JP5747194B2 - Wireless access point with high connectivity and its program - Google Patents

Description

  The present invention relates to a wireless master device (hereinafter referred to as an access point) and a program thereof in a wireless network, and in particular, can efficiently manage information related to a wireless slave device (hereinafter referred to as a wireless client). About things.

  With the rapid spread of wireless LAN networks in recent years, not only typical wireless LAN devices such as PCs but also various electronic devices such as mobile phones and PDAs are used as wireless clients. On the other hand, security awareness has improved along with the spread, and it has become common sense that wireless communication that is relatively easy to intercept by a third party is encrypted.

  FIG. 1 is an overall system diagram of a general wireless LAN network. The access point 101 manages a plurality of wireless clients 102 as slave units, and the wireless client 102 can communicate with other wired network devices (not shown) via the access point 101.

  Although only three wireless clients 102 are shown in the drawing, more wireless clients 102 can connect to the access point 101 in an actual wireless LAN network.

  As described above, the communication between each wireless client 102 and the access point 101 is normally encrypted by a predetermined encryption algorithm. Hereinafter, this point will be described in detail.

  FIG. 2 is an example of a table of encryption keys managed by the access point 101. This table is stored in a storage area (not shown) such as a memory provided in the access point 101, and numerals 0 to 7 indicate blocks on the storage area.

  The access point 101 manages the encryption key for each wireless client. In this figure, encryption keys for six wireless clients (described as STAs in the figure) 01 to 06 are managed. CCMP and TKIP shown in the figure indicate encryption key algorithms to be used.

  Based on each encryption key stored in this encryption key table, communication between the access point 101 and each wireless client 102 is separately encrypted.

  Thus, although the encryption key is managed in the storage area of the access point 101, the number that can be managed is not infinite.

  As shown in FIG. 2, the number of encryption keys that can be managed by the access point 101 is finite. Specifically, it depends on the number of blocks of the secured encryption key table, that is, the capacity of the storage area of the access point allocated for storing the encryption key table.

  Therefore, the number of wireless clients 102 that can be connected to the access point 101 is actually dependent on the capacity of the storage area at the present time when encrypted communication is commonplace.

  For example, in the case of the encryption key table shown in FIG. 2, there are 8 blocks 0 to 7, in which the encryption keys of 6 wireless clients are stored. STA01 to STA05 use CCMP encryption keys, and each uses one block. On the other hand, STA06 uses a TKIP encryption key, and uses two blocks, block 5 and block 6.

  Thus, the number of blocks consumed may vary depending on the type of encryption key used. Furthermore, the TKIP shown in the figure requires not only two blocks but also a continuous block. However, the conditions such as blocks required for the encryption key may differ depending on the access point. This is because such a condition is a part that can be designed independently by the vendor and is not defined by a standard or the like. In other words, another encryption key, for example, CCMP may require two blocks.

  By the way, the encryption key stored in the encryption key table is stored while the connection between the access point 101 and the wireless client 102 is held. Therefore, when communication with the wireless client 102 is disconnected, the encryption key corresponding to the wireless client is deleted from this table. The block from which the encryption key is deleted becomes an empty block, and the encryption key for other wireless clients can be stored.

  FIG. 3 is an example of an encryption key table in which such an empty block has occurred. In the case of this figure, since the communication between STA02 and STA04 has been disconnected, the encryption keys of block 1 and block 3 are deleted and become empty blocks. In addition to the block 7 which was an empty block from the beginning, the block 1 and the block 3 can be newly used.

  In this way, the access point 101 reuses the encryption key table, but such operation has the following problems.

  FIG. 4 shows such a problem. As is clear from the figure, when trying to register an encryption key that requires a plurality of consecutive blocks like TKIP, the encryption key cannot be registered in the table even if there are many empty blocks. Sometimes. The reason is that the access point encryption key table has become fragmented and empty blocks have become discrete due to repeated wireless client connection disconnection processing. That is, even if the necessary number of free blocks is satisfied, if they are not continuous, an encryption key such as TKIP cannot be registered. Due to this limitation, the number of wireless clients 102 that can be connected to the access point 101 depends not only on the type of encryption key used but also on the fragmentation status of the encryption key table. I had it.

  On the premise that there is such a problem, Patent Document 1 discloses an invention in which many wireless clients 102 can be connected to an access point 101.

