JP2008219750A - Wireless lan communication equipment - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide wireless LAN communication equipment in which the security setting of a wireless LAN communication terminal can be flexibly changed in accordance with a place where the wireless LAN communication terminal is used, or the environment thereof. <P>SOLUTION: The wireless LAN communication equipment includes: a wireless LAN communication terminal including a wireless LAN communication section for wirelessly connecting with one of a plurality of wireless LAN access points and a security setting section for performing security setting; and a wireless LAN connection device including a connection control section for establishing wireless connection between the wireless LAN access point and the wireless LAN communication terminal and enabling the wireless LAN communication terminal to acquire an access point identifier of the wirelessly connected wireless LAN access point each time when the wireless connection is established. The wireless LAN communication equipment further includes a security setting information database for storing security setting information made to correspond to each access point identifier, a setting information control section for acquiring the security setting information from the security setting information database, and a security setting control section for performing security setting on the basis of the security setting information. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a wireless LAN communication device including a wireless LAN communication terminal provided with security setting means, and a wireless LAN connection device that establishes a wireless connection between the wireless LAN communication terminal and a wireless LAN access point.

Wireless LAN communication terminals having a security setting function for preventing information leakage and tampering are widely used. Usually, the strength of security to be set differs depending on the location and environment where the wireless LAN communication terminal is used. For example, a setting with a high security level is desirable outside a wireless LAN communication area such as a place where the risk of information leakage is high, and a low security level may be set within an in-house wireless LAN communication area. On the other hand, normally, the security conditions already set are not changed unless the user of the wireless LAN communication terminal resets. For this reason, every time the use place or environment of the wireless LAN communication terminal changes, the user must reset the security conditions, which is inconvenient. In addition, since the convenience of the wireless LAN communication terminal is often lowered when a high security level is set, the user tends to set the security level low. Therefore, for example, even if an employee who dislikes the convenience of the wireless LAN communication terminal receives an instruction from the company to set a high security level, the setting may be left at a low security level against the instruction. . In this case, there is a problem that the company's security policy cannot be thoroughly enforced. For these reasons, it is desired that the security settings of the wireless LAN communication terminal can be flexibly changed according to the use place and environment of the wireless LAN communication terminal. For example, Patent Literature 1 discloses a portable terminal that changes security conditions based on a connection form to a network such as wired connection or wireless connection.
JP 2006-157470 A

  However, since the mobile terminal disclosed in Patent Document 1 changes the security condition based on the connection form to the network such as whether it is a wired connection or a wireless connection, the security setting is not changed unless the connection form to the network is changed. There was a problem that was not changed. Therefore, in a wireless LAN communication terminal that always communicates via a wireless LAN, there is a problem that the security setting is not flexibly changed according to the place of use and the environment. In this case, the inconvenience that the user must reset the security condition every time the use place or environment of the wireless LAN communication terminal changes is not solved. In addition, the problem that employees who dislike the decrease in convenience of the wireless LAN communication terminal cannot keep the company's security policy by setting the security level at a low level cannot be solved.

  The present invention has been made in view of the above-described problems, and provides a wireless LAN communication apparatus capable of flexibly changing the security settings of a wireless LAN communication terminal according to the use place and environment of the wireless LAN communication terminal. With the goal.

  A wireless LAN communication apparatus according to the present invention includes a wireless LAN communication unit that wirelessly connects to any of a plurality of wireless LAN access points each having a different access point identifier, and a security setting unit that performs security settings. A wireless connection is established between a communication terminal, the wireless LAN access point, and the wireless LAN communication terminal, and an access point identifier of the wireless LAN access point wirelessly connected by the wireless LAN communication terminal is acquired each time the wireless connection is established. A wireless LAN communication device including a connection control unit that performs security setting information storage that stores security setting information associated with each access point identifier, and acquired by the connection control unit Associated with the assigned access point identifier A setting information control unit that acquires the obtained security setting information from the security setting information storage unit, and a security setting control unit that performs security setting based on the acquired security setting information by the security setting unit. It is characterized by including.

