JP2004153736A - Access control method for radio terminal and system therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform access control in a wireless LAN system, particularly, to prevent illegal access from the outside without changing a protocol. <P>SOLUTION: An access permitted region is preset as a range of radio terminal positions to permit access to a network and when the radio terminal tries access to the network via a base station, position characteristics of the radio terminal are measured based upon a signal from the radio terminal received in the base station. When the measured position characteristics are out of the range of the access permitted region, the access is refused. <P>COPYRIGHT: (C)2004,JPO

Description

ここで、Ｃは、送信アンテナ利得Ｇｔ、受信アンテナ利得Ｇｒ、送信電力Ｐｔ（Ｗ）の積によって表せる。これらは標準規格で定められている数値などから決定すればよく、例えば、Ｐｔ＝０．０１（Ｗ）、Ｇｔ＝Ｇｒ＝２．１５（ｄＢｉ）などと設定すればよい。また、αは該基地局を運用する環境により定めてよい。例えば、屋外駐車場ならα＝２、街頭ならα＝２．５、ビル内部であればα＝３などと設定すればよい。数値例として、λ＝０．１２（ｍ）、Ｐｔ＝０．０１（Ｗ）、Ｇｔ＝Ｇｒ＝２．１５（ｄＢｉ）、α＝２のとき、ｘ＝１０（ｍ）の許可領域に対して、受信電力特性に対する閾値として数１によりＰｒ≒２．４５Ｅ−８（Ｗ）を得る。図５の５０３は、先のステップで得た受信電力特性に対する閾値を基地局に設定するステップである。
【００１５】
図７および図８を用いて本発明によるアクセス制御システムとそのフローの第二の実施例を説明する。図７において、７０１、７０２は無線端末を、７１０は基地局０（アクセスポイント）を、７１１、．．．、７１ｎはそれぞれ基地局１、．．．、ｎ（センサー）を、７２０はサーバーを、７３０はネットワークを示す。管理者は予めサーバーにより無線端末のアクセス許可領域７４０を設定しておく（８０１）。無線端末７０１から基地局０を通じてネットワークへのアクセスが試みられたとする（８０２）。基地局０は、無線端末７０１からのパケットに格納されているソースアドレスを取り出し、サーバーに対して該端末のアクセス可否を問い合わせる（８０３）。サーバーは基地局０からの問い合わせを元に、該基地局の周囲の基地局１、．．．、ｎに対し、パケットキャプチャを要求する（８０４）。その際、キャプチャすべきパケット信号を特定するために無線端末と基地局０のアドレスを伝える。さらに必要に応じて基地局０の周波数チャネル番号を伝えてもよい。続いてサーバーは基地局０を介して無線端末７０１にエコー要求を送る（８０５）。基地局１、．．．、ｎは基地局０から無線端末７０１に送信される該パケット信号をキャプチャする（８０６）。その際、基地局１、．．．、ｎは、それぞれの時計によりそれぞれキャプチャ信号の先頭時刻を記録する。無線端末７０１はエコー応答を基地局０を介してサーバーに返す（８０７）。基地局１、．．．、ｎは無線端末７０１から基地局０に送信される該パケット信号をキャプチャする（８０８）。その際、基地局１、．．．、ｎは、それぞれの時計によりそれぞれキャプチャ信号の先頭時刻を記録する。基地局０は該エコー応答をサーバーへフォワードする。基地局１、．．．、ｎはパケットキャプチャ応答により上記キャプチャした基地局０の信号とその先頭時刻と、上記キャプチャした無線端末７０１の信号とその先頭時刻とをサーバーに伝える（８０９）。サーバーは各基地局との位置と上記パケットキャプチャ応答とを元に無線端末７０１の位置を計算する（８１０）。そして位置計算結果を上記設定したアクセス許可領域７４０により評価する（８１１）。無線端末７０１に関する位置計算結果がアクセス許可領域の外部にあると評価されると、サーバーは無線端末７０１のアクセス不許可を基地局０に伝える（８１２）。この場合、基地局０は無線端末７０１からのパケットを廃棄する（８１３、８１５）。
一方、無線端末７０２の様にアクセス許可領域の内部にあって、上記フローにより無線端末７０２に関する位置計算結果がアクセス許可領域の内にあると評価されると、サーバーは無線端末７０２のアクセス許可を基地局０に伝える（８１２）。この場合には、基地局０は無線端末７０２からのパケットをフォワードする（８１３、８１４）。
【００１６】
本実施例のアクセス制御システムには、例えば、本願出願人による先願の特許文献５記載の無線システムを適用すればよい。図９は基地局１、．．．、ｎ（センサー）の構成の一例を示す図である。同図において、９１０はクロックであり、無線通信部９２０と信号蓄積部９３０にクロックパルスを供給する。無線通信部９２０はアンテナ、高周波（ＲＦ）部、ベースバンド（ＢＢ）部、メディアアクセスコントロール（ＭＡＣ）部から構成され、無線通信における物理層の処理やＭＡＣ層の処理を行う。また、無線通信部９２０はベースバンド受信ＩＱアナログ信号を信号蓄積部９３０に供給する。信号蓄積部９３０は、無線通信部９２０から入力されるベースバンド受信ＩＱアナログ信号をＡＤ変換器（ＡＤＣ）によりＡＤ変換し、メモリに蓄積する。この際、該信号の最高周波数の２倍以上のレートでサンプリングすることが望ましい。また信号蓄積部９３０はカウンタを持ち、信号を蓄積する際にその開始時刻を記録する。ＬＡＮ Ｉ／Ｆ ９４０はローカルエリアネットワークに対するインターフェース部である。ＣＰＵ ９５０はＬＡＮ Ｉ／Ｆ ９４０を制御しサーバーとの間で通信を行う。また、ＣＰＵ ９５０は蓄積部９３０を制御してベースバンド受信ＩＱアナログ信号の蓄積開始を指示する。さらに、ＣＰＵ ９５０は無線通信部９２０より取得する受信パケットのソースアドレスを用いて信号蓄積部９３０に蓄積したベースバンド受信ＩＱアナログ信号がターゲットとなるパケットであるか否かを判定する。
【００１７】
基地局１、．．．、ｎがキャプチャした信号とその先頭時刻から無線端末の位置を算出するには、例えば、同出願人による先願の特許文献５記載の位置検出方法を適用すればよい。図１０はサーバーにおける位置算出のフローの一例を示す図である。同図において、１００１は基地局ｉ（ｉ＝１， ．．．， ｎ）が基地局０よりキャプチャした信号ｒ＿ａ＿ｉと基地局０からの送信信号波形ｗとの相互相関ｒ＿ａ＿ｉ×ｗを計算するステップである。また、１００２は基地局ｉが無線端末よりキャプチャした信号ｒ＿ｓ＿ｉと無線端末からの送信信号波形ｗとの相互相関ｒ＿ｓ＿ｉ×ｗを計算するステップである。ここでｒ＿ａ＿ｉ、ｒ＿ｓ＿ｉ、ｗは複素信号系列であり、それぞれの相互相関は例えば図１１の様に図示される。１００３はｒ＿ａ＿ｉの先頭時刻とｒ＿ａ＿ｉ×ｗから該信号の基地局ｉにおける受信時刻Ｔｒ＿ａ＿ｉ＠ｉを求めるステップである。ここで受信時刻Ｔｒ＿ａ＿ｉ＠ｉは、例えば、ｒ＿ａ＿ｉの先頭時刻に、図１１に示す様な相互相関のピーク値を与える遅延時間を加えるなどして求めればよい。あるいは、特許文献６記載の方法を適用して求めてもよい。当該ステップでは同様にｒ＿ｓ＿ｉの先頭時刻とｒ＿ｓ＿ｉ×ｗから該信号の基地局ｉにおける受信時刻Ｔｒ＿ｓ＿ｉ＠ｉも求める。１００４は基地局ｉの位置ｐｉと基地局０の位置ｐａと基地局ｉにおける受信時刻Ｔｒ＿ａ＿ｉ＠ｉとを用いて基地局１に対する基地局ｉ（ｉ＝２， ．．．， ｎ）の時刻のずれを求め、各基地局ｉ（ｉ＝２， ．．．， ｎ）における受信時刻Ｔｒ＿ａ＿ｉ＠ｉを基地局１における受信時刻Ｔｒ＿ｓ＿ｉ＠１に換算するステップである。１００５は無線端末の位置ｐを連立方程式
【００１８】
【数２】

の最尤解として求めるステップである。ここで｜｜ｘ｜｜はベクトルｘの大きさを示す。ｃは光速を示す。
【００１９】
図７のシステムにおいて、３台以上（ｎ≧３）の基地局（センサー）が存在する場合には、無線端末の平面上の測位が可能である。アクセス許可領域７４０は平面上の領域として設定してよい。４台以上（ｎ≧４）の基地局（センサー）が存在する場合には、無線端末の三次元空間上の測位が可能である。アクセス許可領域７４０は三次元空間上の領域として設定してよい。図１２は基地局８台を用いてアクセス許可領域を三次元空間上の領域として設定したシステムの構成の一例を示す図である。システムは２つの階からなる建築物の内部に設置されている。同図において、１２０１、１２０２、１２０３は無線端末を示す。１２１０乃至１２１７は基地局を示す。１２２０はサーバーを、１２３０はネットワークを示す。１２４０は三次元空間上の領域として設定したアクセス許可領域を示す。アクセス許可領域は２階の全域と１階の図面左側の領域である。該領域内の無線端末１２０２および１２０３は基地局を介してネットワークにアクセスすることが可能となるが、該領域外の無線端末１２０１はネットワークにアクセスを拒否されることになる。このような三次元空間上のアクセス許可領域の設定は、例えば、ネットワークを利用するオフィスにオープンスペースが隣接するようなビルなどにおいて特に有効である。なお、高さ方向に位置検出の精度を要求する場合には、基地局を同一水平面上に設置するのではなく、水平面に対する垂直方向に各々の設置位置の差を大きく取ることが好ましい。
