JP2011040918A - Wireless lan access point; wireless lan terminal; and system, method and program for preventing wireless lan fraudulence - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a wireless LAN system capable of identifying a terminal performing fraudulent access. <P>SOLUTION: The system for preventing wireless LAN fraudulence includes a wireless LAN access point where the wireless LAN access point includes: an identification information update means 10 to update identification information for permitting connection to a wireless LAN following a predetermined condition; and a fraudulent access terminal identification means 20 to determine whether identification information used when a wireless LAN terminal accesses the wireless LAN access point coincides with identification information before being updated by the identification information update means 10, and to identify the wireless LAN terminal of which the identification information is determined to coincide as a wireless LAN terminal performing the fraudulent access. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a wireless LAN access point and a wireless LAN terminal. The present invention also relates to a wireless LAN fraud prevention system, a wireless LAN fraud prevention method, and a wireless LAN fraud prevention program.

  Generally, in a wireless LAN system, there are an unauthorized access prevention function for controlling an SSID (Service Set Identifier) so as not to be seen to the outside, and an unauthorized access prevention function for dynamically changing an SSID.

  For example, Patent Document 1 describes an information processing system that can automatically update the SSID and encryption method of a wireless LAN access point without the user being aware of it.

  Patent Document 2 describes a wireless LAN system that prevents unauthorized access by notifying only a legitimate client of a new password when a predetermined time has elapsed and changing the password.

JP 2008-244945 A JP 2005-117488 A

  In the systems described in Patent Literature 1 and Patent Literature 2, it is possible to obtain a certain suppression effect against unauthorized access without troublesome users. However, there is no way to specify a wireless LAN terminal to be illegally accessed, and there is a problem that it is difficult to specify an unauthorized terminal.

  Accordingly, the present invention provides a wireless LAN access point, a wireless LAN terminal, a wireless LAN fraud prevention system, a wireless LAN fraud prevention method, and a wireless LAN fraud prevention program that can identify a terminal that performs unauthorized access in a wireless LAN system. The purpose is to do.

  The wireless LAN fraud prevention system according to the present invention includes a wireless LAN access point, and the wireless LAN access point updates identification information for permitting connection to the wireless LAN according to a predetermined condition, and a wireless LAN. It is determined whether the identification information used when the terminal accesses the wireless LAN access point matches the identification information before being updated by the identification information updating means, and unauthorized access is made to the wireless LAN terminal determined to match. And unauthorized access terminal specifying means for specifying as a wireless LAN terminal to perform.

  The wireless LAN access point according to the present invention includes identification information updating means for updating identification information for permitting connection to the wireless LAN according to a predetermined condition, and identification information used when the wireless LAN terminal accesses the wireless LAN access point. Determining whether or not it matches the identification information before being updated by the identification information update unit, and specifying an unauthorized access terminal specifying unit that specifies the wireless LAN terminal determined to match as a wireless LAN terminal performing unauthorized access; It is characterized by having.

  A wireless LAN terminal according to the present invention includes a terminal measurement data determination unit that determines whether measurement data measured by a measurement unit included in a wireless LAN access point has reached a predetermined threshold, and a terminal measurement data determination. When it is determined that the means has reached a predetermined threshold, terminal identification information updating means for updating the identification information generated based on the identification information held by the wireless LAN terminal and the measurement data as new identification information is provided. It is characterized by that.

  The wireless LAN fraud prevention method according to the present invention includes an identification information update step for updating identification information for permitting connection to a wireless LAN according to a predetermined condition, and an identification used when a wireless LAN terminal accesses a wireless LAN access point. An unauthorized access terminal specifying step of determining whether or not the information matches the identification information before being updated, and specifying the wireless LAN terminal determined to match as a wireless LAN terminal performing unauthorized access And

  The wireless LAN fraud prevention program according to the present invention updates identification information for permitting a computer to connect to a wireless LAN according to a predetermined condition, and when a wireless LAN terminal accesses a wireless LAN access point. It is determined whether or not the identification information used for the identification matches the identification information before being updated, and unauthorized access terminal identification processing is performed to identify the wireless LAN terminal determined to be coincident as a wireless LAN terminal performing unauthorized access It is characterized by making it.

  According to the present invention, it is possible to identify a terminal that performs unauthorized access in a wireless LAN system.

