Network connection control device, network connection control method and network connection control program

Abstract

To control for each grasped area operation of a radio communication terminal positioned in the area by precisely grasping a position of each radio communication terminal.SOLUTION: A space list is held in a space list storage section 105, and an operation definition list is held in an operation definition list storage section 106. On the basis of information obtained by receiving a signal from a radio communication terminal, a position of the radio communication terminal is detected by a position detection section 112. Based on the position of the radio communication terminal which is detected by the position detection section 112, the space list is referenced and a space in which the radio communication terminal is positioned is determined by a space determination section 113. On the basis of the space which is determined by the space determination section 113, the operation definition list is referenced and operation regarding the radio communication terminal is controlled by an operation control section 114.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a device, called, for example, a wireless access point, that is used when constructing a wireless LAN (Local Area Network), and to a method and a program used in the device. [Background technology]

[0002] Patent Document 1, which will be described later, discloses an invention relating to a mobile wireless communication terminal and a program that, when using a wireless communication function to identify the current area and to implement area-specific restrictions, can implement area-specific restrictions even if the wireless communication function is turned off. In the invention disclosed in Patent Document 1, the current area of ​​the mobile wireless communication terminal is identified by the mobile wireless communication terminal side depending on whether communication with a specified access point is possible (Example 1) or whether a signal from a specified transmitter can be received (Example 2). In other words, the invention disclosed in Patent Document 1 implements function restrictions in the mobile wireless communication terminal when communication with a specified access point is possible or when a signal from a specified transmitter can be received.

[0003] Also, Patent Document 2, which will be described later, discloses an invention relating to a mobile wireless communication terminal and its function restriction control method, which sets effective function restrictions without impairing the freedom of use of the mobile communication terminal. In the invention disclosed in Patent Document 2, a slave unit, the available functions of which are restricted by a predetermined master unit, acquires current location information of the terminal itself and current location information of the master unit, and determines whether or not to use a specific function according to the positional relationship with the master unit. That is, the invention disclosed in Patent Document 2 restricts functions in the slave unit depending on whether or not the slave unit is located near the master unit. In addition, the positions of the master unit and the slave unit are detected by a positioning system based on the positions of base stations communicating with the master unit and the slave unit, and information from the global positioning system (GPS) of the master unit and the slave unit. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 4891108 [Patent Document 2] Patent No. 5397699 Summary of the Invention [Problem to be solved by the invention]

[0005] As described above, the invention disclosed in Patent Document 1 determines whether the mobile wireless communication terminal is within a specified area (for example, whether it is within a company) based on whether the mobile wireless communication terminal can communicate with an access point or whether it can receive a signal from a specified transmitter. The invention disclosed in Patent Document 2 detects the location of the master unit and the slave unit based on the location of the base station communicating with the master unit and the slave unit, and information from the GPS of the master unit and the slave unit. Therefore, it is only possible to confirm the location in a broad sense, such as whether the mobile wireless communication terminal is within a company or whether the distance between the master unit and the slave unit is within a specified distance. Furthermore, the invention disclosed in Patent Document 1 cannot specify whether the mobile wireless communication terminal can be legitimately connected to the access point.

[0006] That is, wireless access points (hereafter referred to as APs) differ from wired ones in that they emit (transmit) radio waves and can therefore be detected (received) by all devices within range. Due to their nature, they are constantly exposed to the risk of unauthorized access. Existing technologies to combat this include the requirement of a network security key, MAC (Media Access Control) address filtering, and concealment of the SSID (Service Set Identifier).

[0007] Existing technology allows for concealment using SSID stealth, but it is not effective because it can be analyzed using special tools. APs, which are particularly widespread and installed in homes, leak radio waves outdoors. There have been cases of damage caused by this, and it is always a potential security risk. MAC address filtering can also be circumvented by intercepting radio waves to obtain and set the MAC address, and random MAC address technology means that its effect on security is not great. Network security key entry is also a type of password authentication, and has the same drawbacks as knowledge authentication.

[0008] In view of the above, an object of the present invention is to enable a network connection control device, such as an AP, to precisely grasp the position of each wireless communication terminal and to control the operation of wireless communication terminals located within a specified area. [Means for solving the problem]

[0009] In order to solve the above problems, the network connection control device according to the invention described in claim 1 comprises: A network connection control device for connecting a wireless communication terminal to a predetermined network, a space list storage means for storing, for each of the three-dimensional spaces divided in advance, space identification information for identifying each space and information for specifying the position and range of each space in association with each other as first stored data; An action definition list storage means for storing action definition information as second stored data for each of the three-dimensional spaces that have been previously divided; a position detection means for detecting a position of the wireless communication terminal in a three-dimensional coordinate space based on information obtained by receiving a transmission signal from the wireless communication terminal, and specifying position information; a space determination means for determining the space in which the wireless communication terminal is located by referring to the first stored data in the space list storage means based on the position information detected by the position detection means; an action control means for controlling an action of the wireless communication terminal by referring to the second stored data of the action definition list storage means based on the space determined by the space determination means; The present invention is characterized by comprising:

[0010] According to the network connection control device of the invention described in claim 1, a space list is stored in a space list storage means, and an action definition list is stored in an action definition list storage means. A position detection means detects the position of a wireless communication terminal based on information obtained by receiving a signal from the wireless communication terminal. A space determination means refers to the space list in the space list storage means based on the position of the wireless communication terminal detected by the position detection means, and determines the space in which the wireless communication terminal is located. An action control means refers to the action definition list in the action definition list storage means based on the space determined by the space determination means, and controls the action of the wireless communication terminal. Effect of the Invention

[0011] According to this invention, the network connection control device can precisely grasp the position of each wireless communication terminal, and for each identified area, it is possible to control the operation of wireless communication terminals located within that area. [Brief description of the drawings]