The access point disclosed in JP 2006-279601 A further includes an external memory as well as an internal memory that is normally provided, and the number of connectable wireless clients can be determined by registering an encryption key in both of them. It is about increasing.

  However, in the case of the present invention, not only an internal memory but also an external memory is required, and there is a problem that the product cost increases.

  The present invention solves this problem. In other words, even in an environment where a large number of wireless clients are frequently connected and disconnected, an access point and program for efficiently managing communication parameters such as encryption keys are provided without requiring additional resources. The purpose is to do.

  In the first aspect of the present invention, whether or not to perform the fragmentation elimination processing based on the parameter storage area for storing parameters for each wireless client connected to itself and the fragmentation state of the parameter storage area When the fragmentation elimination processing judgment means judges that the fragmentation elimination processing is to be performed, at least a wireless client can receive the data, and a predetermined time is specified and a communication suppression request is sent to the wireless client during that time. A wireless access point comprising: a communication suppression request transmitting means for performing, and a fragmentation resolving means for performing a fragmentation resolving process for the parameter storage area within a specified predetermined time when a communication suppression request is transmitted.

  Preferably, the wireless access point further comprises a fragmentation elimination time estimation means for estimating a time required for the fragmentation elimination means to eliminate the fragmentation of the parameter storage area, and the communication suppression request transmission means The predetermined time designated by the communication to be transmitted is based on the time estimated by the fragmentation elimination time estimation means.

  Preferably, the parameter is an encryption key for encrypting communication with the wireless client.

  According to a second aspect of the present invention, a wireless access point is stored on the basis of a parameter storage area for storing parameters for each wireless client connected to the wireless access point, and the fragmentation state of the parameter storage area. A fragmentation elimination process judging means for judging whether to perform the elimination process, and if it is judged that the fragmentation elimination process is to be carried out, it can be received at least by the wireless client, and the wireless client is communicated during the specified time. It functions as a communication suppression request transmission means for transmitting a communication suppression request to be suppressed, and a fragmentation elimination means for performing a fragmentation elimination process for the parameter storage area within a specified time when a communication suppression request is transmitted. It is a program.

  Preferably, the program further causes the wireless access point to function as a fragmentation elimination time estimation means for estimating a time required for the fragmentation elimination means to eliminate the fragmentation of the parameter storage area, and to perform communication. The predetermined time specified in the communication transmitted by the suppression request transmission unit is based on the time estimated by the fragmentation elimination time estimation unit.

  Preferably, the parameter is an encryption key for encrypting communication with the wireless client.

  The access point according to the present invention eliminates the storage area of communication parameters such as an encryption key, if necessary, if necessary. At that time, by suppressing in advance communication performed from the wireless client to itself, fragmentation can be eliminated without hindering communication with the connected wireless client. As a result, the communication parameter storage area is efficiently used. The effect that it can be used is produced. Furthermore, since the wireless client is preliminarily estimated and notified to the wireless client, the influence on the communication performance of the wireless client can be reduced.

Embodiments according to the present invention will be described below with reference to the drawings.
[Example]
[System overview]

Since the entire system according to the present invention is the same as that of FIG. The apparatus according to the present invention is the access point 101.
[Function block diagram]

  FIG. 5 is a functional block diagram of the access point 101.

  The encryption key table storage unit 501 is a storage area such as a RAM, and is a unit for storing the encryption key table described with reference to FIG.

  The fragmentation elimination processing determination unit 502 is a unit that acquires the fragmentation status of the encryption key table stored in the encryption key table storage unit 501 and determines whether to eliminate fragmentation based on the status. Specifically, a predetermined threshold value is set for the parameter relating to the fragmentation status, and when it is satisfied, it is determined that the fragmentation elimination process is executed.

  The fragmentation elimination time estimation means 503 is a means for estimating the time required for the fragmentation elimination means 505 described later to eliminate fragmentation of the encryption key table.

  The communication suppression request transmission unit 504 is a unit that operates when the above-described fragmentation elimination processing determination unit 502 determines that fragmentation is to be eliminated. Specifically, during the time estimated by the fragmentation elimination time estimation means 503 described above, a request for suppressing communication with itself from the wireless client 102 is transmitted. By transmitting this request, even if there is a wireless client 102 connected to itself, fragmentation of the encryption key table can be eliminated while keeping the influence on encrypted communication with the wireless client 102 low. That is, encrypted communication can be continued without any problems before and after the fragmentation elimination processing.

