JP2006345150A - Terminal device and authentication device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem that when authentication information is updated by a system wherein the same authentication information is set to a plurality of physically and logically independent LANs and an arbitrary terminal among a plurality of movable terminal devices is connected to an arbitrary LAN, it becomes difficult to make a connection when there are both an updated LAN and an unupdated LAN and it costs to update all the LANs at the same time. <P>SOLUTION: The terminal device 100 stores a plurality of pieces of authentication information including authentication information before update and requests authentication device 200 to perform authentication. When the authentication with old authentication information is successful, the terminal device 100 requests the authentication device 200 to update the authentication information. The authentication device 200 when requested to update the authentication information acquires the authentication information (updated information) to be updated from the terminal device 100, and updates the authentication information on condition that the acquired updated information is regular. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to updating of authentication information connected to an independent network, for example.

In a wireless LAN (local area network) system, since it is necessary to prevent information leakage due to interception of wireless communication, communication encryption is performed.
Further, in order to further enhance the confidentiality of communication, a key (wireless LAN encryption key) used for communication encryption is automatically generated periodically and updated by distribution via wired connection (for example, Patent Document 1). .
JP 2000-341262 A

According to the technique described in Patent Document 1, devices to which a common wireless LAN encryption key should be set need to be connected to a common wired LAN or the like.
However, there are a plurality of physically and logically independent LAN systems, and when a common wireless LAN encryption key is set for them, it is difficult to connect devices connected to these to a common wired LAN, the Internet, or the like. .
For example, when performing maintenance work by connecting a terminal device carried by a maintenance worker dispatched to the site to a maintenance target device via a wireless LAN in a business of performing maintenance management of a device installed at a contractor, the maintenance target device Are connected to each other.
On the other hand, since the maintenance worker does not know where the worker is dispatched, the terminal device carried by the maintenance worker needs to be able to connect to all the wireless LANs of the contracted parties. Therefore, it is desirable that the wireless LAN encryption keys set for these wireless LANs are common.
However, connecting these wireless LAN systems to the Internet or the like in order to set a wireless LAN encryption key requires installation costs and causes a reduction in safety.
Alternatively, the device to which the wireless LAN encryption key is to be set is temporarily removed from the site and brought home, connected to the LAN for setting the wireless LAN encryption key, the wireless LAN encryption key is set, and when the setting is completed, the site is again Although a method of returning to the wireless LAN encryption key is also conceivable, it is expensive to perform this operation every time the wireless LAN encryption key is updated.
An object of the present invention is to solve the above-described problems and to set authentication information for a device connected to an independent network safely and easily.

The terminal device according to the present invention is
In the terminal device that notifies the authentication information to the authentication device that authenticates the terminal device based on the authentication information notified by the terminal device,
A terminal storage unit for storing a plurality of authentication information;
A terminal notification unit that notifies the authentication information stored in the terminal storage unit to the authentication device;
A terminal determination unit that determines whether the authentication information notified by the terminal notification unit is predetermined authentication information when the authentication device succeeds in authentication of the terminal device;
An update request notification unit for notifying the authentication device of an update request for requesting an update of authentication information when the terminal determination unit determines that the authentication information is not predetermined;
It is characterized by having.

  According to the present invention, for example, when the authentication device does not know the newly generated authentication information and the terminal device is authenticated by the old authentication information, the authentication device is requested to update the authentication information. There is an effect that the authentication information can be updated safely and easily without being connected to the Internet or the like.

Embodiment 1 FIG.
The first embodiment will be described with reference to FIGS.

FIG. 1 is a diagram showing an example of the external appearance of the authentication device 200 and the management device 300 in this embodiment.
In FIG. 1, an authentication device 200 and a management device 300 are a system unit 910, a CRT (Cathode Ray Tube) display device 901, a keyboard (K / B 902), a mouse 903, a compact disc device (CDD905), a printer device 906, a scanner device. 907, which are connected by a cable.
Further, the authentication device 200 and the management device 300 are connected to the FAX machine 932 and the telephone 931 with a cable, and are connected to a local area network (LAN 942).
The terminal device 100 has the same appearance as the authentication device 200 and the management device 300 except that the terminal device 100 is a portable device.

FIG. 2 is a diagram illustrating an example of a hardware configuration of the terminal device 100, the authentication device 200, and the management device 300 according to this embodiment.
2, the terminal device 100, the authentication device 200, and the management device 300 include a CPU (Central Processing Unit) 911 that executes a program. The CPU 911 includes a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a CRT display device 901, a K / B 902, a mouse 903, a FDD (Flexible Disk Drive) 904, and a bus 912. A device 920, a CDD 905, a printer device 906, and a scanner device 907 are connected.
The RAM 914 is an example of a volatile memory. The ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are examples of nonvolatile memories. These are examples of a storage device or a storage unit.
The communication board 915 is connected to a FAX machine 932, a telephone 931, a LAN 942, and the like.
For example, the communication board 915, the K / B 902, the scanner device 907, the FDD 904, and the like are examples of the input unit.
Further, for example, the communication board 915, the CRT display device 901, and the like are examples of the output unit.

  The magnetic disk device 920 stores an operating system (OS) 921, a window system 922, a program group 923, and a file group 924. The program group 923 is executed by the CPU 911, the OS 921, and the window system 922.

The program group 923 stores programs that execute functions described as “˜units” in the description of the embodiments described below. The program is read and executed by the CPU 911.
In the file group 924, what is described as “determination result of”, “calculation result of”, and “processing result of” in the description of the embodiment described below is stored as “˜file”. Yes.
In addition, the arrow portion of the flowchart described in the description of the embodiment described below mainly indicates input / output of data, and for the input / output of the data, the data is the RAM 914 or the magnetic disk device 920, FD (Flexible Disk). , Optical disc, CD (compact disc), MD (mini disc), DVD (Digital Versatile Disk) and other recording media. Alternatively, it is transmitted through a signal line or other transmission medium.

  In addition, what is described as “unit” in the description of the embodiment described below may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented by software alone, hardware alone, a combination of software and hardware, or a combination of firmware.

  A program for implementing the embodiment described below also includes a RAM 914 or a magnetic disk device 920, an FD (Flexible Disk), an optical disk, a CD (Compact Disk), an MD (Mini Disk), a DVD (Digital Versatile Disk), and the like. You may memorize | store using the recording apparatus by other recording media.

  FIG. 3 is a system configuration diagram showing an example of the overall configuration of the system in this embodiment.

The terminal devices 100a and 100b are portable devices. By moving the terminal devices 100a and 100b, it is possible to connect to both the in-house LAN 500 and the contracted LANs 600a and 600b.
In order for the terminal devices 100a and 100b to connect to the contracted LANs 600a and 600b, authentication by the authentication devices 200a and 200b must be successful. If authentication fails, the connection is refused.
For authentication, the terminal devices 100a and 100b notify the authentication devices 200a and 200b of information having authentication information.

  The authentication devices 200a and 200b authenticate the terminal devices 100a and 100b when the stored authentication information matches the authentication information extracted from the information notified by the terminal devices 100a and 100b, and connect to the contracted LANs 600a and 600b. Allow connection.

  The terminal devices 100a and 100b that are permitted to connect to the contracted LANs 600a and 600b perform maintenance work on the maintenance target devices 400a and 400b connected to the contracted LANs 600a and 600b.

  The management device 300 manages authentication information. For security reasons, authentication information is updated regularly or irregularly. The management apparatus 300 generates new authentication information and notifies the terminal apparatuses 100a and 100b via the in-house LAN 500.

  FIG. 4 is a block diagram illustrating an example of functional block configurations of the terminal device 100, the authentication device 200, and the management device 300 according to this embodiment.

  The management apparatus 300 includes an authentication information generation unit 311, a management storage unit 312, a management notification unit 313, and an update information notification unit 314.

  The authentication information generation unit 311 generates new authentication information. For example, a timer may be set once a week or once a day, and new authentication information may be generated periodically, or an administrator may issue an authentication information generation command from an input unit such as K / B 902. If it is input, new authentication information may be generated. Alternatively, new authentication information may be generated when the terminal device is dispatched a predetermined number of times.

The management storage unit 312 stores the authentication information generated by the authentication information generation unit 311.
The management storage unit 312 stores not only the latest authentication information generated by the authentication information generation unit 311 but also authentication information previously generated by the authentication information generation unit 311.
However, since it is not necessary to store all of them, the number of pieces of authentication information to be stored may be determined, and when authentication information exceeding the number is generated, the oldest one may be deleted in order. Or it is good also as deleting based on a production | generation date and time that the predetermined period passed since production | generation.
Further, the management storage unit 312 may encrypt and store the authentication information for improving security.

The management notification unit 313 notifies the terminal device 100 of the authentication information stored in the management storage unit 312 via the in-house LAN 500. In order to improve security, the authentication information may be encrypted and notified.
At this time, not only the latest authentication information stored in the management storage unit 312 but also the authentication information stored in the management storage unit 312 is notified. This is because, depending on the interval at which the terminal device 100 is connected to the in-house LAN 500, there is a possibility that the terminal device 100 is not notified of the authentication information generated last time or the last time.
Or it is good also as notifying the acquisition date or generation date of the newest authentication information in the terminal device 100, and notifying only newer authentication information.
The management notification unit 313 also notifies information for determining which authentication information is the latest among the notified authentication information. For example, the generation date and time of authentication information.

