JP4677784B2 - Authentication method and system in collective residential network - Google Patents

Description

  The present invention relates to an authentication method and system in a collective home network.

  FIG. 1 is a system configuration diagram of a collective residential network in the prior art.

  The home network is generally constructed using a telephone line, a power line, Ethernet (registered trademark) or the like, and is connected to a home appliance (personal computer, television, air conditioner, etc.) 3 having a communication function. The plurality of home networks are connected to the network connection device 1 via the collective network. The network connection device 1 is connected to the Internet access network 5 via an ADSL (Asymmetric Digital Subscriber Line), an optical fiber or the like, and further connected to the Internet 7 via an ISP (Internet Service Provider) carrier network 6. Connected. The ISP provider network 6 includes an ISP authentication server 4 for user authentication. The ISP authentication server 4 includes a registration database that holds contracted user information and a user authentication unit. The network configuration shown in FIG. 1 is hereinafter referred to as a collective home network.

  According to FIG. 1, different home networks in the same building share the same collective network. In this case, a situation may occur in which communication data transmitted from a certain home network is intercepted by a terminal connected to another home network. In order to prevent such a situation, it is necessary to share communication data encryption and a common key for communication between the two parties. According to the prior art, each of the terminals connected to the home network needs to request authentication from the ISP authentication server 4 and share a common key.

JP 2002-345051 A JP 2003-179699 A

  However, considering that future home appliances will be equipped with communication functions, the number of communication terminals per home network will also increase. As a result, the number of communication terminals connected to the collective network is enormous. In this case, if each communication terminal requests authentication, the network connection device is overloaded. Also, if a group is configured with a plurality of communication terminals and a common key is to be managed in units of groups, the processing by the network connection device becomes more complicated, which is not realistic.

  Also, in recent years, there have been an increasing number of scenes that require the secrecy of communications in groups, such as information home appliance networks that provide communication functions for televisions, air conditioners, etc. The technology to share is becoming necessary.

  Therefore, an object of the present invention is to provide an authentication method and system capable of reducing the complexity of common key management in terminals connected to a collective home network.

  The present invention relates to a system having an intra-group network to which a plurality of terminals are connected, a network connection device connected between the plurality of intra-group networks and the Internet, and an authentication server capable of communicating with the network connection device. .

The authentication method in the present invention is:
There is a home station for each network in the group.
When the home station transmits an authentication request message to the authentication server via the network connection device, the first common key is shared with the authentication server, and the authentication server communicates to the network connection device with the first common A first step of transmitting a key;
A second step in which the network connection device determines a second common key for the intra-group network, and transmits the second common key encrypted using the first common key to the home station;
When the terminal transmits an authentication request message to the home station via the network connection device, the third common key is shared with the home station, and the home station transmits the third common key to the network connection device. A third step of transmitting
The network connection device includes a fourth step of transmitting the second common key encrypted using the third common key to the terminal.

According to another embodiment of the authentication method of the present invention, an IEEE 802.1x authentication scheme is applied,
In the first step, the home station is a supplicant, the network connection device is an authenticator, the authentication server is an authentication server,
In the second step, it is also preferable that the terminal functions as a supplicant, the network connection device functions as an authenticator, and the home station functions as an authentication server.

  According to another embodiment of the authentication method of the present invention, the EAP-TLS scheme is applied to the first step, and the EAP-TLS scheme or the EAP-MD5 scheme is applied to the second step. Is also preferable.

  Furthermore, according to another embodiment of the authentication method of the present invention, it is also preferable that the second common key is used for encryption of a data frame communicated between the network connection device and the terminal.

  Furthermore, according to another embodiment of the authentication method of the present invention, the intra-group network may be a home network and may be a power line carrier communication network.

According to the system of the present invention,
There is a home station for each network in the group.
The authentication server receives an authentication request message from the home station via the network connection device, thereby sharing the first common key with the home station, and the network connection device with the first common key. A common key transmission means for transmitting to
The home station transmits an authentication request message to the authentication server via the network connection device, and authentication server function means for sharing the first common key with the authentication server, and an authentication request from the terminal via the network connection device An authentication terminal function means for receiving a message and sharing a third common key with the terminal;
The network connection device transmits a second common key encrypted using the first common key to the home station, a group common key determination unit for determining a second common key for the intra-group network, and a first transmission. And a second transmission means for transmitting the second common key encrypted using the third common key to the home station.

