JP2006005398A - Access point, wireless lan connection method, medium for recording wireless lan connection program, and wireless lan system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology of attaining newly additional entries of terminals for utilizing a wireless LAN with a simple method while preventing leakage of data representing an encryption key. <P>SOLUTION: A side of an access point 20 stores first ID data and stores second ID data corresponding to a USB key 30 as an external storage device in pairs with the access point 20, connects the USB key 30 to a terminal 50 of the wireless LAN to allow the terminal 50 to transmit subscription instruction data being a connection request together with the ID data in compliance with the wireless LAN standards, the side of the access point compares the ID data stored in advance with the ID data included in the subscription instruction data (step S240 (not shown)), and continues the connection procedure only when the ID data are coincident, then the security can be enhanced while the simplicity is maintained. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an access point, a wireless LAN connection method, a medium recording a wireless LAN connection program, and a wireless LAN system.

  In recent years, an access point, which is a wireless LAN repeater, is a device for connecting a plurality of computers at distant locations to the Internet, where a specific person such as a home or office continuously operates (hereinafter referred to as a private space). As well as hotels, airports, shopping streets, parks, stations, and other places where a large number of unspecified people are temporarily active (hereinafter referred to as public spaces). For example, an access point is connected to a broadband line that realizes a high-speed Internet connection service such as an xDSL line or a CATV line, and is placed in a public space so that a radio wave transmitted from the access point can reach (wireless communication area) A service has been proposed that provides a space (hereinafter referred to as a free spot) that can be freely connected to the Internet for an unspecified number of people inside. That is, the broadband line to which the public space manager is subscribed is opened to a terminal owned by the public space user using a wireless LAN access point. Thereby, the convenience of the internet connection by a user increases, and utilization promotion of a public space can be aimed at.

  In such a free spot, the authority to connect to the Internet via the wireless LAN in the wireless communication area may be granted only to a limited person (for example, a customer). It was necessary to prevent unauthorized entry into the network by humans. In addition, in free spots where many people gather, radio waves frequently fly between the terminals owned by each person and the access point, so in order to fully protect the privacy of many people, There was a need to reliably prevent communication contents from leaking to a third party due to interception of radio waves in the wireless communication area.

On the other hand, regarding wireless LANs, various security techniques have been proposed for preventing unauthorized entry into a network and leakage of communication contents to a third party. For example, a MAC (Media Access Control) address, which is a unique identification number assigned in advance to a wireless LAN connection device (for example, a wireless LAN adapter) attached to a terminal, is used, and this MAC address is registered in an access point. In addition, the access point authenticates the MAC address with the access from the terminal, and if the MAC address is other than the registered MAC address, a technique for rejecting a connection request to the network from the terminal (hereinafter referred to as MAC) Address restriction) has been proposed (see, for example, Patent Document 1). In addition, a WEP (Wired Equivalent Privacy) key is set as a common encryption key in the terminal and the access point, and the content of data exchanged between the terminal and the access point is encrypted using the WEP key. Even if the data leaks, a technique (hereinafter referred to as WEP encryption) that makes it difficult to analyze the contents of the data and prevents the contents of the data from being known has also been proposed (see, for example, Patent Document 2).
JP 2001-320373 A Therefore, in order to realize a free spot in which security is ensured, prior to the use of the free spot, the MAC address registration and the WEP key are set for each terminal of the person who intends to use the free spot. It was necessary to set up.

  However, in the conventional security technology described above, registration of the MAC address to the access point and setting of the WEP key to the terminal must be performed manually, and a new terminal using a wireless LAN is to be added. There is a problem that it is complicated and inconvenient. In particular, in the free spot provided in the public space, there are many people who want to use the free spot, and it gradually increases. It is extremely inconvenient and impractical to impose terminal operations related to MAC address registration and WEP key setting as a condition for using a free spot for many terminal owners.

  In addition, in order to set a WEP key set using an arbitrary character string on the terminal side also on the access point side, it is set using a wireless LAN, that is, WEP key data is transmitted from the terminal to radio waves. It is reasonable that the access point that is placed and wirelessly transmitted to the access point sets the WEP key for the terminal. This is because the terminal owner can use various services (for example, Internet connection) via the wireless LAN immediately after transmitting the WEP key. When the WEP key is transmitted wirelessly in this way, the WEP key may be leaked to a third party due to the interception of radio waves between the terminal and the access point. In this case, a third party who has the leaked WEP key can analyze all data exchanged between the terminal set with the WEP key and the access point to know the contents of the data. In this case, the security system based on encryption will not function. In particular, in the free spot access point, WEP keys are set for the terminals of a large number of persons who want to use the free spots. Therefore, leakage of the WEP keys can be sufficiently prevented, and communication of a large number of users can be prevented. It is necessary to ensure confidentiality.

  In addition to general-purpose computers such as personal computers, home appliances and the like are being connected to a home network to enable various controls. However, if a wireless LAN is adopted to improve convenience, the procedure for setting the WEP key of the access point becomes difficult.