The update information notification unit 314 notifies the update information to the terminal device 100 via the in-house LAN 500.
The update information includes the latest authentication information among the authentication information stored in the management storage unit 312. In addition, the update information includes information that proves that the update information is generated by the management apparatus 300, and cannot be modified by a third party including the terminal apparatus 100.
For example, if encryption is performed using a secret key corresponding to the public key of the management apparatus 300, modification by a third party can be prevented. Alternatively, the electronic signature of the management apparatus 300 may be included.
Alternatively, if encryption is performed using a secret common key that only the management device 300 and the authentication device 200 know, it is possible not only to prevent modification by a third party but also to prevent eavesdropping by a third party.

The management notification unit 313 and the update information notification unit 314 may automatically notify the authentication information and the update information when the terminal device 100 is connected to the in-house LAN 500. Or it is good also as notifying when the terminal device 100 requests | requires.
However, the latest authentication information notified to the terminal device 100 needs to match the authentication information included in the update information. Therefore, when new authentication information is notified to the terminal device 100, update information is also notified.

  The terminal device 100 includes a terminal acquisition unit 111, a terminal storage unit 112, a terminal notification unit 113, a terminal determination unit 114, an update information acquisition unit 121, an update information storage unit 122, and an update request notification unit 123.

  The terminal acquisition unit 111 acquires authentication information notified by the management apparatus 300 via the in-house LAN 500. In addition, information for determining which authentication information is the latest is also acquired.

The terminal storage unit 112 stores the authentication information acquired by the terminal acquisition unit 111. In addition, information for determining which authentication information is the latest is also stored.
When the configuration is such that all of the authentication information stored in the management device 300 is notified, the terminal storage unit 112 stores only the authentication information acquired this time by the terminal acquisition unit 111, and the authentication information acquired last time is deleted. It is good to do.
When it is set as the structure which notifies only the information which has not yet notified to the terminal device 100 among the authentication information which the management apparatus 300 has memorize | stored, not only the authentication information newly acquired by the terminal acquisition part 111 but before Authentication information acquired by the terminal acquisition unit 111 is also stored.
However, since it is not necessary to store all of them, the number of pieces of authentication information to be stored may be determined, and when authentication information exceeding the number is generated, the oldest one may be deleted in order. Or it is good also as deleting based on a production | generation date and time that the predetermined period passed since production | generation.
Further, the terminal storage unit 112 may encrypt and store the authentication information for improving security.

  The update information acquisition unit 121 acquires update information notified by the management apparatus 300 via the in-house LAN 500.

  The update information storage unit 122 stores the update information acquired by the update information acquisition unit 121. The update information storage unit 122 may encrypt and store the update information for improving security.

The terminal notification unit 113 acquires one piece of authentication information from the terminal storage unit 112 and notifies the authentication apparatus 200 of it. The terminal notification unit 113 may encrypt and notify the authentication information for security improvement.
The authentication information includes, for example, a password.
Or it is good also as a structure which notifies what encrypted predetermined information using authentication information as an encryption key. In that case, the information encrypted by the authentication information may be predetermined. Alternatively, the authentication device 200 may receive an authentication request from the terminal device 100 and notify the terminal device 100 of randomly generated information.

  The terminal determination unit 114 determines whether or not the terminal device 100 has been authenticated by the authentication device 200 based on the authentication information notified to the authentication device 200 by the terminal notification unit 113. For example, when the authentication is successful, the authentication device 200 notifies the authentication success, and when the terminal device 100 acquires the notification, the terminal determination unit 114 determines that the authentication is successful.

  If the authentication fails, the terminal notification unit 113 acquires another authentication information from the terminal storage unit 112 and notifies the authentication device 200 of the authentication information. This is repeated until authentication is successful.

  If the terminal device 100 succeeds in the authentication, the terminal device 100 is permitted to connect to the contracted LAN 600, so that the maintenance work can be performed on the maintenance target device 400 via the contracted LAN 600.

  When determining that the authentication is successful, the terminal determination unit 114 further determines whether or not the authentication information that has been successfully authenticated is the latest authentication information. For example, when the terminal notification unit 113 acquires authentication information from the terminal storage unit 112 and acquires the authentication information sequentially from the terminal storage unit 112 and notifies the authentication device 200 of the authentication information, the latest authentication information is obtained when succeeded at the first time. It is determined that the authentication is successful, and if the authentication is successful after the second time, it is determined that the authentication is successful based on the authentication information that is not the latest authentication information.

When the authentication is successful with authentication information that is not the latest authentication information, the authentication device 200 does not know the authentication information newly generated by the management device 300 and performs authentication with the old authentication information.
Therefore, it is necessary to update the authentication information stored in the authentication device 200.

When the terminal determination unit 114 determines that the authentication is successful based on the authentication information that is not the latest authentication information, the update request notification unit 123 generates an update request that requests an update of the authentication information stored in the authentication device 200 and performs authentication. Notify the device 200. The update request notification unit 123 may encrypt and notify the authentication information for security improvement.
The update request notification unit 123 notifies the authentication apparatus 200 of update information, which is information including the latest authentication information, together with the update request. Notify.
However, for example, authentication information generation rules may be determined in advance, and when the authentication apparatus 200 receives an update request, new authentication information may be generated internally. If this generation rule is the same as that used by the management apparatus 300, the authentication information generated by the management apparatus 300 matches the authentication information generated by the authentication apparatus 200. Is not required to be notified to the authentication device 200.
As described above, the update information includes information that proves that the update information is generated by the management apparatus 300. Therefore, the update information cannot be altered not only by an irrelevant third party but also by the terminal device 100, and new authentication information generated by the management device 300 is notified to the authentication device 200 as it is.

  The authentication device 200 includes an authentication unit 211, an authentication storage unit 212, an update request acquisition unit 221, and an authentication update unit 222.

The authentication storage unit 212 stores authentication information. When new authentication information is stored, the authentication storage unit 212 deletes the old one and always stores the latest authentication information.
However, since the contracted LAN 600 to which the authentication device 200 is connected is a network independent of the in-house LAN 500 to which the management device 300 is connected, even when the management device 300 generates new authentication information, it can be known immediately. The old authentication information is stored as it is.

The authentication unit 211 authenticates the terminal device 100 by acquiring information notified by the terminal device 100 and verifying authentication information included in the information.
For example, in the case of an authentication method using authentication information as an encryption key, the terminal device 100 is authenticated by the following procedure.
First, the terminal device 100 notifies the authentication device 200 of an authentication request.
The authentication device 200 receives the authentication request from the terminal device 100 and generates random information.
The authentication device 200 notifies the terminal device 100 of the generated information as it is.
The terminal device 100 acquires the information generated by the authentication device 200 and encrypts it using the authentication information as an encryption key.
The terminal device 100 notifies the authentication device 200 of the encrypted information.
The authentication unit 211 decrypts the information notified by the terminal device 100 using the authentication information stored in the authentication storage unit 212 as an encryption key.
The authentication unit 211 compares the decrypted information with the previously generated information. If the two match, it can be seen that the encryption key (that is, authentication information) used by the terminal device 100 for encryption matches the encryption key (authentication information) used by the authentication unit 211 for decryption.

The authentication unit 211 authenticates the terminal device 100 when the authentication information included in the information notified by the terminal device 100 matches the authentication information stored by the authentication storage unit 212, and thereafter the terminal device 100 authenticates the contracted LAN 600. Allow to connect to.
As a specific method for permitting connection, for example, if the terminal device 100 is a wireless LAN terminal device and the authentication device 200 is a wireless LAN access point device, the authentication device 200 contracts communication from the terminal device 100 thereafter. Relay to another device connected to the destination LAN 600. When the connection is not permitted, the communication from the terminal device 100 is not relayed to other devices connected to the contracted LAN 600.

  The authentication unit 211 notifies the terminal device 100 of the authentication result. Notification may be made only when authentication is successful. In this case, the terminal device 100 determines that the authentication has failed when the authentication success notification is not received after waiting for a predetermined time.

  Note that the authentication unit 211 may authenticate the terminal device 100 not only for the first time based on the authentication request from the terminal device 100 but also for every predetermined time or irregularly.

  The update request acquisition unit 221 acquires the update request notified by the terminal device 100. When the terminal device 100 is configured to notify the update information together, the update information is also acquired.

  The authentication update unit 222 determines whether the update request acquired by the update request acquisition unit 221 is legitimate. For example, the update request notified by the terminal device 100 that has been successfully authenticated may always be determined to be a legitimate one, or by attaching an electronic signature of the terminal device 100 to the update request and verifying the electronic signature. You may judge whether it is a regular thing.

When the update information is acquired together with the update request, the update information includes information certifying the device that generated the update information, and the update request is legitimate by verifying the information. It may be determined whether or not.
For example, when the electronic signature of the management apparatus 300 is included in the update information, it is determined whether or not the update request is legitimate by verifying the electronic signature.
In the method of verifying the electronic signature of the terminal device 100, the authentication device 200 needs to have information for verifying the signature for all the terminal devices 100 that may request connection to the contracted LAN 600. It is not possible to cope with the case where 100 increases. In the method of verifying the electronic signature of the management apparatus 300, only the management apparatus 300 needs to have information for verifying the signature, so that it is possible to deal with cases where the terminal apparatus 100 is increased.

When a method of encrypting update information using a secret common key known only to the management device 300 and the authentication device 200 is used as information for certifying the device that generated the update information, the common key may be leaked to the outside. There is.
However, if the common key is configured to be used only when the update information is encrypted, the possibility of the common key leaking to the outside is reduced by intercepting communication and decrypting it.
Alternatively, the common key itself may be changed periodically or irregularly in the same manner as the authentication information.

