JP5037157B2 - Wireless LAN system and security setting method - Google Patents

Description

  The present invention relates to a security setting technique in a wireless LAN system.

With the spread of the Internet in recent years, access points for broadband access such as optical fiber lines and xDSL lines have been installed in various places. In general, an access point and a personal computer are connected by a LAN cable. However, in the case of a notebook personal computer, the location to be used is not fixed.
For this reason, wireless LAN systems are rapidly spreading in businesses and homes due to the low price of wireless LAN devices that connect access points and personal computers wirelessly and the improvement of connectivity through standardization of wireless LAN systems. In particular, it is considered that wireless LANs will become more popular in the future because they are freed from troublesome work places and wiring as compared to wired LANs.

In general, in such a wireless LAN system, an access point having a wireless function and a wireless LAN card that is wirelessly connected to the access point are mounted on a notebook computer (see, for example, Patent Document 1). In addition, while wireless LAN is convenient, if wireless LAN is used without security setting, anyone within the reach of radio waves may be able to intercept communication contents and intrude into the network. Therefore, security setting is necessary (for example, see Non-Patent Document 1).
JP 2005-31658 A “Guidelines for Wireless LAN Security (Revised)” Japan Electronics and Information Technology Industries Association

  However, when the wireless LAN system is used, various initial settings must be performed, which is a big problem for beginners who have difficulty in complicated operations. In particular, in the case of a wireless LAN system in which an access point and a laptop computer are connected wirelessly, even if the wireless LAN system is used indoors, for example, on the first floor and the second floor, the radio wave leaks to the outdoors. It is necessary to perform complicated security settings.

Also, if there are multiple access points, or if you perform wireless LAN security settings from multiple computers at the same time, it will be necessary to shift the time, and it will take time to search for and set the access points. Or could not be searched.
In view of the above problems, an object of the present invention is to enable a wireless LAN system to easily and reliably connect to a wireless LAN access point to be connected even by a user who has no wireless LAN expertise for security settings in a wireless LAN system. To provide a system and security setting method.

A wireless LAN system according to the present invention is an information terminal , a wireless LAN card for a terminal that can be attached to and detached from the information terminal, and a wireless LAN for connecting to the network from the information terminal on which the wireless LAN card for the terminal is mounted . In a wireless LAN system including an access point , a security setting temporary storage unit is provided in the terminal wireless LAN card, and the access point holds security settings for permitting connection of the terminal wireless LAN card A holding unit and an access point control unit that controls connection with the terminal wireless LAN card, and the access point control unit, when the terminal wireless LAN card is attached to the access point, Unique security information stored in advance in the security setting storage Write the set security setting temporary storage unit of the wireless LAN card said terminal, said information terminal has a software for wireless LAN connection to the access point, the software is the security setting temporary storage unit When the terminal wireless LAN card in which the security setting of the access point is written is attached to the information terminal, the security setting written in the security setting temporary storage unit of the terminal wireless LAN card is read and the access is performed. Perform security settings of software for wireless LAN connection to the point, and delete the security settings written in the security setting temporary storage unit of the terminal wireless LAN card after completing the connection to the access point And

The wireless LAN system security setting method according to the present invention includes an information terminal , a terminal wireless LAN card that can be attached to and detached from the information terminal, and a wireless LAN from the information terminal to which the terminal wireless LAN card is attached. In the security setting method of a wireless LAN system comprising an access point for connecting to a network, the terminal wireless LAN card has a security setting temporary storage unit, and in the access point, the terminal wireless LAN card is connected to the access point. When attached to the point, the unique security setting stored in advance is written in the wireless LAN card for the terminal, and the information terminal has software for wireless LAN connection to the access point , , The security of the terminal wireless LAN card If the terminal wireless LAN card to the access point security settings in utility setting temporary storage unit is written is attached to the information terminal, the security written in the security setting temporary storage unit of the terminal radio LAN card Security setting of software for reading the setting and connecting to the access point by wireless LAN, and after completing the connection to the access point, the security setting written in the security setting temporary storage unit of the terminal wireless LAN card It is characterized by deleting .

  According to the present invention, by inserting a wireless LAN card for a terminal into an access point in advance and writing a unique security setting held by the access point in the wireless LAN card for the terminal, security in the wireless LAN system is achieved. Setting can be performed with a simple operation.

