JP2004297604A - Communication control device and its method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make accessible a server or the like from a communication apparatus which can undergo authentication when a radio communication apparatus 101 is connected to the server, and an ID (identifier) and a password for the authentication are fixed, if the communication apparatus logged in the past to a network from its radio access point. <P>SOLUTION: The radio communication apparatus 101 for establishing a radio link in response to a connection request from the connection apparatus located in a radio communication area 102 receives a set instruction of a link with each communication apparatus located in the radio communication area 102 when link control is set to be valid, and sets a radio link following the set instruction. It registers, when the connection with the communication apparatus where the radio link is established is disconnected, the identification information of the communication apparatus in a memory, and processes the connection request from the communication apparatus based upon the identification information registered in the memory. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a communication control device and a method thereof, for example, to a link control of a communication device that establishes a wireless link in response to a connection request.
[0002]
[Prior art]
In an office environment in which networking is progressing with the spread of the Internet, there is a growing need to replace a part of a wired network represented by Ethernet® with wireless data communication that does not require cumbersome wiring.
[0003]
On the other hand, various communication systems have been put to practical use in digital wireless communication technology. With the aim of replacing cables that connect devices, a new wireless interface method that uses a simple wireless communication method to achieve low cost and low power consumption is being studied, and it is gradually being commercialized. Once started, it is expected to spread as a means of making office networks wireless.
[0004]
When performing communication between devices equipped with a wireless interface (hereinafter referred to as “wireless communication device”), a wireless communication device having the same interface within a communication area prior to establishing a wireless link. An inquiry signal for searching is transmitted, a desired communication partner is selected from the received response (search result), and then a connection request signal is transmitted to perform wireless connection.
[0005]
In addition, the apparatus performs an operation of receiving an inquiry signal and a connection request signal (hereinafter, referred to as a “request signal”) at a certain period in order to receive the inquiry signal and the connection request signal. Is received only when the response signal is received.
[0006]
The operation of receiving the request signal is performed by temporarily interrupting the data communication at predetermined intervals even if the wireless link is established and the data communication is being performed. By such a reception operation, a wireless access point that has already established a wireless link with a wireless communication device can receive an inquiry signal and a connection request signal from a new wireless communication device.
[0007]
This wireless communication device can be applied as a communication terminal and a wireless access point. When communicating with a wireless access point connected to a wired LAN, an access point is established in advance to prevent unauthorized access when establishing a wireless link. In this configuration, user authentication is performed using an ID (Identifier) and a password determined between the wireless communication device and the wireless communication device. Further, by incorporating an authentication procedure using a higher-level protocol, higher security can be realized.
[0008]
If a wireless access point is installed in a conference room, is connected to a server, and has a fixed ID and password for authentication, if the wireless communication device has logged in to the network from the wireless access point in the past, authentication will be performed. It is possible to always access the server from the conference room.
[0009]
Security is assured on the assumption that the ID and password for authentication are not leaked to a malicious third party. Therefore, in the case of a conference room that is also used by an outsider, there is no means for defending unauthorized access to a malicious third party who has learned the ID and password in the past. For example, if countermeasures such as changing IDs and passwords are taken for each meeting, legitimate users will be forced to make troublesome settings to access the network, which will reduce convenience. Of course, when notifying the authorized user of the ID and password, there is a possibility that the ID and password may be leaked to a third party, so that complete security cannot be ensured.
[0010]
Also, by transmitting an inquiry signal from the wireless communication device, the wireless access point can be easily found, and even if the wireless access point has no access experience, the ID and the password can be obtained by any means. After that, unauthorized access cannot be prevented.
[0011]
[Problems to be solved by the invention]
An object of the present invention is to solve the above-mentioned problems individually or collectively, and an object of the present invention is to secure security of a communication device that establishes a link in response to a connection request from a communication device in a communication area.
[0012]
[Means for Solving the Problems]
The present invention has the following configuration as one means for achieving the above object.
[0013]
The present invention is characterized in that, when the connection with a communication device is disconnected, the identification information of the communication device is registered in a memory, and a connection request from another communication device is processed based on the identification information registered in the memory. And
[0014]
Preferably, a connection request for a communication device corresponding to the identification information registered in the memory is permitted, and a connection request for a communication device not corresponding to the identification information registered in the memory is rejected.
