JP2001320373A - Wireless lan system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a wireless LAN system which controls the permission/non- permission of communication, based on identification information of a radio communication terminal, which is previously registered in a memory. SOLUTION: In the wireless LAN system performing data communication between the radio communication terminals via an access point device, the access point device previously registers the serial number or MAC address of the radio communication terminal, whose communication is permitted in the memory as identification information. When a packet is transmitted from the radio communication terminal, it is checked as to whether the security flag of the received packet is already raised When it is not raised, the transmission address of the received packet is obtained and it is checked whether the address is matched with identification information of the memory. When the transmission address exists in identification information of the memory, the access point device raises the security flag of the received packet and transmits it to the radio communication terminal. When the security flag is raised or the transmission address does not exist in identification information of the memory, the pertinent packet is canceled (steps S301 to S306).

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] 1. Field of the Invention [0002] The present invention relates to a wireless LAN system, and more particularly, to a wireless LAN system with improved security in a wireless LAN.

[0002]

2. Description of the Related Art Recently, with the spread of information processing apparatuses such as computers and the development of wireless communication technology, a wireless communication adapter is connected to an information processing apparatus such as a computer to serve as a wireless communication terminal. Wireless LANs for transmitting and receiving data have been constructed and used.

In such a wireless LAN system, there is a risk that communication data is intentionally intercepted and that the intercepted communication data is stolen.

[0004] Further, in wireless LAN systems constructed close to each other within the reach of radio waves, the same address can be assigned to adjacent wireless LAN systems because the address of the destination can be freely assigned. In such a case, erroneous transfer of data and mutual interference may occur.

Therefore, conventionally, in a data communication apparatus which wirelessly transmits data to another terminal and receives data from the other terminal, input means for setting an identification code and data communication only to a specific device are provided. Has an ID code distributing means for distributing an ID code for enabling the ID code, and an ID code storing means for storing the ID code. When the ID code is set, the device to which data communication is permitted is the same. When the devices belonging to the same group are connected as a group and an input for setting an identification code is given from the input unit, the identification code is present in the identification code recording unit of both devices. If not,
An identification code is generated in one device, the generated identification code is stored in the identification code storage means of the one device and transferred to the other device, and the transferred identification code is transferred to the other device. The identification code is stored in the identification code storage unit of the other device. If the identification code is already stored in the identification code storage unit of the one device, the identification code is stored in the identification code storage unit of the one device. The other device is controlled to store the transferred identification code in the identification code storage means of the other device, and the devices belonging to the same group are transferred to the other device. A data communication device has been proposed in which the same identification code is distributed to devices so that data communication is possible only between devices belonging to the same group. Flat reference Patent Publication No. 11-8625).

That is, this data communication apparatus is a wireless communication adapter in the same group in a wireless LAN that performs peer-to-peer data communication between computers connected to the wireless communication adapter without passing through an access point. A wireless LAN communication method has been proposed in which an identification code unique to a group is set in the LAN, and communication can be performed only with a wireless communication adapter having the identification code.

[0007]

However, in such a conventional wireless communication LAN system, an identification code unique to the group is set for each group, and communication is performed only with the wireless LAN adapter having the identification code. In order to prevent eavesdropping between groups by making it possible, not only can identification be performed on a group basis, it is necessary to set an identification code for each group, There is a problem that the setting operation of the identification code is troublesome and the usability is poor. In addition, if the identification code of each group is leaked, there is a possibility that eavesdropping may be performed indefinitely.

Therefore, according to the first aspect of the present invention, when performing data communication between wireless communication terminals having a wireless communication adapter via the access point device, the access point device identifies a wireless communication terminal to which communication is permitted. By registering the identification information to be performed in advance in the storage unit and permitting communication only to the wireless communication terminals registered in the storage unit,
The wireless communication terminals are individually identified, communication permission / non-permission is controlled, data security from a third party is secured,
It is an object of the present invention to provide a wireless LAN system that prevents the risk of data being intentionally intercepted or stolen, and also prevents erroneous data transfer and mutual interference between adjacent wireless LAN systems.