If the authentication update unit 222 determines that the update request is valid, the authentication update unit 222 updates the authentication information stored in the authentication storage unit 212.
That is, the authentication information to be newly stored in the authentication storage unit 212 is acquired by generating new authentication information according to a predetermined generation rule or acquiring it from update information. Then, the acquired authentication information is stored in the authentication storage unit 212.

  If the terminal device 100 is connected to the contracted LAN 600 and is performing maintenance work, the authentication update unit 222 authenticates after the maintenance work is completed and the terminal device 100 disconnects from the contracted LAN 600. The authentication information stored in the storage unit 212 may be updated, or may be updated immediately after an update request is acquired.

  In this way, in the network system configured to enhance security by updating the authentication information regularly or irregularly, the authentication system 200 is newly added because the network system is physically and logically independent. You may not know the generated authentication information.

  In this embodiment, since the terminal device 100 stores not only the latest authentication information but also old authentication information, the authentication device 200 authenticates the terminal device 100 even when the authentication device 200 does not know the latest authentication information. It is configured as possible.

  As a result, even if the authentication information is updated, the terminal device 100 can be prevented from being unable to connect to the contracted LAN 600, so that the authentication information can be updated frequently, and the security against unauthorized access is increased. .

  When the terminal device 100 is authenticated by old authentication information, the authentication information stored in the authentication device 200 is always updated by requesting the authentication device 200 to update the authentication information. Therefore, the authentication information can be updated frequently, and the security against unauthorized access is increased.

  The authentication device 200 determines whether or not the update request is legitimate, and determines whether or not to update the authentication information. Therefore, there is no concern that the authentication information will be updated without permission due to unauthorized access. Becomes higher.

  Further, the terminal device 100 notifies the authentication device 200 of information (update information) including the latest authentication information, and the authentication device 200 updates the authentication information based on the notified authentication information. It can be a completely independent network, reducing installation costs and increasing safety.

  The update information notified from the terminal device 100 to the authentication device 200 includes information proving the device that generated the update information and cannot be altered by a third party including the terminal device 100. Therefore, there is no worry that the authentication information is arbitrarily updated by impersonation or the like, and the security against unauthorized access is increased.

  In particular, in a wireless LAN, since communication between connected devices is performed wirelessly, it is necessary to prevent eavesdropping and unauthorized access by a third party.

  If the authentication information is frequently changed by the method described here, and the communication in the wireless LAN is encrypted using the changed authentication information as an encryption key, the person who intercepted this communication decrypts the communication and obtains the encryption key. Even so, when the eavesdropping or unauthorized access is attempted using the encryption key, the encryption key is changed, so that the security is improved.

Embodiment 2. FIG.
The second embodiment will be described with reference to FIGS. 2 and 5 to 16.

  In this embodiment, a case will be described in which a WEP (Wired Equivalent Privacy) key and an SSID (Service Set Identifier) are updated.

There is the IEEE 802.11 standard as a wireless network, and there is a wireless LAN access point device as a device for constructing the 802.11 network.
FIG. 15 shows a wireless network using a wireless LAN access point device.
The wireless LAN access point device 860 is connected to the wired network 851 and communicates between devices belonging to the wired network 851 and devices belonging to the wireless network 852 (for example, communication between the wired network device 840 and the wireless network device 810a). And communication means between devices belonging to the wireless network 852 (for example, communication between the wireless network device 810a and the wireless network device 810b).
The wireless LAN access point device 860 communicates with the wireless network devices 810a and 810b belonging to the wireless network 852 through the wireless communication interface 881 and the antenna 883.
The wireless / wired bridge unit 882 transfers communication between the wired network 851 and the wireless network 852 to each other.
The wireless LAN connection control unit 861 provides identification of the wireless network 852 when the wireless network devices 810a and 810b are connected to the wireless network 852, and permits / denies participation of the wireless network devices 810a and 810b in the wireless network 852 ( Control).
For identification of the wireless network 852, an SSID is used in the case of a wireless LAN of the IEEE 802.11 standard. The wireless network devices 810a and 810b can select a wireless network to be connected by SSID.
For permission / rejection of participation of the wireless network device, for example, in the WEP method, a wireless LAN encryption key called a WEP key is used, and the wireless LAN connection control unit 861 uses the WEP key used by itself, the wireless network device 810a, If the WEP key used by b does not match, the connection of the same device is rejected.
The WEP key is also used for communication encryption by the wireless communication interface 881 in wireless communication after the wireless network device joins the wireless network 852.
Thus, the wireless network devices 810a and 810b to be connected to the wireless network 852 have a mechanism that cannot participate in the wireless network 852 without using the same SSID and WEP key as the wireless LAN access point device 860.
In the wireless LAN access point device 860, these SSID and WEP key are stored in the access point connection information storage unit 862 as wireless LAN connection information, and further, connection information for setting these wireless LAN connection information in the wireless LAN access point device. An update unit 872 is included.

As described above, in the wireless network, since the mediating means for communication is wireless, connection authentication to the wireless network and encryption of wireless communication are performed to ensure security.
A wireless LAN connection authentication key such as a password is used for this connection authentication, and a wireless LAN communication encryption key is used for communication encryption. When a secret key such as a WEP key is used as these wireless LAN keys, the key must be updated periodically for security.

  Conventionally, when updating the wireless LAN connection information in the wireless LAN access point device 860, a setting screen is displayed on the CRT display device of the wired network device 840 connected to the wired network 851, and the setting is input manually. The connection information update unit 872 performs an update process based on the above.

  However, since the wireless LAN connection information is a relatively long meaningless character that does not use the words described in the dictionary for the purpose of the secret key, the wireless LAN set by the setter in the wireless LAN access point device 860 is used. There is a possibility that the confidentiality is lowered by noting the connection information for the memory of the setter.

In order to solve the problem of lowering confidentiality when updating the wireless LAN connection information, for example, there are the following techniques.
When multiple wireless LAN access point devices are connected via a wired network and the key setting mode is activated on the wireless LAN access point device serving as a master station, a key is generated, the generated key is stored, and the key setting mode is activated. The key is distributed and set to the wireless LAN access point device as the slave station. The effect is that the key update is performed secretly to the setter, and the key distributed over the wired network is unlikely to be intercepted by a third party.

There is work to undertake maintenance of equipment installed at customers. Devices installed at customers include a wide range of devices such as elevators, escalators, surveillance cameras / recorders, air conditioners, entrance / exit management devices, automatic ticket gates, ticket vending machines, and money changers.
As maintenance work for these maintenance target devices, bring a maintenance terminal device to the maintenance work site, connect the maintenance terminal device to the maintenance target device via a wired network, collect operation data, detect faulty locations, and perform trial operation. The maintenance work such as is performed.

  However, if the maintenance terminal device is wired to the maintenance target device, the terminal device cannot be freely moved. When maintaining a large device such as an elevator, an operator may want to move while the terminal device is connected.

  Therefore, if the maintenance terminal device and the maintenance target device are connected via a wireless network, the terminal device can be moved relatively freely. However, when the maintenance terminal device and the maintenance target device are connected via a wireless network, the following problems occur.

FIG. 16 is a diagram illustrating an operation when a maintenance terminal device and a maintenance target device are connected via a wireless network.
The maintenance company 590 has n maintenance workers. A maintenance worker carries the maintenance terminal device 150d, the maintenance terminal device 150e,. The maintenance worker dispatches to m maintenance work sites, maintenance work site 690d, maintenance work site 690e,..., Maintenance work site 690f.
A maintenance target device 490d, a maintenance target device 490e,..., And a maintenance target device 490f are installed at each maintenance work site.
Further, a wireless LAN access point device 660d, a wireless LAN access point device 660e,..., And a wireless LAN access point device 660f are installed on the maintenance work site in order to connect the maintenance terminal device and the maintenance target device via a wireless network.
Here, maintenance worker operation of the maintenance company may dispatch an arbitrary maintenance worker to the maintenance work site because of the immediacy of customer correspondence. For this reason, the maintenance terminal devices 150d to 150f and the wireless LAN access point devices 660d to 660f must be connected to each other. For example, the wireless LAN access point device 660d at the maintenance work site 690d must be able to connect to any of the maintenance terminal devices 150d to 150f. Further, the maintenance terminal device 150d must be able to connect to any of the wireless LAN access point devices 660d to 660f. That is, there is an n-to-m relationship.

  When the secret key such as the wireless LAN authentication key or the wireless LAN communication encryption key of the wireless LAN access point devices 660d to 660f is updated under such an operation, the maintenance terminal device 150d to 150f and the wireless LAN access point device between the wireless LAN access point devices 660d to 660f. If the secret key is in a different state, the maintenance terminal devices 150d to 150d cannot be connected to the wireless network, which hinders maintenance work. In order to avoid this, it is necessary to simultaneously change the secret keys of all the wireless LAN access point devices and the maintenance terminal device at the same timing.

  For this purpose, there is a method in which the wireless LAN access point devices 660d to 660f are temporarily collected and connected to a maintenance company network to change the wireless LAN key. Alternatively, there is a method in which the wireless LAN access point devices 660d to 660f are connected to a wide area network and connected to a maintenance company network via this to change the wireless LAN key. Thereby, simultaneous change processing is possible.

  However, in the method of recovering the wireless LAN access point device from the maintenance work site, it is necessary to replace the updated wireless LAN access point device on the spot or to reinstall the updated wireless LAN access point device. There is a disadvantage that the equipment cost and the work cost increase. Further, the method of providing a wide area network has a drawback that the equipment cost increases.