  A wireless LAN communication apparatus according to the present invention includes a wireless LAN communication terminal including a wireless LAN communication unit that is wirelessly connected to a wireless LAN access point, and a security setting unit that performs security settings, the wireless LAN access point, and the wireless A wireless LAN connection device including a connection control unit that establishes a wireless connection with a LAN communication terminal and acquires an IP address assigned to the wireless LAN communication terminal each time the wireless connection is established. A security setting information storage unit that stores security setting information and a subnet mask associated with each subnet address, and the communication terminal based on the IP address and the subnet mask acquired by the connection control unit. Determine the subnet address assigned to the subnet A setting information control unit that acquires the security setting information associated with the address from the security setting information storage unit, and a security setting that performs the security setting by using the security setting unit based on the acquired security setting information And a control unit.

  According to the wireless LAN communication device of the present invention, even when the wireless LAN communication terminal is connected from the first wireless LAN access point to the second wireless LAN access point, the wireless LAN communication device can maintain the security of the wireless LAN communication terminal. Since the setting can be changed flexibly, the inconvenience that the user of the wireless LAN communication terminal has to reset the security condition is solved. According to the wireless LAN communication device of the invention, the wireless LAN communication terminal can be connected from the first wireless LAN access point to the second wireless LAN access point without resetting by the user of the wireless LAN communication terminal. Since security settings are made when the service is done, the problem that employees who dislike the convenience of wireless LAN communication terminals cannot keep the company's security policy by keeping the settings at a low security level is also solved. .

  Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

  FIG. 1 is a block diagram showing a wireless LAN communication apparatus according to the present invention.

  The wireless LAN communication device includes a wireless LAN connection device 1, a server 5, a wireless LAN communication terminal 10, a wireless LAN network 16, and wireless LAN access points 17-0 to 17-n.

  FIG. 1 illustrates an example when the wireless LAN access point 17-0 and the wireless LAN communication terminal 10 that are closest to the wireless LAN communication terminal 10 among the wireless LAN access points 17-0 to 17-n are wirelessly connected. Yes. Different access point identifiers are assigned to the wireless LAN access points 17-0 to 17-n.

  The wireless LAN connection device 1 includes a connection control unit 2, a connection information storage unit 3, and a connection information transmission unit 4.

  The connection control unit 2 is connected to the wireless LAN access point 17-0 via the wireless LAN network 16. When the wireless LAN communication terminal 10 that has been turned on arrives within a wireless connection area with the wireless LAN access point 17-0, the connection control unit 2 establishes a connection between the wireless LAN access point 17-0 and the wireless LAN communication terminal 10. A wireless connection is established, and each time the wireless connection is established, the access point identifier of the wireless LAN access point 17-0 to which the wireless LAN communication terminal 10 is wirelessly connected is acquired. The IP address assigned to the wireless LAN communication terminal 10 is also acquired together with the acquisition of the access point identifier.

  The connection information storage unit 3 stores a terminal information table in which the access point identifier and IP address acquired by the connection control unit 2 are associated with the identifier of the wireless LAN communication terminal 10. Table 1 is an example of a terminal information table.

  The terminal identifier 1111 is a terminal identifier of the wireless LAN communication terminal 10 and is stored in the connection information storage unit 3 in advance. When the wireless LAN communication apparatus includes a plurality of wireless LAN communication terminals 10 (not shown) other than the wireless LAN communication terminal 10, their terminal identifiers 2222 to 4444 are also stored in the same manner. The access point identifier AAAA is an access point identifier of the wireless LAN access point 17-0 to which the wireless LAN communication terminal 10 is wirelessly connected. An IP address 123.1233.0001.001 is an IP address assigned when the wireless LAN communication terminal 10 is wirelessly connected to the wireless LAN access point 17-0. When a wireless LAN communication terminal (not shown) having terminal identifiers 2222 and 4444 is wirelessly connected to one of the wireless LAN access points 17-0 to 17-n, the access point identifiers BBBB and CCCC are assigned to the terminal IDs 2222 and 4444, respectively. They are stored in association with each other. Also, the IP address 123.1233.0002.001 and the IP address 123.1233.0003.03 assigned when wirelessly connected to any of the wireless LAN access points 17-0 to 17-n are associated with the terminal IDs 2222 and 4444, respectively. Is remembered. When a wireless LAN communication terminal (not shown) whose terminal ID is 3333 is not wirelessly connected to any of the wireless LAN access points 17-0 to 17-n, the access point identifier and the IP address are NULL.