  In view of the above, the present invention solves the above-described problems, and aims to realize a new addition of a terminal using a wireless LAN by a simple method while preventing leakage of data representing an encryption key. Was taken.

In order to achieve the above object, an invention according to claim 1 is an access point connected to a wired LAN, connected to an external wireless LAN terminal based on a predetermined wireless LAN standard, and intervening with the wired LAN. The access point has a pair of external storage devices,
The external storage device includes a communication interface connected to the wireless LAN terminal, and output means for outputting a signal for recognizing that a known disk device is connected to the wireless LAN terminal when the communication interface is connected. The second ID data paired with the first ID data for identification stored in the access point and the second ID data for the wireless LAN terminal that has recognized the connection of the disk device are used. And an automatic execution program storage means for storing an automatic execution program for connecting to the access point,
The access point has the first ID data, and when the wireless LAN terminal executes the automatic execution program and has a connection request, the second ID transmitted along with the connection request. Data is obtained, and the connection with the wireless LAN terminal is performed on condition that the first ID data and the second ID data correspond to each other.

  In the invention according to claim 1 configured as described above, when the access point interposes the connection between the external wireless LAN terminal and the wired LAN, the access point has a pair of external storage devices. The reason is that the first ID data stored in the access point and the second ID data stored in the external storage device have a one-to-one correspondence. The correspondence may be the same data, and various correspondences may be considered, such as matching by performing some operation. Note that the one-to-one correspondence is not necessarily absolute, and it does not deny that the same pair of ID data exists with a very low probability.

  When the external storage device is connected to the wireless LAN terminal here, the output means outputs a signal for recognizing that a known disk device is connected to the wireless LAN terminal via the communication interface, and the stored automatic The executable program is started. This automatic execution program starts processing for connecting to the access point using the second ID data for the wireless LAN terminal that has recognized the connection of the disk device.

  On the other hand, when the wireless LAN terminal executes the automatic execution program and makes a connection request, the access point acquires the second ID data transmitted along with the connection request, and the first ID Connection to the wireless LAN terminal is performed on condition that the data and the second ID data correspond to each other.

  That is, when the external storage device is connected to the external wireless LAN terminal, it is recognized as a disk device and a predetermined automatic execution program is automatically started, and the external storage device and the access point are in a correspondence relationship. Certain ID data is stored, and it is possible to realize approval and encryption / decryption processing using the ID data.

  It is necessary to write the second ID data and the first ID data that have a corresponding relationship in the external storage device and the access point described above. The invention according to claim 2 stores the second ID data in a one-time ROM as a writing area on the external storage device side. In the invention according to claim 3, the second ID data Is stored in the flash ROM.

It is assumed that these second ID data are different for each external storage device, and the above-described one-time ROM and flash ROM are useful as areas for writing different ID data to individual external storage devices.
Various standards for a communication interface for connecting the external storage device to the external wireless LAN terminal can be used. For example, in the invention according to claim 4, the communication interface of the external storage device employs a communication interface based on the universal serial bus standard. In the invention according to claim 5, the communication of the external storage device. The communication interface employs a communication interface based on the Bluetooth standard, and in the invention according to claim 6, the communication interface of the external storage device employs a communication interface based on the IEEE 1394 standard.

  These communication standards are widely standardized and easy to connect, and as described above, by simply recognizing a connection port for communication as a disk device, a predetermined automatic execution program can be executed simply by connection. Can be realized. Of course, the universal serial bus standard is highly standardized and can be connected to virtually any device. The Bluetooth standard provides convenience that is not wired. The IEEE 1394 standard achieves high-speed processing. it can.

Furthermore, the invention according to claim 7 is configured such that when the first ID data receiver acquires the first ID data, the wireless output range is narrowed, and when the connection procedure is completed, the wireless output range is restored. .
In the invention concerning Claim 7 comprised as mentioned above, if an access point acquires said 1st ID data with a 1st ID data receiver, a radio | wireless output range will be narrowed. That is, the acquisition of the first ID data by the first ID data receiver is a precondition that a connection request based on the wireless LAN standard is received, and the security is lowered at the time of such a connection request. However, by narrowing the wireless output range, those who make a connection request must naturally approach the access point sufficiently, and even as an administrator, it can be immediately understood if a suspicious person in security approaches the access point. On the other hand, those that cannot sufficiently access the access point cannot issue subsequent connection requests. Therefore, as a result, by narrowing the wireless output range, those that can physically issue a connection request are limited.

  The access point determines whether or not to make a connection according to the correspondence between the first ID data and the second ID data, but these ID data may be used in addition to the start of a connection request. As an example thereof, in the invention according to claim 8, the external storage device and the access point use the first ID data and the second ID data to encrypt security data during communication based on a wireless LAN standard. It is configured to perform the combination.

  In other words, when it is necessary to send and receive security data during connection request processing, each of the external storage device and the access point has corresponding first ID data and second ID data. Is used for encryption and decryption seeds, security data can be transmitted and received while maintaining a secret state with the outside.