[0012] [Figure 1] 1 is a diagram showing an example of a wireless communication system configured using an AP (Access Point device) to which an embodiment of a network connection control device according to the present invention is applied. [Diagram 2] 1 is a diagram for explaining an example of the position of a wireless communication terminal and the space (area) in which the wireless communication terminal is located, which are grasped by an AP according to an embodiment. FIG. [Diagram 3] FIG. 2 is a block diagram illustrating a configuration example of an AP according to an embodiment. [Figure 4] FIG. 13 is a diagram illustrating an example of an identification information list. [Diagram 5] FIG. 13 is a diagram showing an example of a space list. [Figure 6] FIG. 13 is a diagram showing an example of a space specification list. [Figure 7] FIG. 13 is a diagram showing an example of an operation definition list. [Figure 8] 1 is a diagram for explaining detection of the position of a wireless communication terminal by a short-range wireless interface; [Figure 9] 11 is a diagram for explaining a process for identifying a space in which a communication wireless communication terminal is located. FIG. [Figure 10] FIG. 11 is a diagram illustrating an HTTP redirect. [Figure 11] FIG. 13 is a diagram for explaining an access time limit. [Figure 12] FIG. 13 is a diagram for explaining Internet access restrictions. [Figure 13] FIG. 13 is a diagram for explaining spatial access restrictions. [Figure 14] FIG. 11 is a diagram for explaining MAC address filtering. [Figure 15] FIG. 13 is a diagram illustrating content filtering. [Figure 16] FIG. 11 is a diagram for explaining address allocation restrictions. [Figure 17] 11 is a flowchart illustrating a process executed by an AP according to the embodiment. [Figure 18] FIG. 11 is a diagram for explaining an example of a method for setting a space. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Hereinafter, with reference to the drawings, an embodiment of the device, method, and program according to the present invention will be described. In the embodiment described below, an example in which the present invention is applied to an AP (Access Point device) used in constructing a wireless LAN (Local Area Network) will be described. The AP in the embodiment described below can be used in constructing a large-scale wireless LAN in a relatively large area such as a company office or factory, and can also be used in constructing a small-scale wireless LAN at home. In the following, for simplicity of explanation, an example in which the present invention is applied to an AP used in constructing a small-scale wireless LAN at home will be described.

[0014] [Example of a wireless communication system] Fig. 1 is a diagram showing an example of a wireless communication system configured using an AP to which an embodiment of a network connection control device according to the present invention is applied. As shown in Fig. 1, an AP 1 and a router 2 are installed indoors in a home, and the AP 1 is connected to a network 3 via the router 2. The network 3 is mainly the Internet, but also includes various networks such as an optical telephone network, a public telephone network, and a mobile phone network that connect communication devices such as the router 2 to the network 3. Various server devices 4 that provide web pages and the like are connected to the network 3.

[0015] As shown in Fig. 1, AP1 realizes the function of wirelessly connecting wireless communication terminals (wireless LAN communication terminals) such as mobile communication terminals 5, such as smartphones, and PCs (Personal Computers) 6 to each other and to other networks (wired LANs, etc.). Note that PCs include PCs that are easy to carry and desktop PCs that are often installed and used, but because both can be connected to AP1 by the wireless LAN function, they are collectively referred to as PCs.

[0016] Router 2 realizes the function of relaying data between two or more different networks, and in this embodiment, relays data between a home wireless LAN and network 3. Router 2 also has a route selection function that determines which route data should be transferred through at the network layer. Note that AP 1 and router 2 may be configured as separate devices, or may be configured as an integrated device as shown by the dotted line. This invention is applicable to both separate APs and devices in which an AP and a router are integrated, but the following description will be given assuming that AP 1 and router 2 are configured as separate devices.

[0017] In this embodiment, the AP1, the mobile communication terminal 5, and the PC 6 are provided with a wireless communication function based on the Wi-Fi (registered trademark) standard and a short-range wireless communication function based on the Bluetooth (registered trademark) standard. In this embodiment, the AP1, the mobile communication terminal 5, and the PC 6 transmit and receive data using the wireless communication function based on the Wi-Fi (registered trademark) standard. The short-range wireless communication function based on the Bluetooth (registered trademark) standard installed in the AP1 is version 5.1 or higher. Therefore, when the AP1 communicates with the mobile communication terminal 5 or the PC 6 using the short-range wireless communication function based on the Bluetooth (registered trademark) standard, the AP1 can measure the location of the mobile communication terminal 5 or the PC 6 with centimeter accuracy using a direction detection function.

[0018] The distance at which communication is possible between AP1 and mobile communication terminal 5 or PC 6 using the short-range wireless communication function of the Bluetooth (registered trademark) standard is in the range of 0 to several hundred meters. In the following description, when referring to different mobile communication terminals, mobile communication terminals 5 will be referred to as mobile communication terminals 5(1) and 5(2), and when referring to different PCs, PCs 6(1) and 6(2).

[0019] FIG. 2 is a diagram for explaining an example of the location of the mobile communication terminal 5 measured by the AP1 of this embodiment and the space (area) in which the wireless communication terminal is located. As a simple example, consider a case where there are two rooms (space A, space B) on the first floor and two rooms (space C, space D) on the second floor. Spaces A, B, C, and D shown in FIG. 2 correspond to rooms A, B, C, and D. As shown in FIG. 2, it is assumed that the AP1 is installed in space A on the first floor, a mobile communication terminal 5(1) is located in space A, a mobile communication terminal 5(2) is located in space B, a mobile communication terminal 5(3) is located in space C, and a mobile communication terminal 5(4) is located in space D. It is also assumed that the mobile communication terminal 5(5) is located outdoors as shown in FIG. 2.

[0020] AP1 can identify the direction and distance of each of mobile communication terminals 5(1), 5(2), 5(3), 5(4), and 5(5) by communicating with each of them using the short-range wireless communication function of the Bluetooth (registered trademark) standard. In other words, the locations of mobile communication terminals 5(1), 5(2), 5(3), 5(4), and 5(5) in three-dimensional space can be identified as point information. In addition, the locations and ranges of spaces A, B, C, and D can be identified if the positions of the eight vertices of each space are known.

[0021] For this reason, the AP1 of this embodiment stores and holds a space list in which the coordinate information of the eight vertices of each of the spaces A, B, C, and D is associated with a space ID (space identification information) for uniquely identifying each of the spaces A, B, C, and D. The coordinate information of the eight vertices of each of the spaces A, B, C, and D can be measured, for example, using a mobile communication terminal 5(1). That is, the AP1 is set to a space position measurement mode, the mobile communication terminal is brought into each space, the space ID is input, and the terminal is positioned in the vicinity of the eight end points (vertices) in order, and communication is performed between the AP1 and the AP1 using a wireless communication function of the Bluetooth (registered trademark) standard. As a result, the AP1 can acquire coordinate data indicating the positions of the eight end points of the space by actual measurement in association with the space ID.

