Abstract:
To reduce the processing load and maintain higher security in the communications, a communication apparatus includes a network surveying unit configured to determine at least one of (1) an architecture of a network comprising the communication apparatus, and (2) the number of apparatuses on the network; and an alteration detecting unit configured to perform alteration detection processing on data packets received by the communication apparatus, the processing being based on the determination by the network surveying unit.

Description:
BACKGROUND OF THE INVENTION  
       [0001]     1. Field of the Invention  
         [0002]     The present invention relates to a security technique employable in communications.  
         [0003]     2. Description of the Related Art  
         [0004]     In wireless communications, encryption techniques are preferably used to avoid any wire tapping. Various encryption methods, such as for example WEP (Wire Equivalent Privacy), TKIP (Temporal Key Integrity Protocol), and AES (Advanced Encryption Standard), can be used in wireless LAN communications performed according to the IEEE802.11 standard.  
         [0005]     Also, Counter mode with Cipher-Block Chaining-Message Authentication Code Protocol (also known as CCMP) is usable to detect alteration (for example falsification) of AES data according to the IEEE802.11i standard.  
         [0006]     According to the CCMP, a wireless communication device can encrypt transmission data using a packet number which is incremented for each packet. Other communication devices can decrypt a received packet with reference to the packet number used in the encryption of the data, and can detect alterations present in the received encrypted data.  
         [0007]     An infrastructure mode and an ad-hoc mode are two communication modes provided by the IEEE802.11 standard. In the infrastructure mode, wireless communication devices can communicate with each other via an access point (AP). In the ad-hoc mode, the wireless communication devices can directly communicate without using the AP.  
         [0008]     As described above, the encryption processing according to the CCMP is performed based on the packet number. Therefore, the encryption key is differentiated for each packet.  
         [0009]     In the infrastructure mode, the AP has a function of administrating the packet number of each wireless communication device in the network to establish data communications between the devices. Each wireless communication device is only required to administrate the packet number related to the MAC (Media Access Control) address of the AP, because no direct communication is performed between the wireless communication devices.  
         [0010]     However, the AP is not present in the ad-hoc mode. Each wireless communication device is required to discriminate all other wireless communication devices in the network, and administrate all packet numbers related to these devices. As a result, a heavy burden is thus placed on each wireless communication device due to the complicated processing.  
       SUMMARY OF THE INVENTION  
       [0011]     Embodiments of the present invention are directed to a technique capable of overcoming or at least mitigating the above-described problems.  
         [0012]     According to an aspect of the present invention, at least one exemplary embodiment is directed to a technique capable of reducing the processing load in the communications and maintaining higher security.  
         [0013]     According to another aspect of the present invention, a communication apparatus includes a network surveying unit configured to determine at least one of (1) an architecture of a network comprising the communication apparatus, and (2) the number of apparatuses on the network; and an alteration detecting unit configured to perform alteration detection processing on data packets received by the communication apparatus, the processing being based on the determination by the network surveying unit.  
         [0014]     Furthermore, according to another aspect of the present invention, a method is provided which may be performed by a communication apparatus. While the method includes determining at least one of (1) an architecture of a network comprising the communication apparatus , and (2) the number of apparatuses on the network; and performing alteration detection processing on data packets received by the communication apparatus, wherein the processing is based on the determination.  
         [0015]     Additionally, according to still yet another aspect of the present application, a computer readable medium is provided containing computer-executable instructions to be performed by a communication apparatus. Here, the medium includes computer-executable instructions for determining at least one of (1) an architecture of a comprising the communication apparatus , and (2) the number of apparatuses on the network; and computer-executable instructions for performing alteration detection processing on data packets received by the communication apparatus, wherein the processing is based on the determination.  
         [0016]     Further features of the present invention will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0017]     The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention.  
         [0018]      FIG. 1  is a schematic view illustrating an example wireless communication system including two wireless communication devices operable in the ad-hoc mode according to an aspect of the present invention.  
         [0019]      FIG. 2  is a block diagram illustrating an example functional arrangement of a digital camera in accordance with an exemplary embodiment.  
         [0020]      FIG. 3  is a block diagram illustrating an example functional arrangement of a printer in accordance with an exemplary embodiment.  
         [0021]      FIG. 4  is a block diagram illustrating an example CCMP decryption circuit according to an exemplary embodiment.  