  As described above, the method for starting the connection by using the method outside the wireless LAN standard and the method based on the wireless LAN standard is not necessarily limited to a substantial device, and it is easy to understand that the method also functions. it can. For this reason, the invention according to claim 9 is a wireless LAN connection method of an access point that is connected to a wired LAN, is connected to an external wireless LAN terminal based on a predetermined wireless LAN standard, and intervenes with the wired LAN. Then, the access point has a pair of external storage devices, and when the external storage device is connected to the wireless LAN terminal, it is recognized that a known disk device is connected to the wireless LAN terminal, An automatic execution program for connecting to the access point is executed using the second ID data paired with the first ID data for identification stored in the access point, and the access point When the LAN terminal executes the automatic execution program and makes a connection request, the second ID data sent along with the connection request is stored. Tokushi, it is constituted to carry out the connection between the wireless LAN terminal on condition that the and the first ID data and the second ID data corresponding.

That is, it is not necessarily limited to a substantial apparatus, and there is no difference that the method is also effective.
By the way, such an access point may exist independently, or may be used in a state of being incorporated in a certain device, but the idea of the invention is not limited to this and includes various aspects. Therefore, it can be changed as appropriate, such as software or hardware.

When the access point software is implemented as an embodiment of the idea of the invention, it naturally exists on a recording medium in which such software is recorded, and it must be used.
As an example, the invention according to claim 10 is a wireless LAN connection program for an access point that is connected to a wired LAN, connects to an external wireless LAN terminal based on a predetermined wireless LAN standard, and intervenes with the wired LAN. A recording medium, the access point has a pair of external storage devices, and when the external storage device is connected to the wireless LAN terminal, a known disk device is connected to the wireless LAN terminal. And executing an automatic execution program for connecting to the access point using the second ID data paired with the first ID data for identification stored in the access point. At the point, when the wireless LAN terminal executes the automatic execution program and makes a connection request, it is sent along with the connection request. The second ID data is acquired, and the computer realizes a function of connecting to the wireless LAN terminal on condition that the first ID data corresponds to the second ID data. is there.

  Of course, the recording medium may be a magnetic recording medium, a magneto-optical recording medium, or any recording medium that will be developed in the future. In addition, the duplication stages such as the primary duplication product and the secondary duplication product are equivalent without any question. In addition, even when the communication method is used as a supply method, the present invention is not changed.

Further, even when a part is software and a part is realized by hardware, the idea of the invention is not completely different, and a part is stored on a recording medium and is appropriately changed as necessary. It may be in the form of being read.
When the present invention is implemented by software, a configuration using hardware or an operating system may be used, or may be implemented separately from these. For example, even if it is a variety of arithmetic processing, if it can be processed by calling a predetermined function in the operating system, it can also be input from hardware without calling such a function. is there. It can be understood that the present invention can be implemented with only this program in the process in which the program is recorded and distributed on the medium even though it is actually realized with the intervention of the operating system.

When the present invention is implemented by software, the present invention is not only realized as a medium storing a program, but the present invention is naturally realized as a program itself, and the program itself is also included in the present invention.
Further, it goes without saying that the present invention is not limited to the access point side as described above, and can be used as a wireless LAN system including a wireless LAN terminal.
Therefore, the invention according to claim 11 is an access point that is connected to a wired LAN, is connected to an external wireless LAN terminal based on a predetermined wireless LAN standard, and intervenes with the wired LAN, and the access point. A wireless LAN system including an external storage device and the external wireless LAN terminal,
The external storage device includes a communication interface connected to the wireless LAN terminal, and an output means for outputting a signal for recognizing that a known disk device is connected to the wireless LAN terminal when the communication interface is connected. The second ID data paired with the first ID data for identification stored in the access point and the second ID data for the wireless LAN terminal that has recognized the connection of the disk device are used. And an automatic execution program storage means for storing an automatic execution program for connecting to the access point,
The wireless LAN terminal can execute the automatic execution program and send the second ID data in response to a connection request based on a wireless LAN standard.
The access point has the first ID data, and when the wireless LAN terminal executes the automatic execution program and has a connection request, the second ID transmitted along with the connection request. Data is obtained, and the connection with the wireless LAN terminal is performed on condition that the first ID data and the second ID data correspond to each other.

  As described above, since the present invention uses ID data for approving the correspondence relationship, the external storage device storing the automatic execution program is used as a pair with the access point, thereby preventing a decrease in security. However, it is possible to provide an access point that can start connection by a simple method.

According to the invention of claim 2, the one-time ROM is used, and according to the invention of claim 3, the flash ROM is used, and the individual ID data is relatively easily transferred to the external storage device. Can be written in a nonvolatile manner.
Further, according to the invention according to claim 4, a communication interface based on the universal serial bus standard is adopted, and according to the invention according to claim 5, a communication interface based on the Bluetooth standard is adopted, and the invention according to claim 6 is adopted. Therefore, by employing a communication interface based on the IEEE 1394 standard, the external storage device can be connected to the external wireless LAN terminal easily and reliably.