【００２０】
図８のフローにおいて、破線四角で囲まれたパケットキャプチャ要求とその応答の部分フローは、必要な位置検出精度に応じて、複数回繰り返してもよい。
【００２１】
図８のフローにおいて、メッセージの無線区間は破線矢印により示してある。ここで、当該システムがＩＥＥＥ８０２．１１に準拠していれば、基地局０がデスティネーションアドレスにターゲットとなる無線端末のＭＡＣアドレスを設定してデータフレームを送信することにより、無線端末はＭＡＣサブレイヤ上のＡＣＫフレームを返してくる。そこで、これらのフレームの往復を無線区間におけるエコー要求とその応答メッセージとして用いてよい。あるいは図８のフローにおいて、エコー要求とその応答メッセージには、それぞれＩＣＭＰ（Ｉｎｔｅｒｎｅｔ Ｃｏｎｔｒｏｌ Ｍｅｓｓａｇｅ Ｐｒｏｔｏｃｏｌ）Ｅｃｈｏ Ｒｅｑｕｅｓｔ（タイプ８）とＩＣＭＰ Ｅｃｈｏ Ｒｅｐｌｙ（タイプ０）を用いてもよい。ＩＣＭＰはＩＰ（Ｉｎｔｅｒｎｅｔ Ｐｒｏｔｏｃｏｌ）を実装している無線端末が元々備えている機能である。これらＩＣＭＰメッセージを用いれば、ＩＰを使ってアクセスしてくる任意の無線端末の位置検出が可能となる。無線端末側に位置検出用のメッセージを送信させるためのソフトウエアを新規に追加することなくなるため、不正アクセス端末の検出を試みる本システムにおいて該メッセージの利用は極めて有効である。
【００２２】
図８のフローにおいて、基地局０は、サーバーに無線端末アクセス可否を問い合わせた後、その結果の履歴を蓄積しておいてもよい。この場合、例えば図１３に示す形式でアクセスログとして蓄積しておく。同図により例示した蓄積形式は、アドレスと、該アドレスをソースアドレスとする無線端末の該基地局へのアクセス可否を示す属性と、該２項目の更新日時の合計３項目より構成される。同図では、アドレス例としてＩＰアドレスを用いているがシステムに応じてＭＡＣアドレスを用いることも本発明の範疇にある。そして、該基地局に対して図１４に示す様に無線端末からアクセスがあった場合には、その都度、サーバーに対してアクセス可否を問い合わせるのでなく、一度、アクセスログを参照する。参照に用いるアドレスは無線端末がアクセス時に送ったパケットのソースアドレスを用いる（１４０１）。アクセスログにて当該アドレスを探し（１４０２）、該当するアドレスが無い場合もしくは、該当するアドレスが記載されていても更新日時が現時刻と比較して（１４０３）予め定めた時間を経過している場合には、図８のフローに従ってサーバーにアクセス可否を問い合わせる（１４０４）。サーバーにアクセス可否を問い合わせた場合にはアクセスログを更新しておく（１４０５）。続いてアクセスログ記載のアクセス可否属性を参照し（１４０６）にアクセス不可（ＮＧ）ならば該無線端末のパケットを廃棄し（１４０７）、アクセス可（ＯＫ）ならば該パケットをフォワードする（１４０８）。このように、無線端末からのアクセス毎にサーバーに対してアクセス可否を問い合わせることを省略することにより、サーバー、ネットワーク、および他基地局の負荷を軽減できる。或いは、アクセス可否の履歴をサーバーに蓄積し、アクセス可否の判定対象の無線端末のアドレスと履歴中のアドレスとを比較してアクセス可否を判定すれば、位置計算を省略することができる。アクセス可否を判断した時点での測定位置を履歴情報に含めてもよい。
【００２３】
図１５および図１６を用いて本発明によるアクセス制御システムとそのフローの第三の実施例を説明する。図１５において、１５０１、１５０２は無線端末を、１５１０は基地局０（センサー・アクセスポイント）を、１５１１、．．．、１５１ｎはそれぞれ基地局１、．．．、ｎ（センサー）を、１５２０はサーバーを、１５３０はネットワークを示す。管理者は予めサーバーにより無線端末のアクセス許可領域１５４０を設定しておく（１６０１）。無線端末１５０１から基地局０を通じてネットワークへのアクセスが試みられたとする（１６０２）。基地局０は、無線端末１５０１からのパケットに格納されているソースアドレスを取り出し、サーバーに対して該端末のアクセス可否を問い合わせる（１６０３）。サーバーは基地局０からの問い合わせを元に、該基地局の周囲の基地局１、．．．、ｎと基地局０に対し、受信電力特性測定を要求する（１６０４）。その際、受信電力特性を測定すべきパケット信号を特定するために無線端末のアドレスを伝える。さらに必要に応じて基地局０の周波数チャネル番号を伝えてもよい。続いてサーバーは基地局０を介して無線端末１５０１にエコー要求を送る（１６０５）。無線端末１５０１はエコー応答を、基地局０を介してサーバーに返す（１６０６）。基地局０と基地局１、．．．、ｎは無線端末１５０１から基地局０に送信される該パケット信号の受信電力特性を測定する（１６０７、１６０８）。基地局０は該エコー応答をサーバーへフォワードする。基地局０および基地局１、．．．、ｎは受信電力特性測定応答により上記測定した無線端末１５０１の受信電力特性をサーバーに伝える（１６０９）。サーバーは各基地局との位置と上記受信電力特性測定応答とを元に無線端末１５０１の位置を計算する（１６１０）。そして位置計算結果を上記設定したアクセス許可領域１５４０により評価する（１６１１）。無線端末１５０１に関する位置計算結果がアクセス許可領域１５４０の外部にあると評価されると、サーバーは無線端末１５０１のアクセス不許可を基地局１５１０に伝える（１６１２）。この場合、基地局１５１０は無線端末１５０１からのパケットを廃棄する（１６１３、１６１５）。
一方、無線端末１５０２の様にアクセス許可領域１５４０の内部にあって、上記フローにより無線端末１５０２に関する位置計算結果がアクセス許可領域１５４０の内にあると評価されると、サーバー１５２０は無線端末１５０２のアクセス許可を基地局０に伝える（１６１２）。この場合には、基地局０は無線端末１５０２からのパケットをフォワードする（１６１３、１６１４）。
【００２４】
基地局が測定した無線端末からのパケットの電力特性から無線端末の位置を算出するには、三辺測量の原理を適用すればよい。図１７はサーバーにおける位置算出のフローの一例を示す図である。同図において、１７０１は基地局ｉ（ｉ＝０， ．．．， ｎ）が測定した無線端末からのパケットの受信電力特性ｐ＿ｓ＿ｉを、該基地局と該端末の距離ｄ＿ｓ＿ｉを計算するステップである。例えば、数３を用いて、受信電力Ｐｒから距離ｄへの換算すればよい。
【００２５】
【数３】

ただし、λは使用する無線の波長（ｍ）、Ｃおよびαは定数である。ここで、Ｃは、送信アンテナ利得Ｇｔ、受信アンテナ利得Ｇｒ、送信電力Ｐｔ（Ｗ）の積によって表せる。これらは標準規格で定められている数値などから決定すればよく、例えば、Ｐｔ＝０．０１（Ｗ）、Ｇｔ＝Ｇｒ＝２．１５（ｄＢｉ）などと設定すればよい。また、αは該基地局を運用する環境により定めてよい。例えば、屋外駐車場ならα＝２、街頭ならα＝２．５、ビル内部であればα＝３などと設定すればよい。数値例として、λ＝０．１２（ｍ）、Ｐｔ＝０．０１（Ｗ）、Ｇｔ＝Ｇｒ＝２．１５（ｄＢｉ）、α＝２のときＰｒ＝２．４５Ｅ−８（Ｗ）に対して、数３からｄ≒１０（ｍ）を得る。図１７において、１７０２は基地局ｉ（ｉ＝０， ．．．， ｎ）の位置ｐｉと上記算出した距離ｄ＿ｓ＿ｉから無線端末の位置ｐを連立方程式
【００２６】
【数４】

の最尤解として求めるステップである。ここで｜｜ｘ｜｜はベクトルｘの大きさを示す。
【００２７】
図１５のシステムにおいて、３台以上（ｎ≧２）の基地局が存在する場合には、無線端末の平面上の測位が可能である。アクセス許可領域１５４０は平面上の領域として設定してよい。４台以上（ｎ≧３）の基地局が存在する場合には、無線端末の三次元空間上の測位が可能である。アクセス許可領域１５４０は三次元空間上の領域として設定してよい。なお、高さ方向に位置検出の精度を要求する場合には、基地局を同一水平面上に設置するのではなく、水平面に対する垂直方向に各々の設置位置の差を大きく取ることが好ましい。
【００２８】
また、不正アクセス情報を表示する装置を設けることが考えられる。表示する情報としては、例えば図１３の履歴情報に含まれる端末のアドレス情報、アクセス可否を判断した時刻、またはその時の端末位置などがある。該表示装置はサーバーが具備してもよいし、別装置としても良い。例えば、図１９に示すように、不正アクセス端末の位置情報をアクセス許可領域とともに図示すれば、管理者はより容易に不正アクセス情報を把握することができ、その情報を不正アクセス対策に役立たせることができる。
【００２９】
【発明の効果】
本発明では、無線端末からアクセスが生じた場合に、該端末の位置特性を検出し、予め設定したアクセス許可領域と比較して、該端末のアクセス可否を決定するので、外部からの不正アクセスを防ぐことが可能である。端末が本来備えている信号の送信機能を用いて基地局側で該端末の位置特性を検出するため、端末に位置検出機能が不要であり、従来例に比較して、実現上有利である。また、システム全体でアクセス許可領域を定義するので端末毎に不正アクセス検出のための基準を予め登録する必要がなく、従来例に比較して、実現上有利である。事前の登録が必要ないため、その端末からの初めてのアクセスの試みであっても、端末の位置に基づいてアクセスの可否を判断することができる。また、基地局が相互に同期をとらないシステムでも実施可能である。