It is a block diagram which shows an example of a structure of the wireless LAN system using the wireless LAN fraud prevention method by this invention. 5 is a flowchart illustrating an example of dynamic SSID generation processing executed by the wireless LAN access point 101. 6 is a flowchart illustrating an example of dynamic SSID generation processing executed by the wireless LAN terminal 201. 6 is a flowchart illustrating an example of a suspicious access recording process executed by a wireless LAN access point 101. 5 is a flowchart illustrating an example of an operation performed by a wireless LAN terminal that does not have a dynamic SSID function. It is a block diagram which shows an example of a structure of the wireless LAN system using the wireless LAN fraud prevention method in 2nd Embodiment. It is a flowchart which shows an example of the dynamic SSID generation process which wireless LAN access point 101 'performs. 6 is a flowchart illustrating an example of dynamic SSID generation processing executed by the wireless LAN terminal 201 ′. It is a block diagram which shows the minimum structural example of a wireless LAN fraud prevention system.

  Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing an example of the configuration of a wireless LAN system using a wireless LAN fraud prevention method according to the present invention. As shown in FIG. 1, a wireless LAN access point 101 and a plurality of wireless LAN terminals 201-1, 201-n are included. The wireless LAN access point 101 and the plurality of wireless LAN terminals 201-1 to 201 -n are connected to each other via a wireless LAN network 301. Although FIG. 1 shows one wireless LAN access point, the wireless LAN system may include a plurality of access points.

  As shown in FIG. 1, the wireless LAN access point 101 includes a parameter setting interface 102, an SSID and parameter storage unit 103, an SSID automatic function notification processing unit 104, an SSID automatic generation processing unit 105, and a temperature measurement unit 107. , A wireless LAN interface 106, a connection management processing unit 108, a suspicious access recording unit 109, and an old SSID storage unit 109.

  The parameter setting interface 102 is realized by a CPU of a wireless LAN access point that operates according to a program. The parameter setting interface 102 has a function of setting an initial SSID and parameters used for generating an SSID in accordance with the operation of the system administrator.

  Specifically, the SSID and parameter storage unit 103 is realized by a storage device such as a memory. The SSID and parameter storage unit 103 stores an SSID (an initial SSID when the system is first operated) and a parameter used when generating the SSID.

  Specifically, the SSID automatic function notification processing unit 104 is realized by a CPU of a wireless LAN access point that operates according to a program. The SSID automatic function notification processing unit 104 has a function of notifying the wireless LAN terminal 201 that the SSID automatic update process is being executed according to the SSID automatic function via the wireless LAN interface unit 106 and the wireless LAN network 301. Yes. The SSID automatic function is a function in which the SSID automatic generation processing unit 105 described later automatically updates the SSID according to a predetermined condition.

  Specifically, the SSID automatic generation processing unit 105 is realized by a CPU of a wireless LAN access point that operates according to a program. The SSID automatic generation processing unit 105 has a function of automatically generating an SSID using parameters such as temperature data and changed temperature data stored in the SSID and parameter storage unit 103.

  Specifically, the wireless LAN interface unit 106 is realized by a network interface unit of a wireless LAN access point that operates according to a program. The wireless LAN interface unit 106 has a function of mediating communication between the wireless LAN access point 101 and the wireless LAN terminal 201.

  Specifically, the temperature measurement unit 107 is realized by a CPU of a wireless LAN access point that operates according to a program, a sensor that can detect temperature data, and the like. The temperature measurement unit 107 has a function of detecting temperature data.

  Specifically, the connection management processing unit 108 is realized by a CPU of a wireless LAN access point that operates according to a program. A function of managing a connection state between the wireless LAN access point 101 and the wireless LAN terminal 201 is provided. For example, the connection management processing unit 108 stores a connection state by storing a terminal ID (for example, a MAC address) that can identify each terminal and information indicating whether or not the connection is being performed in association with a memory or the like. I manage.

  The suspicious access recording unit 109 is specifically realized by a storage device such as a memory. The suspicious access recording unit 109 records information (for example, a MAC address) regarding the wireless LAN terminal 201 that may be illegally accessing the wireless LAN access point 101.

  Specifically, the old SSID storage unit 109 is realized by a storage device such as a memory. The old SSID storage unit 109 stores the SSID before the change. Only one old SSID immediately before the change of the current SSID may be stored, or a plurality of past old SSIDs may be stored.

  The wireless LAN terminal 201 includes an SSID automatic function reception processing unit 204, an SSID and parameter storage unit 203, an SSID automatic generation processing unit 205, a temperature measurement unit 207, and a wireless LAN interface 202. Specifically, the wireless LAN terminal 201 is realized by an information processing apparatus such as a personal computer having a wireless communication function that operates according to a program.