  From a cost standpoint, it is possible to change the setting of the wireless LAN access point device from the wireless network device (maintenance terminal device) while being dispatched to the maintenance work site during normal maintenance work, and updating the secret key of the wireless LAN access point device It is desirable because it does not require special dispatch for.

  In this embodiment, when the connection between a wireless LAN access point device belonging to a plurality of independent networks and the wireless network device is in an n-to-m relationship, the wireless LAN access point device can be connected to any wireless network device. Updating wireless LAN connection information such as a secret key, and matching wireless LAN connection information between the wireless network device and the wireless LAN access point device so that the wireless LAN access point device can be connected from any wireless network device, It is the first purpose.

  Furthermore, the second object of this embodiment is to prevent leakage of wireless LAN connection information held in the wireless network device.

  Furthermore, the third object of this embodiment is to be able to update the wireless LAN connection information of the wireless LAN access point device without affecting the work using a normal wireless network.

FIG. 2 is a diagram illustrating an example of a hardware configuration of the connection information management server device 350, the wireless LAN terminal device 150, the wireless LAN access point device 260, the access point management device 270, the independent network component device 450, and the like in this embodiment. It is.
Since FIG. 2 has been described in Embodiment 1, the description thereof is omitted here.

  FIG. 5 is a system configuration diagram showing an example of the overall configuration of the system in this embodiment.

  Intranet 550 is a first independent network. In the intranet 550, the connection information management server device 350, the wireless LAN terminal device 150a, the wireless LAN terminal device 150b, and the wireless LAN terminal device 150c are connected by a wired / wireless network 551. In this example, the number of wireless LAN terminal devices is three. However, the number is not limited to three and may be any number.

The independent network 650a is a second independent network. A wireless LAN access point device 260a, an access point management device 270a, and an independent network constituent device 450a are connected to the independent network 650a via a wired network 651a.
The wireless LAN access point device 260a and the access point management device 270a constitute an authentication device. Thus, the authentication device does not need to be physically one device, and can be realized by a plurality of devices connected by a network.
The independent network 650b is also a second independent network having the same configuration as the independent network 650a. In this example, the number of second independent networks is two. However, the number is not limited to two, and may be any number.

The wireless LAN terminal device 150a, the wireless LAN terminal device 150b, and the wireless LAN terminal device 150c can be moved. If there is, connect to the intranet 550. In some cases, the wireless network 652a connects to the independent network 650a. In some cases, it may be connected to the independent network 650b.
For example, the wireless LAN terminal device 150a is connected to the independent network 650a via the wireless network 652a controlled by the wireless LAN access point device 260a. The same applies to the connection of the other wireless LAN terminal apparatuses 150a to 150c to the independent networks 650a and 650b.
After the wireless LAN terminal device 150a is connected to the independent network 650a, the wireless LAN terminal device 150a communicates with the independent network constituent device 450a to perform work using a normal wireless network. The work using a normal wireless network is an arbitrary communication between the wireless LAN terminal device 150a and the independent network constituent device 450a, and is, for example, a maintenance work by the wireless LAN terminal device 150a for the independent network constituent device 450a. .

FIG. 6 is a block diagram showing an example of the functional block configuration of the connection information management server device 350 (an example of a management device) in this embodiment.
FIG. 7 is a block diagram illustrating an example of a functional block configuration of the wireless LAN terminal device 150 (an example of a terminal device) according to this embodiment.
FIG. 8 is a block diagram showing an example of functional block configurations of the wireless LAN access point device 260 and the access point management device 270 in this embodiment.

  The connection information management server device 350, the wireless LAN terminal device 150, the wireless LAN access point device 260, and the access point management device 270 are connected according to the system configuration in FIG.

  The connection information management server device 350 includes a connection information generation unit 361 (an example of an authentication information generation unit), a connection information storage unit 362 (an example of a management storage unit), a shared key storage unit 391, a management device shared information encryption unit 392, It has a terminal shared information encryption unit 393 and a connection information distribution unit 353 (an example of a management notification unit / update information notification unit).

  The connection information generation unit 361 generates wireless LAN connection information (an example of authentication information). Specifically, a wireless LAN encryption key (WEP key) and an SSID are generated as wireless LAN connection information.

The connection information storage unit 362 stores the wireless LAN connection information in the order of generation.
In this embodiment, it is assumed that this connection information storage unit 362 can store wireless LAN connection information for up to j generations. When wireless LAN connection information exceeding j generations is generated, the oldest wireless LAN connection information is deleted.

The shared key storage unit 391 stores a key for encrypting the wireless LAN connection information.
There are two types of keys. These are a wireless LAN terminal device key that is a secret encryption key shared with the wireless LAN terminal device 150 and an access point management device key that is a secret encryption key shared with the access point management device 270.

  The management apparatus shared information encryption unit 392 encrypts the latest one-generation wireless LAN connection information using the access point management apparatus key (an example of update information). Since the access point management device key is secretly managed only by the connection information management server device 350 and the access point management device 270, eavesdropping occurs while this information (update information) is being transmitted to the access point management device 270. To prevent unauthorized modification. Further, this information is information that proves that the information is generated by a device that knows the access point management device key (that is, the connection information management server device 350).

The terminal shared information encryption unit 393 encrypts all generations of wireless LAN connection information (maximum j generations) using the wireless LAN terminal device key.
The connection information distribution unit 353 distributes the encrypted wireless LAN connection information (authentication information and update information) to the wireless LAN terminal device 150.

  The wireless LAN terminal device 150 includes a connection information reception unit 151, a terminal connection information storage unit 152, a terminal device shared key storage unit 191, a terminal device shared information decryption unit 192, an access point connection control unit 163, and a connection information update request unit 173. Have.

The connection information receiving unit 151 receives wireless LAN connection information (authentication information and update information) from the connection information management server device 350.
The terminal connection information storage unit 152 stores wireless LAN connection information.
In this embodiment, the terminal connection information storage unit 152 can store all generations of wireless LAN connection information (maximum j generations) (authentication information) and the latest one generation of wireless LAN connection information (update information).
The former (all-generation wireless LAN connection information) (authentication information) is encrypted with the wireless LAN terminal device key, and the latter (latest one generation wireless LAN connection information) (update information) is the access point management device key. It is encrypted with.
Therefore, the wireless LAN terminal device 150 cannot decode the latter (update information). However, since the latest one generation of wireless LAN connection information is also included in the former (authentication information), the wireless LAN terminal device 150 can know this by decoding the former (authentication information).

The terminal device shared key storage unit 191 stores the wireless LAN terminal device key.
The terminal device shared information decryption unit 192 decrypts the encrypted wireless LAN connection information (authentication information) with the wireless LAN terminal device key.

  The access point connection control unit 163 communicates with the wireless LAN access point device 260 using the wireless LAN connection information and connects to the wireless network 652.

  The connection information update request unit 173 sends an update request for the wireless LAN connection information of the wireless LAN access point device 260 to the access point management device 270 via the wireless LAN access point device 260 and the latest one generation to be updated. Wireless LAN connection information (update information) is transmitted.

  The wireless LAN access point device 260 includes a wireless LAN connection control unit 261, an access point connection information storage unit 262, a wireless communication interface 281, a wireless / wired bridge unit 282, and a connection information update unit 272.

The wireless LAN connection control unit 261 provides identification of the wireless network 652 when the wireless LAN terminal device 150 is connected to the wireless network 652, and permits / denies connection (authentication) of the wireless LAN terminal device 150 to the wireless network 652. Control).
In this embodiment, the wireless network 652 is identified using an SSID of the IEEE 802.11 standard. Further, permission / rejection (authentication) of participation of the wireless network device is also based on the WEP method of the 802.11 standard, and the WEP key is used as the wireless LAN connection authentication key.
If the WEP key received from the wireless LAN terminal device 150 does not match, the wireless LAN connection control unit 261 rejects the connection of the device.
Specifically, the WEP key is not transmitted directly. This is because if a third party eavesdrops, a WEP key that must be kept secret will be leaked.
Therefore, when authenticating the wireless LAN terminal device 150, the wireless LAN access point device 260 first transmits randomly generated information to the wireless LAN terminal device 150.
The wireless LAN terminal device 150 receives this, and transmits what is encrypted with the WEP key to the wireless LAN access point device 260.
In the wireless LAN access point device 260, the wireless LAN connection control unit 261 decrypts the received information with the WEP key stored in the access point connection information storage unit 262.
The decrypted information is compared with the transmitted information. If they match, it can be determined that the WEP key used for encryption by the wireless LAN terminal device 150 and the WEP key stored in the access point connection information storage unit 262 are the same.

  The wireless communication interface 281 communicates with the wireless LAN terminal device 150 by transmitting and receiving wireless signals. Communication via the wireless network 652 is performed by a WEP method in which a WEP key is encrypted as a wireless LAN communication encryption key for security. Accordingly, the wireless communication interface 281 uses the WEP key stored in the access point connection information storage unit 262 to encrypt / decrypt wireless communication data.

The access point connection information storage unit 262 stores one generation of wireless LAN connection information set in the wireless LAN access point device 260.
The access point connection information storage unit 262 provides the wireless LAN connection control unit 261 with the SSID and the WEP key, and provides the wireless communication interface 281 with the WEP key.

The wireless / wired bridge unit 282 transfers communication between the wireless network 652 and the wired network 651 to each other.
The connection information update unit 272 updates the wireless LAN connection information stored in the access point connection information storage unit 262.

  The access point management device 270 includes a connection information update request reception unit 271, a management device shared key storage unit 291, a management device shared information decryption unit 292, and a connection information setting unit 273.