  The connection information transmission unit 4 transmits the access point identifier and IP address acquired by the connection control unit 2 to the server 5.

  The server 5 includes a connection information receiving unit 6, a security setting information storage unit 7, a setting information control unit 8, and a setting information transmission unit 9.

  The connection information receiving unit 6 receives the access point identifier and IP address transmitted from the connection information transmitting unit 4 and supplies them to the setting information control unit 8. These pieces of information are stored in the security setting information storage unit 7 by the setting information control unit 8.

  The security setting information storage unit 7 stores a terminal information table in which the access point identifier and the IP address transmitted from the connection information transmission unit 4 are associated with the identifier of the wireless LAN communication terminal 10. Table 2 is an example of a terminal information table. The access point identifier and the IP address are stored in association with the terminal identifier. Since these storage formats are the same as those shown in Table 1, description thereof will be omitted.

  The security setting information storage unit 7 stores a security setting table for each access point in which security setting information is associated with each access point identifier. Table 3 is an example of a security setting table for each access point.

  Each of the access point identifiers AAAA to DDDD is stored in association with a security level that represents the strength of security stepwise. For example, level 1 is associated with the access point identifier AAAA. For example, level 1 represents a strict security setting, and level 2 represents a relaxed security setting. Here, the level is set at levels 1 and 2, but it may be set at a level number of 3 or higher.

  The security setting information storage unit 7 stores a security setting table for each subnet in which security setting information is associated with each subnet address. Table 4 is an example of a security setting table for each subnet.

  Each of the subnet addresses 123.123.01.255 to 123.1233.004.255 is stored in association with a security level that indicates the strength of security in a stepwise manner. For example, level 1 is associated with the access point identifier 123.123.01.255. Usually, the administrator of the wireless LAN communication device sets a desired security level in advance in association with each access point identifier and subnet address.

  FIG. 2 is a diagram showing the wireless LAN access points 17-0 to 19-19 and their wireless LAN communication areas arranged on the same floor FL0. The ellipses in the figure represent the wireless LAN communication areas of the wireless LAN access points 17-0 to 17-19. Usually, the wireless LAN access points 17-0 to 17-n are arranged so that wireless LAN communication areas overlap. The shaded portion in the figure represents the overlapping portion of the wireless LAN communication area. The security levels of the wireless LAN access points 17-0 to 17-19 may all be different. For example, the wireless LAN access points 17-0 to 17-5 are group GP1, the wireless LAN access points 17-6 to 9 are group GP2, The wireless LAN access points 17-10 to 19-19 may be grouped for each area with the group GP 3, and the security level may be set for each group. For example, the security level of the wireless LAN access points 17-0 to 17-5 belonging to the group GP1 is set to level 1, the security level of the wireless LAN access points 17-6 to 9 belonging to the group GP2 is set to level 2, and the wireless LAN access belonging to the group GP3 is set to level 2. The security level of points 17-10 to 19 may be level 3.

  FIG. 3 is a diagram illustrating the wireless LAN access points 17-0 to 15-15 arranged on the floors FL1 to FL4 and their wireless LAN communication areas. The ellipses in the figure represent the wireless LAN communication areas of the wireless LAN access points 17-0 to 17-15. The shaded portion in the figure represents the overlapping portion of the wireless LAN communication area. The security levels of the wireless LAN access points 17-0 to 17-15 may be all different. For example, the wireless LAN access points 17-0 to 17-3 are group GP4, the wireless LAN access points 17-4 to 7-7 are group GP5, The security level may be set for each group by grouping the wireless LAN access points 17-8 to 11 to group GP6, the wireless LAN access points 17-12 to 15 to group GP7, and floors FL1 to FL4. For example, the security level of the wireless LAN access points 17-0 to 3 belonging to the group GP4 is set to level 1, the security level of the wireless LAN access points 17-4 to 7 belonging to the group GP5 is set to level 2, and the wireless LAN access belonging to the group GP6 is set to level 2. The security level of the points 17-8 to 11 may be level 3, and the security level of the wireless LAN access points 17-12 to 15 belonging to the group GP7 may be level 4.