[0015]
Also, according to the authentication result, when the communication device connects to another communication device and disconnects from the connected other communication device, the identification information of the communication device is registered, and the communication device corresponding to the registered identification information is registered. Is characterized in that connection is performed without performing authentication processing.
[0016]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, a communication system according to an embodiment of the present invention will be described in detail with reference to the drawings.
[0017]
[Constitution]
FIG. 1 is a block diagram illustrating a configuration example of the communication system according to the embodiment.
[0018]
The wireless communication device 101 is a wireless access point connected to the wired LAN 108 and having a wireless interface mounted thereon, and the area indicated by reference numeral 102 is a communicable area. Wireless interfaces are mounted on personal computers (hereinafter, referred to as “PCs”) 103 to 107.
[0019]
FIG. 2 is a diagram illustrating an example of a control screen 202 for performing link establishment control of the wireless communication apparatus 101. FIG. 2 illustrates an example in which a control screen 202 is displayed on a monitor screen 201 of a wireless communication device 103 (hereinafter, referred to as a “control terminal”) that performs link establishment control of the wireless communication device 101. The wireless communication device that performs the link establishment control is not limited to the wireless communication device 103, and may be a wireless communication device (or a computer connected to the wired LAN 108) in which a communication application program for link establishment control described later is installed. Just fine.
[0020]
On the control screen 202, a control window 203 is a window for setting the validity / invalidity of the link establishment control function of the wireless communication device 101, and a display window 204 is a state for receiving the inquiry signal and the connection request signal of the wireless communication device 101. A control window 205 is a window for controlling the wireless communication apparatus 101 to perform link establishment control, and a control window 210 is for controlling the transmission of an inquiry signal from the wireless communication apparatus 101 under link establishment control. It is a window.
[0021]
The control window 205 displays a device name column 207, a unique address column 208, a link establishment control column 206, a link status column 209, and the like. In the device name column 207 and the unique address column 208, the name and unique address (for example, MAC address) of each device obtained from the result of searching for the device from the wireless communication device 101 are displayed. In the link establishment control column 206, an operation instruction button for instructing the establishment of a link with the wireless communication apparatus 101 under the link establishment control is arranged. The link status column 209 displays the status of establishing a link between the wireless communication device 101 and the detected device.
[0022]
[When link establishment control is not performed]
FIG. 3 is a flowchart illustrating an operation example of the wireless communication apparatus 101 when link establishment control is not performed, and FIG. 4 is a case where link establishment control of the wireless communication apparatus (for example, 103, the same applies to other wireless communication apparatuses) is not performed. 3 is a diagram showing a sequence example of FIG.
[0023]
When the power is turned on, the wireless communication apparatus 101 starts a communication program (S101), permits the wireless section of the apparatus to receive a request signal (S102), and waits for reception of a connection request signal (S103). ). The radio unit permitted to receive the request signal repeats the request signal receiving operation at predetermined time intervals according to the parameters included in the permission signal.
[0024]
On the other hand, when the power is turned on (S401), the wireless communication apparatus 103 starts up a communication application program (hereinafter, referred to as “communication AP”) (S402). When the communication AP starts up, the user instructs to switch the mode of the communication AP to a mode for performing link establishment control of the wireless communication apparatus 101 (setup instruction, S403).
[0025]
The wireless communication apparatus 103 that has received the communication AP mode switching instruction first sets up its own wireless unit (consisting of a communication program and a wireless module) (S404), and then, sets up the wireless communication apparatus within the communication area. An instruction to transmit an inquiry signal is sent to the wireless unit in order to search for (terminal search request, S405).
[0026]
The wireless unit instructed to transmit the inquiry signal transmits the inquiry signal to the wireless transmission path for a predetermined time (Inquiry, S406), and receives a response signal from the wireless communication device in the communication area (Inquiry response, S407). ). Then, the wireless unit that has received the response signal from the wireless communication device in the communication area transfers the search result to the communication AP (search result response, S408). The communication AP temporarily stores the received search result in a RAM or the like of the wireless communication device 103 and displays the search result on the monitor screen 201 of the control terminal 103 (S409).