The connection information update request receiving unit 271 receives a connection information update request from the wireless LAN terminal device 150. The connection information update request includes the latest one generation of wireless LAN connection information (update information) for updating the wireless LAN connection information of the wireless LAN access point device 260.
The management device shared information decryption unit 292 decrypts the wireless LAN connection information (update information) with the access point management device key.
The management device shared key storage unit 291 stores the access point management device key.

The connection information setting unit 273 transmits the decrypted wireless LAN connection information to the wireless LAN access point device 260 to update it.
The transmission timing may be any timing, but in this embodiment, the update timing is an operation using a normal wireless network between the wireless LAN terminal device 150 and the independent network constituent device 450 described above. After the completion of.

In this embodiment, as the wireless LAN connection information encryption means performed by the management device shared information encryption unit 392, the terminal shared information encryption unit 393, the terminal device shared information decryption unit 192, and the management device shared information decryption unit 292, DES (Data Encryption Standard) is used.
DES has a key length of 56 bits (64 bits including parity), and the block size of data to be encrypted / decrypted is 64 bits. The data length of the SSID is 32 bytes and the WEP key is 64 bits or 128 bits. In order to process these data with DES, a DES CBC (Cipher Block Chaining) mode or a DES ECB (Electronic Code Block) mode is used. Both CBC and ECB are methods for combining encrypted data of data when encrypting / decrypting data exceeding 64 bits.
Encryption / decryption processing by DES is performed by the management device shared information encryption unit 392, the terminal shared information encryption unit 393, the terminal device shared information decryption unit 192, and the management device shared information decryption unit 292. Therefore, both the wireless LAN terminal device key and the access point management device key are DES keys.

The detailed operation of each device will be described.
The operation of this embodiment will be described in three phases. The first phase is a “wireless LAN connection information generation phase”, the next phase is a “wireless LAN connection information distribution phase”, and the last phase is a “wireless LAN connection information setting phase”.

In the “wireless LAN connection information generation phase”, the connection information management server device 350 generates and stores wireless LAN connection information.
In the “wireless LAN connection information distribution phase”, the connection information management server device 350 encrypts and distributes the wireless LAN connection information to the wireless LAN terminal device 150.
In the “wireless LAN connection information setting phase”, the wireless LAN terminal device 150 transmits wireless LAN connection information to the access point management device 270 after connecting to the wireless LAN access point device 260. The access point management device 270 sets / updates the wireless LAN connection information in the wireless LAN access point device 260.

Prior to the operation described below, wireless LAN connection information (n−k) from the nth generation wireless LAN connection information (denoted as wireless LAN connection information (n)) to k generations before has been generated. And
The connection information storage unit 362 of the connection information management server device 350 stores wireless LAN connection information (n) to (n−k).
Any one of the wireless LAN connection information (n) to (nk) is set in the wireless LAN access point device 260.

  The operation described in detail here is to generate (n + 1) -th generation wireless LAN connection information (n + 1) and set it in the wireless LAN access point device 260. The generation of the wireless LAN connection information in the connection information management server device 350 is performed in an arbitrary period in which the safety of the wireless LAN connection information can be sufficiently maintained.

The detailed operation of the “wireless LAN connection information generation phase” will be described.
FIG. 9 is a flowchart showing an example of the control flow of the connection information management server device 350 in the “wireless LAN connection information generation phase”.

In the connection information management server device 350, in step S301, the connection information generation unit 361 generates wireless LAN connection information (n + 1).
In the connection information management server device 350, in step S302, the connection information storage unit 362 stores the wireless LAN connection information (n + 1) generated in S301.

The detailed operation of the “wireless LAN connection information distribution phase” will be described.
FIG. 10 is a diagram illustrating an example of a control flow of the connection information management server device 350 and the wireless LAN terminal device 150 in the “wireless LAN connection information distribution phase” and a communication sequence between them.

  First, the wireless LAN terminal device 150 is connected to the wired / wireless network 551 of the intranet 550.

In the wireless LAN terminal device 150, in step S601, a connection information request transmission unit (not shown) transmits a wireless LAN connection information request (message 401) to the connection information management server device 350.
The electronic message 401 reaches the connection information management server device 350 via the intranet 550.
In the connection information management server device 350, in step S501, a connection information request receiving unit (not shown) receives a wireless LAN connection information request (message 401) from the wireless LAN terminal device 150.

  In the connection information management server device 350, in step S502, the management device shared information encryption unit 392 reads the wireless LAN connection information (n + 1) stored in the connection information storage unit 362, and the access point stored in the shared key storage unit 391. Encrypt with the management device key.

  In the connection information management server device 350, in step S503, the terminal shared information encryption unit 393 reads the wireless LAN connection information (n + 1) to (n−k) stored in the connection information storage unit 362, and the shared key storage unit 391. Is encrypted with the stored wireless LAN terminal key.

In the connection information management server device 350, in step S504, the connection information distribution unit 353 transmits the encrypted wireless LAN connection information (message 402) to the wireless LAN terminal device 150.
The electronic message 402 reaches the wireless LAN terminal device 150 via the intranet 550.
In the wireless LAN terminal device 150, in step S602, the connection information receiving unit 151 receives the wireless LAN connection information (message 402) from the connection information management server device 350.

  In the wireless LAN terminal device 150, in step S603, the terminal connection information storage unit 152 stores the received wireless LAN connection information in an encrypted state.

  The detailed operation of the “wireless LAN connection information setting phase” will be described.

  FIG. 11 is a diagram illustrating an example of a communication sequence of the wireless LAN terminal device 150, the wireless LAN access point device 260, and the access point management device 270 in the “wireless LAN connection information setting phase”.

The wireless LAN terminal device 150 tries to connect to the wireless LAN access point device 260 using the wireless LAN connection information (n + 1) to (n−k) in the message 701.
The wireless LAN terminal apparatus 150 transmits a wireless LAN connection information update request including the wireless LAN connection information (n + 1) encrypted with the access point management apparatus key to the access point management apparatus 270 by using a message 702.
Thereafter, the wireless LAN terminal device 150 performs an operation using a normal wireless network with the independent network constituent device 450 (not shown).
When the work with the independent network component device 450 is completed, the wireless LAN terminal device 150 transmits a wireless LAN disconnection notification to the access point management device 270 using a telegram 703.
Thereafter, the connection with the wireless LAN access point device 260 is disconnected by a telegram 704.
After receiving the message 703, the access point management device 270 transmits a wireless LAN connection information setting including wireless LAN connection information (n + 1) to the wireless LAN access point device 260 using the message 705.

  FIG. 12 is a flowchart showing an example of a control flow of the wireless LAN terminal device 150 in the “wireless LAN connection information setting phase”.

  In the wireless LAN terminal device 150, in step S801, the terminal device shared information decryption unit 192 reads the encrypted wireless LAN connection information (n + 1) to (n−k) from the terminal connection information storage unit 152.

  Next, in step S802, the terminal device shared information decryption unit 192 decrypts the wireless LAN connection information (n + 1) to (n−k) using the wireless LAN terminal device key stored in the terminal device shared key storage unit 191. To do.

Steps S803 to S806 are connection processing with the wireless LAN access point device 260 based on the wireless LAN connection information (n + 1) to (nk) performed by the access point connection control unit 163.
In step S803, the counter i is set to n + 1.
In step S804, connection with the wireless LAN access point device 260 is attempted using the SSID of the i-th generation wireless LAN connection information (i) and the WEP key.
In step S805, it is determined whether the connection with the wireless LAN access point device 260 has succeeded or failed.
For example, if the SSIDs do not match, the wireless LAN access point device 260 does not respond to the authentication request.
Alternatively, the authentication result transmitted by the wireless LAN access point device 260 is received, and it is determined whether the authentication is successful or unsuccessful.
If it is determined that the connection with the wireless LAN access point device 260 has failed, the process proceeds to step S806. One generation is returned (subtracted from the counter i), and the process returns to step S804 to try connection again.

  If the connection with the wireless LAN access point device 260 is successful, the process proceeds to step S807. The connection information update request unit 173 determines whether the generation i of the wireless LAN connection information used for connection is n + 1.

If it is determined that the generation i of the wireless LAN connection information is n + 1, the process proceeds to step S811.
In this case, since the latest wireless LAN connection information (n + 1) is already set in the wireless LAN access point device 260, there is no need to update the connection information.
Therefore, in step S811, the wireless LAN terminal device 150 communicates with the independent network constituent device 450 and performs a normal operation.
After the work is completed, in step S812, the access point connection control unit 163 disconnects the connection with the wireless LAN access point device 260.

When the wireless LAN connection information (n + 1) is already set in the wireless LAN access point device 260, the following cases can be considered.
A case where oneself (for example, the wireless LAN terminal device 150a) has already updated the wireless LAN access point device 260.
In this case, if it is memorized, it is possible to simply try connection without following the above procedure.
Alternatively, another wireless LAN terminal device 150b or wireless LAN terminal device 150c has already updated the wireless LAN access point device 260.
In this case, since the generation information of the connection information used by the wireless LAN access point device 260 is unknown, the above procedure is necessary.

If it is determined in step S807 that the wireless LAN connection information used for connection is not the (n + 1) th generation, the process proceeds to S808.
In this case, it is necessary to update the connection information to wireless LAN connection information (n + 1).
In the wireless LAN terminal device 150, in step S808, the connection information update request unit 173 transmits a wireless LAN connection information update request (message 702) to the access point management device 270. The wireless LAN connection information update request (message 702) includes wireless LAN connection information (n + 1) (update information) encrypted with the access point management device key.