  The security setting information storage unit 7 stores a determination method setting table that indicates whether security setting is performed in units of access point identifiers or subnet addresses. Table 5 is an example of a determination method setting table.

  “Method name” is an item indicating the name of a unit for performing security setting. Here, it is a subnet address. “True” is an item indicating that security setting is performed in units of subnet addresses when “true”, and security setting is performed in units of IP addresses when “false”. Here, “false”, that is, security setting is performed in units of subnet addresses. “Subnet mask” is an item indicating a subnet mask for obtaining a subnet address from the IP address acquired by the connection control unit 2. Here, the subnet mask is set to 255.255.255.0. In this way, the administrator of the wireless LAN communication apparatus or the like can set in advance whether security setting is performed in units of access point identifiers or subnet addresses.

  The security setting information storage unit 7 stores a security setting table for each level indicating whether or not each process executable by the wireless LAN communication terminal 10 can be executed for each security level. The processes that can be executed by the wireless LAN communication terminal 10 include, for example, a call, transmission / reception of mail, access to an address book, access to a Web (homepage), and imaging with an attached camera. Table 6 is an example of the level-specific security setting table.

  “Security ID” is an identifier associated with “security item name”. Here, ID0001 is associated with a call, ID0002 is associated with mail transmission / reception, ID0003 is associated with address book access, and ID0004 is associated with web (homepage) access. “In-range security restriction” is an item indicating whether or not the processing indicated by these security item names can be executed. The process indicated by the security item name whose item is “ON” cannot be executed, and the process indicated by the security item name whose item is “OFF” can be executed. Here, in the case of security level 1, it indicates that telephone calls and mail transmission / reception cannot be executed, and address book access and Web access can be executed. Further, in the case of security level 2, it represents that all of calls, mail transmission / reception, address book access, and Web access can be executed. Usually, the administrator of the wireless LAN communication device or the like sets in advance whether or not to execute these processes for each security level.

  The security setting information storage unit 7 stores out-of-connection security setting information to be security-set when the wireless LAN communication terminal 10 is out of the wireless connection range with the wireless LAN access points 17-0 to 17-n. Table 7 is an example of out-of-service-area security setting information.

  “Security ID” is an identifier associated with “security item name”. Here, ID0001 is associated with a call, ID0002 is associated with mail transmission / reception, ID0003 is associated with address book access, and ID0004 is associated with web access. “Out-of-service security restriction” is an item indicating whether or not the processing indicated by these security item names can be executed. The process indicated by the security item name whose item is “ON” cannot be executed, and the process indicated by the security item name whose item is “OFF” can be executed. Here, it is indicated that all calls, mail transmission / reception, address book access, and Web access cannot be executed. This out-of-connection security setting information is also usually stored in advance in the security setting information storage unit 7 by the administrator of the wireless LAN communication device or the like.

  The setting information control unit 8 stores the access point identifier and IP address supplied from the connection information receiving unit 6 in the security setting information storage unit 7. Examples of access point identifiers and IP addresses stored in the security setting information storage unit 7 are shown in Table 2.

  The setting information control unit 8 refers to the determination method setting table and determines whether to perform security setting in units of subnet addresses or IP addresses. If the “true / false” item corresponding to the “method name” subnet address in the determination method setting table is “true”, the IP address assigned to the wireless LAN communication terminal 10 (stored in the terminal information table) and The subnet address is derived from the “subnet mask” in the judgment method setting table. Subsequently, the setting information control unit 8 acquires the security level associated with the subnet address from the subnet-specific security setting table. If the “true / false” item corresponding to the “method name” subnet address in the determination method setting table is “false”, the access point identifier of the wireless LAN access point 17-0 to which the wireless LAN communication terminal 10 is wirelessly connected ( The security level associated with (stored in the terminal information table) is acquired from the security setting table for each access point.

  The setting information control unit 8 refers to the security setting table for each level, and acquires the setting value (ON / OFF) of the area security restriction for each security item name based on the security level acquired by the above-described processing. Subsequently, the setting information control unit 8 refers to the out-of-service security setting table and acquires the out-of-service security setting value (ON / OFF) of each security item name. The setting information control unit 8 supplies the acquired information to the setting information transmission unit 9.