【００３０】
一つの基地局を用いて、該基地局からの距離としてアクセス許可領域を設定し、該基地局が測定する無線端末からのパケットの受信電力より該端末までの距離を求めることにより、アクセス可否を判定できる。このような実施形態は、例えば、ホームユースにおいて、外部からの不正アクセスを防ぐのに有効である。また、指向性アンテナを適用すれば、その指向パターンに応じてアクセス許可領域の形状を変更できるため便利である。
【００３１】
３台以上の基地局（センサー）を用いて、キャプチャした受信信号とその先頭時刻から、無線端末の位置を検出する実施形態では、平面上の位置検出が可能なことから、アクセス許可領域を任意形状の平面領域として設定できるので便利である。また、４台以上の基地局（センサー）を用いて、キャプチャした受信信号とその先頭時刻から、無線端末の位置を検出する実施形態では、３次元空間上の位置検出が可能なことから、アクセス許可領域を任意形状の３次元空間領域として設定できるので一層便利である。このような実施形態は、例えば、オフィスやオープンスペースが混在する雑居ビルでの利用において、外部からの不正アクセスを防ぐのに有効である。また、基地局がアクセスログを蓄積して、これを参照し、無線端末の位置検出を省略することにより、ネットワーク負荷を低減できる。ＩＥＥＥ８０２．１１に準拠しているシステムでは、無線端末に宛にパケットを送信するとＡＣＫパケットが返えるため、この二つのパケットを該無線端末の位置検出に利用できる。ＩＰアドレスを有する無線端末ではＩＣＭＰ Ｅｃｈｏ ＲｅｑｕｅｓｔとＥｃｈｏ Ｒｅｐｌｙを該無線端末の位置検出に利用できる。このように位置検出のための追加プロトコルを無線端末に実装する必要がなく実現上有利である。
【００３２】
３台以上の基地局を用いて、無線端末の受信電力特性から該端末の位置を検出する実施形態でも、平面上の位置検出が可能なことから、アクセス許可領域を任意形状の平面領域として設定できるので便利である。また、４台以上の基地局を用いれば、３次元空間上の位置検出が可能なことから、アクセス許可領域を任意形状の３次元空間領域として設定できるので一層便利である。このような実施形態は、例えば、オフィスやオープンスペースが混在する雑居ビルでの利用において、外部からの不正アクセスを防ぐのに特に有効である。
【図面の簡単な説明】
【図１】無線端末のアクセス制御システムの公知例を示す構成図である。
【図２】無線端末のアクセス制御システムの別の公知例を示す構成図である。
【図３】本発明による無線端末のアクセス制御システムの実施例を示す構成図である。
【図４】本発明による無線端末のアクセス制御システムの実施例の変形例を示す構成図である。
【図５】本発明におけるサーバーのアクセス許可領域の設定フローの実施例を示すフロー図である。
【図６】本発明による無線端末のアクセス制御方法の実施例を示すフロー図である。
【図７】本発明による無線端末のアクセス制御システムの第二の実施例を示す構成図である。
【図８】本発明による無線端末のアクセス制御方法の第二の実施例を示すフロー図である。
【図９】本発明による第二の実施例における基地局の構成の実施例を示す構成図である。
【図１０】本発明による第二の実施例におけるサーバーの位置算出フローの実施例を示すフロー図である。
【図１１】本発明による第二の実施例においてサーバーにより算出される相互相関の一例を示すグラフである。
【図１２】本発明による無線端末のアクセス制御システムの第二の実施例の適用例を示す構成図である。
【図１３】本発明による第二の実施例において基地局が蓄積するアクセスログの一例を示すテーブルである。
【図１４】本発明による第二の実施例においてアクセスログを用いた基地局フローの一例を示すフロー図である。
【図１５】本発明による無線端末のアクセス制御システムの第三の実施例を示す構成図である。
【図１６】本発明による無線端末のアクセス制御方法の第三の実施例を示すフロー図である。
【図１７】本発明による第三の実施例におけるサーバーの位置算出フローの実施例を示すフロー図である。
【図１８】本発明による第一の実施例における無線端末の構成図である。
【図１９】本発明による不正アクセス情報の表示方法の例である。
【符号の説明】
１１０，２１０：端末、１１１：位置検出部、１２０：サーバー、１２１：認証部、１３０：ネットワーク、２２０：基地局、２１１，２２１：同期部、２２２：メモリ、２２３：比較器、３０１，３０２，３０３，７０１，７０２，１２０１，１２０２，１２０３，１５０１，１５０２：無線端末、３１０，４１０：基地局、３２０，７２０，１２２０，１５２０：サーバー、３３０，７３０，１２３０，１５３０：ネットワーク、３４０，４４０，７４０，１２４０，１５４０：アクセス可能領域、７１０，１５１０：基地局０、７１１，１５１１：基地局１、７１ｎ，１５１ｎ：基地局ｎ、９１０：クロック、９２０：無線通信部、９３０：信号蓄積部、９４０：ＬＡＮインターフェース部、９５０：ＣＰＵ、１２１０，１２１１，１２１２，１２１３，１２１４，１２１５，１２１６，１２１７：基地局、１８００：無線通信部、１８１１：アンプ、１８２１：復調部、１８２２：ＡＧＣ制御部、１８４０：ＬＡＮインターフェース部、１８５０：ＣＰＵ、１８６０：メモリ、１８９１：受信電力測定部、１８９２：アクセス許可判定部。[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a wireless LAN system, and more particularly to an access control method for a wireless LAN terminal.
[0002]
[Prior art]
A wireless LAN represented by the IEEE 802.11 standard is compatible with the Internet and realizes high-speed data transfer using a broadband wireless medium (quasi-microwave, quasi-millimeter-wave, infrared, etc.). It has penetrated public spaces called hot spots. However, wireless LANs have a problem that they are more likely to be eavesdropped than wired because they use a wireless medium. For example, if a password of a certain wireless LAN is leaked due to an eavesdropping act, the network is illegally accessed from the outside.
[0003]
As techniques for preventing such unauthorized access, access control methods based on the position of a terminal are disclosed in Patent Literature 1, Patent Literature 2, and Patent Literature 3. These summaries are shown in FIG. The terminal 110 has a position detection unit 111 for detecting the position of the terminal 110 itself. As the position detection unit 111, for example, a GPS (Global Positioning System) receiver is used. If the terminal 110 is a mobile phone terminal, for example, a cell ID acquisition function is used for the position detection unit 111. The cell ID acquisition function is a function for identifying the cell to which the own device belongs. By acquiring the cell ID, the position of the own device is associated with the cell position. The server 120 includes an authentication unit 121. When the terminal 110 connects to the server or accesses the network behind the terminal 110, the terminal 110 notifies the server of its position and receives authentication. This access control method is disadvantageous in terms of implementation because it requires a function for detecting the position of the terminal itself and an authentication protocol from the terminal.
