Wireless LAN access point, communication method and program

Abstract

To provide a wireless LAN access point, a communication method, and a program that are more secure connection means in order to prevent third parties not authorized by an administrator from connecting to and using the wireless LAN access point.SOLUTION: If a request from a wireless LAN slave device 107 includes an authentication SSID, a slave device connection control unit 103 performs control to perform authentication and communicate using a main connection SSID after the authentication is performed. While the wireless LAN slave device 107 is communicating using the main connection SSID, the slave device connection control unit 103 performs control to reject requests from the wireless LAN slave device 107 using the authentication SSID.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to wireless LAN access points. [Background technology]

[0002] Patent document 1 describes a wireless access point device that can automatically cause a wireless slave device to use the optimal SSID by determining that the SSID having setting information closest to the optimal setting information predetermined for the type of wireless slave device is the optimal SSID for the wireless slave device. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2013-131993 Summary of the Invention [Problem to be solved by the invention]

[0004] However, even if an administrator has configured the connection settings and security settings for a wireless LAN (Local Area Network) access point, there is a problem that the wireless LAN access point can be used illegally.

[0005] For example, if a wireless LAN access point is operated with the default settings at the time of installation or if low-security encryption is used, an unauthorized third party may learn the SSID and encryption key of the wireless LAN access point and use the wireless LAN access point illegally.

[0006] In addition, administrators of wireless LAN access points often do not notice when unauthorized third parties are using the wireless LAN access point illegally, and once a third party connects to the wireless LAN access point, there is a possibility that the third party will continue to use the wireless LAN access point illegally.

[0007] The purpose of the present disclosure is to provide a wireless LAN access point, communication method, and program that are more secure connection means to prevent third parties not authorized by the administrator from connecting to and using the wireless LAN access point. [Means for solving the problem]

[0008] In one embodiment, a wireless LAN access point includes an attribution management unit that manages attribution of wireless LAN adapters, a adapter connection control unit that controls connection of the wireless LAN adapters, an authentication SSID unit that manages an authentication SSID, and a main connection communication SSID unit that manages an SSID for main connection communication, and when a request from the wireless LAN adapter includes the authentication SSID, the adapter connection control unit performs authentication and controls communication to be performed using the main connection SSID after performing the authentication, and the adapter connection control unit controls to reject requests from the wireless LAN adapter using the authentication SSID while the wireless LAN adapter is communicating using the main connection SSID.

[0009] In one embodiment of the communication method, when a request from a wireless LAN adapter includes an authentication SSID, authentication is performed, and after the authentication is performed, control is performed so that communication is performed using a main connection SSID, and while the wireless LAN adapter is communicating using the main connection SSID, control is performed so that requests from the wireless LAN adapter using the authentication SSID are rejected.

[0010] In one embodiment, the program causes a computer to execute the steps of: when a request from a wireless LAN adapter includes an authentication SSID, performing authentication and controlling communication to be performed using a primary connection SSID after the authentication is performed; and rejecting a request from the wireless LAN adapter using the authentication SSID while the wireless LAN adapter is communicating using the primary connection SSID. [Effects of the Invention]

[0011] According to the wireless LAN access point, communication method, and program disclosed herein, security can be further improved by preventing third parties not authorized by the administrator from connecting to and using the wireless LAN access point. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a block diagram showing a configuration of a wireless LAN access point according to a first embodiment; [Figure 2] FIG. 4 is a sequence diagram illustrating an example of an operation of the wireless LAN access point according to the first embodiment. [Figure 3] 5 is a flowchart illustrating an example of an operation of the wireless LAN access point according to the first embodiment. [Figure 4] 5 is a flowchart illustrating an example of an operation of the wireless LAN access point according to the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] Embodiment 1 The present embodiment will be described below with reference to the drawings. Fig. 1 is a block diagram showing the configuration of a wireless LAN access point according to the first embodiment. In Fig. 1, wireless LAN access point 101 includes an association management unit 102, a client connection control unit 103, an authentication SSID unit 104, a main connection communication SSID unit 105, and a router unit 106.