According to a second aspect of the present invention, the access point device stores the MA of the wireless communication terminal as identification information in the storage means.
By registering the C address, the MAC address assigned to each wireless communication terminal in the wireless LAN system is usually used as identification information, and identification information such as a serial number for wireless LAN is stored in the wireless communication adapter. Wireless communication terminal with no additional memory
It is an object of the present invention to provide an inexpensive wireless LAN system that identifies using a C address and appropriately controls communication permission / non-permission.

According to a third aspect of the present invention, the access point device transmits a request packet to each wireless communication terminal when the device is reset, and transmits a reply packet including identification information from the wireless communication terminal in response to the request packet. Upon receipt, the identification information included in the reply packet is registered in the storage means, so that the identification information of each wireless communication terminal to which communication is permitted is automatically registered in the storage means, and the trouble of registering the identification information is saved. It is an object of the present invention to provide a highly usable wireless LAN system in which wireless communication terminals are appropriately identified and communication permission / non-permission is controlled.

[0011]

According to a first aspect of the present invention, there is provided a wireless LAN system for performing data communication between wireless communication terminals having a wireless communication adapter via an access point device. The device registers in advance in the storage means identification information for identifying the wireless communication terminal that permits communication, and performs a communication control process that allows communication only to the wireless communication terminal registered in the storage means. The above objective has been achieved.

According to the above configuration, when performing data communication between the wireless communication terminals having the wireless communication adapter via the access point device, the access point device transmits identification information for identifying the wireless communication terminal to which communication is permitted. Since the communication is permitted only to the wireless communication terminals registered in the storage means in advance and registered in the storage means, it is possible to individually identify the wireless communication terminals and control the permission / non-permission of the communication,
The security of data from a third party can be ensured to prevent the risk of data being intentionally intercepted or stolen, and to prevent erroneous data transfer and mutual interference between adjacent wireless LAN systems. be able to.

[0013] In this case, for example, as described in claim 2, the access point device registers the MAC address of the wireless communication terminal as the identification information in the storage means and performs the communication control processing. Is also good.

According to the above configuration, the access point device registers the MAC address of the wireless communication terminal as identification information in the storage means, so that the MAC address assigned to each wireless communication terminal in the wireless LAN system is normally identified. The wireless communication terminal can be used as information without using a new memory for storing identification information such as a serial number for a wireless LAN in a wireless communication adapter.
By using the AC address for identification, communication permission / non-permission can be appropriately and inexpensively controlled.

Also, for example, as set forth in claim 3, the access point device transmits a request packet to each of the wireless communication terminals when the device is reset, and the wireless communication terminal according to the request packet. When receiving a reply packet including the identification information from the storage device, the identification information included in the reply packet may be registered in the storage unit.

According to the above configuration, when the access point device transmits a request packet to each wireless communication terminal when the device is reset, and receives a reply packet including identification information from the wireless communication terminal in response to the request packet, Since the identification information included in the reply packet is registered in the storage unit, the identification information of each wireless communication terminal to which communication is permitted can be automatically registered in the storage unit, which saves the trouble of registering the identification information. It is possible to improve the usability by omitting, and to appropriately identify the wireless communication terminal and control the permission / non-permission of the communication.

[0017]

Preferred embodiments of the present invention will be described below in detail with reference to the accompanying drawings. It should be noted that the embodiments described below are preferred embodiments of the present invention, and therefore, various technically preferable limitations are added. However, the scope of the present invention is not limited to the following description. The embodiments are not limited to these embodiments unless otherwise specified.

FIGS. 1 to 6 show an embodiment of a wireless LAN system according to the present invention. FIG. 1 shows a wireless LAN to which an embodiment of the wireless LAN system according to the present invention is applied.
1 is a system configuration diagram of a system 1. FIG.

In FIG. 1, a wireless LAN system 1 comprises:
A plurality of wireless communication terminals S1 to Sn and an access point device Ap are provided, and the access point device Ap is connected to the wired LAN 2. The wireless LAN system 1
When another access point device (not shown) is connected to the wired LAN 2, another wireless LAN is connected via the wired LAN 2.
Connected to AN system. In the present embodiment,
Although a case where a plurality of wireless LAN systems are constructed by connecting the access point device Ap to the wired LAN 2 is shown, a single wireless LAN system may be used.