  The setting information transmission unit 9 transmits the setting value (ON / OFF) of the within-range and out-of-range security restriction of each security item name received from the setting information control unit 8 to the wireless LAN communication terminal 10.

  The wireless LAN communication terminal 10 includes a wireless LAN communication unit 11, a setting information storage unit 12, a security setting control unit 13, a security setting unit 14, and a connection area determination unit 15. The wireless LAN communication terminal 10 is, for example, a mobile phone, a PDA (Personal Digital Assistants), a notebook personal computer, or the like.

  The wireless LAN communication unit 11 is wirelessly connected to any of the wireless LAN access points 17-0 to 17-n and can communicate with the server 5 via the wireless LAN network 16. The wireless LAN communication unit 11 receives the security restriction setting value (ON / OFF) of each security item name transmitted by the setting information transmission unit 9 and stores them in the setting information storage unit 12. The wireless LAN communication unit 11 captures wireless LAN communication radio waves emitted from the wireless LAN access points 17-0 to 17-n in order to establish a wireless connection with any one of the wireless LAN access points 17-0 to 17-n. It has radio field intensity measuring means for measuring the intensity.

  The setting information storage unit 12 stores the security restriction setting value (ON / OFF) of each security item name received by the wireless LAN communication unit 11 in the terminal security setting information table. Table 8 is an example of a terminal security setting information table.

  “Security ID” is an identifier associated with “security item name”. As in Tables 6 and 7, ID0001 is associated with a call, ID0002 is associated with mail transmission / reception, ID0003 is associated with address book access, and ID0004 is associated with Web (homepage) access. “In-range security restriction” and “Out-of-area security restriction” are items indicating whether or not the processing indicated by these security item names can be executed, and the setting information storage unit 12 includes the area of each security item name received by the wireless LAN communication unit 11. And the setting value (ON / OFF) of out-of-service security restriction is stored as it is. When the setting information storage unit 12 stores setting values for the in-range and out-of-range security restrictions, the setting information storage unit 12 updates the setting values in the update flag table. Table 9 is an example of an update flag table.

  When the setting information storage unit 12 stores the setting values of the in-range and out-of-range security restrictions, the setting information storage unit 12 sets “true” to the “true / false” item associated with the “flag name” update flag. When the security setting unit 14 described later performs security setting, the security setting unit 14 sets the item “true / false” to “false”.

  The security setting control unit 13 periodically refers to the update flag table, and if the “true / false” item is “true”, the security setting information stored in the terminal security setting information table is performed by the security setting unit 14. Make security settings based on (the security security setting value for each security item name). The security setting information is information acquired by the setting information control unit 8.

  The security setting unit 14 refers to the terminal security setting information table in accordance with the security setting command issued by the security setting control unit 13 and the connection range determining unit 15, and stores the security setting information (the range of each security item name) stored in the table. Configure security settings based on the security restriction settings. Further, when the security setting is completed, the security setting unit 14 sets the “true / false” item in the update flag table to “false”.

  When the connection area determination unit 15 determines that the wireless LAN communication terminal 10 is out of the wireless connection area with the wireless LAN access point 17-0 based on the strength of the wireless LAN communication radio wave measured by the wireless LAN communication unit 11. Then, the security setting unit 14 performs security setting based on the security setting information stored in the terminal security setting information table (the setting value of the area security restriction for each security item name). The security setting information is information acquired by the setting information control unit 8.

  FIG. 4 is a sequence diagram illustrating an example of a security setting processing order when the wireless LAN communication terminal 10 is within the wireless LAN communication area. The security setting process will be described below with reference to FIG.

  The security setting information storage unit 7 stores the above-described security setting table for each access point, security setting table for each subnet, determination method setting table, security setting table for each level, and out-of-connection security according to the registration work of the administrator of the wireless LAN communication device. The setting table is stored (S41). When the wireless LAN communication terminal 10 whose power is turned on arrives within a wireless connection area with the wireless LAN access point 17-0, the connection control unit 2 connects the wireless LAN access point 17-0, the wireless LAN communication terminal 10, and Each time the wireless connection is established, the access point identifier of the wireless LAN access point 17-0 to which the wireless LAN communication terminal 10 is wirelessly connected and the IP address assigned to the wireless LAN communication terminal 10 are acquired. (S42, S43). In FIG. 4, these access point identifiers and IP addresses are shown as “connection information”.