[0027]
The user refers to the display of the search result, selects the wireless communication device 101, and instructs to establish a link (communication device selection connection instruction, S410). The communication AP having received the connection instruction instructs the wireless unit to connect to the wireless communication device 101 (S411). The wireless unit instructed to connect transmits a connection request signal to wireless communication apparatus 101 (S412).
[0028]
Upon receiving the connection request signal from the wireless communication device 103, the wireless communication device 101 causes the wireless unit to transmit a connection response signal (S104), and then determines whether there is a response from the wireless unit indicating that a physical link has been established. It is determined (S105). If there is no response, it is determined whether or not the time for waiting for the response has elapsed (S106). If the waiting time has not elapsed, the process returns to step S105. This operation is repeated until a response is received or the waiting time has timed out.
[0029]
Upon receiving a response indicating that the physical link has been established, the wireless communication apparatus 101 causes the wireless unit to transmit a request for an authentication code for establishing a link of a higher-level communication protocol (S107). It is determined whether or not the reception has been performed (S108). If not, it is determined whether or not the time for waiting for the reception has elapsed (S109). If the waiting time has not elapsed, the process returns to step S108. This operation is repeated until an authentication code is received or the waiting time expires. If a timeout occurs, the wireless communication apparatus 101 instructs the wireless unit to disconnect the physical link (S110).
[0030]
On the other hand, in the wireless communication apparatus 103, when a physical link is established and a request for an authentication code is received (S413), the communication AP displays an ID and password input request on the monitor screen 201 (S414). In response to this display, the user inputs an ID and a password set in advance with the wireless communication apparatus 101 (S416). The input ID and password are sent to the communication AP (S417), and the communication AP instructs the wireless unit to transmit an authentication code (S418), and the wireless unit transmits the authentication code to the wireless communication device 101.
[0031]
Upon receiving the authentication code, the wireless communication device 101 performs authentication (S111). If the relationship between the ID and the password matches, the wireless communication device 101 performs setup processing of a higher-level protocol including an authentication confirmation response with the wireless communication device 103 ( Then, data communication is performed (S113). This data communication is continued until it is determined that the link disconnection request has been received (S114), and when the link disconnection request has been received, the link is disconnected (S115). If the relationship between the ID and the password does not match in the authentication, the wireless communication apparatus 101 instructs the wireless unit to disconnect the physical link (S110).
[0032]
When the authentication of the wireless communication device 101 is obtained, the wireless module of the wireless communication device 103 sends an authentication completion notification to the communication program (S419). The communication program that has received the authentication completion notification performs setup processing of a higher-level communication protocol (S420), and sends a connection completion notification to the communication AP when setup is completed (S421). The communication AP that has received the connection completion notification displays the connection completion on the monitor screen 201 (S422).
[0033]
With the above, the connection between the wireless communication apparatuses 101 and 103 is completed, and subsequently, the communication through the wireless network becomes possible, for example, by acquiring an IP address by a DHCP (Dynamic Host Configuration Protocol) according to a general communication procedure. Of course, the upper communication protocol is not limited to TCP / IP, but may be another communication protocol, and the IP address is not limited to acquisition by DHCP.
[0034]
[When performing link establishment control]
FIGS. 5 and 6 are flowcharts showing an operation example when the wireless communication apparatus 101 performs link establishment control, and FIG. 7 is a diagram showing an example of a sequence under activation of a link establishment control function and under link establishment control.
[0035]
When the link between the wireless communication devices 101 and 103 is established, the user of the wireless communication device (control terminal) 103 starts a Web browser (S521) and accesses the link control function of the wireless communication device 101 (S522).
[0036]
Upon receiving a request to log in to the link control page from the wireless communication device with which the link has been established (S200), the wireless communication device 101 causes the wireless unit to request an authentication code to log in to the page (S201). It is determined whether or not the authentication code has been received (S202). If the authentication code has not been received, it is determined whether or not the time for waiting for the reception has elapsed (S203). Return to S202. This operation is repeated until an authentication code is received or the waiting time expires. If a timeout occurs, the wireless communication device 101 returns the process to step S200.