Thereafter, in step S809, the wireless LAN terminal device 150 communicates with the independent network component device 450 and performs normal operations.
After completion of the work, in step S810, the wireless LAN disconnection notification transmission unit (not shown) transmits a wireless LAN disconnection notification (message 703) to the access point management device 270.
Finally, in step S812, the access point connection control unit 163 disconnects the wireless LAN terminal device 150 from the wireless LAN access point device 260.

  In step S804, if the connection succeeds with the wireless LAN connection information (n-1) to (n-k) before the nth generation, the wireless LAN connection information (n) to be originally implemented or earlier. This means that the wireless LAN connection information has not been updated. This is because the wireless LAN connection information (n) was not applied because the visit interval to the independent network 650 was longer than the update interval of the wireless LAN connection information in the connection information management server device 350. The operation of this embodiment is normal.

  FIG. 13 is a flowchart illustrating an example of a control flow of the access point management apparatus 270 in the “wireless LAN connection information setting phase”.

  In the access point management device 270, in step S901, the connection information update request receiving unit 271 receives a wireless LAN connection information update request (message 702) from the wireless LAN terminal device 150. The wireless LAN connection information update request (message 702) includes wireless LAN connection information (n + 1) encrypted with the access point management device key.

In step S902, the management apparatus shared information decryption unit 292 decrypts the wireless LAN connection information (n + 1) with the access point management apparatus key stored in the management apparatus shared key storage unit 291.
The decrypted wireless LAN connection information (n + 1) SSID and WEP key are wireless LAN connection information to be set / updated in the wireless LAN access point device 260.
Since the access point management device key is a shared key that is secretly managed only by the connection information management server device 350 and the access point management device 270, the wireless LAN connection information is not leaked or altered in the middle. .

Here, the connection information setting unit 273 may immediately update the wireless LAN connection information.
In that case, it is necessary to disconnect the connection between the already established wireless LAN terminal device 150 and the wireless LAN access point device 260 and reconnect with the updated wireless LAN connection information.
By doing so, it can be confirmed that the wireless LAN connection information has been correctly updated, which may be preferable.

However, if it does so, it will be necessary to redo the connection operation again, so that it will be delayed to start normal work performed by communication between the wireless LAN terminal device 150 and the independent network constituent device 450.
Even if this communication is intercepted by a malicious third party and the connection information is decrypted, the decrypted connection information is old as long as the connection is made with the old connection information. Therefore, even if a malicious third party attempts to connect after updating to the latest connection information after the work is completed, the old connection information cannot be used for connection, and unauthorized access can be prevented.
Therefore, in this embodiment, the wireless LAN connection information is updated after waiting for normal work to end so that normal work is not hindered.

In step S903, the access point management apparatus 270 determines whether a wireless LAN disconnection notification receiving unit (not shown) has received a wireless LAN disconnection notification (message 703) from the wireless LAN terminal apparatus 150.
If it is determined that the wireless LAN disconnection notification (message 703) has been received, the process proceeds to S905.
In this case, since the wireless LAN terminal device 150 has completed the work using the wireless network, it is understood that the setting of the wireless LAN access point device 260 may be changed.
In step S905, the connection information setting unit 273 transmits a connection information setting request (message 705) to the wireless LAN access point device 260. The connection information setting request (message 705) includes wireless LAN connection information (n + 1).

There may be a case where the wireless LAN disconnection notification (telegram 703) cannot be received due to a lack of a telegram or an illegal operation.
Therefore, in the access point management apparatus 270, in step S904, the connection information setting unit 273 determines whether a predetermined time has elapsed.
If the wireless LAN terminal device 150 does not receive the wireless LAN disconnection notification (message 703) even after waiting for a sufficient time to complete the work, it is determined that the reception has failed for some reason, and the process returns to step S905. Then, a connection information setting request (message 705) is transmitted.

FIG. 14 is a flowchart showing an example of a control flow of the wireless LAN access point device 260 in the “wireless LAN connection information setting phase”.
Note that the authentication procedure of the wireless LAN terminal device 150 is omitted.

  In the wireless LAN access point device 260, in step S1001, the connection information update unit 272 receives a wireless LAN connection information setting request (message 705) from the access point management device 270. The wireless LAN connection information setting request (message 705) includes wireless LAN connection information (n + 1).

  In step S1002, the connection information updating unit 272 stores the wireless LAN connection information (n + 1) in the access point connection information storage unit 262. Thereby, the update of the wireless LAN connection information is completed.

  In this way, after the wireless LAN connection information is generated by the connection information management server device 350, carried by the wireless LAN terminal device 150, and checked by the access point management device 270, the connection information of the wireless LAN access point device 260 is updated. Thus, the wireless LAN connection information is not known on the way, and the wireless LAN connection information can be updated safely.

When connection authentication by the WEP method is performed, the same WEP key is used for encryption of communication after authentication, so that there is a risk that the WEP key may be decrypted by a malicious third party who intercepts the communication. Moreover, since SSID is also exchanged for every communication after authentication, it will be known to the malicious third party who intercepted communication.
If the same WEP key is continuously used, the risk of the WEP key being decrypted increases accordingly, so it is desirable to update the connection information frequently.

  In this embodiment, since the connection information can be updated when the wireless LAN terminal device 150 is dispatched to actually perform the work, it is not necessary to perform a special dispatch just to update the connection information. Even if the connection information is updated, the cost is not increased.

In this embodiment, the wireless LAN connection information is updated after the work by the wireless LAN terminal device 150 is completed. Accordingly, communication during work is performed using the WEP key and SSID before update.
Suppose that a malicious third party intercepts this communication, knows the WEP key and SSID, and tries to connect to the wireless LAN access point device 260.
However, if it is after the work is completed, since the connection information of the wireless LAN access point device 260 has been updated, the malicious third party is not authenticated and the unauthorized access attempt fails.

  Thus, by adopting a configuration in which the connection information is updated after the work is completed, even if the WEP key has been decrypted, unauthorized access can be prevented and the safety is increased.

In this embodiment, the WEP method is used as a method for connection authentication with a wireless LAN. The WEP method is also used as a method for encrypting wireless LAN communication. Therefore, in this embodiment, the wireless LAN connection information to be updated is also used as the WEP key.
However, other authentication methods and encryption methods may be used.
In that case, the password used for the authentication and the encryption key used for the encryption can be updated by the same method as in this embodiment.
In other words, any shared information such as a password or passphrase used for wireless LAN connection authentication and wireless LAN communication encryption can be updated. For example, available wireless LAN connection authentication methods and wireless LAN communication encryption methods include WPA (Wi-Fi Protected Access) -PSK (Pre-Shared Key), TKIP (Temporal Key Integrity Protocol), AES (Advanced Encrypted Encryption). and so on.

  Furthermore, when information that must be shared by devices that are not connected to each other (for example, the connection information management server device 350 and the wireless LAN access point device 260) is secretly managed, the same as in this embodiment It can be managed and updated by the method.

  In this embodiment, the DES method is used as the wireless LAN connection information encryption / decryption method. However, as long as the data can be encrypted / decrypted, TripleDES, MISTY (registered trademark: Mitsubishi Improved) is used. Different encryption / decryption schemes such as Secure Technology may be used.

In this embodiment, as shown in steps S803 to S806, as a method for the wireless LAN terminal device 150 to try to connect to the wireless LAN access point device 260, connection is tried in order with a set of SSID and WEP key. As a way to do it.
However, the wireless LAN access point device 260 may transmit the SSID as a beacon, and the wireless LAN terminal device 150 may receive the SSID to know the SSID used by the wireless LAN access point device 260.
In that case, the wireless LAN terminal device 150 searches the stored wireless LAN connection information (n + 1) to (n−k) for a matching SSID and tries to connect using the WEP key of that generation. As a result, the connection will not fail. This is possible by including the SSID as the wireless LAN connection information updated by the wireless LAN access point device.
Thereby, there is an effect that time for wireless LAN connection can be shortened.

  The wireless LAN connection information update system described here has the following features.

The (n + 1) th generation for updating the nth generation connection information (wireless LAN connection information (n)) distributed and set as wireless LAN connection information that enables the wireless LAN terminal device and the wireless LAN access point device to be connected to each other. The connection information management server device that generates the connection information (wireless LAN connection information (n + 1)) and distributes / updates it to the wireless LAN access point device and the wireless LAN terminal device constitutes an independent first network.
A wireless LAN access point device that connects a wireless LAN terminal device to a network and an access point management device that connects to a wired network and sets wireless LAN update information in the wireless LAN access point device are independent of the wired network and the wireless network. Configure the second network.
One or more wireless LAN terminal devices move between the first network and the one or more second networks, and connect to the respective networks.
In such a configuration, the connection information management server device has the same wireless LAN connection information (as well as the wireless LAN access point device that constitutes one or more independent second networks for which wireless LAN connection information (n) has been set. The wireless LAN connection information updating system distributes and updates wireless LAN connection information (n + 1) to one or more wireless LAN terminal devices for which n) has been set.

  The connection information management server device includes at least a connection information storage unit that stores one or more generations of wireless LAN connection information generated previously, a connection information generation unit that generates (n + 1) th generation wireless LAN connection information, A connection information distribution unit that distributes the generated n + 1 generation wireless LAN connection information (n + 1) and the previously generated n generation wireless LAN connection information to the wireless LAN terminal device connected to the first network; .

