the password included in the first registration data item.

4. The communication apparatus according to claim 1, wherein the memory in the wireless LAN control unit stores a plurality of cryptographic algorithms including the first cryptographic algorithm, the cryptographic algorithms having different cryptographic strengths in correspondence with security levels.

5. The communication apparatus according to claim 3, wherein the registration data items include a group of registration data items each having the first terminal identifier, each of the registration data items of the group includes an independent security level and an independent password, and the first registration data item belongs to the group.

6. The communication apparatus according to claim 1, wherein the authentication unit selects the first security level, when the authentication result of the first terminal is not success.

7. The communication apparatus according to claim 5, wherein the authentication unit selects the first security level, when the registration data items included in the group fail to include the password corresponding to the first password.

8. A communicating method for communicating between a first terminal and one of a plurality of networks corresponding to different security levels and including a first network of a first security level which is a lowest security level of the security levels and a second network of a second security level of the security levels, the communicating method comprising:

(a) storing a first cryptographic algorithm corresponding to the second security level and an identifier of the first cryptographic algorithm in a memory device;

(b) authenticating the first terminal to obtain an authentication result of the first terminal;

(c) selecting one of the first security level and the second security level based on the authentication result of the first terminal, a first terminal identifier, and a first password corresponding to one of the networks, the first terminal identifier and the first password being transmitted by the first terminal;

(d) generating, when the second security level is selected, a cryptographic key used in the first cryptographic algorithm;

(e) transmitting, when the second security level is selected, the cryptographic key and the identifier of the first cryptographic algorithm to the first terminal;

(f) transferring, when the second security level is selected, a first data item to the second network and a second data item to the first terminal, the first data item obtained by being encrypted by the first terminal using the first cryptographic algorithm and the cryptographic key, and is transmitted by the first terminal, and the second data item addressed to the first terminal and transmitted from the second network; and

(g) transferring, when the first security level is selected, a third data item to the first network and a fourth data item to the first terminal, the third data item transmitted by the first terminal, and the fourth data item addressed to the first terminal and transmitted from the first network.

9. The communicating method according to claim 8, wherein the transferring (f) includes:

decrypting the first data item by using the first cryptographic algorithm and the cryptographic key;

transferring the first data item decrypted to the second network;

encrypting the second data item by using the first cryptographic algorithm and the cryptographic key; and

transferring the second data item encrypted to the first terminal.

10. The communicating method according to claim 8, wherein the selecting (c) includes:

storing, in a second memory device, a plurality of registration data items including a first registration data item having the first terminal identifier, the first registration data item including the second security level and a password necessary to access the second network; and

selecting the second security level included in the first registration data item, when the authentication result of the first terminal is successful and the first password corresponds to the password included in the first registration data item.

11. The communicating method according to claim 10, wherein the registration data items include a group of registration data items each having the first terminal identifier, each of the registration data items belonging to the group includes an independent security level and an independent password, and the first registration data item belongs to the group.

12. The communicating method according to claim 8, wherein the selecting (c) selects the first security level, when the authentication result of the first terminal is failed.

13. The communicating method according to claim 11, wherein the selecting (c) selects the first security level, when the registration data items included in the group fail to include the password corresponding to the first password.

14. The communicating method according to claim 8, wherein

the authenticating (b) authenticates the first terminal via a communication apparatus and a third network whose security level is higher than the security levels;

and

the selecting (c) selects, based on the authentication result of the first terminal, the first terminal identifier and the first password, the first terminal identifier and the first password being transferred via the communication apparatus and the third network.