[0014] The association management unit 102 monitors the association state of the wireless LAN slave device 107 of the authentication SSID 104. The association management unit 102 also monitors the association state of the wireless LAN slave device 107 of the main connection communication SSID 105. Furthermore, the association management unit 102 notifies the slave device connection control unit 103 of the association state of the wireless LAN slave device 107.

[0015] When the slave connection control unit 103 receives a notification from the association management unit 102 that the wireless LAN slave 107 has associated with the authentication SSID unit 104, the slave connection control unit 103 registers the MAC address (Media Access Control address) of the wireless LAN slave 107 in the connection refusal list 141 and the connection permission list 151. As a result, the wireless LAN slave 107 is no longer able to connect to the authentication SSID unit 104, but is able to connect to the main connection communication SSID unit 105.

[0016] In addition, when the slave connection control unit 103 receives a notification from the belonging management unit 102 that the wireless LAN slave 107 has been removed from the SSID 105 for main connection communication, the slave connection control unit 103 deletes the MAC address of the wireless LAN slave 107 from the connection refusal list 141 and the connection permission list 151.

[0017] The authentication SSID unit 104 manages the authentication SSID. The authentication SSID is an SSID for which stealth and ANY connection refusal are enabled, and to which wireless LAN client devices 107 not registered in the connection refusal list 141 can connect. SSID stealth is a function that stops the transmission of a beacon signal that notifies the surrounding area of ​​its own SSID. By enabling SSID stealth, it is possible to reduce the possibility that a third party will learn the authentication SSID.

[0018] Furthermore, ANY connection refusal is a function that prevents a response to a probe request from a wireless LAN client device unless the SSID of the wireless LAN access point is directly specified. By enabling ANY connection refusal, the wireless LAN access point 101 having the function of the present disclosure can prevent a response if the probe request from the wireless LAN client device 107 does not contain SSID information from the authentication SSID section 104.

[0019] The connection refusal list 141 is a list for refusing connection of the wireless LAN slave device 107 having a specific MAC address to the authentication SSID 104 by MAC address filtering.

[0020] The SSID unit for primary connection communication 105 manages SSIDs to which the wireless LAN slave device 107 can connect. Specifically, the SSID unit for primary connection communication 105 manages SSIDs to which the wireless LAN slave device 107 having a MAC address registered in the connection permission list 151 can connect.

[0021] The connection permission list 151 is a list for permitting connection of the wireless LAN slave device 107 having a specific MAC address to the SSID 105 for primary connection communication by MAC address filtering.

[0022] The router unit 106 relays communication from the wireless LAN slave device 107 to a different network. The router unit 106 also determines the route through which communication should be relayed or forwarded. The router unit 106 also relays communication from a different network to the wireless LAN slave device 107.

[0023] When the MAC address of the wireless LAN slave device 107 is registered in the connection permission list 151, the wireless LAN slave device 107 can belong to the main connection communication SSID and communicate using the SSID and encryption key of the main connection communication SSID section 105.

[0024] When the wireless LAN slave device 107 is no longer associated with the main connection communication SSID 105, the MAC address of the wireless LAN slave device 107 is deleted from the connection refusal list 141 and the connection permission list 151. As a result, the wireless LAN slave device 107 can no longer connect to the main connection communication SSID 105, but can connect to the authentication SSID 104.

[0025] Therefore, in order for the wireless LAN slave device 107 to connect to the main connection communication SSID 105 again, it is necessary to connect to the authentication SSID 104.

[0026] With the above configuration, when the administrator's wireless LAN terminal is absent, the MAC address of the terminal has already been deleted from the connection permission list 151, thereby preventing unauthorized access using a spoofed MAC address.