[0004]
Another example of an access control method based on the location of a terminal is disclosed in Patent Document 4. The summary is shown using FIG. Terminal 210 and base station 220 are part of a TDMA or CDMA synchronization system. The terminal 210 and the base station 220 have a synchronizing unit for synchronizing, and synchronize for communication between them. At the time of synchronization, the base station 220 measures the propagation delay amount of the signal from the terminal 210, so that the position characteristics of the distance from the terminal 210 can be obtained. The memory 222 stores propagation delay information when the terminal 210 is incorporated into the system. The comparator 223 performs terminal authentication by comparing the propagation delay information with the position characteristics. Therefore, in order to prevent unauthorized access by this access control method, a protocol for registering the distance (propagation delay amount) between the terminal and the base station in advance is required, which is disadvantageous in terms of realization. When the terminal moves, re-registration of the distance (propagation delay amount) is frequently required, which is disadvantageous in terms of realization. Further, since this access control method requires a synchronous system, it is not suitable for a terminal conforming to the IEEE 802.11 standard which has already spread, which is disadvantageous in terms of realization.
[0005]
[Patent Document 1]
JP 2001-306530 A
[Patent Document 2]
JP 2000-341749 A
[Patent Document 3]
JP 2000-40064 A
[Patent Document 4]
JP-A-10-84576
[Patent Document 5]
Japanese Patent Application No. 2002-260772
[Patent Document 6]
JP-A-2002-14152
[0006]
[Problems to be solved by the invention]
Therefore, it is an object to prevent unauthorized access from the outside without changing the protocol to the wireless LAN terminal.
[0007]
[Means for Solving the Problems]
According to the present invention, in a network system in which a wireless terminal communicates with a node on a local or wide area network via a base station, an access permission area which is a range of a position of the wireless terminal permitted to access the network is preset. Then, when the wireless terminal attempts to access the network via the base station, measure the position characteristics of the wireless terminal based on a signal from the wireless terminal received at the base station, If the measured position characteristic is outside the range of the access permission area, the access is rejected.
[0008]
BEST MODE FOR CARRYING OUT THE INVENTION
An embodiment of an access control system according to the present invention and its flow will be described with reference to FIGS. 3, reference numerals 301 and 302 denote wireless terminals, 310 denotes a base station (access point sensor), 320 denotes a server, and 330 denotes a local or wide area network. The administrator sets the access permission area 340 of the wireless terminal to the base station by the server (601). By setting the access-permitted area as a common one for each terminal, the management of the area and the determination of whether or not each access is permitted are made easier. The access permission area specified by the server is converted into a threshold value for the received power characteristic in the base station (602), and is set in the base station (603). Now, it is assumed that the access from the wireless terminal 301 to the network through the base station is attempted (604). At that time, the base station 310 measures the received power characteristic of the signal from the terminal (605) and compares it with the threshold (606). Since the terminal is outside the access permission area, the received power of a signal from the terminal observed by the base station is less than the threshold. Therefore, the base station determines that the terminal is outside the access permission area, rejects the access, and discards the wireless packet from wireless terminal 301 (608).