  Specifically, the wireless LAN interface 202 is realized by an interface unit such as a wireless LAN card attached to an information processing apparatus that operates according to a program. The wireless LAN interface unit 206 has a function of relaying communication between the wireless LAN access point 101 and the wireless LAN terminal 201.

  Specifically, the SSID and parameter storage unit 203 is realized by a storage device such as a magnetic disk device, an optical disk device, or a memory. The SSID and parameter storage unit 203 stores parameters used when generating the SSID and SSID. Note that it may be set in advance by the user, or may be automatically set according to a fraud prevention program.

  Specifically, the SSID automatic function reception processing unit 204 is realized by a CPU of an information processing apparatus that operates according to a program. The SSID automatic function reception processing unit 204 has a function of receiving a notification that the SSID automatic function is being executed from the wireless LAN access point 101 via the wireless LAN network 301 and the wireless LAN interface 202.

  Specifically, the SSID automatic generation processing unit 205 is realized by a CPU of an information processing apparatus that operates according to a program. The SSID automatic generation processing unit 205 has a function of automatically generating an SSID using temperature data stored in the SSID and parameter storage unit 203, a changed temperature, or the like.

  Specifically, the temperature data receiving unit 207 is realized by a CPU and a network interface unit of an information processing apparatus that operates according to a program. The temperature data receiving unit 207 has a function of receiving temperature data measured by the temperature measuring unit 107 from the wireless LAN access point 101. In this embodiment, the temperature data receiving unit 207 receives the measured temperature data every time the temperature measuring unit 107 measures the temperature data, and the temperature held by the wireless LAN terminal 201 and the wireless LAN access point 101. Data shall be synchronized. In this embodiment, the synchronization means that the temperature data recognized by the wireless LAN access point 101 and the wireless LAN terminal 201 are the same.

  Next, the operation of the wireless LAN access point 101 will be described. FIG. 2 is a flowchart illustrating an example of the dynamic SSID generation process executed by the wireless LAN access point 101.

  When the wireless LAN access point 101 is activated by a system administrator or the like and the wireless LAN system is in operation, the wireless LAN access point 101, for example, according to a setting operation by the system administrator or the like, includes an SSID (representing the network name of the wireless LAN network 301). The initial SSID) is stored in the SSID and parameter storage unit 103 of the wireless LAN access point 101 (step S11).

  Next, when the automatic function notification of the wireless LAN network is valid (step S12), the temperature measurement unit 107 measures the temperature. The automatic function notification refers to a function that notifies the wireless LAN terminal 201 that the SSID automatic update process is being executed. Then, the wireless LAN access point 101 (SSID automatic generation processing unit 105) inputs temperature data from the temperature measurement unit 107 (step S13).

  Next, the wireless LAN access point 101 (SSID automatic generation processing unit 105) determines whether or not the input temperature data has reached a predetermined temperature (for example, 15 degrees, 20 degrees, and 25 degrees) (step S14). ). A plurality of threshold values may be set as the predetermined temperature. Also, it is desirable to use different values depending on the season. If it is determined in step S14 that the wireless LAN access point 101 has not been reached, the wireless LAN access point 101 (SSID automatic generation processing unit 105) shifts the processing to step S13. Thereafter, the processes in steps S13 to S14 are repeated until a predetermined temperature is reached.

  On the other hand, if it is determined that the wireless LAN access point 101 has been reached, the wireless LAN access point 101 (SSID automatic generation processing unit 105) dynamically changes the SSID (step S15). When dynamically changing the SSID, the SSID automatic generation processing unit 105 adds the temperature data input to the SSID that is the network name, and generates a result of executing a predetermined encryption process as a new SSID.

  In addition, the SSID automatic function notification processing unit 104 transmits a notification that the SSID automatic update process is being executed according to the SSID automatic function to the wireless LAN terminal 201 via the wireless LAN network 301 and the wireless LAN interface 106. Reconnection with the wireless LAN terminal 201 is performed (step S15).

  Next, the operation of the wireless LAN terminal 201 will be described. FIG. 3 is a flowchart illustrating an example of the dynamic SSID generation process executed by the wireless LAN terminal 201.

  When connection processing with the wireless LAN access point 101 is performed to perform wireless communication, the wireless LAN terminal 201 displays an SSID representing the network name of the wireless LAN network 301 in the SSID and parameter storage unit 203 of the wireless LAN terminal 201. Store (step S21).