Each of the wireless communication terminals S1 to Sn has, for example, a wireless communication adapter Ad1 to Adn connected to an information processing device C1 to Cn such as a computer.
1 to Cn are processed by the wireless communication adapters Ad1 to Ad1.
It wirelessly transmits to the access point device Ap via the Adn, and receives data wirelessly transmitted from the other wireless communication terminals S1 to Sn via the access point device Ap via the wireless communication adapters Ad1 to Adn. Then, the information processing devices C1 to Cn perform the processing.

The access point device Ap wirelessly transmits and receives transfer data to and from the wireless communication adapters Ad1 to Adn of the wireless communication terminals S1 to Sn, and relays wireless communication in the wireless LAN system 1. .

In the wireless communication between the access point device Ap and each of the wireless communication terminals S1 to Sn, transfer data is packetized and transmitted, and the packet for transmitting the transfer data is configured as shown in FIG. ing. That is,
The packet includes a destination address that is the address of the destination wireless communication terminal S1 to Sn, and a source wireless communication terminal S1 to Sn.
n, a transmission address which is an address, data which is a data body to be transmitted (this data also includes a protocol type), a frame check sequence for checking a frame of a packet, and a security flag. In.

The access point device Ap
Is a memory for storing identification information for identifying the wireless communication terminals S1 to Sn to which communication is permitted, for example, an EEPROM in order to secure the security of the wireless LAN system 1 or the security of data from a third party.
(Electrically Erasable and Programmable ROM)
And the like, and as the identification information, the wireless communication terminal S1
To Sn, the serial numbers or MAC addresses of the wireless communication adapters Ad1 to Adn can be used.

In this case, when using the serial numbers of the wireless communication adapters Ad1 to Adn connected to the wireless communication terminals S1 to Sn, a memory such as an EEPROM for storing the serial numbers and the like is stored in the wireless communication adapters Ad1 to Adn. Provide. However, when a MAC address is used as identification information, it is not necessary to newly provide a memory. That is, since a MAC address is usually assigned to each LAN adapter in a LAN, the wireless communication adapters Ad1 to A1
dn is an EEPROM for storing the MAC address.
This is because the EEPROM can be used because it already has the OM. Therefore, as the identification information for identifying the wireless communication terminals S1 to Sn, MAC
Using addresses is the simplest and cheapest method. The identification information includes the serial number and MA
It is not limited to the C address.

As the identification information, inputting identification information such as a serial number or a MAC address of the wireless communication terminals S1 to Sn permitted to communicate from an input device provided in the access point device Ap, for example, a keyboard or the like. Or by automatically acquiring identification information such as a serial number or a MAC address of each of the wireless communication terminals S1 to Sn to which communication is permitted at the time of resetting the access point device Ap or the like, thereby registering it in the memory.

Next, the operation of the present embodiment will be described. The wireless LAN system 1 registers identification information of the wireless communication terminals S1 to Sn that permit communication in a memory of the access point device Ap, and registers the registered wireless communication terminals S1 to Sn.
The feature is that communication is permitted only for n.

That is, in the wireless LAN system 1, each of the wireless communication terminals S1 to Sn mutually transmits and receives transfer data via the access point device Ap, but secures security from a third party or data security. For this purpose, identification information for identifying the wireless communication terminals S1 to Sn that permit communication in the memory of the access point device Ap, for example, the serial numbers or MAC addresses of the wireless communication terminals S1 to Sn are registered in the internal memory. This identification information can be registered in the memory of the access point device Ap by inputting the identification information from an input device such as a keyboard of the access point device Ap, but is automatically registered when the access point device Ap is reset. You can also.

That is, the access point device Ap:
As shown in FIG. 3, when reset (step S10)
1), a request packet is transmitted to each of the wireless communication terminals S1 to Sn (step S102).

When a request packet is transmitted from the access point device Ap, each of the wireless communication terminals S1 to Sn receives the request packet (step S1).
03), and transmits a reply packet including its own serial number or MAC address to the access point device Ap (step S104).