[0022] Therefore, for example, if the AP1 can measure the location of the mobile communication terminal 5(1), it can grasp in which space (in which room) the mobile communication terminal 5(1) is located. This allows the AP1 to change control depending on which space the mobile communication terminal 5(1) is located in. For example, when the mobile communication terminal 5(1) is located in space A, it can enable connection to network 3, but when the mobile communication terminal 5(1) is located in space B, it can disable connection to network 3. In addition, for a mobile communication terminal 5(5) that is not located in any of spaces A, B, C, or D, it can disable communication through the AP1 even if communication with the AP1 is possible.

[0023] In this way, the AP1 of this embodiment has a space recognition function and can grasp the relative positions of all wireless communication terminals (such as the mobile communication terminal 5 and the PC 6) connected to it. The AP1 can be set to perform a predetermined operation for each space. Therefore, by using the location of the wireless communication terminal as authentication key information, it is possible to provide functions such as access denial, redirection, and content filtering according to the space (room) in which the wireless communication terminal is located, as will be described in detail later. The configuration and operation of the AP1 of this embodiment will be specifically described below.

[0024] [Example of AP1 configuration] 3 is a block diagram for explaining a configuration example of an AP according to an embodiment. The connection terminal 101T and the wired LAN communication unit 101 are communication interfaces that enable communication with the router 2. Therefore, data to be transmitted from the AP 1 to the router 2 is converted into data for transmission in the wired LAN communication unit 101, and transmitted through the connection terminal 101T. Data from the router 2 and the like is received through the connection terminal 101T, and converted into data in a format that can be processed by the wired LAN communication unit 101 before being imported.

[0025] The control unit 102 is a microprocessor including a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), a non-volatile memory, and the like, and realizes the function of controlling each part of the AP1. The ROM of the control unit 102 stores programs executed by the CPU and data required for processing. The RAM of the control unit 102 is mainly used as a working area. The non-volatile memory of the control unit 102 stores upgrade programs provided later via the network 3, highly important data that needs to be retained even when the power is turned off, and the like.

[0026] The storage unit 103 is a device unit consisting of a recording medium having a relatively large capacity, such as a semiconductor memory, and its driver, and is used to store and hold various data, etc., as well as a work area for storing intermediate results in various processes. Each of the identification information list storage unit 104, the space list storage unit 105, and the operation definition list storage unit 106 is also a device unit consisting of a recording medium having a relatively large capacity, such as a semiconductor memory, and its driver. Each of these can be configured as a separate storage unit as shown in Figure 3, or can be configured with different storage areas for one storage unit.

[0027] 4 is a diagram showing an example of an identification information list. The identification information list is information formed in position detection unit 112, which will be described later. The identification information list is made up of terminal-specific identification information of a wireless communication terminal, such as mobile communication terminal 5 or PC 6, whose location in three-dimensional space has been detected by performing short-range wireless communication with AP1, and the detected three-dimensional terminal position information (x, y, z). Such an identification information list is recorded and held in identification information list storage unit 104 for use. The terminal-specific identification information is the MAC address or IP / IPv6 address of a wireless communication terminal, such as mobile communication terminal 5 or PC 6.

[0028] Fig. 5 is a diagram showing an example of a space list. As shown in Fig. 5, the space list is composed of a space ID for uniquely identifying each space (room) and coordinate data of eight end points (vertices) for specifying the position and area of ​​each space. In Fig. 5, information indicated by symbols a1, b1, c1, ..., h1, etc. is coordinate data of the end points, and is actually information indicated by coordinate data in a three-dimensional space such as (xa1, ya1, za1). Such a space list (end point coordinate list for each space) is prepared in advance in the space list storage unit 105.

[0029] That is, as described above, the AP1 is set to the spatial position measurement mode, the mobile communication terminal is brought to each space, the space ID is input, the terminal is positioned in the vicinity of the eight end points (vertices) in order, and communication is performed between the AP1 and the AP1 by the wireless communication function of the Bluetooth (registered trademark) standard. As a result, the AP1 can obtain coordinate data indicating the positions of the eight end points of the space in association with the space ID. By performing such processing for each space (room) A, B, C, and D, the control unit 102, the short-range wireless communication unit 111, and the position detection unit 112 cooperate to form the space list shown in FIG. 5 in the space list storage unit 105 by actual measurement. Note that, in the example shown in FIG. 2, it has been described that there are four spaces A, B, C, and D, but it is of course possible to define (set) more spaces depending on the size of the building.

[0030] Fig. 6 is a diagram showing an example of a space identification list. The space identification list is made up of terminal-specific identification information and a space ID, and is information formed in space determination unit 113, which will be described in detail later. The space identification list is formed as information indicating in which space a terminal identified by terminal-specific identification information is located, by matching an identification information list (Fig. 4) formed in position detection unit 112 with a space list (Fig. 5) in space list storage unit 105.

[0031] FIG. 7 is a diagram showing an example of an action definition list. As shown in FIG. 7, the action list is configured with space ID, device, action type, parameter 1, parameter 2, ..., parameter N. In this example, since parameter 1, parameter 2, and parameter 3 already exist, the character N of parameter N means an integer of 4 or more. The space ID is information that uniquely identifies a space. The device is information that indicates the type of wireless communication terminal to be controlled. The action type is information that indicates what action is to be performed. Parameter 1, parameter 2, ..., parameter N are information required when performing the action indicated by the action type, and simply mean information given for the purpose of dynamically determining the content of the process, like a variable.

[0032] Therefore, the action definition list defines that, in the space specified by the information in the space ID column, a wireless communication terminal of a type specified by the information in the device column is made to perform an action specified by the information in the action type column. The information used to perform the action is parameter 1, parameter 2, ..., parameter N. Such an action definition list is created in advance using, for example, PC6, and provided to AP1, where it is recorded and held in the action definition list storage unit 106. Details of the action types, etc. will be described later.

[0033] In the operation definition list shown in Fig. 7, the only device specified is the speaker for space C, and the others are not specified, that is, all devices are the targets. Also, the device information in the operation definition list shown in Fig. 7 is basically notified by being included in the transmission data from the wireless communication terminal that performed the short-distance wireless communication.

[0034] The wireless LAN communication unit 107 and the wireless LAN antenna 107A are communication interfaces that enable communication via a wireless LAN, and are communication units conforming to the Wi-Fi (registered trademark) standard. Therefore, when data is transmitted from the AP1 to the mobile communication terminal 5 or the PC 6, the data is converted into data for transmission in the wireless LAN communication unit 107 and transmitted through the wireless LAN antenna 107A. Also, data from the mobile communication terminal 5 or the PC 6 is received by the wireless LAN antenna 107A, and converted into data in a format that can be processed by the wireless LAN communication unit 107 before being imported.