(First embodiment)
A first embodiment of a wireless LAN system and a security setting method according to the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram illustrating a configuration example of a wireless LAN system 100. The basic configuration of the wireless LAN system 100 includes an access point 101a connected to an external network via an ADSL line, an AP (access point) wireless LAN card 102a, and a PC (personal computer) wireless LAN card 105. The user uses the notebook personal computer 104 with the PC wireless LAN card 105 attached thereto.

  There may be a plurality of the same devices as the access point 101a and the wireless LAN card for AP 102a. Further, in the present embodiment, assuming a company office, a case will be described in which four access points 101a to 101d placed at various locations in the office are accessed from a notebook personal computer equipped with a PC wireless LAN card 105. Each of the four access points 101a to 101d is provided with four AP wireless LAN cards 102a to 102d and provided with setting buttons 103a to 103d used during installation.

  Similarly to the access point, there may be a plurality of the same devices for the PC wireless LAN card 105. However, in the present embodiment, the case of a single PC wireless LAN card 105 will be described for easy understanding. To do. In this embodiment, an access point ID (identifier) in an IEEE 802.11 series wireless LAN called SSID (Service Set IDentifier) is used, and a combination of 32 alphanumeric characters is possible. By setting this SSID in the access point 101 a and setting the same SSID in the PC wireless LAN card 105, the access point 101 a to which the AP wireless LAN card 102 a is attached and the PC wireless LAN card 105 are set. Communication is possible. Further, in order to realize a secure connection for performing communication with encryption, an encryption key including a serial number (manufacturing number) unique to the access point 101a is determined, and the AP wireless LAN card 102a and the PC wireless LAN card 105 are connected. It is necessary to set the encryption key on both sides.

Next, the configuration of the access point 101a will be described with reference to FIG. Although the access points 101b to 101d have the same configuration as the access point 101a, the SSID, serial number, and encryption key are different.
In FIG. 2, an access point 101a is connected to a telephone line via a modular jack 201 having an RJ-11 shape. The frequency-multiplexed voice signal and the ADSL modulated signal on the telephone line are separated or multiplexed by the splitter 202, and the voice signal such as a call is connected to a telephone, a FAX, or the like via the RJ-11 shaped modular jack 210. The signal is input / output to / from the SW (switch) unit 208 via the ADSL transformer 203 for direct current cut. The ADSL modulation signal separated or multiplexed by the splitter 202 is input / output to / from the xDSL unit 205 via the ADSL transformer 203, and the ADSL modulation / demodulation processing is performed by the xDSL unit 205. The xDSL unit 205 outputs the demodulated data to the ATM processing unit 206, and conversely modulates the data input from the ATM processing unit 206 and outputs it to the ADSL transformer 203.

  The ATM processing unit 206 converts the IP data input from the IP processing unit 207 into ATM cells, and returns the ATM cell demodulated by the xDSL unit 205 to IP data and outputs the IP data to the IP processing unit 207. The ATM processing unit 206 has a processing function of an OAM (Operations, Administration, and Maintenance) cell that provides various network management functions with a special ATM cell.

  The IP processing unit 207 performs OSI model layer 3 or higher processing such as PPP (Point to Point Protocol) termination processing, IP routing processing, and DHCP (Dynamic Host Configuration Protocol) processing. The IP processing unit 207 receives voice data input / output from / to the VoIP (Voice over IP) unit 212, information data input from the MAC processing unit 213, and from the AP wireless LAN card 102a via the wireless LAN control unit 216. The input information data or the like is converted into IP data and output to the ATM processing unit 206. Conversely, the IP data input from the ATM processing unit 206 is converted into voice data or information data, and the VoIP unit 212 and the MAC processing unit, respectively. 213 or the wireless LAN control unit 216 to output to the AP wireless LAN card 102a.

The MAC processing unit 213 performs MAC frame processing (so-called bridge processing) of data input / output with the LAN unit 214. The LAN unit 214 terminates an Ethernet (Ethernet is a registered trademark) frame, and transmits and receives data by connecting to a network terminal connected by a wired LAN cable via an RJ-45 modular jack 215.
The wireless LAN control unit 216 controls the wireless LAN card for AP 102a, and transmits / receives data and setting information to / from the notebook personal computer 104 in which the wireless LAN card for PC 105 is mounted. Data to be transmitted / received to / from the notebook personal computer 104 is input / output to / from the IP processing unit 207, and is transmitted / received to / from an external network via the ADSL line via the route described above. The wireless LAN control unit 216 is connected to the setting memory 217 and the setting button 103a, recognizes that the setting button 103a has been pressed, and executes a predetermined operation described later. In the present embodiment, it is assumed that the security information unique to the access point such as the SSID, serial number, and encryption key described above is stored in the setting memory 217 when the access point is manufactured or shipped from the factory.