         [0022]      FIG. 5  is a table showing example wireless communication parameters in accordance with an exemplary embodiment.  
         [0023]      FIG. 6  is a flowchart showing an example replay check control performed by each wireless communication device in accordance with an exemplary embodiment.  
         [0024]      FIG. 7  is a diagram illustrating an example participation sequence in the ad-hoc network according to an aspect of the present invention.  
         [0025]      FIG. 8  is a diagram illustrating a packet number control according to the CCMP system according to an aspect of the present invention.  
         [0026]      FIG. 9A  is a block diagram illustrating an example CCMP encryption circuit in accordance with an exemplary embodiment.  
         [0027]      FIG. 9B  is a block diagram illustrating an example CCMP decryption circuit in accordance with an exemplary embodiment.  
         [0028]      FIG. 10  is a schematic view illustrating an example wireless communication system including three wireless communication devices operable in the ad-hoc mode according to an aspect of the present invention.  
         [0029]      FIG. 11  is a schematic view illustrating another example wireless communication system including wireless communication devices operable in the infrastructure mode according to an aspect of the present invention. 
     
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS  
       [0030]     The following description of exemplary embodiments is merely illustrative in nature and is in no way intended to limit the invention, its application, or uses. It is noted that throughout the specification, similar reference numerals and letters refer to similar items in the following figures, and thus once an item is defined in one figure, it may not be discussed for following figures. Exemplary embodiments will now herein be described in detail below with reference to the drawings.  
         [0031]     First, a CCMP system will be described with reference to  FIGS. 9A and 9B .  FIG. 9A  is a block diagram illustrating a circuit arrangement for performing encryption processing according to the CCMP system. A packet number incrementing section  902  can increment a packet number for each packet and can administrate the incremented packet number.  
         [0032]     A CCM encrypting section  901  can encrypt a data portion of a clear text MPDU (i.e., MAC Protocol Data Unit) with reference to a MAC header involved in the entered clear text MPDU, a MAC header address (i.e., source address), a temporary key set by a user, and a packet number.  
         [0033]     A CCMP header producing section  903  can produce a CCMP header with reference to encrypted data, MIC (i.e., Message Integrity Check) checking consistency of data, the MAC header extracted from the clear text, the packet number, and a Key ID designating a key number used in the encryption processing. An encrypted MPDU assembling section  904  can combine the above data to produce an encrypted MPDU.  
         [0034]      FIG. 9B  is a block diagram illustrating a circuit arrangement for performing decryption processing in the CCMP system. ACCMP decrypting section  905  can decrypt the encrypted data portion with reference to the MAC header of the received encrypted MPDU, MIC, MAC header address, the packet number, and the temporary key set by a user. A clear text MPDU assembling section  906  can assemble a clear text MPDU based on the MAC header extracted from the encrypted MPDU and the decrypted data portion. Each wireless communication device can administrate the MAC address of other wireless communication device in relation to the packet number.  
         [0035]     A replay check processing section  907  can execute “Replay Check” processing. More specifically, the replay check processing section  907  compares a “packet number administrated by the communication device” with a “packet number of received encrypted MPDU.” When the “packet number administrated by the device” is smaller than or equal to the “packet number of the received encrypted MPDU”, the replay check processing section  907  decides that the received encrypted MPDU is normal data.  
         [0036]     On the other hand, if the “packet number administrated by the device” is larger than the “packet number of the received encrypted MPDU”, the replay check processing section  907  decides that the received encrypted MPDU has been altered.  
         [0037]      FIG. 1  shows an example system arrangement including a camera, such as a digital still camera (hereinafter referred to as DSC)  101  and a printer  102  which can perform wireless communications in the ad-hoc mode defined by the IEEE802.11 standard. The DSC  101  can function as an image capturing apparatus, while the printer  102  can function as an image output apparatus. The DSC  101  and the printer  102  are configured to perform data encryption according to the CCMP system, and are also configured to perform data decryption and alteration detection according to the CCMP system.  
         [0038]      FIG. 2  is a block diagram illustrating an example functional arrangement of the DSC  101  according to the exemplary embodiment. An operating section  210  is connected via a system controller  211  to a CPU  215 . The operating section  210  includes a shutter switch and various keys of the DSC  101 . An image capturing section  202  can capture an image when the shutter switch is pressed by a user. An image processing section  203  can process the image captured by the image capturing section  202 . A display unit  206 , such as LCD display, LED display, or sound display, can display various information and data.  