[0035] Therefore, for example, the action definition list (FIG. 7) formed by PC 6 is received by wireless LAN antenna 107A, converted and imported by wireless LAN communication unit 107, and recorded in action definition list storage unit 106 by control unit 102. Also, mobile communication terminal 5 and PC 6 are connected to network 3 via AP 1 and router 2, and can perform various processes such as browsing web pages and sending and receiving e-mails.

[0036] The short-distance wireless communication unit 111 and the short-distance wireless communication antennas 111A(1), 111A(2), 111A(3), and 111A(4) are a short-distance wireless interface that enables short-distance wireless communication according to the Bluetooth (registered trademark) standard. Therefore, the short-distance wireless interface consisting of the short-distance wireless communication unit 111 and the short-distance wireless communication antennas 111A(1), 111A(2), 111A(3), and 111A(4) can convert received data into data in a format that can be processed by the device itself and import the data. In addition, the short-distance wireless communication interface can convert data to be transmitted from the device itself into data in a format to be transmitted and transmit the data from the short-distance wireless communication antennas 111A(1), 111A(2), 111A(3), and 111A(4).

[0037] Furthermore, a direction detection function realized by cooperation between the short-range wireless communication unit 111 and the position detection unit 112 detects the distance and direction to the wireless communication terminal that has communicated in polar coordinate format. FIG. 8 is a diagram for explaining detection of the position of a wireless communication terminal by a short-range wireless interface. The short-range wireless communication unit 111 supplies the position detection unit 112 with terminal-specific identification information of the wireless communication terminal received through the short-range wireless communication antennas 111A(1), 111A(2), 111A(3), and 111A(4). The short-range wireless communication unit 111 also supplies the receiving electric field strength of the signal received by each of the short-range wireless communication antennas 111A(1), 111A(2), 111A(3), and 111A(4) to the position detection unit 112.

[0038] The position detection unit 112 detects the direction and distance of the wireless communication terminal based on the signals from the wireless communication terminal received by each of the short-range wireless communication antennas 111A(1), 111A(2), 111A(3), and 111A(4). There are two types of "direction detection function" technology in Bluetooth (registered trademark) 5.1, which are called the AoA (Angle of Arrival) method and the AoD (Angle of Departure) method.

[0039] In the AoA method, a single antenna transmitter transmits a signal to a multiple antenna receiver, and since there is a distance between each antenna, the receiver can receive signals with different phases and calculate the angle from the phase difference. The AoD method is the opposite of AoA, in that the transmitter has multiple antennas, receives signals from each antenna, and calculates the target angle from the phase difference. The AP1 in this embodiment can be configured to use either AoA or AoD, but in this embodiment, the AoA technology is used to identify the position of the wireless communication terminal.

[0040] First, as shown in Fig. 8(A), the position detection unit 112 sets the installation position of AP1 as the origin O and specifies the distance r from the origin O to the location P of the wireless communication terminal. Furthermore, the position detection unit 112 obtains an angle θ between the z axis and a straight line OP connecting the origin O and the location P of the wireless communication terminal. Furthermore, the position detection unit 112 specifies a point Q that is a position on the xy plane of a perpendicular line drawn from the location P of the wireless communication terminal to the xy plane, and obtains an angle α between the x axis and a straight line OQ connecting the origin O and the point Q on the xy plane. As a result, the location P of the wireless communication terminal in the three-dimensional space is specified in polar coordinate format as (r, θ, α) as shown in Fig. 8(A).

[0041] However, if the detected location of the wireless communication terminal remains in polar coordinate format, subsequent processing is difficult. Therefore, as shown in FIG. 8(B), the position detection unit 112 substitutes the obtained (r, θ, α) into equation (1) to obtain the x coordinate, and substitutes it into equation (2) to obtain the y coordinate. Furthermore, it substitutes it into equation (3) to obtain the z coordinate. In this way, the polar coordinates (r, θ, α) can be converted into three-dimensional coordinates (x, y, z). The position detection unit 112 forms an identification information list (FIG. 4) consisting of the terminal-specific identification information from the short-range wireless communication unit 111 and the specified terminal position information (x, y, z), and stores it in the identification information list storage unit 104.

[0042] The space determination unit 113 is formed by the position detection unit 112, and in the AP1 of this embodiment, the space in which the wireless communication terminal is located is determined by referring to the space list (FIG. 5) in the space list storage unit 105 based on the identification information list (FIG. 4) recorded in the identification information list storage unit 104. FIG. 9 is a diagram for explaining the process of identifying the space in which the wireless communication terminal is located. As shown in FIG. 9(A), in a three-dimensional space represented by the x-axis, y-axis, and z-axis, the AP1 is installed at the position indicated by the origin O, and a space in which the position and area are defined is defined by eight end points a1, a2, a3, a4, a5, a6, a7, and a8. In FIG. 9(A), a1, a2, ... indicate end points, such as a1(10,20,50), a2(90,20,50), ..., and the three values ​​in parentheses indicate the x-coordinate, y-coordinate, and z-coordinate.

[0043] In this case, as shown in Fig. 9(A), it is assumed that mobile communication terminal 5(1) is located within the space, and mobile communication terminal 5(2) is located outside the space. In order to determine whether each of mobile communication terminals 5(1) and 5(2) is within the space (a rectangular parallelepiped space in this embodiment), each of the sides perpendicular to the x-axis, the y-axis, and the z-axis of the rectangular parallelepiped are regarded as windows. The basic idea is to look into the space from each window (from each axial direction).

[0044] In this case, since the mobile communication terminal 5(1) is located within the space, it can be seen from all axial directions as shown in FIG. 9(B). In contrast, the mobile communication terminal 5(2) is not located within the space. Therefore, as shown in FIG. 9(C), when it is removed from the x-axis direction, the presence of the mobile communication terminal 5(2) can be confirmed, but when it is viewed from the y-axis direction or the z-axis direction, the presence of the mobile communication terminal 5(2) cannot be confirmed. Based on this concept, the space determination unit 113 performs a process of projecting a predetermined space defined in a three-dimensional space onto a two-dimensional plane and comparing the coordinates of the eight end points with the coordinates of the mobile communication terminals 5(1) and 5(2).