  The access point 101a can use an IP phone using the VoIP function described above, and the IP phone is connected to the RJ-11 shaped modular jack 210. The TEL unit 209 terminates the audio signal of the telephone connected to the modular jack 210 and is connected to the VoIP unit 212 via the SW unit 208. When using an IP phone, the switching control unit 211 switches the SW unit to the VoIP unit 212 side, and when using a normal phone, switches to the ADSL transformer 203 side. When the SW unit 208 is switched to the ADSL transformer 203 side, the TEL unit 209 is connected to the ADSL transformer 203 and connected to the telephone line via the splitter 202 and the modular jack 201.

The AC adapter 218 connects the plug 219 to a 100 V AC power source, converts the plug 219 to DC, and supplies the DC power to the power source unit 220. The power supply unit 220 converts the direct current supplied from the AC adapter 218 into each voltage of 12V, 5V, and 3.3V, and supplies it to each unit of the access point 101a.
Next, the configuration of the PC wireless LAN card 105 will be described with reference to FIG. The PC wireless LAN card 105 is connected to the notebook computer 104 via a card bus (CardBus) I / F 301 and operates by being supplied with power from the notebook computer 104. The control unit 305 controls the overall operation of the PC wireless LAN card 105. The control unit 305 stores setting information and security information necessary for operation in the setting memory 306.

  In FIG. 3, the MAC / BB unit 302 performs MAC frame processing and baseband processing on the data input / output to / from the notebook computer 104 connected via the card bus I / F 301, and the baseband modulation / demodulation signal is wirelessly communicated. Input / output to / from the unit 303. The wireless communication unit 303 converts the modulation signal output from the MAC / BB unit 302 into a high frequency signal and radiates a radio wave from the antenna 304. Conversely, the high-frequency signal received by the antenna 304 is converted into a baseband modulation signal by the wireless communication unit 303, demodulated by the MAC / BB unit 302, and output to the personal computer 104 via the card bus I / F 301.

Next, a procedure for performing security setting on the PC wireless LAN card 105 will be described. The flowchart in FIG. 4 shows processing when a card is inserted into the access point 101a.
(Step S401) The wireless LAN card for PC 105 is attached to the access point 101a to be connected, and processing is started.
(Step S402) When the PC wireless LAN card 105 is attached to the access point 101a, it is determined whether or not the attached wireless LAN card is for AP. If it is a wireless LAN card for AP, the process proceeds to step S403. If it is not a wireless LAN card for AP, the process proceeds to step S404.
(Step S403) If it is an AP wireless LAN card, it is recognized as a valid card as it is, and the process proceeds to step 409, where the initial processing at the time of card insertion is terminated, and it operates as a normal access point.
(Step S404) If the mounted wireless LAN card is not a wireless LAN card for AP, it is determined whether or not it is a wireless LAN card for PC. If it is a PC wireless LAN card, for example, a PC wireless LAN card 105, the process proceeds to step S406, and if it is not a PC wireless LAN card, the process proceeds to step S405. That is, if the wireless LAN card is not compatible with the wireless LAN system 100 or the wireless LAN card, the process proceeds to step S405.
(Step S405) If it is not a wireless LAN card or wireless LAN card that is not compatible with the wireless LAN system 100, the card is recognized as an invalid card, the process proceeds to step 409, and the initial process at the time of card insertion is terminated. In this case, the wireless LAN function of the access point 101a does not operate, and only the VoIP function or the LAN function connected to the modular jack 215 by wire operates.
(Step S406) If the card attached to the access point 101a is a PC wireless LAN card, for example, it is confirmed whether or not the security setting is held in the setting memory 306 of the PC wireless LAN card 105. If security settings are not held, the process proceeds to step S407, and if security settings are held, the process proceeds to step S408.
(Step S407) If the security setting is not held, the security setting held in the setting memory 217 of the access point 101a is newly written in the setting memory 306 of the PC wireless LAN card 105.
(Step S408) When the security setting is held, the security setting held in the setting memory 217 of the access point 101a is overwritten with the security setting held in the setting memory 306 of the PC wireless LAN card 105.
(Step S409) The initial process at the time of card insertion is terminated.

