JP2013207642A - Connection management device, terminal device, connection management method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a connection management device, a terminal device, a connection management method, and a program, capable of individually isolating a terminal device under a wireless LAN environment.SOLUTION: In a network 10, a job network 11 and an isolated network 12 are constructed by an L2 switch 20, and wireless LAN access points 30 and 31 are connected to the L2 switch 20. Terminal devices 40 and 50 can be connectable to the wireless LAN access point 30 or 31. A terminal device 40 (or 50) comprises: an illegal state determination part 42 (or 52) determining whether or not the own device is in an illegal state; and a setting change part 43 (or 53) changing, in the case that the own device is in the illegal state, the setting of the wireless LAN access point connected to the own device to limit a terminal device connectable to the wireless LAN access point to the own device, and operating the L2 switch 20 so as to connect only the wireless LAN access point to one network 12 for isolation.

Description

  The present invention relates to a connection management device, a terminal device, and a connection management method for isolating a terminal device in an unauthorized state under a wireless LAN environment, and further relates to a program for realizing these.

  In recent years, a quarantine network system has attracted attention as one technique for countermeasures against information leakage. The quarantine network system is a system that improves a security level in a company by isolating a terminal having an insufficient security level from a network used in a normal business.

  Specifically, in a general quarantine network system using the prior art, a network used for normal business (hereinafter referred to as “business network”) and a network for isolating a terminal with an insufficient security level. (Hereinafter referred to as “isolated network”) are constructed by VLAN (Virtual LAN).

  In the quarantine network system, first, the security countermeasure status (application status of security patches distributed from Microsoft, etc., update status of anti-virus software pattern files, etc.) of the terminal (computer) connected to the corporate LAN Checked.

  Next, a terminal whose security countermeasure state does not conform to the in-house security policy is isolated in the isolated network, and after forcibly urging the application of a security patch, it is connected to the business network. Similarly, the quarantine network system also isolates terminals infected with viruses in a quarantine network to prevent the spread of virus infection.

  However, in a conventional quarantine network system, a terminal infected with a virus is also isolated in the same isolated network as the isolated network in which terminals that do not comply with the security policy are isolated. Therefore, a terminal infected with a virus and a terminal with a low security level can communicate with each other in the isolated network, and a phenomenon occurs in which only terminals with a low security level are infected with a virus in the isolated network.

  In order to eliminate the above phenomenon, one VLAN is assigned to each terminal by linking a general L2 intelligent switch (for example, refer to Patent Document 1) corresponding to VLAN and each terminal. . As a result, each terminal can be isolated individually by a separate VLAN, so that a virus-infected terminal and a terminal with a low security level are isolated from each other.

International Publication No. 2004/114599

  However, only terminals connected in a wired LAN environment can be individually isolated by the above-described method using the L2 intelligent switch. On the other hand, in recent years, the introduction of wireless LAN systems is progressing in companies and the like, and the number of terminals connected to a network by radio is increasing. For this reason, it is required to isolate each terminal individually using a VLAN even in a wireless LAN environment.

  An example of an object of the present invention is to provide a connection management device, a terminal device, a connection management method, and a program that can solve the above-described problems and can individually isolate a terminal device in a wireless LAN environment.

In order to achieve the above object, a connection management device according to one aspect of the present invention provides:
In a network in which a business network and an isolation network are constructed by a switch and a wireless LAN access point is connected to the switch, a terminal device connected to the wireless LAN access point is in an illegal state An unauthorized state determination unit that determines whether or not
When there is a terminal device determined to be in an unauthorized state, the wireless LAN access point connected to the terminal device determined to be in an unauthorized state is changed and connected to the wireless LAN access point Limit the possible terminal devices to the terminal devices determined to be in the unauthorized state, and further operate the switch to connect only the wireless LAN access point to one isolation network. And
It is characterized by having.