         [0039]     A display processing section  207  can control display contents. A user can select desirable item(s) displayed on the display unit  206  by operating the operating section  210 . In this respect, the display unit  206  and the operating section  210  cooperatively constitute a user interface (I/F) of the DSC  101 . A wireless communication section  204  is capable of performing wireless communications.  
         [0040]     An RF section  205  can control transmission/reception of a wireless signal between the DSC  101  and other wireless communication device. The wireless communication section  204  and the RF section  205  cooperatively constitute a wireless section of the DSC  101 .  
         [0041]     Amemory card I/F  208  is an inter face via which a memory card  209  is detachably connected to the CPU  215 . A USB I/F  212  is an interface via which an external USB device can be connected to the CPU  215 . An audio I/F  214  is an interface via which a sound signal can be transmitted to an external device. The CPU  215  can control the above-described functional sections as described later.  
         [0042]     A ROM  216  or a flash ROM  213  can store various programs executable by the CPU  215 . The data processed in the CPU  215  can be written into or read from a RAM  217  or a flash ROM  213 . The flash ROM  213  is a nonvolatile storage medium that can store setting information relating to the wireless communications. The captured image data, after compression processing, can be written (stored) in the memory card  209  via the memory card I/F  208 .  
         [0043]      FIG. 3  is a block diagram illustrating an example functional arrangement of a printer  102  according to the present exemplary embodiment. An operating section  310  is connected via a system controller  311  to a CPU  315 . A print engine  302  can print an image on a paper. A print processing section  303  can process the image. A display unit  306 , such as LCD display, LED display, or sound display, can display various information and data.  
         [0044]     A display processing section  307  can control display contents. A user can select desirable item(s) displayed on the display unit  306  by operating the operating section  310 . In this respect, the display unit  306  and the operating section  310  cooperatively constitute a user interface (I/F) of the printer  102 .  
         [0045]     The wireless communication section  304  is capable of performing wireless communications. An RF section  305  can control transmission/reception of a wireless signal between the printer  102  and other wireless communication device. The wireless communication section  304  and the RF section  305  cooperatively constitute a wireless section of the printer  102 .  
         [0046]     A memory card I/F  308  is an interface via which a memory card  309  is detachably connected to the CPU  315 . When the memory card  209  of the DSC  101  is connected to the memory card I/F  308  of the printer  102 , the print engine  302  can print an image captured by the DSC  101 . A USB I/F  312  is an interface via which an external USB device can be connected to the CPU  315 .  
         [0047]     A parallel I/F  314  is an interface via which the CPU  315  can perform parallel communications with an external device (such as a host computer). The CPU  315  can control the above-described functional sections as described later. A ROM  316  or a flash ROM  313  can store various programs executable by the CPU  315 . The data processed in the CPU  315  can be written into or read from a RAM  317  or a flash ROM  313 . The flash ROM  313  is a nonvolatile storage medium that can store setting information relating to the wireless communications.  
         [0048]      FIG. 4  is a block diagram illustrating an example CCMP decryption circuit according to the present exemplary embodiment. The wireless communication section  204  (or the RF section  205 ) of the DSC  101  and the wireless communication section  304  (or the RF section  305 ) of the printer  102  includes the CCMP decryption circuit shown in  FIG. 4 .  
         [0049]     The CCMP decryption circuit shown in  FIG. 4  is different from the decryption circuit shown in  FIG. 9B  in that a replay check control section  401  is additionally provided. The replay check control section  401 , having a communication path switching function, can selectively transmit an output of the clear text MPDU assembling section  906  to an output terminal  402  or to a terminal  403 .  
         [0050]     When a switching terminal of the replay check control section  401  is connected to the terminal  403 , the replay check processing section  907  executes “replay check” processing and detects alteration involved in the received data based on the packet number. When any alteration is detected, the replay check processing section  907  abandons the received data. When no alteration is found, the replay check processing section  907  decides that the received data is normal, and forwards the received data to a host application.  
         [0051]     When the switching terminal of the replay check control section  401  is connected to the terminal  402 , the clear text MPDU assembling section  906  can directly send its output (i.e., received data) to the host application without executing the “replay check” processing.  