[0037]
The control terminal 103 that has received the request for the authentication code displays an input request for an ID and a password on the monitor screen 201. In response to this display, the user inputs an ID and a password that have been set in advance with the wireless communication device 101 (S523).
[0038]
Upon receiving the authentication code, the wireless communication device 101 performs authentication (S204), and if the relationship between the ID and the password matches, activates the link control program (S205) and waits for a control operation instruction from the control terminal 103. Wait (S206). If the relationship between the ID and the password does not match, a signal for rejecting login is transmitted to the wireless unit (S207).
[0039]
The control terminal 103 that has been authenticated by the wireless communication device 101 displays a control screen 202 shown in FIG. First, the user sets the radio button of the control window 203 of the control screen 202 to ON (link establishment control ON), sets the transmission parameter of the inquiry signal in the control window 210, and transmits to transmit the inquiry signal. The button is pressed (S524).
[0040]
When the transmission button is pressed, the wireless communication apparatus 101 instructs the wireless unit to stop receiving the inquiry signal and the connection request signal (S208), and transmits the inquiry signal according to the transmission parameters set in the control window 210. It instructs (S209) and waits for reception of a response to the transmission of the inquiry signal (S210). The wireless unit transmits the inquiry signal to the wireless transmission path, and is in a state of receiving a response from the wireless communication device in the communication area 102.
[0041]
If the wireless communication device 101 receives a response to the inquiry signal from the wireless communication device 105, the wireless communication device 101 stores the registration name and the unique address information of the wireless communication device 105 from the response in a RAM or the like (S211). Further, it is determined whether or not the transmission time of the preset inquiry signal has elapsed (timed out) (S212), and if not, it is determined whether or not the cancel button is instructed by the interruption button of the control window 210 (S212). S213). If the time has not elapsed and the cancel is not instructed, the process returns to step S209. Further, when a timeout occurs or a cancel is instructed, all information of the wireless communication device (hereinafter, referred to as “communication terminal”) that has received (detected) the response is reflected in the control window 205 of the control screen 202 (S214). ). The control screen 202 is updated by the user performing a Web page update operation (S529, S530).
[0042]
Subsequently, when the desired wireless terminal is displayed on the control screen 202 by the update operation (S529, S530) of the control screen 202, the user presses the connection button on the display line of the communication terminal in the control window 205 ( S531).
[0043]
When the connection button is pressed (S215), the wireless communication apparatus 101 performs a link establishment process including the establishment of a physical link with the designated communication terminal (S216). The unique address information and the like are stored as connection terminal information in a RAM or the like, and the connection status is reflected in the link status column 209 of the control window 205 (S217). When the connection with the designated communication terminal is completed and the user performs an update operation of the control screen 202 (S533), the control screen 202 indicating the latest connection state is displayed on the monitor screen 201 of the control terminal 103.
[0044]
Of course, if the user selects another communication terminal and issues a connection instruction, a link with the communication terminal can be established by the above-described series of operations. This operation can be continuously executed until the link establishment control is terminated by a user's instruction (S218). If it is determined that the user has again instructed detection of the communication terminal (S219), the communication control device 101 returns the process to step S208.
[0045]
That is, when the link establishment control program is started in response to a request from the control terminal 103, the link states of all the communication terminals in the communication area 102 and the wireless communication device 101 are controlled (connected or disconnected) by the control screen 202 of the control terminal 103. Will be possible. In other words, in order for the wireless communication devices 104 to 107 other than the control terminal 103 to link to the wireless communication device 101, it is necessary to instruct the wireless communication device 101 to connect the link via the control screen 202 of the control terminal 103.
[0046]
Although an example in which the Web page provided by the wireless communication device 101 is used for the link establishment control has been described, the invention is not limited to this, and the link establishment control can be realized by using a dedicated control program or the like. In addition, the method of instructing connection to communication terminals is not limited to the method of specifying communication terminals one by one, but it is also necessary to specify multiple communication terminals to be connected using radio buttons and check boxes and to instruct connection at once Is also possible, and any instruction method may be adopted.