Further, according to the invention of claim 7, since the wireless output range is narrowed during the connection procedure, the connection procedure cannot be performed unless it is between a limited range of wireless LAN terminals, and security can be improved. it can.
According to the eighth aspect of the present invention, security data can be transmitted and received safely and reliably by wireless communication by performing encryption and decryption using ID data having a corresponding relationship.
Furthermore, according to the invention of claim 9, a wireless LAN connection method having the same effect can be provided, and according to the invention of claim 10, a medium in which a wireless LAN connection program is recorded can be provided. According to the invention, a wireless LAN system can be provided.

In order to further clarify the configuration and operation of the present invention described above, embodiments of the present invention will be described in the following order.


A. First Example A-1. Overview of Encryption Key Setting System LH1 A-2. Contents of processing related to setting of WEP key A-3. Effect B. Summary

A. Example:
A-1. Overview of the encryption key setting system LH1:
FIG. 1 is an explanatory diagram showing a hardware configuration for realizing the encryption key setting system LH1 according to the first embodiment of the present invention, and FIG. 2 is an explanatory diagram showing a configuration of the access point 20.

  In the wireless LAN wireless communication area AR1, the encryption key setting system LH1 wirelessly communicates between the terminal 50 and the access point 20 with key data representing the contents of the WEP key as an encryption key on radio waves. In this system, a WEP key used by the access point 20 is set in the terminal (external wireless LAN terminal) 50.

  As shown in FIG. 1, an access point (wireless base station) 20 that is a wireless LAN repeater is installed in the wireless communication area AR1. As shown in FIG. 2, the access point 20 includes a CPU 11, a ROM 12, a RAM 13, a non-volatile storage device 14 such as a hard disk, a WAN port 17 as a network interface, a wired LAN, and the CPU 11. The LAN port 22, the wireless communication interface 18, the display controller 15, and the input / output controller 16 are provided.

  The ROM 12 stores various programs relating to communication with the terminals 50, 60, and 70 in the wireless communication area AR1 and connection to the Internet IN and data necessary for executing the programs. Here, individual ID data for identification (first ID data) can be written in the ROM 12 and has an ID ROM area 12a for that purpose. As the ID ROM area 12a, a one-time ROM or a flash ROM can be used, and writing is performed by connecting a predetermined electrode to a writing pad (not shown) in a manufacturing process.

The input / output controller 16 is connected to a registration switch (SW) 27 for starting execution of registration processing on the access point side.
FIG. 3 is a schematic block diagram showing a USB key 30 as an external storage device paired with the access point 20. In the figure, a USB device I / F 31 has a universal serial bus (USB) that is a serial standard, and can be connected to a PC that is an external wireless LAN terminal. Access such as data writing and reading from the PC to the USB key 30 is performed via the USB device I / F 31. Hereinafter, connecting the USB key 30 to the PC via the USB device I / F 31 is referred to as USB connection.

  The ROM 33 is chrome provided with a signal program for outputting a pseudo signal for causing the OS to recognize the USB key 30 as a CD-ROM which is one of known disk devices, and an automatic execution program. The pseudo signal from the signal program is output in response to a device setting request from the PC side when the USB key 30 is connected to the USB. After being recognized as a CD-ROM on the PC side, the automatic execution program is activated. The ROM 33 may be built in the CPU 32.

  Unlike the mask ROM 33, the flash ROM 34 has individual ID data (second ID data) corresponding to the individual ID data (first ID data) on the access point 20 side for each USB key 30. ID data) is written. Writing to the flash ROM 34 is performed by connecting a predetermined electrode to a writing pad (not shown) in the manufacturing process. Since it is necessary to manufacture the USB key 30 having an individual correspondence relationship for each individual access point 20, it is preferable to perform writing in the last step of the access point 20 manufacturing process or the step of packing the access point 20.

  The USB connection of the USB key 30 composed of these elements to the PC and processing of the automatic execution program will be described. FIG. 4 is a flowchart showing processing contents executed on the OS side and the USB key 30 side of the PC as the wireless LAN terminal 50 from the USB connection to the activation of the automatic execution program.

  First, when the user inserts into a USB connection port of a running PC (step S100), the OS recognizes that a device is connected to the USB connection port (step S110). The OS that recognizes the device requests a signal for recognizing the type from the device (step S120).

The USB key 30 whose type of device is not recognized from the OS side outputs a signal corresponding to the CD-ROM in response to a request from the OS (step S130).
The OS determines the type of the device connected to the USB connection port based on the signal received from the USB key 30, and recognizes that the device is a CD-ROM (step S140). Specifically, the connected device is recognized as a read-only disk, and a CD-ROM image is mounted.

  Subsequently, the OS mounting the CD-ROM image inquires whether or not the automatic execution program exists in the CD-ROM image (step S150). Upon receiving the inquiry, the USB key 30 transmits a signal indicating the presence of the automatic execution program in the ROM 33 to the OS (step S160).