[0009]
On the other hand, it is assumed that an attempt is made to access the network from the wireless terminal 302 through the base station. At that time, the base station 310 measures the received power characteristic of the signal from the terminal (605) and compares it with the threshold (606). Since the terminal is inside the access permission area, the reception power of the signal from the terminal observed by the base station exceeds the threshold. Therefore, the base station determines that the terminal is inside the access permission area, permits the access, and forwards the wireless packet from the wireless terminal 302 (607).
[0010]
In the present embodiment, it is assumed that the transmission power of the wireless terminal is constant, and the position of the wireless terminal with respect to the base station is utilized by utilizing the fact that the power of the radio wave attenuates in proportion to the square of the propagation distance or more. The characteristics are being measured.
[0011]
The access permission area is determined by the threshold and the antenna directivity of the base station. For example, when the antenna is omnidirectional, the shape of the area is a sphere centered on the base station. When the access permission area is expanded in this shape, the threshold may be lowered. Alternatively, for example, as shown in FIG. 4, in a geographical environment where an unauthorized access person easily lurks in a certain direction, a directional antenna having a characteristic of low gain in the direction is used to form the shape of the access permission area. Is also within the scope of the present invention.
[0012]
FIG. 18 shows a configuration example of a base station for realizing this embodiment. In the figure, a wireless communication unit 1800 includes an antenna, a radio frequency (RF) unit, a baseband (BB) unit, and a media access control (MAC) unit, and performs processing of a physical layer and processing of a MAC layer in wireless communication. In wireless communication section 1800, amplifier 1811 amplifies the received signal, demodulation section 1821 demodulates the signal, and AGC control section 1822 controls amplifier 1811 based on the reception level from demodulation section 1821. The LAN I / F 1840 is an interface unit for a local area network. CPU 1850 controls bridging between wireless and wired networks. Further, the CPU 1850 controls the LAN I / F 1840 and performs communication with the server. Further, when wireless communication section 1800 receives a wireless packet, CPU 1850 reads a control voltage value of the AGC control section from wireless communication section 1800 and converts the control voltage value into a received power value. Then, the transfer of the packet is controlled based on a comparison between the received power value and a threshold value set by the server. In order to perform the conversion to the received power value, for example, the correspondence between the control voltage value of the AGC control unit and the received power value may be obtained in advance. The memory 1860 stores the correspondence between the threshold and the control voltage value of the AGC control unit and the received power value. Reference numeral 1891 denotes a part related to the reception power measurement, and reference numeral 1892 denotes a part related to the determination of the access permission.
[0013]
Referring to FIG. 5, an embodiment of a flow of setting a server access permitted area according to the present invention will be described. In the figure, reference numeral 501 denotes a step of giving an area to which access from a terminal is permitted as a distance characteristic from the base station. Specifically, an area to which access is permitted is given as an "area of a radius x (m) from the base station". When the base station uses a directional antenna, the area is given as “an area that is x (m) from the base station in the maximum (or minimum) gain direction of the antenna”. Subsequently, step 502 converts the distance characteristic given in the previous step into a threshold value for the received power characteristic in the base station. The above x is converted into received power Pr (W) using, for example, Equation 1. Here, λ is a wireless wavelength (m) to be used, and C and α are constants.
[0014]
(Equation 1)

Here, C can be represented by the product of the transmission antenna gain Gt, the reception antenna gain Gr, and the transmission power Pt (W). These may be determined from numerical values and the like defined in the standard, for example, Pt = 0.01 (W), Gt = Gr = 2.15 (dBi), and the like. Α may be determined according to the environment in which the base station operates. For example, α = 2 for an outdoor parking lot, α = 2.5 for a street, and α = 3 for a building. As a numerical example, when λ = 0.12 (m), Pt = 0.01 (W), Gt = Gr = 2.15 (dBi), and α = 2, the permission area of x = 10 (m) is obtained. Then, Pr ≒ 2.45E-8 (W) is obtained from Expression 1 as a threshold for the reception power characteristic. Reference numeral 503 in FIG. 5 is a step of setting a threshold value for the reception power characteristic obtained in the previous step in the base station.
[0015]
A second embodiment of the access control system and its flow according to the present invention will be described with reference to FIGS. 7, reference numerals 701 and 702 denote wireless terminals, 710 denotes a base station 0 (access point), 711,. . . , 71n are base stations 1,. . . , N (sensor), 720 indicates a server, and 730 indicates a network. The administrator sets the access permission area 740 of the wireless terminal by the server in advance (801). It is assumed that an attempt is made to access the network from the wireless terminal 701 through the base station 0 (802). The base station 0 extracts the source address stored in the packet from the wireless terminal 701, and inquires of the server whether the terminal can access (803). The server, based on the inquiry from the base station 0, base stations 1,. . . , N (step 804). At this time, the address of the wireless terminal and the address of the base station 0 are transmitted to specify the packet signal to be captured. Further, the frequency channel number of the base station 0 may be transmitted as needed. Subsequently, the server sends an echo request to the wireless terminal 701 via the base station 0 (805). Base stations 1,. . . , N capture the packet signal transmitted from the base station 0 to the wireless terminal 701 (806). At that time, the base stations 1,. . . , N record the start time of the capture signal by each clock. The wireless terminal 701 returns an echo response to the server via the base station 0 (807). Base stations 1,. . . , N capture the packet signal transmitted from the wireless terminal 701 to the base station 0 (808). At that time, the base stations 1,. . . , N record the start time of the capture signal by each clock. Base station 0 forwards the echo response to the server. Base stations 1,. . . , N transmit the captured signal of the base station 0 and its leading time and the captured signal of the wireless terminal 701 and its leading time to the server in a packet capture response (809). The server calculates the position of the wireless terminal 701 based on the position with each base station and the packet capture response (810). Then, the position calculation result is evaluated based on the set access permission area 740 (811). When the position calculation result for the wireless terminal 701 is evaluated as being outside the access permission area, the server notifies the base station 0 that the wireless terminal 701 is not allowed to access (812). In this case, the base station 0 discards the packet from the wireless terminal 701 (813, 815).
On the other hand, if the position calculation result for the wireless terminal 702 is evaluated as being within the access permitted area by the above flow within the access permitted area as in the case of the wireless terminal 702, the server permits the access permission of the wireless terminal 702. The information is transmitted to the base station 0 (812). In this case, the base station 0 forwards the packet from the wireless terminal 702 (813, 814).
[0016]
The access control system according to the present embodiment may employ, for example, a wireless system described in Japanese Patent Application Laid-Open No. H10-216, filed by the present applicant. FIG. 9 shows base stations 1,. . . , N (sensor) is a diagram showing an example of the configuration. In the figure, reference numeral 910 denotes a clock, which supplies a clock pulse to the wireless communication unit 920 and the signal storage unit 930. The wireless communication unit 920 includes an antenna, a high frequency (RF) unit, a baseband (BB) unit, and a media access control (MAC) unit, and performs processing of a physical layer and processing of a MAC layer in wireless communication. Further, the wireless communication unit 920 supplies the baseband received IQ analog signal to the signal storage unit 930. The signal storage unit 930 performs AD conversion of the baseband reception IQ analog signal input from the wireless communication unit 920 using an AD converter (ADC) and stores the analog signal in a memory. At this time, it is desirable to perform sampling at a rate of twice or more the highest frequency of the signal. The signal storage unit 930 has a counter and records the start time when storing a signal. The LAN I / F 940 is an interface unit for a local area network. The CPU 950 controls the LAN I / F 940 and performs communication with the server. Further, the CPU 950 controls the storage unit 930 to instruct the start of storage of the baseband reception IQ analog signal. Further, the CPU 950 determines whether or not the baseband reception IQ analog signal stored in the signal storage unit 930 is a target packet using the source address of the reception packet acquired from the wireless communication unit 920.