  In this way, by holding the security setting held in the setting memory 217 of the access point 101a in the setting memory 306 of the PC wireless LAN card 105, the PC wireless LAN card 105 establishes a security connection with the access point 101a. be able to. Note that even if another PC wireless LAN card that has not been set security or a PC wireless LAN card that has other access point security settings connected to the access point 101a, the security settings are different, so the security connection Can not do it. However, in this case, it is possible to connect without security.

Next, processing when the PC wireless LAN card 105 is mounted on the notebook computer 104 will be described. The flowchart in FIG. 5 shows processing when the PC wireless LAN card 105 is inserted into the notebook computer 104.
(Step S501) The notebook personal computer 104 is turned on and started up.
(Step S502) The PC wireless LAN card 105 is attached to the notebook computer 104.
(Step S503) A CD-ROM in which software for wireless LAN connection is written is set in the notebook computer 104.
(Step S504) The notebook personal computer 104 recognizes that the CD-ROM has been set, and the installation software automatically starts up and installs the necessary driver software on the PC wireless LAN card 105.
(Step S505) When the driver installation is completed, the utility is automatically installed.
(Step S506) When all the software necessary for using the PC wireless LAN card 105 is installed, it is confirmed whether or not the security setting is held in the attached wireless LAN card. If the security setting is retained, the process proceeds to step S507. If the security setting is not retained, the process proceeds to step S509.
(Step S507) If security settings are held in the PC wireless LAN card 105, the security is automatically set. That is, when the security setting is held in the PC wireless LAN card 105, the access point having the same security setting as the held security setting is connected among the peripheral access points capable of wireless communication. In this embodiment, since the security setting held in the setting memory 217 of the access point 101a is the same as the security setting held in the setting memory 306 of the PC wireless LAN card 105, the PC wireless LAN card 105 is the access point. A security connection is made to 101a.
(Step S508) When the security connection is established to the access point 101a, the security setting held in the setting memory 306 of the PC wireless LAN card 105 is deleted, and the connection process is terminated in Step S512.
(Step S509) When the security setting is not held in the setting memory 306 of the PC wireless LAN card 105, it is confirmed on the screen of the notebook personal computer 104 whether or not the security setting is made to the user. If the user selects to set security, the process proceeds to step S510. If the user selects not to set security, the process proceeds to step S511.
(Step S510) When the user selects to set security, the conventional security setting is executed. In other words, the four access points 101a to 101d are searched in the order of strong radio waves, and when an access point to be connected is detected, one of the setting buttons 103a to 103d of the access point to be connected by security is pressed manually. Configure security settings. Alternatively, the user is prompted to manually input the security setting value of the access point to be secured. Here, for example, when the user presses the setting button 103a of the access point 101a, the PC wireless LAN card 105 is security-connected to the access point 101a. Alternatively, when the security setting value of the access point 101a is input on the setting screen of the notebook computer 104, the security setting value is sent to the access point 101a, and the PC wireless LAN card 105 and the access point 101a are connected by security.
(Step S511) If the user selects not to set security, the user is connected to one of the four access points without security.
(Step S512) The connection process is terminated.

  As described above, when the PC wireless LAN card 105 is attached to the notebook computer 104 and a CD-ROM in which software for wireless LAN connection is written is set, necessary software is automatically installed, and the PC wireless LAN is installed. When the security setting is held in the card 105, the security is automatically set, and the PC wireless LAN card 105 is connected to the access point 101a by security.

  That is, as described with reference to FIG. 4, the PC wireless LAN card 105 is mounted in advance on the access point 101a, and the security setting of the access point 101a is temporarily stored in the setting memory 306 of the PC wireless LAN card 105. Thus, the user does not need to perform a complicated operation of inputting a meaningless symbol such as an SSID or an encryption key. That is, communication with established security can be easily performed without specialized knowledge regarding security settings.

  In addition, when the security setting is held in the PC wireless LAN card 105, the access point is connected to an access point having the same security setting as the held security setting among the peripheral access points capable of wireless communication. Even when there are multiple access points, there is no need to spend time searching or setting access points as in the past, and even if you perform wireless LAN security settings from multiple computers at the same time. The wireless LAN access point to be connected can be easily and reliably connected in a short time.