[0045] Specifically, in the example shown in FIG. 9(A), if the x coordinate (larger (value 90))>x coordinate of the mobile communication terminal 5>x coordinate (smaller (value 10)) in the x-axis direction, it can be determined that the mobile communication terminal 5 is located within the predetermined space in the x-axis direction. Similarly, if the y coordinate (larger (value 30))>x coordinate of the mobile communication terminal 5>y coordinate (smaller (value 20)) in the y-axis direction, it can be determined that the mobile communication terminal 5 is located within the predetermined space in the y-axis direction. Similarly, if the z coordinate (larger (value 50))>z coordinate of the mobile communication terminal 5>z coordinate (smaller (value 0)) in the z-axis direction, it can be determined that the mobile communication terminal 5 is located within the predetermined space in the z-axis direction. As a result, when it is determined that the mobile communication terminal 5 is located within the predetermined space in all of the x-axis direction, y-axis direction, and z-axis direction, it can be determined that the mobile communication terminal 5 is located within the predetermined space.

[0046] The space determination unit 113 performs a process of determining whether or not all wireless communication terminals, such as the mobile communication terminal 5 and the PC 6, are located in all spaces A, B, C, D, ... specified by the space ID. If the coordinates of the end points of the spaces defined in the space list overlap, the process may be performed so that the higher space (the space registered at the higher position) in the space list is given priority. For a wireless communication terminal that is ultimately determined not to belong to any space, it is determined that the terminal is located outside the range, that is, in this embodiment, that the terminal is located outdoors, not indoors, in a specific home. The space determination unit 113 forms the space identification list described above using FIG. 6, and provides the list to the operation control unit 114 through the control unit 102.

[0047] The operation control unit 114 refers to the operation definition list in the operation definition list storage unit 106 based on the space in which each wireless communication terminal is located, as determined by the space determination unit 113, and controls the operation of each wireless communication terminal. That is, the operation control unit 114 refers to the operation definition list in the operation definition list storage unit 106 based on the space identification list (FIG. 6) from the space determination unit 113, and finally determines the operation for each wireless communication terminal according to the space in which the wireless communication terminal is located. This operation corresponds to the operation type in the operation definition list shown in FIG. 7. After the operation is determined, various execution modules corresponding to it are called. Various execution modules refer to those that provide existing functions such as filtering and access blocking. For this reason, the operation control unit 114 is capable of using various information (addresses, etc.) required to call the execution modules.

[0048] [Details of action type] As shown in the operation definition list in Fig. 7, the AP1 of this embodiment can use seven different operation types. Below, an overview of each operation type will be explained.

[0049] <HTTPリダイレクト> FIG. 10 is a diagram for explaining HTTP redirect. As shown in FIG. 7, in this embodiment, HTTP redirect is set as the operation type in spaces A and B. HTTP redirect is an operation in which wireless communication terminals located in spaces A and B execute an operation to return a preset web page instead of the requested web page. Therefore, as shown in FIG. 10, even if PC6(1) located in space A accesses web page "xxx.co.jp", AP1 executes an execution module to access web page "aaa.co.jp" and returns web page "aaa.co.jp" to PC6(1).

[0050] Similarly, even if PC6(2) located in space B attempts to access the web page "xxx.co.jp", AP1 executes an execution module that accesses the web page "bbb.co.jp", and returns the web page "bbb.co.jp" to PC6(2). This operation of restricting the web pages that can be accessed for each space is called HTTP redirection.

[0051] Streaming switching can be achieved in the same manner as in the case of HTTP redirection. For example, as shown in FIG. 7, in space C, a speaker is specified as the device, and streaming switching is set as the operation type. Therefore, even if the wireless communication terminal located in space C is a wireless communication terminal equipped with a speaker and a music playback function and accesses a streaming connection destination such as "yyy.co.jp", AP1 executes an execution module that accesses the streaming connection destination "ccc.co.jp" and returns it to the wireless communication terminal located in space C. In this way, streaming switching is the process of switching to a streaming connection destination different from the streaming connection destination specified by the wireless communication terminal.

[0052] <Access time limit> FIG. 11 is a diagram for explaining the access time restriction. As shown in FIG. 7, in this embodiment, in space D, an access time restriction is set as an operation type. The access time restriction is set from the time (time) when the presence in the space is detected for the first time, and after the time specified by the parameter has elapsed, the access is cut off. Therefore, as shown in FIG. 11, from the time when the PC6(4) located in space D is detected to be located in space D, as shown in FIG. 7, an execution module that allows access to the Internet is executed for only 30 minutes specified by the parameter 1. In this case, if the Internet has been accessed after the 30 minutes, the access is cut off, and new access is also disabled.

[0053] In this embodiment, access to the Internet from wireless communication terminals located in other spaces where no access time limit is set is not restricted. However, when parameter 1 of the access time control is set to 0 minutes, the operation is restricted to constant connection. As shown in FIG. 11, for PC6(5) recognized as "NULL (belonging to nowhere)", the connection available time is always 0 minutes, and connection through AP1 is always rejected by AP1. In this specification, WAN is used as equivalent to the Internet.

[0054] <Internet access restrictions> Fig. 12 is a diagram for explaining Internet access restriction. The connection from a wireless communication terminal located in a space to outside the LAN is permitted with a time limit or completely rejected. As shown in Fig. 7, for space A, Internet access restriction is set as the operation type, parameter 1 is set to "permitted," and parameter 2 is set to "10 minutes." For space E, Internet access restriction is set as the operation type, and parameter 1 is set to "not permitted."

[0055] In this case, as shown in Fig. 12, AP1 executes an execution module that allows PC6(1) located in space A to connect to the Internet for only 10 minutes from the time when the PC6(1) first entered the space. AP1 also executes an execution module that denies Internet connection to PC6(6) located in space C. In this case, the module discards packets from PC6(6) that are not addressed to a LAN at AP1.

[0056] AP1 also executes an execution module that denies Internet connection to PC6(7), which does not belong to any space. In this case, the module discards packets from PC6(7) that are not addressed to the LAN in AP1. However, because PC6(7), which does not belong to any space, is also unable to connect to the LAN due to spatial access control, the result is that all packets from PC6(7), which does not belong to any space, are discarded by AP1.