  The connection information transmission unit 4 transmits the access point identifier and IP address acquired by the connection control unit 2 to the server 5 (S44). The connection information receiving unit 6 receives the access point identifier and IP address transmitted from the connection information transmitting unit 4 (S45). The security setting information storage unit 7 stores these in the terminal information table (S45). The setting information control unit 8 refers to the determination method setting table and determines whether to perform security setting in units of subnet addresses or IP addresses. If the “true / false” item corresponding to the “method name” subnet address in the determination method setting table is “true”, the IP address 123.1233.0001.001 (terminal information table) assigned to the wireless LAN communication terminal 10 The subnet address 123.123.001.001 is derived from the “subnet mask” 255.255.255.0 of the determination method setting table. Subsequently, the setting information control unit 8 acquires the security level (level 1) associated with the subnet address from the security setting table for each subnet (S46). If the “true / false” item corresponding to the “method name” subnet address in the determination method setting table is “false”, the access point identifier AAAA of the wireless LAN access point 17-0 to which the wireless LAN communication terminal 10 is wirelessly connected. The security level (level 1) associated with (stored in the terminal information table) is acquired from the security setting table for each access point (S46). Subsequently, the setting information control unit 8 refers to the security setting table for each level, and based on the security level (level 1) acquired by the above-described processing, the setting value (ON / OFF) of the area security restriction for each security item name Is acquired (S46). Here, when the security level is level 1, the call is ON, the mail transmission / reception is ON, the address book access is OFF, and the Web access is OFF. In addition, the setting information control unit 8 refers to the out-of-service security setting table and acquires the out-of-service security setting value (ON / OFF) of each security item name (S46). Here, all calls, mail transmission / reception, address book access, and Web access are OFF. The setting information transmission unit 9 transmits the setting value (ON / OFF) of the within-range and out-of-range security restriction of each security item name received from the setting information control unit 8 to the wireless LAN communication terminal 10 (S46). In FIG. 4, these setting values are indicated as “security setting information”.

  The wireless LAN communication unit 11 receives the security restriction setting value (ON / OFF) of each security item name transmitted by the setting information transmission unit 9, and stores them in the setting information storage unit 12 (S47). At this time, the setting information storage unit 12 sets the item “true / false” associated with the “flag name” update flag to “true”.

  When the setting information storage unit 12 stores the setting values of the in-range and out-of-range security restrictions, the setting information storage unit 12 sets “true” to the “true / false” item associated with the “flag name” update flag. When the security setting unit 14 described later performs security setting, the security setting unit 14 sets the item “true / false” to “false”. The security setting control unit 13 periodically refers to the update flag table, and if the “true / false” item is “true”, the security setting information stored in the terminal security setting information table is performed by the security setting unit 14. The security setting is made based on (the setting value of the area security restriction for each security item name) (S48). The security setting unit 14 refers to the terminal security setting information table according to the security setting command issued by the security setting control unit 13, and stores the security setting information stored in the table (setting value of the area security restriction for each security item name). Security settings are made based on (S49). Further, when the security setting is completed, the security setting unit 14 sets the “true / false” item in the update flag table to “false”.

  In the above processing, when the wireless LAN communication terminal 10 arrives within the wireless connection area with the wireless LAN access point 17-0, the connection control unit 2 establishes wireless connection between the wireless LAN access point 17-0 and the wireless LAN communication terminal 10. The wireless LAN communication terminal 10 moves away from the wireless connection area with the wireless LAN access point 17-0 and is within the wireless connection area with any of the wireless LAN access points 17-0 to 17-n. The process similar to S42 to S49 shown in FIG. Accordingly, whenever the wireless LAN communication terminal 10 moves or the connection destination is changed to any one of the wireless LAN access points 17-0 to 17-n, the security setting of the wireless LAN communication terminal 10 is also changed. . As described above, the wireless LAN communication apparatus according to the present embodiment can flexibly change the security setting of the wireless LAN communication terminal 10 according to the use place and environment of the wireless LAN communication terminal 10.