  When the SSID automatic function reception processing unit 204 receives a notification that the SSID automatic function transmitted by the wireless LAN access point 101 is executed in step S16 (step S22), the temperature measurement unit 207 determines the temperature. taking measurement. Then, the wireless LAN terminal 201 reads temperature data from the temperature data receiving unit 207 (step S23). As described above, in the present embodiment, the temperature data receiving unit 207 receives the measured temperature data every time the temperature measuring unit 107 measures the temperature data, and the wireless LAN terminal 201 and the wireless LAN access point 101. Is synchronized with the temperature data held by the.

  Next, the wireless LAN terminal 201 (SSID automatic generation processing unit 205) determines whether or not the read temperature data has reached a predetermined temperature (step S24). If it is determined in step S24 that the wireless LAN terminal 201 has not reached the wireless LAN terminal 201 (SSID automatic generation processing unit 205), the process proceeds to step S23. Thereafter, the processes in steps S23 to S24 are repeated until a predetermined temperature is reached.

  On the other hand, if it is determined that the wireless LAN terminal 201 has reached, the wireless LAN terminal 201 (SSID automatic generation processing unit 205) dynamically changes the SSID (step S25). When dynamically changing the SSID, the SSID automatic generation processing unit 205 adds temperature data to the SSID that is the network name, and generates a result of executing a predetermined encryption process as a new SSID.

  At this time, the wireless LAN terminal 201 and the wireless LAN access point 101 each generate a new SSID using the same temperature data and SSID as parameters. For this reason, the SSID generated by the wireless LAN terminal 201 matches the SSID generated by the wireless LAN access point 101. In addition, since the temperature data held between the wireless LAN terminal 201 and the wireless LAN access point 101 is synchronized, the timing for reaching a predetermined temperature is the same, and the timing for generating a new SSID is also the same. Become.

  Thereafter, the wireless LAN terminal 201 performs reconnection with the wireless LAN access point 101 using the generated SSID.

  As described above, in the present embodiment, the network name SSID is dynamically changed when a change in temperature measured by the wireless LAN access point 101 and the wireless LAN terminal 201 occurs. Therefore, compared with the case where the same SSID is always used, the probability that the SSID is stolen and illegally used can be reduced.

  In this embodiment, the temperature data measured at the wireless LAN access point 101 is used as additional data when changing the SSID. However, the temperature data is not limited to the temperature data. For example, humidity data measured by a sensor mounted on the wireless LAN access point. May be used as additional data.

  Next, the operation of the wireless LAN access point 101 for suspicious access will be described. FIG. 4 is a flowchart illustrating an example of a suspicious access recording process performed by the wireless LAN access point 101.

  When the SSID is dynamically changed in step S15, the wireless LAN access point 101 stores the old SSID in the old SSID storage unit 103 as the old SSID (step S31).

  Next, the connection management processing unit 108 determines whether or not the SSID used when the wireless LAN terminal 201 is connected to the wireless LAN network 301 matches the SSID stored in the old SSID storage unit 103 (step S32). ). If it is determined that they match, the connection management processing unit 108 records information on this connection in the suspicious access recording unit 109 while continuing the connection with the wireless LAN terminal 202 using the old SSID (step S33). At this time, the connection management processing unit 108 stores, for example, information (MAC address or the like) that can identify the wireless LAN terminal 201 in association with the old SSID used in the suspicious access storage unit 109 as information related to the connection. .

  Next, the temperature measurement unit 107 measures the temperature. Then, the wireless LAN access point 101 (connection management processing unit 108) inputs temperature data from the temperature measurement unit 107, and determines whether or not the input temperature data has reached a predetermined temperature (step S34). If it is determined in step S34 that the wireless LAN access point 101 has not been reached, the wireless LAN access point 101 (connection management processing unit 108) shifts the processing to step S33. Thereafter, the processes in steps S33 to S34 are repeated until a predetermined temperature is reached.

  On the other hand, if it is determined that the wireless LAN terminal 201 has been reached, the connection management processing unit 108 identifies the wireless LAN terminal 201 stored in the suspicious access storage unit 109 as a terminal that performs unauthorized access, and connects to the identified wireless LAN terminal 201. Is stopped (step S35). In addition, the connection management processing unit 108 increases the security level for the SSID stored in the suspicious access storage unit 109. For example, in order to increase the security level, the connection management processing unit 108 imposes certain restrictions on the connection. At this time, the wireless LAN access point 101 transmits a predetermined notification (for example, a warning report) to the wireless LAN terminal 201 stored in the suspicious access storage unit 109.

  FIG. 5 is a flowchart illustrating an example of an operation performed by a wireless LAN terminal that does not have a dynamic SSID function or a wireless LAN terminal that eavesdrops on an SSID that is being used for a certain period and attempts an unauthorized connection.