[0027] Next, an operation of the wireless LAN slave device 107 connecting to a wireless LAN access point will be described. Fig. 2 is a sequence diagram showing an example of the operation of the wireless LAN access point according to the first embodiment. Fig. 2 shows a general sequence from when the wireless LAN slave device 107 transmits a Probe Request until it connects to the wireless LAN access point.

[0028] First, in step S201, the wireless LAN slave device 107 transmits a probe request to the wireless LAN access point 101.

[0029] Next, in step S202, the wireless LAN access point 101 returns a probe response.

[0030] Then, in step S203, the wireless LAN slave device 107 and the wireless LAN access point 101 perform connection setup processing, and the connection setup is completed, allowing the wireless LAN slave device 107 to belong to the wireless LAN access point 101.

[0031] Next, the operation of the wireless LAN access point will be described with reference to a flowchart of FIG.

[0032] In step S301, the wireless LAN access point 101 repeats reception until it receives a Probe Request from the wireless LAN slave device 107. If a Probe Request is received from the wireless LAN slave device 107, the process proceeds to step S302.

[0033] In step S302, the SSID included in the Probe Request is determined. If the Probe Request received from the wireless LAN slave device 107 does not include the SSID of the authentication SSID 104, the process returns to step S301. If the Probe Request received from the wireless LAN slave device 107 includes the SSID of the authentication SSID 104, the process proceeds to step S303.

[0034] In step S303, the wireless LAN access point 101 returns a probe response to the wireless LAN client device 107. Then, the process proceeds to step S304.

[0035] In step S304, the wireless LAN access point 101 checks whether the MAC address of the wireless LAN slave device 107 is registered in the connection refusal list 141. If the MAC address of the wireless LAN slave device 107 is registered in the connection refusal list 141, the process returns to step S301. If the MAC address of the wireless LAN slave device 107 is not registered in the connection refusal list 141, the process proceeds to step S305.

[0036] In step S305, the wireless LAN access point 101 performs a connection setup process for the wireless LAN client device 107 to belong to the authentication SSID 104. Then, the process proceeds to step S306.

[0037] In step S306, the wireless LAN handset 107 determines whether or not the connection setup process with the wireless LAN access point 101 has been completed. If the wireless LAN handset 107 has completed the connection setup process with the wireless LAN access point 101, the process proceeds to step S307. If the connection setup process with the wireless LAN access point 101 has not been completed, the wireless LAN handset 107 returns to step S301.

[0038] In step S307, the wireless LAN access point 101 determines whether the wireless LAN slave device 107 belongs to the authentication SSID 104. If the wireless LAN slave device 107 belongs to the authentication SSID 104, the process proceeds to step S308. If the wireless LAN slave device 107 does not belong to the authentication SSID 104, the process returns to step S301.

[0039] In step S308, the association management unit 102 issues a notification to the client connection control unit 103 to notify that the wireless LAN client 107 belongs to the authentication SSID 104. Upon receiving the notification from the association management unit 102, the client connection control unit 103 registers the MAC address of the wireless LAN client 107 in the connection refusal list 141 of the authentication SSID 104. The MAC address of the wireless LAN client 107 is registered in the connection refusal list 141 of the authentication SSID 104 because the wireless LAN client 107 has already been authenticated and therefore no longer needs to connect to the authentication SSID 104. Then, the process proceeds to step S309.

[0040] In step S309, upon receiving the notification from the association management unit 102, the client connection control unit 103 registers the MAC address of the wireless LAN client 107 in the connection permission list 151 of the SSID 105 for main connection communication. Then, the series of processes ends. Note that this series of processes may be executed repeatedly.

[0041] Next, a description will be given of an operation when the wireless LAN slave device 107 disconnects communication with the wireless LAN access point 101. Fig. 4 is a flowchart showing an example of an operation of the wireless LAN access point according to the first embodiment.

[0042] First, in step S401, the association management unit 102 determines whether the wireless LAN slave device 107 has left the association of the primary connection communication SSID 105. If the wireless LAN slave device 107 has left the association of the primary connection communication SSID 105, the process proceeds to step S402. If the wireless LAN slave device 107 has not left the association of the primary connection communication SSID 105, step S401 is repeated.