  The OS that has received the data from the USB key 30 determines whether there is an automatic execution program (step S165). Here, if there is no automatic execution program, the process ends with the device recognized. However, in this embodiment, since the signal indicating the presence of the automatic execution program is transmitted, the OS stores in the ROM 33. This program is loaded and activated (step S170). With the start of the automatic execution program, the processing on the USB key 30 side ends. This automatic execution program is a connection request program for the access point 20 from the external wireless LAN terminal 50 to be described later, and uses the second ID data written in the flash ROM 34 at the time of execution.

  Returning to the access point 20 shown in FIG. 2, the wireless communication interface 18 is connected to a transmitter 25 that transmits radio waves and a receiver 26 that receives radio waves. The transmitter 25 and the receiver 26 are built in the access point 20 in a state where transmission of radio waves to the outside and reception of radio waves from the outside are possible. In FIG. 1, when the output of the transmitter 25 and the reception sensitivity of the receiver 26 are set as standard setting values, the radio wave transmitted from the transmitter 25 arrives and the receiver 26 receives signals from the terminals 50, 60, and 70. A range in which radio waves can be received is represented as a wireless communication area AR1. By installing the access point 20 as described above, a wireless LAN having a normal communication range in the wireless communication area AR1 is established.

  Note that the ROM 12 includes an output value change program in which the contents of processing for temporarily changing the standard setting value of the output of the transmitter 25 are described as a program related to communication with the terminals 50, 60, and 70 and the receiver 26. A reception sensitivity value changing program in which the content of processing for temporarily changing the standard setting value of the reception sensitivity is described is stored in advance. Specifically, the process for changing the set value is realized by an arithmetic process for multiplying the standard set value by 1 / n (n is a predetermined constant). The CPU 11 outputs the changed output value and the reception sensitivity value to the transmitter 25 and the receiver 26 via the wireless communication interface 18 by executing the output value change program and the reception sensitivity value change program. Thereby, the output of the radio wave transmitted from the transmitter 25 and the reception sensitivity of the radio wave in the receiver 26 are changed.

  The terminals 50, 60, and 70 are well-known notebook personal computers, and include a control device including a CPU, a ROM, a RAM, and the like, a hard disk as a storage device, a CD-ROM drive, and the like. Of course, other terminals such as a personal digital assistant may be used. In the present embodiment, the terminals 50, 60, and 70 are personal computers, but they may be realized by home appliances that incorporate a wireless LAN device.

  In addition, wireless LAN adapters 52, 62, and 72 are attached to the terminals 50, 60, and 70 as wireless LAN connection devices that can transmit and receive radio waves to and from the access point 20. When the device drivers of the wireless LAN adapters 52, 62, 72 are incorporated in the terminal 50, the terminals 50, 60, 70 recognize the attached wireless LAN adapters 52, 62, 72, and the wireless LAN adapters 52, 62 , 72 can be controlled. The wireless LAN adapters 52, 62, 72 are assigned MAC addresses that are identification numbers unique to the adapters.

  Terminals 50, 60, 70 as computers that have entered the wireless communication area AR1 are connected to the access point 20 by transmitting and receiving radio waves between the attached wireless LAN adapters 52, 62, 72 and the access point 20. Wireless communication. The access point 20 and the wireless LAN adapters 52, 62, 72 can convert the data to be exchanged into a format suitable for communication, so-called a packet, whereby the terminals 50, 60, 70 and the access point 20 can be converted. It is theoretically possible to exchange data offline (without being connected to the Internet).

  Next, a configuration for connecting the access point 20 to the Internet IN will be described. As shown in FIG. 1, a router 28 with a built-in modem is connected to the WAN port 24 of the access point 20 via a cable. Based on the MAC addresses of the wireless LAN adapters 52, 62, and 72, the router 28 can identify a plurality of terminals 50, 60, and 70 in the wireless LAN and distinguish them.

  The modem in the router 28 is connected to the Internet IN via a broadband communication line CL such as a CATV line or an xDSL line, or a dedicated line of the provider PV. That is, the router 28 functions as a gateway that connects the wireless LAN to the Internet IN.

In this embodiment, among terminals equipped with a wireless LAN adapter owned by a person in the wireless communication area AR1, a terminal whose MAC address is registered in the access point 20 (hereinafter referred to as a registered terminal) is wirelessly connected. Allow connection to LAN. The owner of the registered terminal can connect his / her terminal to the Internet IN through the access point 20 and acquire various information such as web contents stored in the server SV on the Internet IN. On the other hand, a terminal whose MAC address is not registered in the access point 20 (referred to as a non-registered terminal) cannot connect to the wireless LAN even in the wireless communication area AR1. That is, the wireless communication area AR1 is a free spot that provides a connection service to the Internet IN only to the owner of the registered terminal. In FIG. 1, the terminals 50 and 60 correspond to registered terminals, and the terminal 70 corresponds to a non-registered terminal.