  The wireless LAN terminal 201 connects to the wireless LAN access point 101 using the stored SSID (step S41). If a dynamic SSID is used (step S42), the wireless LAN terminal 201 records information that can identify itself by the connected wireless LAN access point 101 (step S43). .

  Next, when a predetermined notification (for example, a warning report) is received from the wireless LAN access point 101 (step S44), the wireless LAN terminal 201 disconnects from the wireless LAN network 301 (step S45).

  As described above, a wireless LAN terminal that does not use a dynamic SSID or a wireless LAN terminal that attempts to make an unauthorized connection by eavesdropping on an SSID that is being used for a certain period of time is connected once and can use the wireless LAN network 301. However, the usage information during this period is recorded, and the connection is stopped or restricted at a certain point. If fraud is detected and the connection is not permitted at all, the fraudulent terminal cannot be recorded, and then it becomes difficult to identify the fraudulent terminal. Yes. For this reason, when a wireless LAN access point using a dynamic SSID is to be used, the user must use a wireless LAN terminal equipped with the dynamic SSID function with high security described in the present embodiment.

  In addition, a wireless LAN terminal that uses a static SSID without malicious intention receives a report indicating that the wireless LAN terminal is disconnected to ensure the security of the wireless LAN network. Therefore, the user can know the security level of the wireless LAN network being used.

  As described above, in this embodiment, the wireless LAN system has a function of dynamically switching SSIDs and recording a wireless LAN terminal that the wireless LAN access point continuously uses the SSID before switching. Therefore, it is possible to specify a wireless LAN terminal that performs unauthorized access in the wireless LAN system. Also, unauthorized access can be prevented by managing the connection with the specified wireless LAN terminal.

  In the present embodiment, security can be improved by changing the SSID along with the change in temperature of the place where the access point is installed. Since temperature changes vary from day to day, the timing of SSID change can be made more random. Further, by recording a terminal that uses a static SSID and recognizing a terminal that performs unauthorized access from terminals that cannot be connected, further security can be ensured.

  The reason is that the modified SSID has a lower probability of being stolen and illegally used than a static SSID. Another reason is that it is possible to suppress an unauthorized connection attempt by a user holding a wireless LAN terminal whose connection is cut off by knowing the high security of the network.

Embodiment 2. FIG.
Next, a second embodiment of the present invention will be described with reference to the drawings. FIG. 6 is a block diagram illustrating an example of a configuration of a wireless LAN fraud prevention system according to the second embodiment. As shown in FIG. 6, the wireless LAN fraud prevention system according to the second embodiment includes a clock unit 111 instead of the temperature measurement unit 107 and a clock instead of the temperature data reception unit 207, as compared with the first embodiment. It differs in that it includes the part 211.

  Specifically, the clock unit 111 is realized by a CPU and a clock of a wireless LAN access point that operates according to a program. The clock unit 111 has a function of measuring the date and time and the passage of time.

  Specifically, the clock unit 207 is realized by a CPU and a clock of an information processing apparatus that operates according to a program. The clock unit 207 has a function of measuring the date and time and the passage of time.

  Next, the operation of the wireless LAN access point 101 ′ in the second embodiment will be described. FIG. 7 is a flowchart illustrating an example of dynamic SSID generation processing executed by the wireless LAN access point 101 ′. Hereinafter, differences from the operation of the wireless LAN access point 101 in the first embodiment will be described.

  When the automatic function notification of the wireless LAN network is valid (step S12), the wireless LAN access point 101 ′ (SSID automatic generation processing unit 105) inputs date and time data from the clock unit 111 (step S13 ′).

  Next, the wireless LAN access point 101 ′ (SSID automatic generation processing unit 105) determines whether or not a predetermined time (for example, 30 minutes) has elapsed since the last time the SSID was updated based on the input date / time data. Is determined (step S14 '). A plurality of threshold values may be set as the predetermined time. If it is determined in step S14 ′ that the time has not elapsed, the wireless LAN access point 101 ′ (SSID automatic generation processing unit 105) shifts the processing to step S13 ′. Thereafter, the processes in steps S13 ′ to S14 ′ are repeated until a predetermined time has elapsed.

  On the other hand, if it is determined that the time has elapsed, the wireless LAN access point 101 ′ (SSID automatic generation processing unit 105) dynamically changes the SSID (step S15 ′). When the SSID is dynamically changed, the SSID automatic generation processing unit 105 adds the input date and time data to the SSID that is the network name, and generates a result of executing a predetermined encryption process as a new SSID.