In order to achieve the above object, in the terminal device according to one aspect of the present invention, a business network and an isolation network are constructed by a switch, and a wireless LAN access point is connected to the switch. In a network, a terminal device connectable to the wireless LAN access point,
An unauthorized state determination unit that determines whether the terminal device is in an unauthorized state;
If it is determined that the wireless LAN access point is connected to the terminal device, the terminal device that can be connected to the wireless LAN access point is limited to the terminal device. , By operating the switch to connect only the wireless LAN access point to one isolation network;
It is characterized by having.

In order to achieve the above object, a connection management method according to one aspect of the present invention includes:
(A) a terminal device connected to the wireless LAN access point in a network in which a business network and an isolation network are constructed by a switch and a wireless LAN access point is connected to the switch; Determining if it is in an unauthorized state, and
(B) When there is a terminal device determined to be in an unauthorized state, the wireless LAN access point is changed by changing the setting of the wireless LAN access point connected to the terminal device determined to be in the unauthorized state Limiting terminal devices connectable to the point to terminal devices determined to be in the unauthorized state; and
(C) operating the switch to connect only the wireless LAN access point to one isolation network; and
It is characterized by having.

Furthermore, in order to achieve the above object, a program according to one aspect of the present invention is provided.
On the computer,
(A) a terminal device connected to the wireless LAN access point in a network in which a business network and an isolation network are constructed by a switch and a wireless LAN access point is connected to the switch; Determining if it is in an unauthorized state, and
(B) When there is a terminal device determined to be in an unauthorized state, the wireless LAN access point is changed by changing the setting of the wireless LAN access point connected to the terminal device determined to be in the unauthorized state Limiting terminal devices connectable to the point to terminal devices determined to be in the unauthorized state; and
(C) operating the switch to connect only the wireless LAN access point to one isolation network; and
Is executed.

  As described above, according to the present invention, terminal devices can be individually isolated under a wireless LAN environment.

FIG. 1 is a block diagram showing configurations of a connection management device and a terminal device according to Embodiment 1 of the present invention. FIG. 2 is a flowchart showing operations of the connection management device and the terminal device according to Embodiment 1 of the present invention. FIG. 3 is a diagram showing a state before the processes from steps A1 to A3 shown in FIG. 2 are executed. FIG. 4 is a diagram showing a state after the processing from steps A1 to A3 shown in FIG. 2 is executed. FIG. 5 is a block diagram showing the configuration of the connection management apparatus according to Embodiment 2 of the present invention. FIG. 6 is a flowchart showing the operation of the connection management apparatus according to Embodiment 2 of the present invention. FIG. 7 is a block diagram illustrating an example of a computer that implements the connection management apparatus according to Embodiments 1 and 2 of the present invention.

(Embodiment 1)
Hereinafter, a connection management device, a terminal device, a connection management method, and a program according to Embodiment 1 of the present invention will be described with reference to FIGS.

[Device configuration]
First, the configuration of the connection management device and the terminal device according to the first embodiment will be described with reference to FIG. FIG. 1 is a block diagram showing configurations of a connection management device and a terminal device according to Embodiment 1 of the present invention.

  As shown in FIG. 1, in the present embodiment, in the network 10, a business network (business network) 11 and an isolation network (isolation network) 12 are connected to an L2 intelligent switch (hereinafter referred to as “L2 switch”). It is written as “.”.

  Further, the wireless LAN access points 30 and 31 are each connected to a port of the L2 switch 20. For this reason, the connection destination of each of the wireless LAN access points 30 and 31 is set to either the business network 11 or the isolated network 12 by the L2 switch 20.

  As shown in FIG. 1, in the first embodiment, the connection management device is provided in the terminal devices 40 and 50 that can be connected to the wireless LAN access point 30 or 31. Specifically, the connection management device is an agent constructed by an agent program installed in each of the terminal devices 40 and 50, and the agent of each terminal device functions as a connection management device.