  In particular, for example, when a security connection is established to the access point 101a, the security setting held in the setting memory 306 of the PC wireless LAN card 105 is deleted, so that a malicious third party can remove the PC wireless LAN card 105. Even if it is taken out and installed in another personal computer, the security setting is not retained, so the security setting is required again, and it is possible to prevent the third party from impersonating and accessing the access point 101a.

  In the above embodiment, the terminal connected to each access point has been described as the personal computer 104, but it is not necessary to be a personal computer. For example, in a network home appliance in which a USB-compatible wireless LAN terminal is mounted on various home appliances instead of the PC wireless LAN card 105 and connected to a network, an access point (USB) to which a USB-compatible wireless LAN terminal is to be connected in advance By connecting to a wireless LAN terminal with USB interface and writing the security settings of the access point to a USB-compatible wireless LAN terminal, users without wireless LAN expertise can easily and securely connect home appliances to the network. Can do.

1 is a block diagram illustrating a configuration example of a wireless LAN system 100 according to a first embodiment. It is a block diagram which shows the structure of the access point 101a. 2 is a block diagram showing a configuration of a PC wireless LAN card 105. FIG. It is a flowchart which shows a process when a card | curd is inserted in the access point 101a. 6 is a flowchart showing processing when the PC wireless LAN card 105 is attached to the notebook computer 104;

Explanation of symbols

100 ... Wireless LAN systems 101a, 101b, 101c, 101d ... Access points 102a, 102b, 102c, 102d ... AP wireless LAN cards 103a, 103b, 103c, 103d ... Setting buttons 104 ... Notebook PC 105 ... PC wireless LAN cards 201, 210 ... RJ-11 shaped modular jack 202 ... Splitter 203 ... ADSL transformer 205 ... xDSL unit 206 ... ATM processing unit 207 ..IP processing unit 208 ... SW unit 209 ... TEL unit 211 ... switching control unit 212 ... VoIP unit 213 ... MAC processing unit 214 ... LAN unit 215 ... RJ-45 Modular jack 216 of shape ... Wireless LAN card control unit 217 ... Setting memory 218... AC adapter 220... Power supply unit 301... Card bus I / F 302... MAC / BB unit 303 .. wireless communication unit 304. ... Setting memory

Claims (2)

In a wireless LAN system comprising: an information terminal; a terminal wireless LAN card that can be attached to and detached from the information terminal; and an access point for connecting to the network via a wireless LAN from the information terminal in which the terminal wireless LAN card is mounted ,
The terminal wireless LAN card is provided with a security setting temporary storage unit,
The access point is
A security setting holding unit for holding security settings for permitting connection of the terminal wireless LAN card;
An access point control unit for controlling connection with the terminal wireless LAN card;
Have
When the terminal wireless LAN card is attached to the access point, the access point control unit sets a unique security setting previously held in the security setting holding unit to the security setting temporary of the terminal wireless LAN card. I write in the storage unit,
The information terminal
Having software for wireless LAN connection to the access point;
The software, when the terminal wireless LAN card in which the security setting of the access point is written in the security setting temporary storage unit is attached to the information terminal, the security setting temporary storage unit of the terminal wireless LAN card The security setting written in is read out, the security setting of the software for connecting to the access point by wireless LAN is performed, and after the connection to the access point is completed, the security setting temporary storage unit of the terminal wireless LAN card is stored. A wireless LAN system, wherein a written security setting is deleted . Security of a wireless LAN system comprising: an information terminal; a terminal wireless LAN card that can be attached to and detached from the information terminal; and an access point for connecting to the network via a wireless LAN from the information terminal on which the terminal wireless LAN card is mounted In the setting method,
The terminal wireless LAN card has a security setting temporary storage unit,
In the access point, when the terminal wireless LAN card is attached to the access point, a unique security setting stored in advance is written in the terminal wireless LAN card,
The information terminal has software for connecting to the access point via a wireless LAN, and the software stores the security setting of the access point in the security setting temporary storage unit of the wireless LAN card for the terminal. Security setting of software for reading the security setting written in the security setting temporary storage section of the terminal wireless LAN card and connecting to the access point by wireless LAN when the wireless LAN card for use is attached to the information terminal And deleting the security setting written in the security setting temporary storage section of the terminal wireless LAN card after completing the connection to the access point .

Images