  Next, the operation of the wireless LAN terminal 201 ′ in the second embodiment will be described. FIG. 8 is a flowchart showing an example of the dynamic SSID generation process executed by the wireless LAN terminal 201 ′. Hereinafter, differences from the operation of the wireless LAN terminal 201 in the first embodiment will be described.

  When the SSID automatic function reception processing unit 204 receives a notification that the SSID automatic function transmitted by the wireless LAN access point 101 is executed in step S16 (step S22), the clock unit 211 measures the date and time. Then, the wireless LAN terminal 201 ′ inputs date / time data from the clock unit 211 (step S23 ′).

  Next, the wireless LAN terminal 201 ′ (SSID automatic generation processing unit 205) determines whether or not a predetermined time (for example, 30 minutes) has elapsed since the last time the SSID was updated based on the input date / time data. Is determined (step S24 '). In the present embodiment, the same time is applied as the predetermined time in the wireless LAN access point 101 ′ and the wireless LAN terminal 201 ′. This is because the wireless LAN access point 101 ′ and the wireless LAN terminal 201 ′ are close to the timing for updating the SSID.

  If it is determined in step S24 ′ that the time has not elapsed, the wireless LAN terminal 201 ′ (SSID automatic generation processing unit 205) shifts the processing to step S23 ′. Thereafter, the processes in steps S23 ′ to S24 ′ are repeated until a predetermined time has elapsed.

  On the other hand, if it is determined that the time has elapsed, the wireless LAN terminal 201 ′ (SSID automatic generation processing unit 205) dynamically changes the SSID (step S25 ′). When dynamically changing the SSID, the SSID automatic generation processing unit 205 adds date / time data to the SSID that is the network name, and generates a result of executing a predetermined encryption process as a new SSID.

  As described above, in this embodiment, the wireless LAN access point 101 ′ and the wireless LAN terminal 201 ′ each update the SSID when a predetermined time has elapsed since the last time the SSID was updated. Then, the wireless LAN access point 101 ′ records the wireless LAN terminal 201 ′ that continuously uses the SSID before update. Therefore, it is possible to specify a wireless LAN terminal that performs unauthorized access in the wireless LAN system. Also, unauthorized access can be prevented by managing the connection with the specified wireless LAN terminal.

  Further, the wireless LAN access point 101 ′ and the wireless LAN terminal 201 ′ use date and time data measured by the clock units provided as parameters for generating a new SSID. Therefore, the SSID can be generated and updated without transmitting / receiving parameters between the wireless LAN access point 101 ′ and the wireless LAN terminal 201 ′, and security can be improved.

Embodiment 3. FIG.
As a third embodiment of the present invention, instead of dynamically changing the SSID using parameters of temperature data and changed temperature, the SSID is dynamically changed using parameters (for example, latitude, longitude, etc.) depending on the use position. There are embodiments to change. In addition, the SSID can be dynamically changed by combining a plurality of parameters.

  Next, the minimum configuration of the wireless LAN fraud prevention system according to the present invention will be described. FIG. 9 is a block diagram illustrating a minimum configuration example of the wireless LAN system. As shown in FIG. 9, the wireless LAN system includes identification information updating means 10 and unauthorized access terminal specifying means 20 as minimum components.

  In the wireless LAN fraud prevention system with the minimum configuration shown in FIG. 9, the identification information update unit 10 updates identification information for permitting connection to the wireless LAN according to a predetermined condition. Then, the unauthorized access terminal specifying unit 20 determines whether or not the identification information used when the wireless LAN terminal accesses the wireless LAN access point matches the identification information before being updated by the identification information updating unit 10. The wireless LAN terminal determined to match is identified as a wireless LAN terminal that performs unauthorized access. Therefore, according to the wireless LAN system with the minimum configuration, it is possible to identify a wireless LAN terminal that performs unauthorized access in the wireless LAN system.

  In this embodiment, the characteristic configuration of the wireless LAN fraud prevention system as shown in the following (1) to (6) is shown.

  (1) The wireless LAN fraud prevention system includes a wireless LAN access point (for example, realized by the wireless LAN access point 101), and the wireless LAN access point has identification information for permitting connection to the wireless LAN (for example, , SSID) according to a predetermined condition, identification information updating means (for example, realized by the SSID automatic generation processing unit 105), and identification information used when the wireless LAN terminal accesses the wireless LAN access point are identification information. It is determined whether or not the identification information before being updated by the updating means (for example, stored in the old SSID storage unit 110) is matched, and the wireless LAN terminal determined to match is determined as a wireless LAN terminal that performs unauthorized access. Unauthorized access identified (for example, stored in the suspicious access recording unit 109) Terminal identifying means (e.g., as implemented by the connection management unit 108), characterized in that it comprises a.