  The wireless LAN terminal device connects to the first network and at least the (n + 1) th generation wireless LAN connection information (n + 1) generated from the connection information management server device and the previously generated nth generation wireless LAN connection information (n). Connection information receiving unit, a terminal connection information storage unit for storing the received wireless LAN connection information, and an access point connection control unit for connecting to the second network by the nth generation wireless LAN connection information (n) And a connection information update request unit that transmits an update request for wireless LAN connection information including the (n + 1) th generation wireless LAN connection information (n + 1) to the access point management apparatus connected to the second network.

  The access point management device includes a connection information update request receiving unit that receives an update request for wireless LAN connection information including the (n + 1) th generation wireless LAN connection information (n + 1) for updating the wireless LAN access point device from the wireless LAN terminal device; A connection information setting unit configured to transmit and set the (n + 1) th generation wireless LAN connection information (n + 1) to the wireless LAN access point device at an arbitrary timing.

  The wireless LAN access point device communicates with a wireless LAN connection control unit that accepts connection based on the nth generation wireless LAN connection information (n) from a wireless LAN terminal, and a wireless network and a wired network of the second network. A wireless / wired bridge unit that bridges based on connection information, an access point connection information storage unit that stores wireless LAN connection information, and wireless LAN connection information (n + 1) received from an access point management device and access point connection information A connection information update unit set in the storage unit.

  The wireless LAN connection information update system described here is also characterized in that the wireless LAN connection information includes at least a wireless LAN connection authentication key and a wireless LAN communication encryption key.

  The wireless LAN connection information updating system described here is also characterized in that the wireless LAN connection information includes at least the SSID of the wireless LAN access point device.

  In the wireless LAN connection information update system described here, the access point management device transmits the wireless LAN connection information (n + 1) of the (n + 1) th generation to the wireless LAN access point device by the connection information setting unit, and sets the wireless LAN connection information update timing. It is also characterized in that it is performed after the terminal device releases the connection with the wireless LAN access point device.

  The wireless LAN connection information update system described here also has the following features.

The connection information management server device includes a shared key storage unit that stores a wireless LAN terminal device key that is an encryption key shared with the wireless LAN terminal device and an access point management device key that is an encryption key shared with the access point management device. A management device shared information encryption unit that encrypts the generated n + 1 generation wireless LAN connection information (n + 1) with an access point management device key, and a previously generated n generation wireless LAN connection information (n) as a wireless LAN. A terminal shared information encryption unit that encrypts with the terminal device key.
The wireless LAN connection information (n) stored in the connection information storage unit is encrypted with the wireless LAN terminal device key, and the wireless LAN connection information (n + 1) generated by the connection information generation unit is encrypted with the access point management device key. The connection information distribution unit distributes to the wireless LAN terminal device.

The wireless LAN terminal device includes a terminal device shared key storage unit that stores a wireless LAN terminal device key, which is an encryption key shared with the connection information management server device, and the nth generation wireless LAN connection information (n). A terminal device shared information decryption unit for decrypting with a key.
The connection information receiving unit connects to the first network and the wireless LAN connection information (n) encrypted with the wireless LAN terminal device key from the connection information management server device and the wireless LAN connection encrypted with the access point management device key Information (n + 1) is received, and the received wireless LAN connection information is stored in the terminal information storage unit.
Further, the wireless LAN terminal device decrypts the wireless LAN connection information (n) with the wireless LAN terminal device key, and after the access point connection control unit connects to the second network with the wireless LAN connection information (n), the connection is established. The information update request unit transmits an update request for wireless LAN connection information including wireless LAN connection information (n + 1) to the access point management apparatus connected to the second network.

The access point management apparatus stores a management apparatus shared key storage unit that stores an access point management apparatus key, which is an encryption key shared with the connection information management server apparatus, and the (n + 1) th generation wireless LAN connection information (n + 1). And a management device shared information decryption unit that decrypts the key.
The connection information update request receiving unit receives the encrypted wireless LAN connection information (n + 1), decrypts the wireless LAN connection information (n + 1) with the access point management device key, and the connection information setting unit receives the wireless LAN connection. Information (n + 1) is transmitted to the wireless LAN access point device and set.

  In the wireless LAN access point device, the connection information update unit receives and sets the wireless LAN connection information (n + 1) from the access point management device.

  The wireless LAN connection information update system described here also has the following characteristics.

Connection information (wireless LAN connection information (n), wireless connection information for k generations before and after the nth generation, distributed and set as wireless LAN connection information that enables the wireless LAN terminal device and the wireless LAN access point device to be connected to each other. Generating (n + 1) th generation connection information (wireless LAN connection information (n + 1)) for updating the LAN connection information (n−1),..., Wireless LAN connection information (n−k), and The connection information management server device distributed / updated to the wireless LAN terminal device constitutes an independent first network.
A wireless LAN access point device that connects a wireless LAN terminal device to a network and an access point management device that connects to a wired network and sets wireless LAN update information in the wireless LAN access point device are independent of the wired network and the wireless network. Configure the second network.
One or more wireless LAN terminal devices move between the first network and the one or more second networks, and connect to the respective networks.
With such a configuration, the connection information management server device configures one or more independent second networks in which any one of the wireless LAN connection information (n) to the wireless LAN connection information (nk) has been set. Similarly to the wireless LAN access point device, wireless LAN connection information (n + 1) is transmitted to one or more wireless LAN terminal devices in which any one of wireless LAN connection information (n) to wireless LAN connection information (nk) has been set. ) Is a wireless LAN connection information update system that distributes and updates.

  The connection information management server device includes a connection information storage unit that stores wireless LAN connection information from the n generation to the nk generation generated previously, and a connection information generation that generates the (n + 1) th generation wireless LAN connection information (n + 1). A first n-th generation wireless LAN connection information (n + 1) and an n-k generation wireless LAN connection information (n-k) from the previously generated n-th generation wireless LAN connection information. A connection information distribution unit for distributing to a wireless LAN terminal device connected to the network.

  The wireless LAN terminal device is connected to the first network and is generated from the (n + 1) th generation wireless LAN connection information (n + 1) generated from the connection information management server device and the previously generated nth generation wireless LAN connection information (n). A connection information receiving unit that receives up to n-k generation wireless LAN connection information (nk), a terminal connection information storage unit that stores the received wireless LAN connection information, and an nth generation wireless LAN connection information in the second network. The access point connection control unit connected by any one of the wireless LAN connection information (n) to the nk-th generation wireless LAN connection information (nk) and the access point management apparatus connected to the second network are connected to the (n + 1) th. A connection information update request unit that transmits an update request for wireless LAN connection information including generation wireless LAN connection information (n + 1).

  The access point management device includes a connection information update request receiving unit that receives an update request for wireless LAN connection information including the (n + 1) th generation wireless LAN connection information (n + 1) for updating the wireless LAN access point device from the wireless LAN terminal device; A connection information setting unit configured to transmit and set the n + 1 generation wireless LAN connection information (n + 1) to the wireless LAN access point device.

  The wireless LAN access point device uses the wireless LAN connection information set from any one of the nth generation wireless LAN connection information (n) to the nk generation wireless LAN connection information (nk) from the wireless LAN terminal. A wireless LAN connection control unit that accepts connection, a wireless / wired bridge unit that bridges communication between the wireless network and the wired network of the second network based on the wireless LAN connection information, and an access point that stores the wireless LAN connection information A connection information storage unit; and a connection information update unit that receives wireless LAN connection information (n + 1) from the access point management apparatus and sets the wireless LAN connection information in the access point connection information storage unit.

  The wireless LAN connection information update system described here is also characterized in that the wireless LAN connection information includes at least a wireless LAN connection authentication key and a wireless LAN communication encryption key.

  The wireless LAN connection information updating system described here is also characterized in that the wireless LAN connection information includes at least the SSID of the wireless LAN access point device.

  In the wireless LAN connection information update system described here, the access point management device transmits the wireless LAN connection information (n + 1) of the (n + 1) th generation to the wireless LAN access point device and sets the timing when the connection information setting unit sets the wireless LAN access point device. It is also characterized in that it is performed after the terminal device releases the connection with the wireless LAN access point device.

  The wireless LAN connection information update system described here further has the following features.

The connection information management server device includes a shared key storage unit that stores a wireless LAN terminal device key that is an encryption key shared with the wireless LAN terminal device and an access point management device key that is an encryption key shared with the access point management device. A management device shared information encryption unit that encrypts the generated n + 1 generation wireless LAN connection information (n + 1) with the access point management device key, and the generated n + 1 generation wireless LAN connection information (n + 1) previously generated A terminal shared information encryption unit that encrypts the wireless LAN connection information (n) from the nth generation wireless LAN connection information (n) to the nk generation wireless LAN connection information (nk) with a wireless LAN terminal device key.
The wireless LAN connection information (n + 1) stored in the connection information storage unit is encrypted with the wireless LAN terminal device key from the wireless LAN connection information (n) to the wireless LAN connection information (n−k), and the wireless LAN connection information (n + 1) generated by the connection information generation unit ) Is encrypted with the access point management device key, and the connection information distribution unit distributes it to the wireless LAN terminal device.

The wireless LAN terminal device includes a terminal device shared key storage unit that stores a wireless LAN terminal device key, which is an encryption key shared with the connection information management server device, and the (n + 1) th generation wireless LAN connection information (n + 1) to the n−kth. A terminal device shared information decryption unit that decrypts up to generation wireless LAN connection information (n−k) with the wireless LAN terminal device key.
A connection information receiving unit connects to the first network, and access points from the wireless LAN connection information (n + 1) to the wireless LAN connection information (nk) encrypted with the wireless LAN terminal device key from the connection information management server device The wireless LAN connection information (n + 1) encrypted with the management apparatus key is received, and the received wireless LAN connection information is stored in the terminal information storage unit.
Further, the wireless LAN terminal device decrypts the wireless LAN connection information (n + 1) to the wireless LAN connection information (n−k) with the wireless LAN terminal device key, and the access point connection control unit uses the wireless LAN connection information (n + 1). After connecting to the second network with any of the wireless LAN connection information (n−k) to the wireless LAN access point device with the wireless LAN connection information other than the wireless LAN connection information (n + 1), the connection information The update request unit transmits an update request for wireless LAN connection information including wireless LAN connection information (n + 1) to the access point management apparatus connected to the second network.