  The inconvenience that the user of the wireless LAN communication terminal 10 has to reset the security condition every time the use place or environment of the wireless LAN communication terminal 10 is changed by the processing as described above is eliminated. Even if the user of the wireless LAN communication terminal 10 does not reset it, security settings are made every time the connected wireless LAN access points 17-0 to 17-n are changed. The problem that employees who dislike the decline cannot keep the security policy of the company by setting the security level to a low level is also solved.

  FIG. 5 is a flowchart showing an example of the security setting process when the wireless LAN communication terminal 10 is out of the wireless LAN communication area.

  The wireless LAN communication unit 11 captures the wireless LAN communication radio waves emitted from the wireless LAN access points 17-0 to 17-n and establishes the strength thereof for wireless connection with any of the wireless LAN access points 17-0 to 17-n. Measurement is performed (S51). Based on the strength of the wireless LAN communication radio wave measured by the wireless LAN communication unit 11, the connection range determination unit 15 determines whether or not the wireless LAN communication terminal 10 is out of the wireless connection range with the wireless LAN access points 17-0 to 17-n. Is determined (S52). When the wireless LAN communication terminal 10 moves or the like, the connection area determination unit 15 determines that the wireless LAN communication terminal 10 is out of the wireless connection area with the wireless LAN access points 17-0 to 17-n. The security setting is made based on the security setting information stored in the information table. The security setting unit 14 refers to the terminal security setting information table in accordance with the security setting command issued by the connection area determination unit 15, and makes security settings based on the security setting information stored in the table (S53). Further, when the security setting is completed, the security setting unit 14 sets the “true / false” item in the update flag table to “false”.

  Even when the wireless LAN communication terminal 10 moves out of the wireless connection range with the wireless LAN access points 17-0 to 17-0n by the processing as described above, the user of the wireless LAN communication terminal 10 must reset the security conditions. This inconvenience is eliminated. Even if the user of the wireless LAN communication terminal 10 does not reset, security settings are made when the wireless LAN communication terminal 10 moves out of the wireless connection area with the wireless LAN access points 17-0 to 17-n. The problem that the employee who dislikes the convenience of the wireless LAN communication terminal 10 cannot keep the security policy of the company by setting the security level at a low level is also solved.

  If the terminal identifier and the access point identifier are identifiers that can identify each of the wireless LAN communication terminal 10 and the wireless LAN access points 17-0 to 17-n, for example, a hardware unique number, SIP-URI (Session Initiation Protocol-Uniform) Resource Identifier), telephone number, etc.

  The wireless LAN connection device 1 may be a device in which a wireless controller is mounted on a different device, such as a SIP (Session Initiation Protocol) server 5.

  In the embodiment described above, the server 5 includes the security setting information storage unit 7 and the setting information control unit 8, but the wireless LAN communication terminal 10 includes the security setting information storage unit 7 and the setting information control unit 8. But it ’s okay. In this case, the wireless LAN communication terminal 10 receives the access point identifier and / or IP address transmitted from the wireless LAN connection device 1 or the server 5, and based on these, the setting information control unit 8 included in the wireless LAN communication terminal 10 Similarly, the security level is acquired from the security setting information storage unit 7 included in the wireless LAN communication terminal 10 and the security setting is performed. Alternatively, the server 5 may receive the access point identifier and / or IP address transmitted from the wireless LAN connection device 1 and transmit the security level obtained based on the identifier to the wireless LAN communication terminal 10. In this case, the wireless LAN communication terminal 10 receives the access point identifier and / or IP address transmitted from the server 5, and the setting information control unit 8 included in the wireless LAN communication terminal 10 is also based on these information. 10, the setting value of the area security restriction for each security item name is acquired from the security setting information storage unit 7 included in the security setting information storage unit 7 and security setting is performed.