  (2) In the wireless LAN fraud prevention system, the wireless LAN access point includes measurement means (for example, realized by the temperature measurement unit 107) that measures predetermined measurement data, and data (for example, temperature data) measured by the measurement means. ) Includes a measurement data determination unit (for example, realized by the SSID automatic generation processing unit 105) that determines whether or not the threshold value has reached a predetermined threshold value. If it is determined that it has reached, the identification information may be updated.

  (3) In the wireless LAN fraud prevention system, the identification information update unit is configured to update the identification information generated based on the identification information before the update and the measurement data measured by the measurement unit as new identification information. May be.

  (4) The wireless LAN fraud prevention system includes a wireless LAN terminal (for example, realized by the wireless LAN terminal 201), and the wireless LAN terminal has predetermined measurement data measured by a measurement unit included in the wireless LAN access point. When it is determined that the terminal measurement data determination means (for example, realized by the SSID automatic generation processing unit 205) and the terminal measurement data determination means that determine whether or not the threshold value has been reached, have reached a predetermined threshold value, Including terminal identification information updating means (for example, realized by the SSID automatic generation processing unit 205) that updates identification information generated based on the identification information and measurement data held by the wireless LAN terminal as new identification information. It may be configured as follows.

  (5) In the wireless LAN fraud prevention system, when the unauthorized access terminal specifying unit determines that the measurement data determining unit has reached a predetermined threshold, the wireless LAN using the identification information before being updated by the identification information updating unit. The wireless LAN terminal that accesses the access point may be configured to be identified as a wireless LAN terminal that performs unauthorized access.

  (6) The wireless LAN fraud prevention system provisionally accesses the wireless LAN access point using the SSID before the change when the SSID used in the wireless LAN access point and the wireless LAN terminal is dynamically changed. Provisional access permission means (for example, realized by the connection management processing unit 108) and recording means for recording the wireless LAN terminal that uses the SSID permitted by the provisional access permission means (for example, unauthorized access recording unit) When the measurement data measured at the wireless LAN access point (for example, realized by the temperature measurement unit 107) changes to a predetermined threshold, access prohibition that prohibits access using the SSID before the change is performed. Means (for example, realized by the connection management processing unit 108); It may be configured to include.

  The present invention can be applied to applications using a wireless LAN system.

DESCRIPTION OF SYMBOLS 10 Identification information update means 20 Unauthorized access terminal specification means 101 Wireless LAN access point 102 Parameter setting interface 103 SSID and parameter storage part 104 SSID automatic function notification process part 105 SSID automatic generation process part 106 Wireless LAN interface 107 Temperature measurement part 108 Connection management Processing unit 109 Suspicious access recording unit 110 Old SSID storage unit 111 Clock unit 201 Wireless LAN terminal 202 Wireless LAN interface 203 SSID and parameter storage unit 204 SSID automatic function reception processing unit 205 SSID automatic machine generation processing unit 207 Temperature change reception unit 211 Clock Part 301 Wireless LAN network

Claims (16)