  The request for the wireless client 102 to suppress communication is, for example, a CTS frame (CTS-to-self) in the IEEE 802.11 standard. This CTS frame is transmitted to itself, but is also received by the wireless client 102. FIG. 6 shows the format of this CTS frame, and the above-described suppression time is designated in the duration field. That is, in the present invention, the time estimated by the fragmentation elimination time estimation means 503 is specified in this duration field. On the other hand, the wireless client 102 that has received this frame postpones transmission during fragmentation elimination, that is, during the time specified in the duration field.

The fragmentation elimination unit 505 is a unit that eliminates fragmentation of the encryption key table and secures an empty capacity (an empty block) of the encryption key table. For example, when there is the encryption key table shown on the right side of FIG. 3, as shown in FIG. 7, the processing is such that the block in use is packed in front of the address. By doing so, it is possible to secure an empty block in which a plurality of blocks are continuous, and it becomes possible to newly register an encryption key such as TKIP.
[Operation flow]

  FIG. 8 is an operation flow of the access point 101.

  In step 801, the fragmentation status of the encryption key table stored in the encryption key table storage unit 501 is acquired.

  In step 802, it is determined whether to eliminate fragmentation based on the acquired fragmentation status. If it is determined that it will be resolved, the process proceeds to the next step, and if not, it returns to step 801.

  In step 803, the time required for the fragmentation elimination process is estimated.

  In step 804, a communication suppression request designating the estimated fragmentation elimination time is transmitted.

In step 805, fragmentation elimination processing is executed.
[Summary]

The access point according to the present invention eliminates the storage area of communication parameters such as an encryption key, if necessary, if necessary. At that time, by suppressing in advance communication performed from the wireless client to itself, fragmentation can be eliminated without hindering communication with the connected wireless client. As a result, the communication parameter storage area is efficiently used. The effect that it can be used is produced. Furthermore, since the wireless client is preliminarily estimated and notified to the wireless client, the influence on the wireless client communication performance can be suppressed to a low level.

Overall system diagram Encryption key table Encryption key table with free blocks Free block reuse Functional block diagram of access point CTS frame format Encryption key table after defragmentation Access point operation flow

501 Encryption key table storage unit 502 Fragmentation elimination processing determination unit 503 Fragmentation elimination time estimation unit 504 Communication suppression request transmission unit 505 Fragmentation elimination unit

Claims (6)

A parameter storage area for storing parameters for each wireless client connected to itself;
A fragmentation elimination process determining means for determining whether to perform the fragmentation elimination process based on the fragmentation state of the parameter storage area;
When it is determined that the fragmentation elimination process is performed, a communication suppression request transmission unit that transmits a communication suppression request that can be received by at least the wireless client and specifies a predetermined time and suppresses communication during the period of the specified time;
When the communication suppression request is transmitted, fragmentation elimination means for performing fragmentation elimination processing of the parameter storage area within the specified predetermined time;
Wireless access point comprising. The wireless access point further includes:
Fragmentation elimination time estimation means for estimating the time required for the fragmentation elimination means to eliminate fragmentation of the parameter storage area,
The predetermined time specified in the communication transmitted by the communication suppression request transmission unit is based on the time estimated by the fragmentation elimination time estimation unit.
The wireless access point according to claim 1. The parameter is an encryption key for encrypting communication with the wireless client.
The wireless access point according to claim 1 or 2, characterized by the above. Wireless access point
A parameter storage area for storing parameters for each wireless client connected to the wireless access point;
A fragmentation elimination process determining means for determining whether to perform the fragmentation elimination process based on the fragmentation state of the parameter storage area;
When it is determined that the fragmentation elimination process is performed, a communication suppression request transmission unit that transmits a communication suppression request that can be received by at least the wireless client and specifies a predetermined time and suppresses communication during the period of the specified time;
When the communication suppression request is transmitted, fragmentation elimination means for performing fragmentation elimination processing of the parameter storage area within the specified predetermined time;
Program to make it work. The program further includes:
Wireless access point
The defragmentation means functions as a defragmentation time estimation means for estimating the time required for defragmenting the parameter storage area;
The predetermined time specified in the communication transmitted by the communication suppression request transmission unit is based on the time estimated by the fragmentation elimination time estimation unit.
The program according to claim 4. The parameter is an encryption key for encrypting communication with the wireless client.
The program according to claim 4 or 5, characterized by the above.