  That is, in the first embodiment, the agent of the terminal device 40 functions as the connection management device 41, and the agent of the terminal device 50 functions as the connection management device 51. Since the connection management devices 41 and 51 have the same function, the following description will mainly focus on the connection management device 41. Further, it is assumed that the terminal device 40 is connected to the wireless LAN access point 30. In the example of FIG. 1, only the terminal devices 40 and 50 are disclosed, but the number of terminal devices is not particularly limited in the first embodiment.

  As shown in FIG. 1, in the terminal device 40, the connection management device 41 includes an unauthorized state determination unit 42 and a setting change unit 43. The unauthorized state determination unit 42 determines whether the terminal device (own terminal device) 40 on which the connection management device 41 is mounted is in an unauthorized state.

  The setting change unit 43 changes the setting of the wireless LAN access point 30 connected to the terminal device 40 when it is determined that the terminal device 40 is in an unauthorized state. The terminal devices that can be connected are limited to the own terminal device 40. Furthermore, the setting change unit 43 operates the L2 switch 20 to connect only the wireless LAN access point 30 to the isolated network 12.

  Specifically, when it is determined that the terminal device 40 is in an unauthorized state, the setting change unit 43 sets the number of connectable wireless LAN access points 30 connected to the terminal device 40 to one. . Further, the setting changing unit 43 changes the MAC address of the connection destination of the wireless LAN access point 30 to the MAC address of the own terminal device. Then, the setting change unit 43 causes the L2 switch 20 to communicate with the isolated network 12 only at the port to which the wireless LAN access point 30 is connected.

  As described above, in the first embodiment, the wireless LAN access point connected to a terminal device in an unauthorized state limits the connectable terminal devices to only this terminal device, and connects other terminal devices. Discontinue. The L2 switch 20 connects only the wireless LAN access point connected to the terminal device in the unauthorized state to the isolated network 12.

  As a result, since only one terminal device can be connected to the quarantine network 12, the terminal devices in an illegal state are individually isolated, and virus infection between the terminal devices in the quarantine network 12 is prevented.

[Device operation]
Next, operations of the connection management device and the terminal device according to Embodiment 1 of the present invention will be described with reference to FIG. FIG. 2 is a flowchart showing operations of the connection management device and the terminal device according to Embodiment 1 of the present invention. In the following description, FIG. 1 is taken into consideration as appropriate. In the first embodiment, the connection management method is implemented by operating the terminal device (connection management device 41) 40 or the terminal device 50 (connection management device 51). Therefore, the description of the connection management method in the first embodiment is replaced with the following description of the operation of the connection management apparatus.

  Also, as a premise, the following description will focus on the connection management device 41 provided in the terminal device 40. Furthermore, the connection management device 41 is an agent of the terminal device 40 as described above, but the agent is not stopped by a malicious user. Further, it is assumed that both the terminal devices 40 and 50 shown in FIG. 1 are within the communication range of both of the wireless LAN access points 30 and 31, and both are connected to the wireless LAN access point 30 in the initial state. . Further, it is assumed that the number of terminal devices connected to the wireless LAN access points 30 and 31 is equal to or less than the maximum number of connections and has a certain margin.

  As shown in FIG. 2, first, in the connection management device 41 in the terminal device 40, the unauthorized state determination unit 42 determines whether or not the own terminal device 40 is in an unauthorized state (step A1). Specifically, the unauthorized state determination unit 42 determines whether the terminal device 40 is not sensitive to viruses, and whether the security measures are the latest. Judge that there is.

  As a result of the determination in step A1, if it is determined that the state is not in an unauthorized state, the unauthorized state determination unit 42 enters a standby state, and executes step A1 again after a certain period of time or when an external instruction is given. .

  On the other hand, if it is determined in step A1 that the state is in an unauthorized state, the unauthorized state determination unit 42 notifies the setting change unit 43 of the fact. Upon receiving the notification from the unauthorized state determination unit 42, the setting change unit 43 changes the setting of the wireless LAN access point 30 connected to the terminal device 40, and sets a terminal device that can be connected to the wireless LAN access point 30. Limited to the own terminal device 40 (step A2).