  Between such a registration terminal and the access point 20, data having various contents such as contracts and services (hereinafter referred to as data with contents) is transmitted and received on radio waves. In the present embodiment, the device (registration terminal, access point 20) on the side that transmits the data with contents encrypts the data with contents using the encryption key called the WEP key described above before the transmission. The data with contents (hereinafter referred to as encrypted data) is transmitted to the receiving device (access point 20, registration terminal). The receiving apparatus decrypts the received encrypted data using the WEP key to obtain data with contents.

WEP is an encryption technique of a secret key encryption method (a method in which the same encryption key is used for both data encryption and decryption of encrypted data) used in IEEE 802.11. A 64-bit or 128-bit WEP key is used.
With such encryption using the WEP key, when a radio wave carrying data with contents is intercepted in the wireless communication area AR1, it becomes difficult to analyze the data with contents and leakage of communication contents to a third party is prevented. Is prevented. For example, when a contract document including a credit card number is transmitted from the registered terminal to the access point 20, it is possible to prevent the credit card number from being known to a third party due to interception of the transmitted radio wave. .

A-2. Contents of processing related to WEP key setting:
Next, a method for setting the WEP key on the terminals 50 and 60 will be described.
The ROM 12 of the access point 20 stores in advance a program (MAC registration program) related to registration of the MAC address of the wireless LAN adapters 52 and 62 as a program related to communication with the terminals 50 and 60. On the other hand, when the above-described USB key 30 is connected to the terminals 50 and 60 when using the wireless LAN, the above-described automatic execution program is activated. WEP key setting program).

  The contents of the WEP key setting program are executed by the CPUs of the terminals 50 and 60, and the contents of the MAC registration program and the output value changing program are executed by the CPU 11 of the access point 20 as the WEP key setting program is executed. Thus, the security data setting process shown in FIG. 5 is performed. By performing this security data setting process, the MAC addresses of the wireless LAN adapters 52 and 62 are registered in the access point 20, and a common WEP key is set in the access point 20 and the terminals 50 and 60.

  The contents of the security data setting process will be described with reference to FIGS. FIG. 5 is a flowchart showing a security data setting processing routine. FIG. 6 is an explanatory diagram showing a radio wave transmittable range in the transmitter 25 after the output value is changed as a security communication area MR1. In the following description regarding FIG. 5 and FIG. 6, it is assumed that the terminal that is the registration target of ID data or the setting target of the WEP key is the terminal 50.

The security data setting processing routine includes a routine A executed by the CPU on the terminal 50 side and a routine B executed by the CPU 11 on the access point 20 side.
In step S200 of the routine B executed at the access point 20, the CPU 11 detects a push-down operation of the registration switch 27 via the input / output controller 16, and starts the following connection procedure when the operation is detected.
The security communication area MR1 is a range in which radio waves can be transmitted by the transmitter 25 when the standard setting value is temporarily reduced by executing the output value changing program described above (see FIG. 6). ), The installation range RR1 of the terminal 50 connected to the USB key 30 is inside the security communication area MR1.

  Thereafter, the access point 20 changes the operation mode from the normal mode to the registration mode, executes the output value change program described above, and reduces the output value of the transmitter 25 to 1 / n of the standard setting value. Is performed (step S220). Thereby, the range in which the transmitter 25 can transmit radio waves is within the security communication area MR1 shown in FIG. 6, and is narrower than the radio communication area AR1. Therefore, even a registered terminal that is in the wireless communication area AR1 cannot access the access point 20 if it is not in the security communication area MR1.

  Next, the terminal 50 obtains individual ID data stored in the flash ROM 34 together with a unique MAC address in the wireless LAN adapter 52 and gives an instruction to join the wireless LAN (hereinafter referred to as a joining instruction). Processing is performed to transmit to the access point 20 a packet in which the MAC address and ID data are added as header information to the data to be represented (step S180).

  Subsequently, the access point 20 reads the MAC address and ID data from the header information of the received packet, and performs a process of temporarily storing the read MAC address and ID data in the buffer area of the RAM 13 (step S230). At this time, the ID data is stored as second ID data.

  In the subsequent step S240, whether or not the first ID data that is the ID data stored in the ID ROM area 12a matches the second ID data that is the ID data included in the subscription instruction data. Determine whether. If they match, it can be confirmed that the terminal 50 is connected to the paired USB key 30 and the subsequent connection procedure is continued. If they do not match, it is this terminal 50 that has sent out the subscription instruction data 50. It can be determined that it is an unauthorized intruder. At this time, in addition to the first-stage security in the security communication area MR1, the second-stage security of receiving the USB key 30 is also added, and the security can be further improved.