The access point management apparatus stores a management apparatus shared key storage unit that stores an access point management apparatus key, which is an encryption key shared with the connection information management server apparatus, and the (n + 1) th generation wireless LAN connection information (n + 1). And a management device shared information decryption unit that decrypts the key.
The connection information update request receiving unit receives the encrypted wireless LAN connection information (n + 1), decrypts the wireless LAN connection information (n + 1) with the access point management device key, and the connection information setting unit receives the wireless LAN connection. Information (n + 1) is transmitted to the wireless LAN access point device and set.
In the wireless LAN access point device, the connection information update unit receives and sets the wireless LAN connection information (n + 1) from the access point management device.

FIG. 3 is a diagram showing an example of the external appearance of an authentication device 200 and a management device 300 in the first embodiment. 2 is a diagram illustrating an example of a hardware configuration of a terminal device 100, an authentication device 200, and a management device 300 according to Embodiment 1. FIG. 1 is a system configuration diagram illustrating an example of an overall configuration of a system according to Embodiment 1. FIG. FIG. 3 is a block diagram illustrating an example of functional block configurations of a terminal device 100, an authentication device 200, and a management device 300 in the first embodiment. FIG. 4 is a system configuration diagram illustrating an example of an overall configuration of a system according to a second embodiment. The block diagram which shows an example of a structure of the functional block of the connection information management server apparatus 350 (an example of a management apparatus) in Embodiment 2. FIG. FIG. 9 is a block diagram illustrating an example of a functional block configuration of a wireless LAN terminal device 150 (an example of a terminal device) in the second embodiment. FIG. 6 is a block diagram showing an example of functional block configurations of a wireless LAN access point device 260 and an access point management device 270 in the second embodiment. The flowchart figure which shows an example of the flow of control of the connection information management server apparatus 350 in a "wireless LAN connection information generation phase". The figure which shows an example of the flow of control of the connection information management server apparatus 350 and the wireless LAN terminal device 150 in a "wireless LAN connection information distribution phase", and the communication sequence between both. The figure which shows an example of the communication sequence of the wireless LAN terminal device 150 in the "wireless LAN connection information setting phase", the wireless LAN access point apparatus 260, and the access point management apparatus 270. The flowchart figure which shows an example of the flow of control of the wireless LAN terminal device 150 in a "wireless LAN connection information setting phase". The flowchart figure which shows an example of the flow of control of the access point management apparatus 270 in a "wireless LAN connection information setting phase". The flowchart figure which shows an example of the flow of control of the wireless LAN access point apparatus 260 in a "wireless LAN connection information setting phase". The figure which shows the wireless network by a wireless LAN access point apparatus. The figure which shows the operation | movement at the time of connecting a maintenance terminal device and a maintenance object apparatus with a wireless network.

Explanation of symbols

  100 terminal device, 111 terminal acquisition unit, 112 terminal storage unit, 113 terminal notification unit, 114 terminal determination unit, 121 update information acquisition unit, 122 update information storage unit, 123 update request notification unit, 500 in-house LAN, 300 management device, 311 Authentication Information Generation Unit, 312 Management Storage Unit, 313 Management Notification Unit, 314 Update Information Notification Unit, 600 Contracted LAN, 200 Authentication Device, 211 Authentication Unit, 212 Authentication Storage Unit, 221 Update Request Acquisition Unit, 222 Authentication Update Unit 150 wireless LAN terminal apparatus 151 connection information receiving section 152 terminal connection information storage section 163 access point connection control section 173 connection information update request section 191 terminal apparatus shared key storage section 192 terminal apparatus shared information decoding section 550 Intranet, 551 wired / wireless network, 350 Continuation information management server device, 361 connection information generation unit, 362 connection information storage unit, 353 connection information distribution unit, 391 shared key storage unit, 392 management device shared information encryption unit, 393 terminal shared information encryption unit, 650 independent network , 651 wired network, 652 wireless network, 450 independent network component device, 250 authentication device, 260 wireless LAN access point device, 261 wireless LAN connection control unit, 262 access point connection information storage unit, 272 connection information update unit, 281 wireless communication Interface, 282 wireless / wired bridge unit, 270 access point management device, 271 connection information update request receiving unit, 273 connection information setting unit, 291 management device shared key storage unit, 292 management device shared information decryption unit, 590 maintenance company, 6 0 maintenance work site, 490 maintenance target device, 810 wireless network device, 840 wired network device, 851 wired network, 852 wireless network, 860 wireless LAN access point device, 861 wireless LAN connection control unit, 862 access point connection information storage unit, 872 Connection information update unit, 881 wireless communication interface, 882 wireless / wired bridge unit, 901 CRT display device, 902 K / B, 903 mouse, 904 FDD, 905 CDD, 906 printer device, 907 scanner device, 910 system unit, 911 CPU, 912 bus, 913 ROM, 914 RAM, 915 communication board, 920 magnetic disk device, 921 OS, 922 window system, 923 program group, 92 File group, 931 telephones, 932 FAX machine, 942 LAN.

Claims (12)

In the terminal device that notifies the information having the authentication information to the authentication device that performs authentication based on the authentication information,
A terminal storage unit for storing a plurality of authentication information;
A terminal notification unit for notifying the authentication device of information having authentication information stored in the terminal storage unit;
A terminal determination that determines whether or not the authentication device has successfully authenticated the terminal device, and determines whether or not the authentication information notified by the terminal notification unit is predetermined authentication information when it is determined that the authentication has succeeded And
An update request notification unit for notifying the authentication device of an update request for updating the authentication information when the terminal determination unit determines that the authentication information notified by the terminal notification unit is not predetermined authentication information; ,
The terminal device characterized by having. The terminal discrimination unit
When the authentication device determines whether or not the authentication of the terminal device is successful, and when it is determined that the authentication is successful, the authentication information notified by the terminal notification unit is the latest among the authentication information stored in the terminal storage unit The terminal device according to claim 1, wherein it is determined whether or not the authentication information. The terminal device further includes:
An update information storage unit that stores information including the predetermined authentication information as update information,
The update request notification unit further includes:
When the terminal determination unit determines that the authentication information notified by the terminal notification unit is not predetermined authentication information, the update information stored in the update information storage unit is notified to the authentication device. The terminal device according to claim 1. The terminal device further includes:
An update information acquisition unit that acquires the update information from a management device that manages authentication information and generates update information,
The update information storage unit
Store the update information acquired by the update information acquisition unit,
The update request notification unit further includes:
When the terminal determination unit determines that the authentication information notified by the terminal notification unit is not predetermined authentication information, the authentication device is notified of information proving the device that generated the update information. The terminal device according to claim 3. The terminal device is
The terminal device according to claim 1, wherein when the authentication device is successfully authenticated, the terminal device is connected to a wireless LAN (local area network). The terminal storage unit
An encryption key for encrypting communication data with the wireless LAN is stored as the authentication information,
The terminal notification part
The information acquired by the authentication device is acquired, the acquired information is encrypted using an encryption key stored in the terminal storage unit, and the encrypted information is notified to the authentication device. 5. The terminal device according to 5. In the authentication device that authenticates the terminal device based on the authentication information notified by the terminal device,
An authentication storage unit for storing authentication information;
An update request acquisition unit that acquires an update request for requesting an update of authentication information stored in the authentication storage unit from the terminal device;
An authentication update unit that determines whether or not the update request acquired by the update request acquisition unit is legitimate, and updates the authentication information stored in the authentication storage unit when it is determined that the update request is legitimate. ,
An authentication apparatus comprising: The update request acquisition unit further includes:
Obtain information including authentication information as update information from the terminal device,
The authentication update unit
It is determined whether or not the update request acquired by the update request acquisition unit is legitimate. If it is determined that the update request is legitimate, authentication information is acquired from the update information acquired by the update request acquisition unit. The authentication device according to claim 7, wherein the authentication device is stored in the authentication storage unit. The update request acquisition unit further includes:
Acquiring information from the terminal device as proof information to certify the device that generated the update information,
The authentication update unit
When the verification information acquired by the update request acquisition unit is verified and it is determined that the device that generated the update information is a predetermined device, the authentication information is acquired from the update information acquired by the update request acquisition unit, The authentication device according to claim 8, wherein the authentication device is stored in the authentication storage unit. The authentication device
10. The authentication device according to claim 7, wherein when the authentication of the terminal device is successful, the connection of the terminal device to a wireless LAN is permitted. The authentication update unit
The authentication information stored in the authentication storage unit is updated when it is determined whether or not communication between the terminal device and the wireless LAN has ended. Authentication device. The authentication storage unit
An encryption key for encrypting communication between the terminal device and the wireless LAN is stored as the authentication information,
The authentication device further includes:
The terminal device is notified of predetermined information, the information obtained by encrypting the notified information by the terminal device is acquired from the terminal device, and the acquired information is stored using the encryption key stored in the authentication storage unit. The decryption information is compared with the notified information to determine whether or not they match, and when it is determined that they match, an authentication unit that authenticates the terminal device is provided. The authentication device described.

Images