[0017]
Base stations 1,. . . , N to calculate the position of the wireless terminal from the signal captured and the start time thereof, for example, the position detection method described in Patent Document 5 of the prior application by the same applicant may be applied. FIG. 10 is a diagram illustrating an example of a flow of the position calculation in the server. In the figure, reference numeral 1001 denotes a step of calculating a cross-correlation r_a_i × w between a signal r_a_i captured by the base station i (i = 1,..., N) from the base station 0 and a transmission signal waveform w from the base station 0. It is. Reference numeral 1002 denotes a step of calculating a cross-correlation r_s_i × w between the signal r_s_i captured by the base station i from the wireless terminal and the transmission signal waveform w from the wireless terminal. Here, r_a_i, r_s_i, and w are complex signal sequences, and their cross-correlations are illustrated, for example, in FIG. Reference numeral 1003 denotes a step of obtaining a reception time Tr_a_i ＠ i of the signal at the base station i from the start time of r_a_i and r_a_i × w. Here, the reception time Tr_a_i ＠ i may be obtained, for example, by adding a delay time for giving a peak value of the cross-correlation as shown in FIG. 11 to the head time of r_a_i. Alternatively, it may be obtained by applying the method described in Patent Document 6. In this step, similarly, the reception time Tr_s_i ＠ i of the signal at the base station i is obtained from the start time of r_s_i and r_s_i × w. 1004 indicates the time of the base station i (i = 2,..., N) with respect to the base station 1 using the position pi of the base station i, the position pa of the base station 0, and the reception time Tr_a_i ＠ i at the base station i. This is a step of calculating the deviation and converting the reception time Tr_a_i ＠ i at each base station i (i = 2,..., N) into the reception time Tr_s_i ＠ 1 at the base station 1. 1005 is a simultaneous equation for the position p of the wireless terminal.
[0018]
(Equation 2)

This is the step of obtaining the maximum likelihood solution of Here, || x || indicates the magnitude of the vector x. c indicates the speed of light.
[0019]
In the system of FIG. 7, when there are three or more (n ≧ 3) base stations (sensors), positioning on the plane of the wireless terminal is possible. The access permission area 740 may be set as a plane area. When there are four or more (n ≧ 4) base stations (sensors), positioning of the wireless terminal in a three-dimensional space is possible. The access permission area 740 may be set as an area in a three-dimensional space. FIG. 12 is a diagram showing an example of a configuration of a system in which an access permission area is set as an area in a three-dimensional space using eight base stations. The system is installed inside a two-story building. In the figure, reference numerals 1201, 1202, and 1203 indicate wireless terminals. Reference numerals 1210 to 1217 denote base stations. 1220 indicates a server, and 1230 indicates a network. Reference numeral 1240 denotes an access permission area set as an area in the three-dimensional space. The access permission area is the whole area on the second floor and the area on the left side of the drawing on the first floor. Wireless terminals 1202 and 1203 within the area can access the network via the base station, but wireless terminals 1201 outside the area are denied access to the network. Such setting of the access permission area in the three-dimensional space is particularly effective in, for example, a building where an open space is adjacent to an office using a network. When accuracy of position detection is required in the height direction, it is preferable that the base station is not installed on the same horizontal plane, but that the difference between the installation positions in the direction perpendicular to the horizontal plane is large.
[0020]
In the flow of FIG. 8, the partial flow of the packet capture request and its response enclosed by the dashed square may be repeated a plurality of times according to the required position detection accuracy.
[0021]
In the flow of FIG. 8, the wireless section of the message is indicated by a broken arrow. Here, if the system complies with IEEE802.11, the base station 0 sets the MAC address of the target wireless terminal to the destination address and transmits the data frame, so that the wireless terminal ACK frame is returned. Therefore, the round trip of these frames may be used as an echo request and a response message in the wireless section. Alternatively, in the flow of FIG. 8, an ICMP (Internet Control Message Protocol) Echo Request (type 8) and an ICMP Echo Reply (type 0) may be used for the echo request and the response message, respectively. ICMP is a function originally provided in a wireless terminal that implements IP (Internet Protocol). By using these ICMP messages, it is possible to detect the position of any wireless terminal accessed using IP. Since there is no need to newly add software for transmitting a message for position detection to the wireless terminal, the use of the message is extremely effective in the present system that attempts to detect an unauthorized access terminal.
[0022]
In the flow of FIG. 8, the base station 0 may accumulate the history of the result after inquiring the server about whether or not the wireless terminal can be accessed. In this case, for example, it is stored as an access log in the format shown in FIG. The storage format illustrated in the figure includes an address, an attribute indicating whether or not a wireless terminal having the address as a source address can access the base station, and a total of three update dates and times of the two items. In the figure, an IP address is used as an example of an address, but the use of a MAC address according to the system is also within the scope of the present invention. Then, when there is access from the wireless terminal to the base station as shown in FIG. 14, each time the access log is referred to once, instead of inquiring of the server whether or not access is possible. The source address of the packet sent by the wireless terminal at the time of access is used as the address used for reference (1401). The access log is searched for the address (1402), and if there is no corresponding address, or even if the corresponding address is described, the update date and time is compared with the current time (1403) and a predetermined time has elapsed. In this case, an inquiry is made to the server according to the flow of FIG. When an inquiry is made to the server as to whether access is possible, the access log is updated (1405). Then, referring to the access permission attribute described in the access log (1406), if access is not possible (NG), the packet of the wireless terminal is discarded (1407), and if access is possible (OK), the packet is forwarded (1408). . As described above, by omitting inquiring of the server whether or not access is possible for each access from the wireless terminal, the load on the server, the network, and other base stations can be reduced. Alternatively, if the access history is stored in the server, and the address of the access-determined wireless terminal is compared with the address in the history to determine whether the access is possible, the position calculation can be omitted. The measurement position at the time of determining whether access is possible may be included in the history information.
[0023]
A third embodiment of the access control system and the flow according to the present invention will be described with reference to FIGS. In FIG. 15, 1501 and 1502 denote wireless terminals, 1510 denotes base station 0 (sensor access point), 1511. . . , 151n are base stations 1,. . . , N (sensor), 1520 indicates a server, and 1530 indicates a network. The administrator sets the access permission area 1540 of the wireless terminal by the server in advance (1601). It is assumed that an attempt is made to access the network from the wireless terminal 1501 through the base station 0 (1602). The base station 0 extracts the source address stored in the packet from the wireless terminal 1501, and inquires of the server whether the terminal can access (1603). The server, based on the inquiry from the base station 0, base stations 1,. . . , N and the base station 0 are requested to measure received power characteristics (1604). At that time, the address of the wireless terminal is transmitted to specify a packet signal whose reception power characteristic is to be measured. Further, the frequency channel number of the base station 0 may be transmitted as needed. Subsequently, the server sends an echo request to the wireless terminal 1501 via the base station 0 (1605). The wireless terminal 1501 returns an echo response to the server via the base station 0 (1606). Base station 0 and base station 1,. . . , N measure the reception power characteristics of the packet signal transmitted from the wireless terminal 1501 to the base station 0 (1607, 1608). Base station 0 forwards the echo response to the server. Base station 0 and base station 1,. . . , N transmit the measured reception power characteristics of the wireless terminal 1501 to the server by the reception power characteristics measurement response (1609). The server calculates the position of the wireless terminal 1501 based on the position with each base station and the received power characteristic measurement response (1610). Then, the position calculation result is evaluated based on the set access permission area 1540 (1611). If the position calculation result for the wireless terminal 1501 is evaluated as being outside the access permission area 1540, the server notifies the base station 1510 that the wireless terminal 1501 is not allowed to access (1612). In this case, the base station 1510 discards the packet from the wireless terminal 1501 (1613, 1615).