  In such a state where security is ensured, the access point 20 performs processing for transmitting data representing the WEP key to be used (hereinafter referred to as WEP key data) to the terminal 50 (step S250), and the WEP key data is transmitted to the terminal. Processing for determining whether or not the content has been distributed to 50 is performed (step S255). This determination of whether or not the distribution has been made can be realized by using the data return function of the wireless LAN adapter 52 described above. If it is determined that the WEP key data is not distributed to the terminal 50, the MAC address and ID data stored in the RAM 13 are deleted (step S260), and this routine is terminated. Note that the state in which security is ensured is based on the assumption that the first ID data and the second ID data that are individually held between the wireless transmitting and receiving terminals are the same. The data is held by being encrypted or decrypted based on the first ID data and the second ID data.

  On the other hand, when it is determined that the WEP key data has been distributed to the terminal 50, the above-described output value change program is executed to perform processing for returning the output value of the transmitter 25 to the standard setting value (step S270). Thereby, the range in which the transmitter 25 can transmit radio waves is the normal range (wireless communication area AR1), and the registered terminal can access the access point 20 if it is within the wireless communication area AR1.

  Subsequently, the access point 20 performs a process of registering the MAC address of the terminal 50 in the management area of the storage device 14 (step S280), returns the operation mode to the normal mode, and ends this routine. Thereby, the registration of the MAC address related to the terminal 50 on the access point 20 side is completed.

  On the other hand, the terminal 50 that has received the WEP key data in the process of step S250 performs a process of automatically setting the WEP key in association with the IP address of the access point 20 (step S190), and ends this routine. Thereby, the setting of the WEP key related to the access point 20 on the terminal 50 side is completed. Thereafter, encrypted data obtained by encrypting data with contents using the set WEP key is transmitted and received between the terminal 50 and the access point 20.

A-3. Effect:
In the encryption key setting system LH1 of the first embodiment described above, the WEP key is automatically set in the terminal 50 by executing the security data setting process described above. Such “automatic setting by WEP key wireless communication” makes it possible to easily add a new terminal 50 that uses a wireless LAN, and to provide a wireless LAN that is easy to join. . For example, when setting the WEP key, the owner of the terminal 50 or the administrator of the access point 20 does not need to connect the terminal 50 and the access point 20 with a cable or the like, and manually creates and sets the WEP key. There is no need to do this. In particular, it is more preferable if the encryption key setting system LH1 is used in a wireless LAN provided in a free spot. This is because the free spot wireless LAN is newly joined by a large number of people who intend to use this, and the necessary work can be greatly reduced according to the setting of each person.

  Furthermore, when the access point 20 transmits the WEP key data on the radio wave to the terminal 50, the range in which the radio wave transmitted from the access point 20 reaches is narrower than the radio communication area AR1, which is the normal range. The security communication area MR1 is changed to a range. For this reason, the possibility that the radio wave carrying the WEP key data is intercepted is reduced. For example, in FIG. 4, when WEP key data is transmitted from the access point 20 to the terminal 50, the radio wave carrying the WEP key data reaches only within the security communication area MR1 which is a narrow range (see arrow Q1). ), It is not received by the registered terminal 60 or the non-registered terminal 70 outside the security communication area MR1. Therefore, even when the WEP key data is transmitted wirelessly as described above, it is possible to prevent the leakage of the WEP key, and a wireless LAN with a high security level can be realized. In particular, when such an access point 20 is installed in a free spot, the WEP key may be leaked to a third party when setting the WEP key for terminals of many people who intend to use the free spot. It is surely prevented. Therefore, it is possible to sufficiently ensure communication secrets of many users.

  In the above-described embodiment, the setting of the WEP key for the free-spot portable personal computer is taken as an example, but the same can be realized even when a home appliance that can be controlled by a wireless LAN in the home is connected to the network. . That is, when an AV device that can be controlled by a network is connected to the access point 20 by a wireless LAN, the USB key 30 is attached to the AV device, and the above-described processing is executed. In some cases, the AV device does not have a USB port, but instead, it often supports IEEE 1394 standard communication and also supports Bluetooth standard communication. Therefore, it is possible to use the external storage device more generally by realizing the external storage device with the communication interface of the IEEE 1394 standard or the Bluetooth standard. Note that an external storage device 30 corresponding to a plurality of communication standards that hold the same ID data for one access point 20 may be manufactured or sold in association with each other.

  As a result, the owner of the terminal and the administrator of the access point connect the USB key 30 as an external storage device to the external wireless LAN terminal and operate the registration switch 27 in the access point 20 only by operating the WEP key. Can be set. The registration switch 16a can be omitted by automatically entering the registration mode when the access point 20 receives a connection request from an external wireless LAN terminal.

B. Summary As described above, the first ID data is stored on the access point 20 side, and the second ID data corresponding to the USB key 30 as a pair of external storage devices is stored, and the USB key 30 is wirelessly connected. By connecting to the LAN terminal 50, the terminal 50 including the ID data and sending out the subscription instruction data that becomes a connection request based on the wireless LAN standard, and the ID data stored in advance on the access point side and the subscription The ID data included in the instruction data is compared (step S240), and the connection procedure is continued only when they match, so that security can be improved while maintaining simplicity.

  It is possible to construct a wireless LAN system that combines ease of operation with improved security.