         [0052]      FIG. 5  shows example parameters for the wireless communications performed between the DSC  101  and the printer  102 . The operating sections  210  and  310  enable users to set various parameters shown in  FIG. 5 . The parameters set by a user of the DSC  101  can be copied into a USB memory, and then the parameters of the USB memory can be copied into the printer  102 .  
         [0053]     Furthermore, an ad-hoc network can be constructed for the wireless communications between the DSC  101  and the printer  102 , so that the wireless communication parameters can be automatically exchanged and determined.  
         [0054]     The parameter table shown in  FIG. 5  may includes numerous parameter items. For example, a “Network Mode” item designates the architecture of the wireless network selectable between the “infrastructure” mode and the “ad-hoc” mode, although the ad-hoc mode is designated according to the example shown in  FIG. 5 .  
         [0055]     An “SSID” item represents a network identifier. A “CH Number” item designates a frequency channel to be used when the device constructs a network operable in the ad-hoc mode.  
         [0056]     An “Authentication Type” item designates an authentication system when the device constructs a network operable in the infrastructure mode. For example, a user can select any one of Open System, Shared System, WPA (Wi-Fi Protected Access), or WPA-PSK (Wi-Fi Protected Access Pre-shared key). When the network is the ad-hoc mode, no selection is required for the “Authentication Type” item.  
         [0057]     An “Encryption Type” item designates an encryption system employed in the wireless network. For example, WEP (40bit), WEP (104bit), TKIP, or CCMP can be selected or automatically determined in the wireless communication device as initial settings, or can be selected by a user. According to the example shown in  FIG. 5 , the selected encryption system is CCMP.  
         [0058]     An “Encryption Key” item designates a key to be used in the encryption processing. The encryption key can be automatically produced by the wireless communication device, or can be directly input by a user. For example, the user can set a desirable encryption key consisting of 8 to 63 characters when the CCMP encryption system is selected.  
         [0059]     Furthermore, the user can designate a total number of wireless communication devices constituting the network. In the exemplary embodiment, the communication devices constituting the wireless communication system are the DSC  101  and the printer  102 . Therefore, a “Network Device Number” item designates two devices.  
         [0060]     Considering the total number of wireless communication devices, each of the wireless communication sections  204  and  304  can determine whether the replay check processing section  907  should execute the “replay check” processing.  
         [0061]      FIG. 6  is a flowchart showing an example replay check control performed by the CPU  215  ( 315 ) according to the program stored in the ROM  216  ( 316 ) or the flash ROM  213  ( 313 ). Furthermore, the CPU  215  ( 315 ) can control the decryption circuit shown in  FIG. 4  in the following manner. When the wireless communication section  204  ( 304 ) includes a control section, the control section can control the decryption circuit shown in  FIG. 4 . In the present exemplary embodiment, each of the CPU  215  and the CPU  315  executes the control shown in  FIG. 6 .  
         [0062]     Now referring to  FIG. 6 , the CPU  215  ( 315 ) determines whether the encryption type set in the parameter table of  FIG. 5  is CCMP (refer to step S 601 ). When the encryption type is not CCMP, the processing flow proceeds to step S 605 . When the encryption type is CCMP, the processing flow proceeds to step S 602 .  
         [0063]     In step S 602 , the CPU  215  ( 315 ) determines whether the network mode is the ad-hoc mode. When the network mode is not the ad-hoc mode (i.e., when the network mode is the infrastructure mode), the replay check control section  401  connects its switching terminal to the terminal  403  to execute the replay check processing. Namely, the output of the clear text MPDU assembling section  906  is sent to the replay check processing section  907  (refer to step S 604 ).  
         [0064]     When the network mode is the ad-hoc mode (i.e., YES in step S 602 ), the processing flow proceeds to step S 603 . In step S 603 , the CPU  215  ( 315 ) determines whether the total number of the network devices is 2. When the total number of the network devices is 2, only one other communication device is present. It is unnecessary to administrate other communication device.  
         [0065]     Thus, the replay check control section  401  connects the switching terminal to the terminal  403  to execute the replay check processing. Namely, the output of the clear text MPDU assembling section  906  is sent to the replay check processing section  907  (refer to step S 604 ). In other words, when the total number of the network devices is 2, the replay check processing is constantly performed based on the packet number.  