  Subsequently, the setting change unit 43 operates the L2 switch 20 to connect only the wireless LAN access point 30 to the isolated network 12 (step A3). As a result, only the terminal device 40 in an unauthorized state is connected to the isolated network 12 via the wireless LAN access point 30. At this time, since the terminal device 50 cannot connect to the wireless LAN access point 30, it starts searching for a new wireless LAN access point.

  Here, it demonstrates concretely using FIG.3 and FIG.4. FIG. 3 is a diagram showing a state before the processes from steps A1 to A3 shown in FIG. 2 are executed. FIG. 4 is a diagram showing a state after the processing from steps A1 to A3 shown in FIG. 2 is executed.

  As shown in FIG. 3, in the initial state, both the terminal devices 40 and 50 are connected to the business network 11 via the wireless LAN access point 30 and the L2 switch 20. In this state, it is assumed that an unauthorized state is detected by the connection management device 41 in the terminal 40. In this case, the connection management device (agent) 41 executes the following processing (a) and processing (b).

[Process (a)]
The connection management device (agent) 41 registers only the MAC address of the terminal device 40 with the wireless LAN access point 30 using the connection MAC address restriction function provided therein.

[Process (a)]
The connection management device (agent) 41 causes the L2 switch 20 to switch the connection destination of the port to which the wireless LAN access point 30 is connected from the business network 11 to the isolated network 12.

  When the above processes (a) to (b) are executed, as shown in FIG. 4, the wireless LAN access point 30 does not permit connection by any terminal device other than the terminal device 40, and the wireless LAN access point 30 Are connected to the isolated network 12.

  Accordingly, the wireless LAN access point 30 is an access point to which the terminal device 40 has been connected so far, and since the connection with the terminal device 40 is continuously secured, the terminal device 40 is immediately connected to the isolated network 12. The For this reason, corrective measures can be taken promptly for the terminal device 40. Further, it becomes impossible for the terminal device 40 to communicate with other terminal devices and further with other terminal devices in an illegal state.

  Also, as shown in FIG. 4, when the process (a) is executed, the connection between the terminal device 50 and the wireless LAN access point 30 is released. Search is performed. As a result, an adjacent wireless LAN access point 31 is found, and the terminal device 50 reconnects with this.

  In the terminal device 50, a communication interruption occurs for a short time during which the wireless LAN access point is switched. This is an event that can occur even in a normal time in a wireless LAN environment. After switching, the terminal device 50 can continue to execute the same processing as before switching.

  By the way, in the example of FIG.3 and FIG.4, it is assumed that the terminal device 40 in an unauthorized state does not require connection by performing a shutdown or the like without correcting the unauthorized state. In this case, the wireless LAN access point 30 is a wireless LAN access point that is connected to the isolated network 12 but is not effectively used. Therefore, in order to avoid such a situation, a wireless LAN access point is provided with a time-out value, and a function is provided to return its own connection setting to the initial state when communication is not performed for a certain period of time. This is the preferred mode.

[Effect of Embodiment 1]
As described above, according to the first embodiment, it is possible to prevent virus infection between terminal devices in the isolated network 12 in a wireless LAN environment. The reason is that only one terminal device can be connected to the isolation network 12.

  Furthermore, the first embodiment can be easily introduced in an existing wireless LAN environment. The reason is that the terminal device connection restriction is realized by utilizing the standard function (MAC address restriction function) of the wireless LAN access point.

  In the example of FIG. 1, only one isolation network is illustrated, but in the first embodiment, a plurality of isolation networks may be constructed. In this case, the setting change unit 43 selects one isolated network, and connects only one wireless LAN access point to which the terminal device in an unauthorized state is connected to the selected isolated network. According to this aspect, even when a plurality of terminal devices determined to be in an unauthorized state exist at the same time, these terminal devices can be individually connected to the isolated network at the same time.