[0047]
FIG. 8 is a flowchart illustrating an operation example when the link of the communication terminal with which the link has been established under the link establishment control is disconnected for some reason. Possible causes of the link disconnection include deterioration of the radio wave condition, power down of the communication device, a user's temporary disconnection request, and the like.
[0048]
First, in a state where the link establishment control is being performed, when detecting that the link with the communication terminal that established the link is disconnected (S300), the wireless communication apparatus 101 detects the disconnection of the communication terminal (hereinafter, “disconnection”). (Referred to as "terminal") is registered in a RAM or the like (S301), and it is determined whether or not the reception of the connection request signal has been stopped (S302). Is permitted (S303), and reception of a connection request signal is waited (S304).
[0049]
Upon receiving the connection request signal, wireless communication apparatus 101 compares the unique address of the previously registered disconnected terminal with the unique address included in the connection request signal (S305). The connection is refused (S307, specifically, the wireless unit transmits a rejection response to the connection request), and the process returns to step S304.
[0050]
When the unique address of the disconnected terminal and the unique address included in the connection request signal match, the wireless communication apparatus 101 instructs the wireless unit to transmit a connection response signal at the physical link level (S308), and thereafter, the upper layer A link establishment process is performed (S309). When the link establishment process is completed, the registration of the disconnected terminal is deleted (S310), and it is determined whether or not another disconnected terminal is registered (S311). If registered, the process returns to step S304 to wait for reception of a connection request signal.
[0051]
When there are no more disconnected terminals registered, wireless communication apparatus 101 instructs the wireless unit to stop receiving the connection request signal (S312), and returns the process to step S300.
[0052]
Although the same device as the other wireless communication device is used as the control terminal for operating the link establishment control of the wireless communication device 101 and the operation mode of the device is switched, the wired LAN 108 is not limited to this. The device connected to the wireless communication device 101 via the wireless communication device 101 may monitor and control the communication state by using an existing technology such as Simple Network Management Protocol (SNMP).
[0053]
[Modification]
Although the link establishment control of a wireless communication device such as a wireless access point has been described above, the link establishment control is not applied only to the wireless access point. For example, in order to smoothly proceed with a conference, data is temporarily centrally managed by a data processing device (for example, a PC, a workstation, or a server) of a conference system that allows participants of the conference to share materials and the like by communication. It is also possible to apply to a data processing device. In the case of such a data processing device, it is possible for the administrator to directly specify a wireless communication device to which access is permitted and to perform link establishment control. By simply stopping the signal reception, the administrator can obtain the same effect without being conscious of special link establishment control.
[0054]
In the above description, the connection request signal is received only when the unique address of the communication terminal with which the link is already established is registered and the disconnection of the link with the terminal is detected. Is not limited to this, the identification information including the unique address of the communication terminal that is permitted to establish a link is registered in advance, and based on this registration information, the unique address included in the connection request signal received from another communication terminal is registered. When link establishment control is performed by comparing such identification information, it is not necessary to stop receiving the connection request signal.
[0055]
According to the embodiment, under link control, the existence of an access point cannot be recognized from an unspecified number of wireless communication devices, strong security can be ensured, and the operation of receiving a connection request signal is stopped. By doing so, it is possible to prevent unauthorized access from the owner of the wireless communication device who has accessed the access point in the past and has no access right to know the unique address and the ID password.
[0056]
In addition, by stopping the operation of receiving the inquiry signal and the connection request signal, data communication with the wireless communication device with which the link is established is not interrupted, and the overall throughput can be improved.
[0057]
Also, when accepting a link connection request at the access point, it becomes possible to perform connection control at the physical link level from the unique address of the communication terminal selected in advance, and if an authentication key in a higher-level protocol is used illegally. Also unable to establish a link. Therefore, the same security level can be ensured even when calling from the communication terminal is permitted. Further, when a connection request is made from a communication terminal having no access right, the upper-level authentication processing can be omitted, so that connection rejection can be performed at high speed, and the load on the authentication server can be reduced.
[0058]
[Other embodiments]
The present invention can be applied to a system including a plurality of devices (for example, a host computer, an interface device, a reader, a printer, etc.), but may be a device including one device (for example, a copying machine, a facsimile machine, etc.). May be applied.