         [0066]     When the total number of the network devices is not 2, the processing flow proceeds to step S 605 . In step S 605 , the replay check control section  401  connects the switching terminal to terminal  402  to directly output the data produced from the clear text MPDU assembling section  906  without executing the replay check processing.  
         [0067]     An example method for connecting the wireless communication devices according to the ad-hoc mode (i.e., a direct communication mode using no relay station) will now be described with reference to  FIG. 7 .  
         [0068]     Both of the DSC  101  and the printer  102  disclosed in  FIG. 1  has the wireless communication function, according to which each communication device can alternately generate a random signal, generally referred to as “Beacon,” notifying other wireless communication device(s) of the information required for the wireless communications so as to synchronize the operations in respective devices.  
         [0069]     In the exemplary embodiment, wireless communication parameters set beforehand for the DSC  101  and the printer  102  are identical to each other. The following is a method for constructing an ad-hoc network for the wireless communication system shown in  FIG. 1 .  
         [0070]     First, the printer  102  turns on a power source of the wireless communication section  304 . Then, the printer  102  retrieves an ad-hoc network which is constructed based on ad-hoc mode wireless communication parameters determined beforehand. To this end, as one method, the printer  102  can retrieve the “Beacon.” As another method, the printer  102  can broadcast a control signal (generally referred to as “Probe Request”) and wait for a returning signal (generally referred to as “Probe Response”). The exemplary embodiment employs the latter method.  
         [0071]     Namely, the printer  102  transmits the probe request (refer to S 701 ) and waits for the probe response. In the exemplary embodiment, no other device is included in the ad-hoc network when retrieved by the printer  102 . Therefore, the printer  102  can receive no probe response after transmitting a predetermined number of probe requests. Accordingly, the printer  102  constructs its own network and starts transmitting the “Beacon” (refer to S 702 ).  
         [0072]     Next, the DSC  101  turns on a power source of the wireless communication section. Similar to the printer  102 , the DSC  101  transmits a “Probe Request” to retrieve an ad-hoc network which is constructed based on the ad-hoc mode wireless communication parameters determined beforehand (refer to S 703 ) At this moment, the ad-hoc network retrieved by the DSC  101  is already constructed by the printer  102 .  
         [0073]     Accordingly, the printer  102  returns the probe response to the DSC  101 . The DSC  101  receives the response (refer to S 704 ). After receiving the probe response, the DSC  101  obtains sync information of the ad-hoc network constructed by the printer  102  and can participate in the ad-hoc network. Then, the printer  102  and the DSC  101  start transmitting and receiving the “Beacon” in the ad-hoc network (refer to S 705 ).  
         [0074]     The DSC  101 , having participated in the ad-hoc network as described above, retrieves other device(s) constituting the ad-hoc network, and selects the printer  102  to instruct the print processing. The data in the wireless communications are encrypted according to the CCMP system (refer to  FIG. 9A ). In this case, the packet numbers are controlled as shown in  FIG. 8 .  
         [0075]     In each of the DSC  101  and the printer  102 , the packet number includes two values which can be administrated as a “transmission number” of the packet and a “reception number” to be expected in the reception of the packet as shown in  FIG. 8 . The “transmission number” is incremented in response to each transmission of the packet transmitted to the other communication device. The “reception number” is incremented in response to each reception of the packet received from the other communication device.  
         [0076]     In each of the DSC  101  and the printer  102 , the packet number of the received data (refer to “Packet Num” shown in  FIG. 8 ) is compared to the reception number administrated in each device (DSC  101 , printer  102 ). As described with reference to  FIG. 9B , alteration of the received packet is determined based on the comparison result.  
         [0077]     In this case, as shown in  FIG. 8 , an unknown DSC having a third wireless communication function (not shown in  FIG. 1 ) may transmit an altered packet resembling a correctly transmitted packet.  
         [0078]     However, as understood from  FIG. 8 , the packet number involved in the transmission packet of the third apparatus is smaller than the packet numbers administrated by the DSC  101  and the printer  102 .  
         [0079]     Accordingly, when CCMP encrypted data is received from any unknown third apparatus, the DSC  101  and the printer  102  can perform the replay check processing to detect alteration involved in the packet and, as a result, can block any unauthorized access.  
         [0080]     As described above, the present exemplary embodiment can easily realize the CCMP data communications in the ad-hoc mode without increasing the processing load in each wireless communication device.  