[0057] <Spatial access restrictions> Fig. 13 is a diagram for explaining space access restriction. As shown in Fig. 7, in this embodiment, in space A, a space access restriction is set as an operation type, an intra-LAN connection is set as parameter 1, and space C is set as parameter 2. Also, as shown in Fig. 7, in this embodiment, in space C, a space access restriction is set as an operation type, an intra-LAN connection is set as parameter 1, and space A is set as parameter 2. As a result, space A is able to communicate only with space C, and space C is able to communicate only with space A. Both spaces are operated in such a way that communication with spaces other than the two spaces is prohibited.

[0058] 13, AP1 executes an execution module that permits communication from PC6(1) located in space A to PC6(2) located in space C. AP1 also executes an execution module that permits communication from PC6(2) located in space C to PC6(1) located in space A. This enables two-way communication between PC6(1) located in space A and PC6(2) located in space C, but prohibits communication with spaces other than both space A and space C.

[0059] Also, as shown in FIG. 13, for PC6(5), which does not belong to any space, the use of the LAN is prohibited as shown in FIG. 7, and therefore communication with wireless communication terminals located in any space is also prohibited.

[0060] <MACアドレスフィルタリング> FIG. 14 is a diagram for explaining MAC address filtering. MAC address filtering allows communication only with wireless communication terminals specified by registered MAC addresses. As shown in FIG. 7, MAC address filtering is set for space F. Note that, for example, as shown in FIG. 14(B), a MAC address table consisting of target spaces and connectable MAC addresses is recorded in advance in a predetermined area of ​​the storage unit 103 and made available for use, for example. The MAC address table is formed, for example, in PC 6, and provided to AP 1 via Wi-Fi (registered trademark), and stored and held.

[0061] In the case of the MAC address table shown in Figure 14(B), the MAC addresses of PC6(1) and 6(2), which are connectable in space F, are registered. For this reason, as shown in Figure 14(A), when PC6(6) is located in space F, AP1 executes an execution module that enables PC6(6) to access PC6(1), which is located in space A. AP1 also executes an execution module that enables PC6(6) to access PC6(2), which is located in space B. Access from PC6(6), which is located in space F, to wireless communication terminals other than PC6(1) and 6(2), is prohibited.

[0062] <Content filtering> Fig. 15 is a diagram for explaining content filtering. Content filtering allows access only to web pages identified by registered uniform resource locators (URLs), or conversely, disables access only to web pages identified by registered URLs. As shown in Fig. 7, content filtering is set for space Z. Note that the URLs of the contents that are allowed or disabled to be accessed in space F are those registered separately.

[0063] FIG. 15(B) shows an example of a content filtering table consisting of a target space and non-connectable contents. In the case of the content filtering table shown in FIG. 15(B), the URL of the content that cannot be connected in the space Z is registered. Such a content filtering table is prepared in advance, for example, in a predetermined area of ​​the storage unit 103. The content filtering table is also formed, for example, in the PC 6, provided to the AP 1 via Wi-Fi (registered trademark), and stored and held. Note that, although FIG. 15(B) shows a content filtering table (blacklist) consisting of a target space and non-connectable contents, this is not limiting. It is also possible to use a content filtering table (whitelist) consisting of a target space and connectable contents.

[0064] When the content filtering table shown in Fig. 15(B) is used, as shown in Fig. 15(A), PC6(1) located in space A where content filtering is not set (disabled) can access the Internet without any restrictions. However, for PC6(7) located in space Z, AP1 executes an execution module that prevents access to the URLs "aaa.co.jp", "bbb.co.jp", and "ccc.co.jp".

[0065] <Address allocation limit> Fig. 16 is a diagram for explaining the address allocation restriction. The address allocation restriction is a function for restricting the address band allocated by a Dynamic Host Configuration Protocol (DHCP) server function for each space. That is, the AP1 of this embodiment has a DHCP server function, and whenever a wireless communication terminal on a wireless LAN starts up, the function automatically assigns setting information required for network use such as an IP address to each wireless communication terminal. As shown in Fig. 7, an address allocation restriction is set for spaces A and B. The address bands used in spaces A and B are registered separately.

[0066] FIG. 16B shows an example of an IP address allocation table including a target space and an IP address range. In the case of the IP address allocation table shown in FIG. 16B, it is set that IP addresses are assigned in the range of "192.168.1.5 to 192.168.1.10" in the space A. In the case of the IP address allocation table shown in FIG. 16B, it is set that IP addresses are assigned in the range of "192.168.1.11 to 192.168.1.15" in the space B. Such an IP address allocation table is prepared in advance in a predetermined area of ​​the storage unit 103, for example. The IP address allocation table is also formed in, for example, the PC 6, provided to the AP 1 via Wi-Fi (registered trademark), and stored and held.

[0067] When the IP address allocation table shown in Fig. 16(B) is used, as shown in Fig. 16(A), AP1 assigns an IP address in the range of "192.168.1.5-192.168.1.10" to PC6(1) located in space A. AP1 also assigns an IP address in the range of "192.168.1.11-192.168.1.15" to PC6(2) located in space B. This makes it possible to specify the range of IP addresses to be assigned to each space, and to set up a wireless LAN as expected.

[0068] From these, the following effects can be obtained. First, for wireless communication terminals that do not belong to any recognized space, that is, in a home where the AP1 of this embodiment is installed, it is possible to prohibit the connection to the AP1 itself for wireless communication terminals that do not belong to any recognized space, and to disable the use of both the LAN and the WAN. Therefore, it is possible to reliably prevent unauthorized use of an outdoor wireless communication terminal to connect to the LAN or WAN via the AP1.

[0069] Furthermore, by using HTTP redirection (Figure 10), it is possible to restrict the Web pages that can be accessed for each space (room). Furthermore, by using access time restrictions (Figure 11), it is possible to restrict the time that a user can connect to the LAN or WAN for each space (room). This makes it possible to prevent users from connecting to the LAN or WAN for long periods of time. Furthermore, by using Internet access restrictions (Figure 12), it is possible to restrict the time that a user can connect to a WAN other than the LAN (the Internet) for each space (room). This allows users to freely connect to the LAN, but makes it possible to restrict long-term Internet use.

[0070] In addition, by using spatial access restrictions (Fig. 13), it is possible to restrict the spaces in which communication is possible for each space (room), for example by preventing a wireless communication terminal in space A from accessing a wireless communication terminal in space C. This makes it possible to prohibit access to wireless communication terminals located in spaces (rooms) where people want to concentrate on work or study. In addition, by using MAC address filtering (Fig. 14), it is possible to determine which wireless communication terminals are accessible for each space (room), for example by allowing access from space F to PCs 6(1) and 6(2) but not to any other.