When the reply packet is transmitted from each of the wireless communication terminals S1 to Sn, the access point device Ap receives the reply packet (step S10).
5), the serial number or the MAC address in the received reply packet is extracted, and the extracted serial number or the MAC address is registered in the memory as identification information of the wireless communication terminals S1 to Sn to which the communication is permitted.
The process ends (Step S106).

Thus, the access point device A
p in a state where the serial number or the MAC address is registered as identification information in the memory of the wireless communication terminal S.
Security processing in communication of transfer data from 1 to Sn is performed.

That is, each of the wireless communication terminals S1 to Sn
When transmitting the transfer data, as shown in FIG. 4, first, the transfer data is packetized (step S201), and a destination address and a transmission address are added to the packetized transfer data as shown in FIG. A packet is generated by setting other necessary components such as a frame check sequence and a security flag as a packet (step S202). At this time, the wireless communication terminals S1 to Sn transmitting data turn off the security flag, that is, generate packets in a state where the security flag is not set.

When the wireless communication terminals S1 to Sn generate a packet, the wireless communication terminals S1 to Sn transmit the generated packet to the access point device A.
p, and the data transmission process ends (step S203).

When a packet is transmitted from the radio communication terminals S1 to Sn, the access point device Ap receives the packet as shown in FIG. 5 (step S30).
1) It is checked whether the security flag of the received packet has already been set (step S302).

In step S302, if the security flag is not set, the access point device Ap
Acquires the transmission address from the received packet, that is, the address of the wireless communication terminal S1 to Sn of the transmission source,
With reference to the identification information registered in the memory, it is checked whether the transmission address exists in the identification information registered in the memory (step S303).

In step S303, if the transmission address exists in the identification information, the access point device Ap
Sets the security flag of the received packet (step S304), and transmits the packet with the security flag set to the wireless communication terminals S1 to Sn, or
The process is terminated by relaying to AN2 (step S
305).

If the security flag is set in step S302, the access point device Ap determines that the packet is not a packet to be received by itself, discards the packet, and ends the process (step S306).

When the transmission address does not exist in the identification information registered in the memory in step S303, the access point device Ap determines that the packet is not a wireless communication terminal that permits communication, and transmits the packet. Discard and end the process (step S306).

Therefore, the access point device Ap
Can permit only communication from the wireless communication terminals S1 to Sn registered in advance in the memory as identification information, and disallow communication from the other wireless communication terminals S1 to Sn.

At the time of reception, each of the wireless communication terminals S1 to Sn receives a packet as shown in FIG. 6 (step S4).
01), it is checked whether a security flag is set on the received packet (step S402). If the security flag is set, it is checked whether the transmission address of the received packet matches its own address (own address) (step S402). Step S403).

In step S403, if the transmission address of the packet matches the own address, the wireless communication terminals S1 to S
n determines that the packet is addressed to itself, extracts data from the packet, converts it into data, and ends the processing (step S404).

In step S403, if the transmission address of the packet does not match its own address, the wireless communication terminals S1 to S1
Sn determines that the packet is not addressed to itself, discards the packet, and ends the processing (step S40).
5).

If it is determined in step S402 that the security flag of the received packet is not set, the radio communication terminals S1 to Sn discriminate that the packet is not a packet to be received by itself, and terminate the process. (Step S405).

As described above, the wireless LAN system 1 according to the present embodiment includes the wireless communication terminals S1 to Sn in which the wireless communication adapters Ad1 to Adn are connected to the information processing devices C1 to Cn.
When performing inter-data communication via the access point device Ap, the access point device Ap previously registers identification information for identifying the wireless communication terminals S1 to Sn to which communication is permitted in the memory, and the information is registered in the memory. Communication is permitted only to the wireless communication terminals S1 to Sn.

Therefore, the wireless communication terminals S1 to Sn can be individually identified to control permission / non-permission of communication, and the security of data from a third party can be ensured, and data can be intentionally intercepted. In addition, it is possible to prevent a risk of plagiarism and prevent erroneous data transfer and mutual interference between adjacent wireless LAN systems.

In the wireless LAN system 1 of the present embodiment, the access point device Ap registers the MAC addresses of the wireless communication terminals S1 to Sn in the memory as identification information.