On the other hand, if the position calculation result for the wireless terminal 1502 is evaluated as being within the access permitted area 1540 according to the above flow within the access permitted area 1540 like the wireless terminal 1502, the server 1520 The access permission is transmitted to the base station 0 (1612). In this case, the base station 0 forwards the packet from the wireless terminal 1502 (1613, 1614).
[0024]
To calculate the position of the wireless terminal from the power characteristics of the packet from the wireless terminal measured by the base station, the principle of trilateration may be applied. FIG. 17 is a diagram illustrating an example of a flow of the position calculation in the server. Referring to FIG. 17, reference numeral 1701 denotes a step of calculating a received power characteristic p_s_i of a packet from a wireless terminal measured by a base station i (i = 0,..., N) and calculating a distance d_s_i between the base station and the terminal. . For example, the reception power Pr may be converted into the distance d using Expression 3.
[0025]
[Equation 3]

Here, λ is a wireless wavelength (m) to be used, and C and α are constants. Here, C can be represented by the product of the transmission antenna gain Gt, the reception antenna gain Gr, and the transmission power Pt (W). These may be determined from numerical values and the like defined in the standard, for example, Pt = 0.01 (W), Gt = Gr = 2.15 (dBi), and the like. Α may be determined according to the environment in which the base station operates. For example, α = 2 for an outdoor parking lot, α = 2.5 for a street, and α = 3 for a building. As numerical examples, λ = 0.12 (m), Pt = 0.01 (W), Gt = Gr = 2.15 (dBi), and when α = 2, Pr = 2.45E-8 (W) Thus, d ≒ 10 (m) is obtained from Expression 3. 17, reference numeral 1702 denotes a simultaneous equation for the position p of the wireless terminal from the position pi of the base station i (i = 0,..., N) and the calculated distance d_s_i.
[0026]
(Equation 4)

This is the step of obtaining the maximum likelihood solution of Here, || x || indicates the magnitude of the vector x.
[0027]
In the system of FIG. 15, when there are three or more (n ≧ 2) base stations, positioning on the plane of the wireless terminal is possible. The access permission area 1540 may be set as a plane area. When there are four or more (n ≧ 3) base stations, positioning of the wireless terminal in a three-dimensional space is possible. The access permission area 1540 may be set as an area in a three-dimensional space. When accuracy of position detection is required in the height direction, it is preferable that the base station is not installed on the same horizontal plane, but that the difference between the installation positions in the direction perpendicular to the horizontal plane is large.
[0028]
It is also conceivable to provide a device for displaying unauthorized access information. The information to be displayed includes, for example, the address information of the terminal included in the history information of FIG. 13, the time at which access was determined, or the terminal position at that time. The display device may be included in the server or may be a separate device. For example, as shown in FIG. 19, if the location information of the unauthorized access terminal is shown together with the access permission area, the administrator can more easily grasp the unauthorized access information and use the information to prevent unauthorized access. Can be.
[0029]
【The invention's effect】
According to the present invention, when an access occurs from a wireless terminal, the position characteristics of the terminal are detected and compared with a preset access permission area to determine whether or not the terminal can be accessed. It is possible to prevent. Since the base station detects the position characteristics of the terminal using the signal transmission function originally provided in the terminal, the terminal does not need a position detection function, which is advantageous in terms of realization as compared with the conventional example. In addition, since the access permission area is defined in the entire system, it is not necessary to previously register a reference for detecting unauthorized access for each terminal, which is advantageous in comparison with the conventional example. Since pre-registration is not required, it is possible to determine whether or not access is possible based on the position of the terminal even for the first access attempt from the terminal. Further, the present invention can be implemented in a system in which the base stations do not synchronize with each other.
[0030]
Using one base station, an access permission area is set as a distance from the base station, and the distance to the terminal is determined from the reception power of a packet from a wireless terminal measured by the base station, thereby determining whether access is possible. Can be determined. Such an embodiment is effective for preventing unauthorized access from the outside in, for example, home use. In addition, when a directional antenna is applied, the shape of the access permission area can be changed according to the directional pattern, which is convenient.
[0031]
In the embodiment in which the position of the wireless terminal is detected from the captured reception signal and the start time thereof using three or more base stations (sensors), since the position on the plane can be detected, the access permission area is optional. This is convenient because it can be set as a planar area of the shape. Further, in the embodiment in which the position of the wireless terminal is detected from the captured reception signal and the leading time thereof using four or more base stations (sensors), since the position detection in a three-dimensional space is possible, This is more convenient because the permitted area can be set as a three-dimensional space area having an arbitrary shape. Such an embodiment is effective for preventing unauthorized access from the outside, for example, in a mixed-use building where offices and open spaces are mixed. Also, the network load can be reduced by accumulating the access log by the base station, referring to the access log, and omitting the position detection of the wireless terminal. In a system compliant with IEEE 802.11, when a packet is transmitted to a wireless terminal, an ACK packet is returned, so that these two packets can be used for position detection of the wireless terminal. In a wireless terminal having an IP address, ICMP Echo Request and Echo Reply can be used for detecting the position of the wireless terminal. Thus, there is no need to implement an additional protocol for position detection in the wireless terminal, which is advantageous in terms of realization.
[0032]
Even in an embodiment in which the position of a wireless terminal is detected from the reception power characteristics of the wireless terminal by using three or more base stations, the access permission area is set as an arbitrary-shaped plane area because position detection on a plane is possible. It is convenient because you can do it. Further, if four or more base stations are used, the position can be detected in a three-dimensional space, so that the access permission area can be set as a three-dimensional space area having an arbitrary shape, which is more convenient. Such an embodiment is particularly effective in preventing unauthorized access from the outside, for example, in a mixed-use building where offices and open spaces are mixed.
[Brief description of the drawings]
FIG. 1 is a configuration diagram illustrating a known example of an access control system for a wireless terminal.
FIG. 2 is a configuration diagram showing another known example of an access control system for a wireless terminal.
FIG. 3 is a configuration diagram showing an embodiment of a wireless terminal access control system according to the present invention.
FIG. 4 is a configuration diagram showing a modification of the embodiment of the access control system for wireless terminals according to the present invention.
FIG. 5 is a flowchart showing an embodiment of a flow of setting a server access permission area in the present invention.
FIG. 6 is a flowchart showing an embodiment of a wireless terminal access control method according to the present invention.
FIG. 7 is a configuration diagram showing a second embodiment of the access control system for a wireless terminal according to the present invention.
FIG. 8 is a flowchart showing a second embodiment of the wireless terminal access control method according to the present invention.