[0071] In addition, by using content filtering (Fig. 15), it is possible to restrict the content that can and cannot be used for each space (room). This makes it possible, for example, to separate spaces (rooms) where video content and music content can be used from spaces (rooms) where video content and music content cannot be used. In addition, by using address allocation restrictions (Fig. 16), it is possible to determine the range of IP addresses that can be assigned to each space (room), making it possible to organize and construct wireless LANs within the home without difficulty.

[0072] [Summary of AP1 operation] Fig. 17 is a flowchart for explaining the process executed by AP1 of the embodiment. Before the process shown in Fig. 17 is executed, the space list (end point coordinate list) explained using Fig. 5 is prepared in the space list storage unit 105, and the action definition list explained using Fig. 7 is prepared in the action definition list storage unit 106. In addition, the process of the flowchart shown in Fig. 17 is basically always executed by the control unit 102 when the power of the AP1 is turned on. This allows appropriate control for each space even when the wireless communication terminal such as the mobile communication terminal 5 or the PC 6 moves and is located in another space (room).

[0073] First, the control unit 102 controls the short-range wireless communication unit 111 and the position detection unit 112 to receive a signal from a wireless communication terminal such as the mobile communication terminal 5 or the PC 6, detect the location, and specify the position information (terminal unique identification information and terminal position information) (step S101). Next, the control unit 102 controls the space determination unit 113 to refer to the space list (FIG. 5) in the space list storage unit 105 based on the position information specified in step S101 and determine (discriminate) the space (room) in which the wireless communication terminal is located (step S102).

[0074] Next, the control unit 102 controls the operation control unit 114, and based on the space determined in step S102, refers to the operation definition list in the operation definition list storage unit 106, and controls the operation for the wireless communication terminal (step S103). After this, the control unit 102 repeats the process from step S101. Note that the process in FIG. 17 has been described in a broad flow of position detection for the wireless communication terminal → space determination → operation control according to the space. However, in order to control the operation according to the space, for example, when an access time restriction is performed, the time when the position in the space is first detected and the time elapsed from the determined time are also specified in, for example, step S102 or step S103.

[0075] [Other examples of spatial settings] In the above-mentioned embodiment, each room in a house is regarded as a space to be recognized and distinguished. That is, the shape of each space to be recognized and distinguished is described as a rectangular parallelepiped. However, this is not limited to this. It is also possible to set a space of any shape. FIG. 18 is a diagram for explaining an example of a space setting method. In order to intuitively set a space, as shown in FIG. 18, a closed curved surface k surrounded by a walking trajectory L formed by a user walking can be specified, and a three-dimensional figure that fits within this closed curved surface k and a certain height H1, H2 above and below it can be set as a predetermined space. In this way, when an Internet access restriction is applied to a space created by a user walking around a room, it is possible to refuse connection from outside the space (outdoors, etc.).

[0076] When setting such an arbitrary space, the user can easily set the arbitrary space by using application software (hereinafter, abbreviated as an app) executed on the mobile communication terminal 5 or the like. The procedure for setting an arbitrary space using the app can be outlined as follows: (1) First, the user opens a setting screen for the AP1 on the mobile communication terminal 5 and selects an item such as setting an arbitrary space. This enables the AP1 to communicate with the mobile communication terminal 5, for example, via a short-range wireless communication function, and send and receive data.

[0077] (2) Next, the user instructs the application of the mobile communication terminal 5 to start setting a closed surface, and walking around the outer edge of the target space with the mobile communication terminal 5, completing the closed surface. This process causes a transmission signal from the mobile communication terminal 5 to be sent to the AP1, and the AP1 identifies the location of the mobile communication terminal 5 at a predetermined time interval. (3) Once the closed surface is completed, the user instructs the application of the mobile communication terminal 5 to end the setting of the closed surface. This allows the AP1 to grasp the closed surface according to changes in the location of the user's mobile communication terminal 5, and the AP1 maps and saves a space with a certain height above and below this closed surface as an access area. This map-stored data becomes the space list shown in FIG. 5.

[0078] As described above, the AP1 holds coordinates corresponding to the path drawn by the user walking while holding the mobile communication terminal 5 as a continuous figure and saves it so that a closed surface can be grasped. However, unless the sampling frequency is very high, it is difficult to obtain a closed surface drawn with a completely free curve, so in practice it is grasped using discrete values.

[0079] That is, the mobile communication terminal 5 that has executed the application transmits sonar radio waves (radio waves for detecting position) at a sampling frequency of fHz (Hertz). AP1 plots the position of the mobile communication terminal 5 at the time when the mobile communication terminal 5 transmits the sonar radio waves on a coordinate system. AP1 linearly complements (connects with straight lines) the points on the coordinate system plot in chronological order (in the order they were plotted). The closed area of ​​the polygon thus created is stored, and the setting of the closed surface is completed. The space with a certain height above and below this closed surface becomes the target space that AP1 grasps.

[0080] The time series order of the plotted coordinates can be determined by indexing the sequence numbers in the order they were plotted. The sampling frequency can be set to a suitable frequency that is not too low. For example, if the sampling frequency is 30 Hz, 30 coordinate data will be recorded per second, which means that a walking trajectory that is quite close to a curve can be obtained.

[0081] In addition, the AP1 needs to be able to properly grasp whether the walking track is closed or not, and this can be done by drawing straight lines in sequence from the coordinates of the user starting to walk, determining that the walking track is closed when the straight lines intersect, and setting the intersections as the start and end points. In addition, the spatial instruction work is completed when the user instructs the app of the mobile communication terminal 5 to complete the work.

[0082] In this way, a closed surface k surrounded by the walking trajectory L formed by the user's walking can be specified, and a three-dimensional figure that fits within this closed surface k and within a certain height H1, H2 above and below it can be set as a predetermined space. Of course, it is also possible to set an arbitrary space by specifying multiple vertices of the bottom surface and multiple vertices of the top surface, as in the above-mentioned embodiment.

[0083] [Effects of the embodiment] According to the AP1 of the above-mentioned embodiment, the position of each wireless communication terminal such as the mobile communication terminal 5 and the PC 6 can be precisely grasped, and the operation of the wireless communication terminal located in each grasped area can be controlled. More specifically, the location of the wireless communication terminal based on the AP1 can be precisely grasped. Furthermore, the user can easily set the space to be grasped, and for each set space, the wireless communication terminal located in that space can be controlled. This makes it possible to provide different services for each set space.