It is a block diagram showing a wireless LAN communication apparatus. It is a figure showing the wireless LAN access point arrange | positioned on the same floor, and those wireless LAN communication areas. It is a figure showing the wireless LAN access point arrange | positioned at several floors, and those wireless LAN communication areas. It is a sequence diagram showing an example of a security setting processing order when a wireless LAN communication terminal is within a wireless LAN communication area. 6 is a flowchart illustrating an example of a security setting process when a wireless LAN communication terminal is outside a wireless LAN communication area.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Wireless LAN connection apparatus 2 Connection control part 3 Connection information storage part 4 Connection information transmission part 5 Server 6 Connection information reception part 7 Security setting information storage part 8 Setting information control part 9 Setting information transmission part 10 Wireless LAN communication terminal 11 Wireless LAN Communication unit 12 Setting information storage unit 13 Security setting control unit 14 Security setting unit 15 Connection area discrimination unit 16 Wireless LAN network 17-0 to n Wireless LAN access point

Claims (7)

A wireless LAN communication terminal including a wireless LAN communication unit that wirelessly connects to any one of a plurality of wireless LAN access points each having a different access point identifier, and a security setting unit that performs security settings; and the wireless LAN access point And a wireless LAN connection including a connection control unit that acquires an access point identifier of a wireless LAN access point wirelessly connected by the wireless LAN communication terminal every time the wireless connection is established A wireless LAN communication device including a device,
A security setting information storage unit that stores security setting information associated with each access point identifier;
A setting information control unit that acquires security setting information associated with the access point identifier acquired by the connection control unit from the security setting information storage unit;
A wireless LAN communication apparatus comprising: a security setting control unit configured to perform security setting based on the acquired security setting information by performing the security setting unit. The security setting information storage unit includes a terminal-specific access point identifier storage unit that stores an access point identifier of a wireless LAN access point wirelessly connected to the communication terminal and a terminal identifier of the wireless LAN communication terminal,
The setting information control unit includes a terminal-specific security setting information acquisition unit that acquires the security setting information based on a correspondence between a terminal identifier and an access point identifier stored in the security setting information storage unit. The wireless LAN communication device according to claim 1. A wireless LAN communication terminal including a wireless LAN communication unit wirelessly connected to the wireless LAN access point, and a security setting unit configured to perform security settings; and establishing a wireless connection between the wireless LAN access point and the wireless LAN communication terminal A wireless LAN communication device including a connection control unit that acquires an IP address assigned to the wireless LAN communication terminal each time a wireless connection is established,
A security setting information storage unit for storing security setting information and a subnet mask associated with each subnet address;
Based on the IP address acquired by the connection control unit and the subnet mask, a subnet address assigned to the communication terminal is determined, and security setting information associated with the subnet address is stored in the security setting information storage unit. A setting information control unit to be acquired,
A wireless LAN communication apparatus comprising: a security setting control unit configured to perform security setting by performing the security setting unit based on the acquired security setting information. The security setting information storage unit includes a terminal-specific IP address storage unit that stores an IP address assigned to the communication terminal and a terminal identifier of the wireless LAN communication terminal in association with each other,
The setting information control unit includes a terminal-specific security setting information acquisition unit that acquires the security setting information based on a correspondence between a terminal identifier and an IP address stored in the security setting information storage unit. The wireless LAN communication device according to claim 3.   The wireless LAN communication apparatus according to claim 1, wherein the security setting information includes a security level that represents the strength of security stepwise.   The security setting information storage unit includes at least one of a call that can be executed by the wireless LAN communication terminal for each security level, mail transmission / reception, access to an address book, access to a Web page, and imaging by an attached camera. The wireless LAN communication apparatus according to claim 1 or 3, characterized in that execution availability information is stored. The security setting information storage unit includes out-of-service area security setting information storage means for storing out-of-service area security setting information,
The wireless LAN communication unit includes a radio wave intensity measuring unit that captures a radio LAN communication radio wave emitted from the wireless LAN access point and measures its intensity.
When the wireless LAN communication terminal determines that it is out of the wireless connection area with the wireless LAN access point based on the intensity of the wireless LAN communication radio wave, the wireless LAN communication terminal performs the security setting unit and obtains the setting information control unit The wireless LAN communication apparatus according to claim 1, further comprising a connection area determining unit configured to perform security setting based on the out-of-connection security setting information.

Images