         [0081]      FIG. 10  shows a wireless communication system including three wireless communication devices (i.e., DSC  1001 , DSC  1002 , and printer  1003 ) operable in the ad-hoc mode. Each of the DSC  1001  and the DSC  1002  has the arrangement shown in  FIG. 2 . The printer  1003  has the arrangement shown in  FIG. 3 .  
         [0082]     In this case, the wireless communication parameters shown in  FIG. 5  are similarly applied to each wireless communication device shown in  FIG. 10 , although the “Network Device Number” is rewritten to three devices.  
         [0083]     According to the flowchart shown in  FIG. 6 , the decision result in step S 603  is NO because the total number of the wireless communication devices is 3. Thus, in step S 605 , the replay check control section  401  connects the switching terminal to terminal  402  to directly output the data produced from the clear text MPDU assembling section  906  without executing the replay check processing based on the packet numbers.  
         [0084]     Accordingly, when three or more communication devices constitute a wireless network operable in the ad-hoc mode, it is unnecessary to perform a complicated control for administrating packet numbers for other communication devices. The processing load of each wireless communication device can be reduced.  
         [0085]     Furthermore, even in this case, the wireless communication devices can execute the encrypted communication according to the CCMP system. The security in the communications can be maintained at a high level. In particular, the encrypted communication according to the CCMP system is excellent in encryption intensity compared to the encrypted communication according to the WEP system. Therefore, the security level can be maintained regardless of execution of the replay check processing.  
         [0086]     Next, the wireless communications performed in the infrastructure mode will be described.  FIG. 11  shows a wireless communication system including three wireless communication devices (i.e., DSC  1101 , printer  1102 , and AP  1103 ) operating in the infrastructure mode. The DSC  1101  has the arrangement shown in  FIG. 2 . The printer  1102  has the arrangement shown in  FIG. 3 .  
         [0087]     The AP  1103  is a wireless access point capable of controlling wireless communications performed between the wireless communication devices according to the IEEE802.11 standard.  
         [0088]     The wireless communication parameters of the DSC  1101  and the printer  1102  are dependent on the method for constructing the wireless network. As the network mode is the infrastructure mode, the item “Network Mode” in  FIG. 5  is set to “Infrastructure.” Furthermore, the “SSID”, “Authentication Type”, “Encryption Type”, and “Encryption Key” items are set to the values identical to the setting values for the AP  1103 .  
         [0089]     According to the example of  FIG. 11 , the “Authentication Type” item is set to “WPA-PSK” and the “Encryption Type” item is set to “CCMP.” As the “CH Number” item designates the operation channel used by the AP  1103  and the “Network Device Number” item designates a total number of the wireless communication devices administrated by the AP, no designation is necessary for these items.  
         [0090]     According to the flowchart shown in  FIG. 6 , the decision result in step S 602  is YES because the network mode is “Infrastructure.”  
         [0091]     Thus, in step S 604 , the replay check control section  401  connects the switching terminal to the terminal  403  to execute the replay check processing based on the packet numbers. When the network mode is “Infrastructure,” each communication device is only required to administrate the packet number relative to the AP  1103 .  
         [0092]     To realize the wireless connection in the infrastructure mode, the wireless communication parameters set for the DSC  1101  are identical to the setting values for the AP  1103 . The wireless communication parameters can be copied in the USB memory, and the parameters stored in the USB memory can be copied in the printer  1102 . Alternatively, each device can construct a network with the AP  1103  for data exchange of wireless communication parameters.  
         [0093]     When the network mode is “Infrastructure,” each of the DSC  1101  and the printer  1102  can perform connection processing with the AP  1103  according to the protocol of the IEEE802.11 and IEE802.11i standards.  
         [0094]     In this network, wireless communication devices can perform the encrypted communication according to the CCMP system, and also perform the decryption processing and the alteration detection according to the CCPM method.  
         [0095]     In the above-described embodiment, the network device number is set by a user. However, it is possible to automatically discriminate the total number of wireless communication devices constituting the ad-hoc network and perform the control processing shown in  FIG. 6 .  
         [0096]     In this case, each wireless communication device can discriminate the total number of the devices constituting the ad-hoc network by administrating the MAC address of a source involved in the Beacon received in the ad-hoc network.  