  According to another embodiment of the system of the present invention, it is preferable that the IEEE802.1x authentication method is applied, the authentication server function unit in the home station functions as an Authentication Server, and the authentication terminal function unit functions as a Supplicant.

  According to another embodiment of the system of the present invention, the EAP-TLS method is applied to the authentication server function unit in the home station, and the EAP-TLS method or the EAP-MD5 method is used as the authentication terminal function unit. It is also preferred that it be applied.

Furthermore, according to another embodiment of the system of the present invention,
The network connection apparatus further includes an encryption / decryption unit that encrypts a data frame to be transmitted to the terminal using the second common key and decrypts the data frame received from the terminal using the second common key. ,
The terminal further includes encryption / decryption means for encrypting a data frame to be transmitted to the network connection apparatus using the second common key, and decrypting the data frame received from the network connection apparatus using the second common key. It is also preferable to have it.

  Furthermore, according to another embodiment of the system of the present invention, the intra-group network may be a home network and may be a power line carrier communication network.

  According to the authentication method and system of the present invention, it is possible to reduce the complexity of managing a common key in a terminal connected to a collective home network. For each home network (for each group), terminals connected to the network can share the same common key, and confidentiality can be ensured for terminals connected to other home networks.

  Further, by leaving the authentication for each home network to the authentication server and leaving the authentication of the terminals in the home network to the home station, the load on the authentication server can be reduced.

  Furthermore, since the ISP authentication server 4 performs authentication processing in units of home networks (group units), charging processing for each home can be facilitated by performing charging processing for each authentication.

  Hereinafter, the best mode for carrying out the present invention will be described in detail with reference to the drawings.

  FIG. 2 is a system configuration diagram of the collective home network according to the present invention.

  According to the present invention, since the home network and the collective network are power line carrier communication networks, a network configuration as shown in FIG. 2 is assumed. That is, a configuration in which a plurality of residential networks are connected is assumed in the collective housing by using the power line for the network.

  FIG. 2 further includes a home station 2 as compared with FIG. The home station 2 includes a communication control unit 21, a transmission / reception unit 22, an intra-group registration terminal database 23, a supplicant function unit 24, an authenticator server function unit 25, an authentication information storage unit 26, and a common key decryption unit 27. A common key storage unit 28 and an encryption / decryption unit 29.

  The transmission / reception unit 22 is connected to an intra-group network called a home network, and transmits / receives data packets. The communication control unit 22 generates and analyzes a data frame and operates in association with other functional units. The in-group registered terminal database 23 stores an identifier (ID: IDentifier) of a terminal connected to the home network and information thereof.

  According to IEEE802.1x, the supplicant function unit 24 functions as a supplicant for the ISP authentication server 4 via the network connection device 1 that is an authenticator. Therefore, the supplicant function unit 24 can share the common key Ka with the ISP authentication server 4.

  According to IEEE802.1x, the authenticator server function unit 25 functions as an authentication server for the terminal 3 as a supplicant through the network connection device 1 as an authenticator. Accordingly, the authenticator server function unit 25 can share the common key Kb with the terminal 3.

  The authentication information storage unit 26 stores a common key Ka shared with the ISP authentication server 4 and a common key Kb shared with the terminal 3.

  The common key decryption unit 27 decrypts the encrypted common key K1. The common key K1 is a key assigned to all terminals in the home network, and is transmitted from the network connection device 1 after being encrypted using the common key Ka. The common key Ka for decryption is notified from the supplicant function unit 24.

  The common key storage unit 28 stores the common key K1 decrypted by the common key decryption unit 27.

  The encryption / decryption unit 29 encrypts the data frame to be transmitted with the common key K1, or decrypts the received data frame with the common key K1.

  According to FIG. 2, the network connection device 1 according to the present invention has a further function compared with FIG. The network connection device 1 includes a communication control unit 11, an Internet side transmission / reception unit 12, a home network side transmission / reception unit 13, an authenticator function unit 14, a group common key determination unit 15, a group common key database 16, and a home station. A side group common key transmission unit 17, a terminal side group common key transmission unit 18, and an encryption / decryption unit 19 are included.