[0043] In step S402, the association management unit 102 sends a notification to the slave connection control unit 103 to notify that the wireless LAN slave 107 has been removed from the association of the SSID 105 for primary connection communication. When the slave connection control unit 103 receives the notification from the belonging management unit 102, it deletes the MAC address of the wireless LAN slave unit 107 from the connection refusal list 141 of the authentication SSID 104. Then, the process proceeds to step S403.

[0044] In step S403, upon receiving the notification from the association management unit 102, the slave connection control unit 103 deletes the MAC address of the wireless LAN slave unit 107 from the connection permission list 151 of the SSID 105 for primary connection communication.

[0045] As described above, according to the wireless LAN access point of embodiment 1, unless a Probe Request containing information about the authentication SSID is sent to the wireless LAN access point, the wireless LAN client device cannot connect to the SSID for main connection communication. Therefore, even if the information about the SSID for main connection communication is known, the wireless LAN access point cannot be used fraudulently.

[0046] Furthermore, according to the wireless LAN access point of embodiment 1, when a wireless LAN client device that was associated with the SSID for main connection communication becomes unassociated with the SSID for main connection communication, it cannot connect to the SSID for main connection communication unless it again sends a Probe Request containing information about the SSID for authentication to the wireless LAN access point, thereby preventing unauthorized access to the SSID for main connection communication by spoofing a MAC address.

[0047] The present disclosure is not limited to the above-described embodiments, and can be modified as appropriate within the scope of the present disclosure.

[0048] For example, if the wireless LAN terminal 107 is a terminal that supports dual bands of 2.4 GHz and 5 GHz, the wireless LAN access point 101 can operate the authentication SSID 104 and the main connection communication SSID 105 in different bands of 2.4 GHz and 5 GHz.

[0049] For example, the authentication SSID 104 may operate at 2.4 GHz, and the main connection communication SSID 105 may operate at 5 GHz.

[0050] By operating the authentication SSID 104 and the main connection communication SSID 105 in different bands of 2.4 GHz and 5 GHz, it is possible to reduce the possibility that the relationship between the authentication SSID 104 and the main connection communication SSID 105 will be discovered.

[0051] If the wireless LAN slave device 107 is compatible with dual bands, it becomes more difficult for a third party not authorized by the administrator to illegally connect to the wireless LAN access point 101, thereby reducing the possibility of the wireless LAN access point being used illegally.

[0052] In this way, the wireless LAN access point 101 can operate the authentication SSID 104 and the main connection communication SSID 105 in different bands of 2.4 GHz and 5 GHz.

[0053] Furthermore, each element depicted in the drawings as a functional block performing various processes can be configured in terms of hardware using a CPU, memory, and other circuits, and in terms of software, can be realized by a program loaded into memory, etc. Therefore, it will be understood by those skilled in the art that these functional blocks can be realized in various forms using only hardware, only software, or a combination thereof, and are not limited to any one of these.

[0054] The above-described program can be stored in and supplied to a computer using various types of non-transitory computer-readable media. Non-transitory computer-readable media include various types of tangible recording media. Examples of non-transitory computer-readable media include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / Ws, and semiconductor memories (e.g., mask ROMs, PROMs (Programmable ROMs), EPROMs (Erasable PROMs), flash ROMs, and RAMs (Random Access Memory)). The program can also be supplied to a computer by various types of temporary computer-readable media. Examples of temporary computer-readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable media can be supplied to a computer via a wired communication path such as an electric wire or optical fiber, or via a wireless communication path. [Explanation of symbols]

[0055] 101 Access Point 102 Attribution Management Department 103 Child device connection control section 104 Authentication SSID section 105 Main connection communication SSID section 106 Router section 107 Handset 141 Connection Denied List 151 Connection Allow List