[0059]
Further, an object of the present invention is to supply a storage medium (or a recording medium) in which a program code of software for realizing the functions of the above-described embodiments is recorded to a system or an apparatus, and a computer (or a CPU or a CPU) of the system or the apparatus. Needless to say, the present invention can also be achieved by an MPU) reading and executing a program code stored in a storage medium. In this case, the program code itself read from the storage medium realizes the function of the above-described embodiment, and the storage medium storing the program code constitutes the present invention. When the computer executes the readout program code, not only the functions of the above-described embodiments are realized, but also an operating system (OS) running on the computer based on the instruction of the program code. It goes without saying that a part or all of the actual processing is performed and the functions of the above-described embodiments are realized by the processing.
[0060]
Further, after the program code read from the storage medium is written into a memory provided in a function expansion card inserted into the computer or a function expansion unit connected to the computer, the function of the program is performed based on the instruction of the program code. It goes without saying that the CPU included in the expansion card or the function expansion unit performs part or all of the actual processing, and the processing realizes the functions of the above-described embodiments.
[0061]
When the present invention is applied to the storage medium, the storage medium stores program codes corresponding to the flowcharts described above.
[0062]
【The invention's effect】
As described above, according to the present invention, security of a communication device that establishes a link in response to a connection request from a communication device in a communication area can be ensured.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration example of a communication system according to an embodiment;
FIG. 2 is a diagram showing an example of a control screen for performing link establishment control of a wireless communication device;
FIG. 3 is a flowchart illustrating an operation example of the wireless communication apparatus when link establishment control is not performed;
FIG. 4 is a diagram showing a sequence example in a case where link establishment control is not performed by the wireless communication apparatus;
FIG. 5 is a flowchart illustrating an operation example of the wireless communication apparatus when performing link establishment control;
FIG. 6 is a flowchart showing an operation example of the wireless communication apparatus when performing link establishment control;
FIG. 7 is a diagram showing an example of a sequence under activation of a link establishment control function and link establishment control;
FIG. 8 is a flowchart illustrating an operation example when a link of a communication terminal to which a link has been established under link establishment control is disconnected for some reason;

Claims (12)

Registration means for registering identification information of the communication device in a memory when the connection with the communication device is disconnected;
A communication processing device for processing a connection request from another communication device based on the identification information registered in the memory. The connection processing means permits a connection request for a communication device corresponding to the identification information registered in the memory, and rejects a connection request for a communication device not corresponding to the identification information registered in the memory. The communication control device according to claim 1. Detecting means for transmitting an inquiry signal to detect a communication device in the communication area when receiving an information request of a communication device in the communication area, and returning information of the detected communication device to the information request; The communication control device according to claim 1 or 2, further comprising: When a predetermined mode is set, a receiving operation for periodically receiving an inquiry signal and a connection request from another communication device is stopped, and processing is performed by the registration unit and the connection processing unit. The communication control device according to any one of claims 1 to 3. The communication control device according to claim 4, wherein when the identification information is registered in the memory, the suspension of the reception operation of the connection request from another communication device is released. The link information is provided to a predetermined communication device, and a link establishment process with another communication device is executed based on a request and an instruction based on the screen information. A communication control device described in any one of the above. A control method for controlling a communication device to perform link control,
A control method characterized by processing a connection request from another communication device based on identification information registered in a memory. The method according to claim 7, wherein a connection request for a communication device corresponding to the identification information registered in the memory is permitted, and a connection request for a communication device not corresponding to the identification information registered in the memory is rejected. Control method. A program for controlling a communication device to realize the control according to claim 7 or 8. A recording medium on which the program according to claim 9 is recorded. Connection means for connecting to another communication device according to the authentication result;
When the connection with the other communication device connected by the connection unit is disconnected, having a registration unit to register identification information of the other communication device,
The communication control device, wherein the connection unit connects to the communication device corresponding to the identification information registered by the registration unit without performing the authentication process. When set to the predetermined mode, it does not respond to an inquiry signal and a connection request signal for searching for a communication device in a communication area sent from another communication device, The communication control device according to claim 11, wherein the identification information of the communication device whose connection has been disconnected during the setting of the communication control device is registered.

Images