  The communication control unit 11 generates and analyzes a data frame, and operates in association with other functional units. The Internet side transmission / reception unit 12 is connected to the Internet access network 5 and transmits / receives data packets to / from the Internet 7 and the ISP authentication server 4. The home network side transmitting / receiving unit 13 is connected to a collective network to which a plurality of home networks are connected, and transmits and receives data packets to and from the home station 2 and the terminal 3.

  According to IEEE802.1x, the authenticator function unit 14 functions as an authenticator for the home station 2 as a supplicant and for the ISP authentication server 4. The authenticator function unit 14 also functions as an authenticator for the terminal 3 as a supplicant and the home station 2 as an authentication server.

  When the authentication between the home station 2 and the ISP authentication server 4 is completed, the group common key determination unit 15 determines the common key K1 assigned to the terminal connected to the home network where the home station 2 exists. The method for determining the common key K1 is performed by any existing technique.

  The group common key database 16 stores the common key K1 determined by the group common key determination unit 15 in association with the home network identifier (group identifier) HID1. For example, the common key K1 is stored in association with the home network identifier HID1.

  The home station side common key transmission unit 17 encrypts the common key K1 determined by the group common key determination unit 15 with the common key Ka shared with the ISP authentication server 4 by the authenticator function unit 14, Transmit to station 2.

  The terminal-side common key transmission unit 18 encrypts the common key K1 determined by the group common key determination unit 15 with the common key Kb shared with the home station 2 by the authenticator function unit 14, and sends it to the terminal 3. Send.

  The encryption / decryption unit 29 encrypts the data frame to be transmitted to the home network with the common key K1, or decrypts the data frame received from the home network with the common key K1.

  FIG. 3 is a conceptual authentication sequence diagram according to the present invention.

  As an authentication method between the home station 2 and the authentication server 4, IEEE 802.1X EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) is applied. EAP-TLS is a method in which both a client and a server are mutually authenticated by a certificate issued by a certificate authority. As a result, a session key that has conventionally been fixed can be automatically generated, and security can be enhanced by performing authentication using an electronic certificate.

  According to S301 to S307 in FIG. 3, the home station 2 functions as a supplicant, the network connection device 1 functions as an authenticator, and the ISP authentication server 4 functions as an authentication server. On the other hand, according to S308 to S318, the terminal 3 functions as a supplicant, the network connection device 1 functions as an authenticator, and the home station functions as an authentication server. In order to clarify the correspondence between FIGS. 3, 4 and 5, the same sequence number means the same function.

(S301 to S305) EAPOL (EAP over LAN) in IEEE 802.1x is applied between the home station 2 and the network connection device 1, and EAPoverRADIUS is applied between the network connection device 1 and the ISP authentication server 4. . As a result, the common key Ka is shared between the home station 2 and the ISP authentication server 4. At this time, the network connection device 1 does not know the common key Ka.
(S306) The ISP authentication server 4 transmits the common key Ka to the network connection apparatus 1. As a result, both the network connection device 1 and the home station 2 can share the common key Ka.
(S307) The network connection device 1 determines the common key K1 for the home network. The common key K1 is encrypted using the common key Ka and transmitted from the network connection apparatus 1 to the home station 2. The home station 2 decrypts the encrypted common key K1 using the common key Ka, and acquires the common key K1. As a result, the home station 2 can also share the common key K1.

(S308 to S315) EAPOL (EAP over LAN) in IEEE802.1x is applied between the terminal 3 and the network connection device 1, and EAPoverRADIUS is applied between the network connection device 1 and the home station 2. Thereby, the common key Kb can be shared between the terminal 3 and the home station 2. At this time, the network connection device 1 does not know the common key Kb.
(S316) The home station 2 transmits the common key Kb to the network connection apparatus 1. Thereby, the network connection apparatus 1 can also share the common key Kb.
(S318) The network connection device 1 encrypts the common key K1 using the common key Kb and transmits it to the terminal 3. The terminal 3 decrypts the encrypted common key K1 using the common key Kb, and acquires the common key K1. Thereby, the common key K1 can be shared between the terminal 3 and the network connection device 1, and the terminal 3 can access the Internet.

  FIG. 4 is a first sequence diagram of specific authentication in the present invention.