Claims

1. an attribute management unit that manages the attribute of the wireless LAN terminal; a slave connection control unit that controls the connection of the wireless LAN slave unit; an authentication SSID unit that manages an authentication SSID; a main connection communication SSID unit that manages a main connection communication SSID, the slave connection control unit performs authentication when an authentication SSID is included in the request from the wireless LAN slave unit, and controls communication to be performed using a main connection communication SSID after the authentication is performed; the slave device connection control unit performs control to reject a request from the wireless LAN slave device using the authentication SSID while the wireless LAN slave device is communicating using the main connection communication SSID; A wireless LAN access point, The authentication SSID is an SSID that has enabled an SSID stealth function that stops the transmission of a beacon signal to notify the surrounding area of ​​its own SSID, and an ANY connection refusal function that prevents the SSID from responding to a probe request from a wireless LAN client device unless the SSID of the wireless LAN access point is directly specified, When the MAC address of the wireless LAN terminal is registered in the connection refusal list of the authentication SSID unit, the terminal connection control unit communicates with the wireless LAN terminal using the main connection communication SSID without performing authentication using the authentication SSID. Wireless LAN access point.

2. 2. The wireless LAN access point according to claim 1, wherein the slave device connection control unit performs control to reject requests from the wireless LAN slave device using the main connection SSID when the wireless LAN slave device is no longer associated with the wireless LAN access point using the main connection SSID.

3. the authentication SSID unit has the connection refusal list that stores communication partners to be refused connection; 2. The wireless LAN access point according to claim 1, wherein the main connection communication SSID section has a connection permission list that stores communication partners that are permitted to connect.

4. The slave device connection control unit, while the wireless LAN slave device is communicating using a main connection SSID, registering the MAC address of the wireless LAN terminal in the connection refusal list and the connection permission list; 4. The wireless LAN access point according to claim 3.

5. When the wireless LAN terminal is released from the wireless LAN access point using the primary connection SSID, The MAC address of the wireless LAN device is deleted from the connection denial list and the connection permission list.

4. The wireless LAN access point according to claim 3.

6. a frequency band for communicating with the wireless LAN terminal using the authentication SSID; The wireless LAN access point according to claim 1 , wherein the frequency bands used to communicate with the wireless LAN slave devices using the main connection communication SSID are different.

7. If the request from the wireless LAN client device includes an authentication SSID, the authentication is performed, and after the authentication is performed, control is performed so that communication is performed using the main connection communication SSID; performing control to reject a request from the wireless LAN terminal using the authentication SSID while the wireless LAN terminal is communicating using the main connection communication SSID; A wireless LAN access point communication method, comprising: The authentication SSID is an SSID that has enabled an SSID stealth function that stops the transmission of a beacon signal to notify the surrounding area of ​​its own SSID, and an ANY connection refusal function that prevents the SSID from responding to a probe request from a wireless LAN client device unless the SSID of the wireless LAN access point is directly specified, If the MAC address of the wireless LAN terminal is registered in the connection refusal list of the authentication SSID section, communication with the wireless LAN terminal is performed using the main connection communication SSID without performing authentication using the authentication SSID. A communication method for a wireless LAN access point.

8. a step of performing authentication when the request from the wireless LAN slave device includes an authentication SSID, and controlling the device to communicate using the main connection communication SSID after the authentication is performed; and rejecting a request from the wireless LAN terminal using the authentication SSID while the wireless LAN terminal is communicating using the main connection communication SSID. A program for a wireless LAN access point, The authentication SSID is an SSID that has enabled an SSID stealth function that stops the transmission of a beacon signal to notify the surrounding area of ​​its own SSID, and an ANY connection refusal function that prevents the SSID from responding to a probe request from a wireless LAN client device unless the SSID of the wireless LAN access point is directly specified, If the MAC address of the wireless LAN terminal is registered in the connection refusal list of the authentication SSID section, the computer executes a step of communicating with the wireless LAN terminal using the main connection communication SSID without performing authentication using the authentication SSID. Wireless LAN access point program.

Images