A wireless LAN access point,
The wireless LAN access point is
Identification information updating means for updating identification information for permitting connection to the wireless LAN according to a predetermined condition;
It is determined whether or not the identification information used when the wireless LAN terminal accesses the wireless LAN access point matches the identification information before being updated by the identification information updating means, and the wireless LAN terminal determined to match is illegal. A wireless LAN fraud prevention system, comprising: an unauthorized access terminal identifying means that identifies a wireless LAN terminal that performs secure access. The wireless LAN access point includes measuring means for measuring predetermined measurement data,
Measurement data determination means for determining whether the measurement data measured by the measurement means has reached a predetermined threshold,
The wireless LAN fraud prevention system according to claim 1, wherein the identification information update unit updates the identification information when the measurement data determination unit determines that the predetermined threshold value has been reached. The wireless LAN fraud prevention system according to claim 2, wherein the identification information updating unit updates the identification information generated based on the identification information before the update and the measurement data measured by the measurement unit as new identification information. A wireless LAN terminal,
The wireless LAN terminal is
Terminal measurement data determination means for determining whether measurement data measured by the measurement means has reached a predetermined threshold;
If the terminal measurement data determination means determines that the predetermined threshold value has been reached, the terminal identification information is updated as new identification information based on the identification information held by the wireless LAN terminal and the measurement data. The wireless LAN fraud prevention system according to claim 2 or 3, further comprising information updating means. If the unauthorized access terminal specifying unit determines that the measurement data determining unit has reached a predetermined threshold, the unauthorized access terminal specifying unit illegally accesses the wireless LAN terminal that accesses the wireless LAN access point using the identification information before being updated by the identification information updating unit. The wireless LAN fraud prevention system according to any one of claims 2 to 4, wherein the wireless LAN fraud prevention system is specified as a wireless LAN terminal that performs secure access. Provisional access permission means for provisionally permitting access using the SSID before change in the wireless LAN access point when the SSID used in the wireless LAN access point and the wireless LAN terminal is dynamically changed;
Recording means for recording a wireless LAN terminal using the SSID permitted by the provisional access permission means;
And a wireless LAN fraud prevention system, comprising: access prohibiting means for prohibiting access using the SSID before the change when the measurement data measured at the wireless LAN access point changes to a predetermined threshold value. Identification information updating means for updating identification information for permitting connection to the wireless LAN according to a predetermined condition;
It is determined whether or not the identification information used when the wireless LAN terminal accesses the wireless LAN access point matches the identification information before being updated by the identification information updating means, and the wireless LAN terminal determined to match is illegal. A wireless LAN access point comprising: an unauthorized access terminal specifying means for specifying as a wireless LAN terminal that performs secure access. Measuring means for measuring predetermined measurement data;
Measurement data determination means for determining whether measurement data measured by the measurement means has reached a predetermined threshold,
The wireless LAN access point according to claim 7, wherein the identification information update unit updates the identification information when the measurement data determination unit determines that the predetermined threshold value has been reached. Parameter setting means for setting the SSID and parameters;
An SSID and parameter storage unit for storing the SSID and parameters;
SSID automatic function notification means for transmitting notification to the wireless LAN terminal that processing for automatically updating the SSID is performed;
An SSID automatic generation processing unit that generates an SSID using the temperature change data and the changed temperature stored in the SSID and parameter storage unit;
Temperature measuring means for measuring temperature data;
A wireless LAN access point comprising a wireless LAN interface unit. Terminal measurement data determination means for determining whether measurement data measured by the measurement means provided in the wireless LAN access point has reached a predetermined threshold;
If the terminal measurement data determination means determines that the predetermined threshold value has been reached, the terminal identification information is updated as new identification information based on the identification information held by the wireless LAN terminal and the measurement data. A wireless LAN terminal comprising an information updating unit. SSID automatic function receiving means for receiving notification that the process of automatically updating the SSID from the wireless LAN access point is being executed;
An SSID and a parameter storage unit for storing an SSID and a parameter used when generating the SSID;
SSID automatic generation means for automatically generating an SSID using the temperature data stored in the SSID and parameter storage unit and the changed temperature;
Temperature data receiving means for receiving temperature data measured by the wireless LAN access point;
A wireless LAN terminal comprising a wireless LAN interface unit. An identification information update step of updating identification information for permitting connection to the wireless LAN according to a predetermined condition;
A wireless LAN that determines whether or not the identification information used when the wireless LAN terminal accesses the wireless LAN access point matches the identification information before being updated, and performs unauthorized access to the wireless LAN terminal determined to match An unauthorized access terminal identifying step that identifies the terminal as a terminal. A measurement step for measuring predetermined measurement data;
A measurement data determination step for determining whether or not the measured measurement data has reached a predetermined threshold value,
The wireless LAN fraud prevention method according to claim 12, wherein the identification information is updated when it is determined in the measurement information determination step that the predetermined threshold is reached in the measurement data determination step. For the SSID used in the wireless LAN access point and the wireless LAN terminal, the temperature data measured by measuring means capable of measuring predetermined measurement data and the changed temperature are used as parameters, and the SSID is used when a temperature change occurs. An SSID changing step for dynamically changing;
And a recording step of recording information that can identify a wireless LAN terminal accessed by a static SSID. On the computer,
Identification information update processing for updating identification information for permitting connection to the wireless LAN according to a predetermined condition;
A wireless LAN that determines whether or not the identification information used when the wireless LAN terminal accesses the wireless LAN access point matches the identification information before being updated, and performs unauthorized access to the wireless LAN terminal determined to match A wireless LAN fraud prevention program for executing unauthorized access terminal identification processing that identifies a terminal. On the computer,
A measurement process for measuring predetermined measurement data;
A measurement data determination process for determining whether the measured measurement data has reached a predetermined threshold value,
The wireless LAN fraud prevention program according to claim 15, wherein the identification information is updated when it is determined in the measurement data determination process that the predetermined threshold is reached in the identification information update process.

Images