[0084] For example, it is possible to prohibit connection from outdoors to an AP1 installed indoors. It is also possible to restrict access to only safe sites in a child's room. In other words, content filtering can be used to block access to specific sites in rooms where children are present. It is also possible to effectively restrict network access in a study room, differentiating it from other rooms. For example, it is possible to restrict access to the Internet from one's own room only during test periods. In other words, it is possible to provide useful services and environments for educational activities at home.

[0085] In particular, by prohibiting the provision of services from outside a designated space, it is possible to solve the disadvantage of wireless connection methods, such as the ability to access the system from anywhere within range of radio waves, and thereby improve security.

[0086] [Variations] In the above embodiment, the AP1 is used at home, but the AP1 can be used not only at home but also in various places such as company offices, factories, schools, event venues, art galleries, museums, etc. For example, when the AP1 to which the present invention is applied is installed in a company office, it is possible to permit connection to the AP1 from the first floor and prohibit connection to the AP1 from outdoors or from other lower levels, and to prohibit connection to the AP1 from guest spaces.

[0087] Also, if AP1 is installed in a factory, it is possible to restrict access to only "aaa.co.jp" from the area where the first process is carried out, and only "bbb.co.jp" from the area where the second process is carried out. Also, if AP1 is installed in a school, it is possible to allow different classrooms with different uses, such as the science room, music room, and craft room, to access different web pages, and to restrict the hours when Internet access is available in general classrooms.

[0088] Moreover, if AP1 is installed at an event venue, it is possible to allow connection to AP1 only from the area where the event venue is installed. For example, it becomes possible to electronically perform administrative tasks (voting, etc.) within a specific booth only within that booth. Moreover, if AP1 is installed in an art gallery or museum, it is possible to allow only areas set up based on each exhibit to access a web page that provides information about that exhibit.

[0089] In this way, the AP1 to which this invention is applied can be installed in various locations, and can cope with the risk of not knowing from where it will be accessed. In addition, the location element is added, and it becomes possible to change the services provided for each space (for example, each room), improving convenience.

[0090] As a secondary effect of cutting off the connection when the device moves a certain distance, it is also possible to forcibly switch to another AP when the signal becomes weak. Also, in cases where employees have fixed seats, such as in a company, area restrictions can be implemented for each space, so that employees who move will connect to the AP that corresponds to that space. As a result, a secondary effect is traffic distribution. [Explanation of symbols]

[0091] 1...AP, 101T...connection end, 101...wired LAN communication unit, 102...control unit, 103...memory unit, 104...identification information list memory unit, 105...space list memory unit, 106...action definition list memory unit, 107...wireless LAN communication unit, 107A...wireless LAN antenna, 111A(1), 111A(2), 111A(3), 111A(4)...short-range wireless communication antenna, 111...short-range wireless communication unit, 112...position detection unit, 113...space determination unit, 114...action control unit, 2...router, 3...network, 4...server device, 5...mobile communication terminal, 6...PC

Claims

1. A network connection control device for connecting a wireless communication terminal to a predetermined network, a space list storage means for storing, for each of the three-dimensional spaces divided in advance, space identification information for identifying each space and information for specifying the position and range of each space in association with each other as first stored data; an action definition list storage means for storing action definition information as second stored data for each of the three-dimensional spaces that have been previously divided; a position detection means for detecting a position of the wireless communication terminal in a three-dimensional coordinate space based on information obtained by receiving a transmission signal from the wireless communication terminal, and specifying position information; a space determination means for determining the space in which the wireless communication terminal is located by referring to the first stored data in the space list storage means based on the position information detected by the position detection means; an action control means for controlling an action of the wireless communication terminal by referring to the second stored data of the action definition list storage means based on the space determined by the space determination means; A network connection control device comprising:

2. 2. The network connection control device according to claim 1, The definition information on the actions stored in the action definition list storage means includes one or more of information on a change in a website, information on a switching of streaming, information on an access time restriction, information on an Internet access restriction, information on a spatial access restriction, information on a MAC address filtering, information on a content filtering, and information on an address allocation restriction. A network connection control device comprising:

3. 3. The network connection control device according to claim 2, When information on MAC address filtering is used, a MAC address table is provided in which the space identification information for identifying a target space is associated with a MAC address of the wireless communication terminal that is to be enabled or disabled for connection; When information related to content filtering is used, a content filtering table is provided in which the space identification information for identifying the target space is associated with content specification information for enabling or disabling a connection; When information on address allocation restrictions is used, an IP address allocation table is provided in which the space identification information for identifying the target space is associated with information indicating IP addresses that can be assigned. A network connection control device comprising:

4. A network connection control method used in a network connection control device for connecting a wireless communication terminal to a predetermined network, comprising: the network connection control device includes a space list storage means for storing, for each of three-dimensional spaces divided in advance, space identification information for identifying each space and information for specifying a position and range of each space in association with each other as first stored data, and an action definition list storage means for storing, for each of the three-dimensional spaces divided in advance, definition information relating to actions as second stored data; a position detection step in which a position detection means detects position information indicating a position of the wireless communication terminal in a three-dimensional coordinate space based on information obtained by receiving a transmission signal from the wireless communication terminal, and specifies the position information; a space determination step of determining the space in which the wireless communication terminal is located by referring to the first stored data in the space list storage means based on the position information detected in the position detection step; an action control step of controlling an action of the wireless communication terminal by referring to the second stored data of the action definition list storage means based on the space determined in the space determination step; 13. A network connection control method comprising:

5. A network connection control program executed by a computer that functions to connect a wireless communication terminal to a predetermined network, the computer is capable of referring to a space list storage means for storing, for each of the three-dimensional spaces divided in advance, space identification information for identifying each of the spaces and information for specifying the position and range of each of the spaces in association with each other as first stored data, and an action definition list storage means for storing, for each of the three-dimensional spaces divided in advance, definition information relating to actions as second stored data; a position detection step of detecting position information indicating a position of the wireless communication terminal in a three-dimensional coordinate space based on information obtained by receiving a transmission signal from the wireless communication terminal, and specifying the position information; a space determination step of determining the space in which the wireless communication terminal is located by referring to the first stored data in the space list storage means based on the position information detected in the position detection step; an action control step of controlling an action of the wireless communication terminal by referring to the second stored data of the action definition list storage means based on the space determined in the space determination step; A network connection control program comprising:

Images