(S301) The home station 2 transmits EAPOL-Start to the network connection device 1.
(S302) Upon receiving the EAPOL-Start, the network connection device 1 transmits an EAP-Request for requesting an identifier to the home station 2.
(S303) Upon receiving the EAP-Request, the home station 2 transmits an EAP-Response to the network connection device 1. The EAP-Response includes a group identifier HID1 indicating a home network, a terminal identifier IDst1 of the home station 2, and flag information indicating that it is a home station. On the other hand, when the network connection apparatus 1 recognizes that the transmission source terminal of the EAP-Response is a home station based on the flag information, the network connection apparatus 1 transmits a RADIUS Access Request to the ISP authentication server. The RADIUS Access Request includes the group identifier HID1 of the home network.

(S304) The ISP authentication server 4 holds a registered user list in advance. It is determined whether or not the group identifier received by the RADIUS Access Request exists in the registered user list. When the group identifier exists in the registered user list, a RADIUS Access Challenge (TLS Start) indicating that EAP-TLS authentication is to be started is transmitted to the network connection apparatus 1. The network connection device 1 that has received the RADIUS-Access Challenge transmits an EAP-Request to the home station 2.
(S305) A TLS negotiation is performed between the home station 2 and the authentication server 4. As a result, the common key Ka is shared between the home station 2 and the authentication server 4.

(S306) When the authentication is successful, the ISP authentication server 4 transmits RADIUS-Access Success indicating that the authentication is successful to the network connection apparatus 1. The RADIUS-Access Success includes a common key Ka. As a result, the network connection apparatus 1 can also share the common key Ka. The common key Ka is encrypted with a common key shared in advance between the network connection device 1 and the ISP authentication server 4 and added to the RADIUS-Access Success. The network connection device 1 that has received the RADIUS-Access Success transmits the EAP-Success to the home station 2 while holding the common key Ka.

(S307) The network connection device 1 determines the common key K1 to be assigned to all the terminals 3 connected to the home network including the home station 2. The common key K1 is encrypted with the common key Ka and transmitted to the home station 2. At this time, the network connection apparatus 1 registers the group identifier HID1 and the common key K1 in the group common key database 16 in association with each other. Furthermore, the network connection device 1 also generates a common key KB shared by all home stations. The common key KB is encrypted with the common key Ka and transmitted to the home station 2. The common keys K1 and KB are shared between the home station 2 and the network connection device 1.

(S308) The terminal 3 transmits EAPOL-Start to the network connection device 1.
(S309) The network connection device 1 that has received EAPOL-Start transmits to the terminal 3 an EAP-Request for requesting an identifier.
(S310) The home station 2 that has received the EAP-Request transmits an EAP-Response to the network connection device 1. The EAP-Response includes a group identifier HID1 indicating a home network, a terminal identifier IDa of the terminal 3, and flag information indicating that the terminal is not a home station.
(S311) The network connection apparatus 1 transmits a RADIUS Access Request to the home station 2 when it recognizes from the flag information that the EAP-Response transmission source terminal is not the home station. The RADIUS Access Request includes a terminal identifier IDa.

(S312) The home station 2 holds a registered terminal identifier list in the terminal database 23. It is determined whether or not the terminal identifier IDa received by the RADIUS Access Request exists in the registered terminal identifier list. When the group identifier exists in the registered terminal identifier list, a RADIUS Access Challenge (TLS Start) indicating that EAP-TLS authentication is started is transmitted to the network connection apparatus 1.
(S313) The network connection device 1 that has received the RADIUS-Access Challenge transmits an EAP-Request to the terminal 3.
(S314) TLS negotiation is performed between the home station 2 and the terminal 3. As a result, the common key Kb is shared between the home station 2 and the terminal 3.

(S316) When the authentication is successful, the home station 2 transmits a RADIUS-Access Success indicating that the authentication is successful to the network connection apparatus 1. RADIUS-Access Success includes a common key Kb. Thereby, the network connection apparatus 1 can also share the common key Kb.
(S317) The network connection device 1 that has received the RADIUS-Access Success transmits the EAP-Success to the terminal 3 while holding the common key Kb.

(S318) The network connection device 1 encrypts the common key K1 with the common key Kb and transmits it to the terminal 3. The terminal 3 decrypts using the common key Kb and acquires the common key K1. The common key K1 can be shared between the terminal 3 and the network connection device 1, and the terminal 3 can access the Internet.

  FIG. 5 is a second sequence diagram of specific authentication in the present invention.

  FIG. 5 differs from FIG. 4 only in S312 to S317. Therefore, only S312 to S317 will be described below.