It is explanatory drawing which shows the structure of the hardware which implement | achieves the encryption key setting system LH1 which is 1st Example of this invention. 2 is an explanatory diagram showing a configuration of an access point 20. FIG. 3 is a block diagram of a USB key as an external storage device that is paired with an access point 20. FIG. It is the flowchart which showed the processing content each performed by the OS side and the external storage device side from USB connection to starting of an automatic execution program. It is a flowchart which shows a security data setting process routine. It is explanatory drawing which shows the transmission possible range of the electromagnetic wave in the transmitter 25 after the output value was changed as the security communication area MR1.

Explanation of symbols

20 ... Access point 12a ... ID ROM area 16 ... I / O controller 27 ... Registration switch 30 ... USB key 34 ... Flash ROM

Claims (11)

An access point connected to a wired LAN and connected to an external wireless LAN terminal based on a predetermined wireless LAN standard to intervene with the wired LAN, the access point having a pair of external storage devices,
The external storage device
A communication interface for connecting to a wireless LAN terminal;
Output means for outputting a signal for recognizing that a known disk device is connected to the wireless LAN terminal when the communication interface is connected;
Second ID data paired with the first ID data for identification stored in the access point and the second ID data for the wireless LAN terminal that has recognized the connection of the disk device are used. And an automatic execution program storage means for storing an automatic execution program for connecting to the access point,
The access point is
Having the above first ID data,
When the wireless LAN terminal executes the automatic execution program and there is a connection request, the second ID data transmitted along with the connection request is acquired, and the first ID data and the second ID are acquired. An access point characterized by connecting to the wireless LAN terminal on condition that the data corresponds.   The access point according to claim 1, wherein the external storage device stores the second ID data in a one-time ROM.   The access point according to claim 1, wherein the external storage device stores the second ID data in a flash ROM.   4. The access point according to claim 1, wherein the communication interface of the external storage device is a communication interface based on a universal serial bus standard.   4. The access point according to claim 1, wherein the communication interface of the external storage device is a communication interface based on a Bluetooth standard.   4. The access point according to claim 1, wherein the communication interface of the external storage device is a communication interface based on the IEEE1394 standard.   The access according to any one of claims 1 to 6, wherein the wireless output range is narrowed in response to a connection request from the wireless LAN terminal, and the wireless output range is restored when the connection procedure is completed. point.   The external storage device and the access point use the first ID data and the second ID data to encrypt and decrypt security data during communication based on a wireless LAN standard. The access point according to claim 1. A wireless LAN connection method for an access point that is connected to a wired LAN, connects to an external wireless LAN terminal based on a predetermined wireless LAN standard, and intervenes with the wired LAN,
The access point has a pair of external storage devices,
When the external storage device is connected to the wireless LAN terminal, a known disk device is connected to the wireless LAN terminal, and a pair with the first ID data for identification stored in the access point is paired. Execute an automatic execution program for connecting to the access point using the second ID data formed;
When the wireless LAN terminal executes the automatic execution program and makes a connection request, the access point acquires the second ID data transmitted along with the connection request, and the first ID data and A wireless LAN connection method for an access point, characterized in that connection with the wireless LAN terminal is performed on condition that the second ID data corresponds. A medium that is connected to a wired LAN, records a wireless LAN connection program of an access point that connects to an external wireless LAN terminal based on a predetermined wireless LAN standard and intervenes with the wired LAN,
The access point has a pair of external storage devices,
When the external storage device is connected to the wireless LAN terminal, a known disk device is connected to the wireless LAN terminal, and a pair with the first ID data for identification stored in the access point is paired. Execute an automatic execution program for connecting to the access point using the second ID data formed;
In the access point, when the wireless LAN terminal executes the automatic execution program and makes a connection request, the second ID data transmitted along with the connection request is acquired, and the first ID data and A medium recording a wireless LAN connection program for causing a computer to realize a function of connecting to the wireless LAN terminal on condition that the second ID data corresponds. An access point connected to a wired LAN, connected to an external wireless LAN terminal based on a predetermined wireless LAN standard and intervening with the wired LAN, an external storage device paired with the access point, and the external wireless LAN A wireless LAN system comprising terminals,
The external storage device is
A communication interface for connecting to a wireless LAN terminal;
Output means for outputting a signal for recognizing that a known disk device is connected to the wireless LAN terminal when the communication interface is connected;
Second ID data paired with the first ID data for identification stored in the access point and the second ID data for the wireless LAN terminal that has recognized the connection of the disk device are used. And an automatic execution program storage means for storing an automatic execution program for connecting to the access point,
The wireless LAN terminal
The second ID data can be sent along with a connection request based on the wireless LAN standard by executing the automatic execution program,
The access point is
Having the above first ID data,
When the wireless LAN terminal executes the automatic execution program and there is a connection request, the second ID data transmitted along with the connection request is acquired, and the first ID data and the second ID are acquired. A wireless LAN system characterized in that connection is made with the wireless LAN terminal on condition that the data corresponds.

Images