Therefore, usually, the wireless LAN system 1
Assigned to each of the wireless communication terminals S1 to Sn
The C address can be used as identification information, and the wireless communication adapters Ad1 to Adn can be used to store the wireless communication terminals S1 to Sn in the MAC without newly providing a memory for storing identification information such as a serial number for wireless LAN. By using the address for identification, communication permission / non-permission can be controlled appropriately and inexpensively.

Further, in the wireless LAN system 1 of the present embodiment, when the access point device Ap resets the device, the access point device Ap transmits a request packet to each of the wireless communication terminals S1 to Sn, and performs wireless communication in response to the request packet. When a reply packet including identification information is received from the terminals S1 to Sn, the identification information included in the reply packet is registered in the memory.

Therefore, the identification information of each of the wireless communication terminals S1 to Sn to which the communication is permitted can be automatically registered in the memory, so that the trouble of registering the identification information can be saved and the usability can be improved. , Wireless communication terminals S1 to
Sn can be appropriately identified and communication permission / non-permission can be controlled.

Although the invention made by the inventor has been specifically described based on the preferred embodiments, the present invention is not limited to the above-described embodiment, and various modifications may be made without departing from the gist of the invention. It goes without saying that it is possible.

[0051]

According to the wireless LAN system of the first aspect of the present invention, when performing data communication between wireless communication terminals having a wireless communication adapter via the access point device, the access point device permits the communication. The identification information for identifying the wireless communication terminal to be performed is registered in the storage means in advance, and communication is permitted only to the wireless communication terminals registered in the storage means. Permission can be controlled, security of data from a third party can be secured, data can be prevented from being deliberately intercepted or stolen, and data can be exchanged between adjacent wireless LAN systems. Erroneous transfer and mutual interference can be prevented.

According to the wireless LAN system of the second aspect of the present invention, the access point device registers the MAC address of the wireless communication terminal as identification information in the storage means. The assigned MAC address can be used as identification information, and the wireless communication terminal can store the MAC address without newly providing a memory for storing identification information such as a wireless LAN serial number. The communication permission / non-permission can be appropriately and inexpensively controlled.

According to the wireless LAN system of the third aspect, the access point device transmits a request packet to each wireless communication terminal when the device is reset, and identifies the wireless communication terminal from the wireless communication terminal according to the request packet. When the reply packet containing the information is received, the identification information included in the reply packet is registered in the storage means, so that the identification information of each wireless communication terminal to which communication is permitted can be automatically registered in the storage means. In addition, it is possible to improve the usability by saving the trouble of registering the identification information, and it is possible to appropriately identify the wireless communication terminal and control the permission / non-permission of the communication.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram of a wireless LAN system to which an embodiment of a wireless LAN system according to the present invention is applied.

FIG. 2 is a configuration diagram of a packet transmitted / received in the wireless LAN system of FIG. 1;

FIG. 3 is a flowchart showing a process of automatically registering identification information in a memory of the access point device of FIG. 1;

FIG. 4 is a flowchart showing data transmission processing by the wireless communication terminal in FIG. 1;

FIG. 5 is a flowchart showing packet relay / security processing by the access point device of FIG. 1;

FIG. 6 is a flowchart showing data reception processing by the wireless communication terminal of FIG. 1;

[Explanation of symbols]

 Reference Signs List 1 wireless LAN system 2 wired LAN S1 to Sn wireless communication terminal C1 to Cn information processing device Ad1 to Adn wireless communication adapter Ap access point device

Claims (3)

[Claims] 1. A wireless LAN system for performing data communication between wireless communication terminals having a wireless communication adapter via an access point device, wherein the access point device includes identification information for identifying the wireless communication terminal to be permitted to communicate. A wireless LAN system that registers in advance in a storage unit and performs a communication control process for permitting communication only to the wireless communication terminal registered in the storage unit. 2. The wireless LAN system according to claim 1, wherein the access point device registers the MAC address of the wireless communication terminal as the identification information in the storage unit, and performs the communication control process. . 3. The access point device transmits a request packet to each of the wireless communication terminals when the device is reset, and receives a reply packet including the identification information from the wireless communication terminal in response to the request packet. 3. The wireless LAN system according to claim 1, wherein the identification information included in the reply packet is registered in the storage unit.