FIG. 9 is a configuration diagram illustrating an embodiment of a configuration of a base station according to the second embodiment of the present invention.
FIG. 10 is a flowchart showing an example of a server position calculation flow according to the second embodiment of the present invention.
FIG. 11 is a graph showing an example of the cross-correlation calculated by the server in the second embodiment according to the present invention.
FIG. 12 is a configuration diagram showing an application example of the second embodiment of the access control system for a wireless terminal according to the present invention.
FIG. 13 is a table showing an example of an access log accumulated by a base station in the second embodiment according to the present invention.
FIG. 14 is a flowchart showing an example of a base station flow using an access log in the second embodiment according to the present invention.
FIG. 15 is a configuration diagram showing a third embodiment of the access control system for a wireless terminal according to the present invention.
FIG. 16 is a flowchart showing a third embodiment of the access control method for a wireless terminal according to the present invention.
FIG. 17 is a flowchart showing an embodiment of a server position calculation flow in the third embodiment according to the present invention.
FIG. 18 is a configuration diagram of a wireless terminal according to the first embodiment of the present invention.
FIG. 19 is an example of a method for displaying unauthorized access information according to the present invention.
[Explanation of symbols]
110, 210: terminal, 111: position detection unit, 120: server, 121: authentication unit, 130: network, 220: base station, 211, 221: synchronization unit, 222: memory, 223: comparator, 301, 302, 303, 701, 702, 1201, 1202, 1203, 1501, 1502: wireless terminal, 310, 410: base station, 320, 720, 1220, 1520: server, 330, 730, 1230, 1530: network, 340, 440, 740, 1240, 1540: Accessible area, 710, 1510: Base station 0, 711, 1511: Base station 1, 71n, 151n: Base station n, 910: Clock, 920: Wireless communication unit, 930: Signal storage unit, 940: LAN interface unit, 950: CPU, 1210, 1211, 1 12, 1213, 1214, 1215, 1216, 1217: base station, 1800: wireless communication unit, 1811: amplifier, 1821: demodulation unit, 1822: AGC control unit, 1840: LAN interface unit, 1850: CPU, 1860: memory, 1891: reception power measurement unit, 1892: access permission determination unit.

Claims (20)

An access control method in a wireless network system in which a wireless terminal communicates with a node on a local or wide area network via a base station,
An access permission area that is a wireless terminal position range that permits access to the network is set in advance,
When an attempt is made to access the network from the wireless terminal via the base station, a position characteristic of the wireless terminal is measured based on a signal from the wireless terminal received by the base station in or around the wireless terminal. And
An access control method for a wireless terminal, characterized in that the access is denied when the measured position characteristic indicates outside the range of the access permission area. The access control method according to claim 1, wherein
The access permission area is set as a reception power characteristic of a signal from the wireless terminal received at the base station to which the access was attempted,
The position characteristics of the wireless terminal are measured by measuring the received power of the signal from the wireless terminal received by the base station,
An access control method, comprising: determining whether the measured position characteristic is out of the range of the access permission area based on a relationship between the received power and the set received power characteristic. The access control method according to claim 2, wherein
The access control method, wherein the base station receives a signal from the wireless terminal using a directional antenna. The access control method according to claim 1, wherein
Finding the reception time of the received signal at a plurality of sensor base stations that are base stations receiving the signal from the wireless terminal, measuring the position characteristics of the wireless terminal based on the reception time Access control method. The access control method according to claim 4, wherein
An access point base station that is a base station to which access has been attempted from the wireless terminal transmits a first signal to the wireless terminal,
Each of the plurality of sensor base stations receives the first signal, measures a first reception time that is the reception time, and transmits a second signal transmitted by the wireless terminal in response to the first signal. And a second reception time that is the reception time is measured, and the position of the wireless terminal is determined based on the first reception time and the second reception time in each of the plurality of sensor base stations. An access control method comprising determining characteristics. The access control method according to claim 5, wherein
The first signal is a frame requesting an acknowledgment on the IEEE 802.11 MAC sublayer,
The access control method, wherein the second signal is an ACK frame on an IEEE 802.11 MAC sublayer. The access control method according to claim 5, wherein
The first signal is an ICMP Echo Reply (Type 8),
The access control method, wherein the second signal is an ICMP Echo Reply (Type 0). The access control method according to claim 1, wherein
Receiving signals from the wireless terminals at a plurality of base stations,
An access control method, comprising measuring position characteristics of the wireless terminals based on received power of signals from the wireless terminals in the plurality of base stations. 9. The access control method according to claim 5, wherein the access permission area is defined by a two-dimensional space position or a three-dimensional space position. 2. The access control method according to claim 1, wherein history information on permission or denial of the access is stored, and the history information includes an address of the wireless terminal that attempted the access, and it is determined whether or not the access is permitted. An access control method characterized by referring to the history information. An access control system for controlling access of a wireless terminal in a wireless network system in which a wireless terminal communicates with a node on a local or wide area network via a base station,
A server that stores an access permission area that is a wireless terminal position range that permits access to the network;
A plurality of base stations connected to the server via a local network and receiving a signal transmitted from the wireless terminal,
The server measures a position characteristic of the wireless terminal based on signals received by the plurality of base stations, and rejects the access when the measured position characteristic indicates out of the range of the access permission area. An access control system for a wireless terminal. The access control system according to claim 11, wherein
An access control system, comprising: measuring reception times of signals received by the plurality of base stations; and measuring a position characteristic of the wireless terminal based on the reception times at the respective base stations. The access control system according to claim 12, wherein
Any one of the plurality of base stations transmits a first signal to the wireless terminal,
Base stations other than the base station that transmitted the first signal among the plurality of base stations,
The first signal is received, a first reception time that is the reception time is measured, and a second signal transmitted by the wireless terminal in response to the first signal is received. Measuring a certain second reception time,
The location characteristic of the wireless terminal is determined based on the first and second reception times at respective base stations of the plurality of base stations other than the base station that transmitted the first signal. And access control system. The access control system according to claim 11, wherein
The plurality of base stations measure reception power of a signal received from the wireless terminal, transmit the reception power to the server,
The access control system, wherein the server determines a position characteristic of the wireless terminal based on the received power at each base station. The access control system according to claim 11, wherein the access permission area is defined as a two-dimensional space position or a three-dimensional space position. 12. The access control system according to claim 11, further comprising a history storage device that stores access permission or denial history information in the server or the base station, wherein the history information is an access permission or denial wireless terminal. An access control system, wherein the server or the base station refers to the history information when determining whether to permit access. 12. The access control system according to claim 11, wherein when the wireless terminal is denied access, the server displays a position characteristic of the wireless terminal when the access is denied together with the access permission area information. An access control system comprising a device. A wireless base station connected to a network and communicating with a terminal device by radio,
A storage device that stores an access permission area that is a terminal device position range that permits access to the network;
A receiving antenna for receiving a signal transmitted from the terminal device,
Receiving power measuring means for measuring the receiving power of the signal;
A wireless base station comprising: access permission determining means for determining whether to permit the terminal device to access the network according to a relationship between the measured reception power and the access permission area. . The wireless base station according to claim 18, wherein
The access permission area is stored as a threshold of the reception power of the signal from the terminal device,
The radio base station, wherein the access permission determination unit rejects the access when the measured reception power is lower than a threshold of the reception power. The radio base station according to claim 19,
A wireless base station, wherein the receiving antenna is a directional antenna.

Images