         [0097]     As described above, regardless of the network architecture and the number of associated communication devices, each wireless communication device can perform the encrypted communication according to the CCMP system and can maintain higher security compared to the encrypted communication according to the WEP method.  
         [0098]     Furthermore, when three or more wireless communication devices constitute a network operable in the ad-hoc mode, administrating all other communication devices constituting the network is unnecessary to perform the alteration detection.  
         [0099]     Also, a complicated control for administrating packet numbers of respective communication devices is unnecessary. Accordingly, the processing load of each device can be decreased.  
         [0100]     Additionally even in this case, the wireless communication devices can execute the encrypted communication according to the CCMP system. The security in the communications can be maintained adequately.  
         [0101]     For example, the encrypted communication according to the CCMP system is excellent in encryption intensity compared to the encrypted communication according to the WEP method. Therefore, the security level can be maintained highly regardless of execution of the replay check processing.  
         [0102]     The above-described exemplary embodiment can reduce the processing load in the wireless communications and can maintain higher security. For example, a wireless communication device can perform both the encrypted communication and the alteration detection when only one other communication device is present in the ad-hoc network. On the other hand, the wireless communication device can cancel the alteration detection and perform only the encrypted communication when two or more other communication devices are present in the ad-hoc network.  
         [0103]     In this manner, the above-described exemplary embodiment can reduce the contents required for administrating other communication devices and therefore can reduce the processing load and can maintain higher security.  
         [0104]     A software program code for realizing the functions of the above-described exemplary embodiments can be supplied, via a storage medium (or a recording medium), to a system or an apparatus. A computer (or CPU or MPU) in the system or the apparatus can read the program code stored in the storage medium and can execute the readout program.  
         [0105]     In this case, the program code read out from the storage medium can realize the functions of the exemplary embodiments. The equivalents of programs can be used if they possess comparable functions. Accordingly, when the functions or processes of the exemplary embodiments are realized by a computer, program code installed in the computer and a recording medium storing the program are used to implement the present invention.  
         [0106]     In other words, the present invention encompasses a computer program that can realize the functions or processes of the exemplary embodiments or any recording medium that can store the program. In this case, the type of the program can be any one of object code, interpreter program, and OS script data. A recording medium supplying the program can be selected from any one of a flexible disk, a hard disk, an optical disk, a magneto-optical disk, an MO, a CD-ROM, a CD-R, a CD-RW, a magnetic tape, a nonvolatile memory card, a ROM, and a DVD (DVD-ROM, DVD-R).  
         [0107]     The method for supplying the program includes accessing a home page on the Internet using the browsing function of a client computer, when the home page allows each user to download the computer program of the present invention, or compressed files of the programs having automatic installing functions, to a hard disk or other recording medium of the user.  
         [0108]     Furthermore, the program code constituting the programs of the present invention can be divided into a plurality of files so that respective files are downloadable from different home pages. Namely, the present invention encompasses WWW servers that allow numerous users to download the program files so that the functions or processes of the present invention can be realized on their computers.  
         [0109]     Furthermore, enciphering the programs of the present invention and storing the enciphered programs in a CD-ROM or comparable recording medium is a practical method when the programs of the present invention are distributed to the users. The authorized users (i.e., users satisfying predetermined conditions) are allowed to download key information from a home page on the Internet. The users can decipher the programs with the obtained key information and can install the programs on their computers. When the computer reads and executes the installed programs, the functions of the above-described exemplary embodiments can be realized.  
         [0110]     Further, not only the functions of the above-described exemplary embodiment can be realized by a computer that executes the programs, but also an operating system (OS) running on the computer can execute part or all of the actual processing based on instructions of the programs.  
         [0111]     Moreover, the program code read out of a storage medium can be written into a memory of a function expansion board equipped in a computer or into a memory of a function expansion unit connected to the computer. In this case, based on an instruction of the program, a CPU provided on the function expansion board or the function expansion unit can execute part or all of the processing so that the functions of the above-described exemplary embodiments can be realized.  
         [0112]     While the present invention has been described with reference to exemplary embodiments, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. The scope of the following claims is to be accorded the broadest interpretation so as to encompass all modifications, equivalent structures and functions.  
         [0113]     This application claims priority from Japanese Patent Application No. 2005-336005 filed Nov. 21, 2005, which is hereby incorporated by reference herein in its entirety.