  According to FIG. 5, IEEE 802.1X EAP-MD5 authentication is applied to the authentication method between the terminal 3 and the home station 2. EAP-MD5 uses a hash value by a password, and is only one-way authentication. The EAP-MD5 is simpler to authenticate than the EAP-TLS, and when the home station functions as an authentication server, the implementation of the home station is relatively easy.

(S312) The home station 2 determines whether or not the terminal identifier IDa received by the RADIUS Access Request exists in the registered terminal identifier list. If the terminal identifier exists in the registered terminal identifier list, the home station 2 generates a random number ra. Then, the home station 2 transmits a RADIUS Access Challenge indicating that EAP-MD5 authentication is started to the network connection device 1. The RADIUS Access Challenge includes a random number ra.
(S313) The network connection device 1 that has received the RADIUS Access Challenge transmits an EAP-Request to the terminal 3. The EAP-Request includes a random number ra.

(S314) The terminal 3 uses the MD5 hash function based on its own terminal identifier (IDa), the random number ra included in the EAP-Request, and the password Pa shared in advance with the home station 2. Calculate the hash value using. Then, the terminal 3 transmits an EAP-Response including the hash value to the network connection device 1. The password Pa may be common in the home network, that is, the group, or may be different for each terminal from the viewpoint of security.
(S315) The network connection device 1 transmits a RADIUS Access Response including the hash value received by the EAP-Response to the home station 2.
(S316) The home station 2 uses the MD5 hash function based on its own terminal identifier (IDst1), the random number ra included in the EAP-Response, and the password Pa shared in advance with the terminal 3. Is used to calculate the hash value Kb. Then, the home station 2 compares the hash value received by the RADIUS Access Response with the calculated hash value Kb, and determines whether or not they match. If they match, a RADIUS Access Accept indicating that the authentication is successful is transmitted to the network connection apparatus 1. RADIUS Access Accept includes a hash value Kb as a common key.
(S317) The network connection device 1 acquires the hash value Kb from the received RADIUS Access Accept. Then, the network connection device 1 transmits EAP-Success indicating authentication success to the terminal 3. As a result, the common key Kb is shared between the network connection device 1 and the terminal 3.

  FIG. 6 is a sequence diagram of a data packet between the terminal and the Internet.

(S401) The terminal 3 includes its own terminal identifier IDa and the identifier HID of the home network in the MAC layer header of the data frame. Further, the MAC (Message Authentication Code) of the data frame calculated using the own terminal identifier IDa, the home network identifier HID, and the common key K1 is assigned to the data frame. Further, the data frame is encrypted using the common key K1. This data frame is transmitted from the terminal 3 to the network connection device 1. The data frame is as shown in Table 1, for example.

(S402) The network connection device 1 searches for the common key K1 corresponding to the HID included in the data frame. Then, the payload portion is decrypted using the common key K1. Further, the assigned MAC is verified with the common key. If the verification is successful, the data frame is reconstructed and transferred to the Internet access network. If verification fails, the frame is discarded.

(S403) The network connection device 1 that has received the data frame transmitted from the Internet access network extracts the terminal identifier IDa from the data frame.
(S404) The network connection apparatus 1 inquires of all the home stations 2 to which group the terminal belongs. This message is encrypted with a common key KB shared by all home stations.

(S405) Each home station decrypts the message with the common key KB. When the terminal exists under its own control, the network connection apparatus 1 is notified that the terminal belongs to its own group. According to FIG. 6, since the terminal IDa belongs to the group HID1, the home station IDst of the group notifies the network connection apparatus 1 of the group ID (HID1) to which the terminal IDa belongs.

(S406) The network connection apparatus 1 that knows the group to which the terminal belongs creates a data frame to which the MAC of the data frame calculated using the terminal ID, the group ID, and the common key K1, and further uses the common key K1. The data frame is encrypted and transmitted to the terminal IDa.

  From the viewpoint of security, when the network connection device 1 verifies the data frame, after inquiring the home station whether the terminal that is the transmission source of the data frame is an authorized user, It is also preferable to decide to transfer or discard.

  According to the above-described various embodiments of the present invention, those skilled in the art can easily make various changes, modifications, and omissions in the technical idea and scope of the present invention. The above description is merely an example, and is not intended to be restrictive. The invention is limited only as defined in the following claims and the equivalents thereto.

It is a system configuration diagram of a collective home network in the prior art. 1 is a system configuration diagram of a collective home network in the present invention. FIG. It is a sequence diagram of conceptual authentication in the present invention. It is a 1st sequence diagram of the specific authentication in this invention. It is a 2nd sequence diagram of the specific authentication in this invention. It is a sequence diagram of a data packet between a terminal and the Internet.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Network connection apparatus 11 Communication control part 12 Internet side transmission / reception part 13 Home network side transmission / reception part 14 Authenticator function part 15 Group common key determination part 16 Group common key database 17 Home station side group common key transmission part 18 Terminal side group common key transmission Unit 19 Encryption / Decryption Unit 2 Home Station 21 Communication Control Unit 22 Transmission / Reception Unit 23 In-Groove Terminal Database 24 Supplicant Function Unit 25 Authenticator Server Function Unit 26 Authentication Information Storage Unit 27 Common Key Decryption Unit 28 Common Key Storage Unit 29 Encrypt / Decryption unit 3 Terminal 4 ISP authentication server 5 Internet access network 6 ISP carrier network 7 Internet

Claims (10)

An authentication method in a system including an intra-group network to which a plurality of terminals are connected, a network connection device connected between the plurality of intra-group networks and the Internet, and an authentication server capable of communicating with the network connection device. And
A home station is provided for each network in the group,
The home station transmits an authentication request message to the authentication server via the network connection device, whereby a first common key is shared with the authentication server, and the authentication server connects to the network connection. A first step of transmitting the first common key to a device;
A second step in which the network connection apparatus determines a second common key for the intra-group network, and transmits the second common key encrypted using the first common key to the home station; ,
When the terminal transmits an authentication request message to the home station via the network connection device, a third common key is shared with the home station, and the home station is connected to the network connection device. A third step of transmitting the third common key to
And a fourth step in which the network connection device transmits the second common key encrypted by using the third common key to the terminal. IEEE 802.1x authentication method is applied,
In the first step, the home station is a supplicant, the network connection device is an authenticator, the authentication server is functioned as an authentication server,
The authentication method according to claim 1, wherein the second step causes the terminal to function as a supplicant, the network connection device to function as an authenticator, and the home station to function as an authentication server. In the first step, an EAP-TLS scheme is applied,
The authentication method according to claim 2, wherein an EAP-TLS method or an EAP-MD5 method is applied to the second step.   The authentication method according to any one of claims 1 to 3, wherein the second common key is used for encryption of a data frame communicated between the network connection device and the terminal. .   The authentication method according to any one of claims 1 to 4, wherein the intra-group network is a home network and is a power line carrier communication network. A system having an intra-group network to which a plurality of terminals are connected, a network connection device connected between the plurality of intra-group networks and the Internet, and an authentication server capable of communicating with the network connection device,
A home station is provided for each network in the group,
The authentication server receives an authentication request message from the home station via the network connection device, thereby sharing an authentication unit that shares a first common key with the home station, and the first common key. And a common key transmitting means for transmitting to the network connection device,
The home station transmits an authentication request message to the authentication server via the network connection device and shares a first common key with the authentication server, and the network connection from the terminal An authentication terminal function means for receiving the authentication request message via a device and sharing a third common key with the terminal;
The network connection device transmits a second common key encrypted using the first common key to the home station, and a group common key determination unit for determining a second common key for the intra-group network. And a second transmission means for transmitting the second common key encrypted using the third common key to the home station. IEEE 802.1x authentication method is applied,
The system according to claim 6, wherein the authentication server function unit in the home station functions as an Authentication Server, and the authentication terminal function unit functions as a Supplicant.   8. The EAP-TLS method is applied to the authentication server function unit in the home station, and an EAP-TLS method or an EAP-MD5 method is applied to the authentication terminal function unit. The described system. The network connection apparatus encrypts a data frame to be transmitted to the terminal using the second common key, and encrypts / decrypts the data frame received from the terminal using the second common key Further comprising means,
The terminal encrypts a data frame to be transmitted to the network connection device using the second common key, and decrypts a data frame received from the network connection device using the second common key The system according to any one of claims 6 to 8, further comprising: a decoding unit.   The system according to any one of claims 6 to 9, wherein the intra-group network is a home network and is a power line carrier communication network.

Images