[program]
The program in the first embodiment may be a program that causes a computer to execute steps A1 to A3 shown in FIG. By installing and executing this program on a computer, the connection management device, the terminal device, and further the connection management method in the first embodiment can be realized. In this case, a CPU (Central Processing Unit) of the computer functions as an unauthorized state determination unit 42 (or 52) and a setting change unit 43 (or 53) to perform processing.

(Embodiment 2)
Next, a connection management device, a connection management method, and a program according to Embodiment 2 of the present invention will be described with reference to FIGS.

[Device configuration]
Initially, the structure of the connection management apparatus in this Embodiment 2 is demonstrated using FIG. FIG. 1 is a block diagram showing configurations of a connection management device and a terminal device according to Embodiment 1 of the present invention.

  In the second embodiment, unlike the first embodiment, as shown in FIG. 5, there is one connection management apparatus 100 connected to the network 10. In each of the terminal devices 60 and 70, a connection management device is not incorporated, but a general agent 61 (or 71) is incorporated. Except for this point, the second embodiment is the same as the first embodiment, and the following description will focus on differences from the first embodiment.

  In the first embodiment, the connection management device manages the connection of only the terminal device on which it is mounted. However, in the second embodiment, the connection management device 100 is connected to a wireless LAN access point. Connection can be managed for all terminal devices (terminal devices 60 and 70 in the example of FIG. 5). Specifically, the unauthorized state monitoring unit 101 determines whether any terminal device is in an unauthorized state for all terminal devices connected to the wireless LAN access points 30 and 31.

  Then, when there is a terminal device in an unauthorized state, the setting change unit 102 sets the connectable number of wireless LAN access points to which the terminal device in an unauthorized state is connected to one. Furthermore, the setting change unit 102 changes the MAC address of the connection destination of this wireless LAN access point to the MAC address of the terminal device in an unauthorized state. Then, the setting change unit 43 causes the L2 switch 20 to communicate with the isolated network 12 only through the port to which this wireless LAN access point is connected.

  Specifically, the connection management apparatus 100 manages a list of each wireless LAN access point, location information indicating the installation position of each wireless LAN access point, and the SSID of each wireless LAN access point. The connection management device 100 also manages the identifiers and MAC addresses of terminal devices connected to each wireless LAN access point. Then, the unauthorized state monitoring unit 101 and the setting changing unit 102 execute the above-described processing based on these pieces of information.

  In the second embodiment, when an unauthorized state occurs in any of the terminal devices, the setting change unit 102 acquires information on the wireless LAN access point to which this terminal device is connected, and this wireless LAN access point It is possible to specify another terminal device in a normal state connected to the. In this case, the setting changing unit 102 searches for each wireless LAN access point having a sufficient capacity in the vicinity of the identified terminal device, guides the SSID to the agent of each terminal device, and switches the connection. Can be encouraged.

[Device operation]
Next, operations of the connection management device and the terminal device according to Embodiment 2 of the present invention will be described with reference to FIG. FIG. 6 is a flowchart showing the operation of the connection management apparatus according to Embodiment 2 of the present invention. In the following description, FIG. In the second embodiment, the connection management method is implemented by operating the connection management apparatus 100. Therefore, the description of the connection management method in the second embodiment is replaced with the following description of the operation of the connection management apparatus 100.

  As shown in FIG. 6, first, in the connection management device 100, the unauthorized state determination unit 101 determines whether any terminal device is in an unauthorized state (step B1). Specifically, the unauthorized state determination unit 101 determines whether a terminal device connected to any one of the wireless LAN access points is not sensitive to viruses, and whether the security measures are the latest. Is determined to be in an unauthorized state.

  If there is no terminal in an unauthorized state as a result of the determination in Step B1, the unauthorized state determining unit 101 enters a standby state and executes Step B1 again after a certain period of time or when an external instruction is given. To do.

  On the other hand, if there is a terminal device in an unauthorized state as a result of the determination in step B1, the unauthorized state determining unit 101 notifies the setting changing unit 102 of the fact. When receiving the notification from the unauthorized state determining unit 101, the setting changing unit 102 specifies the wireless LAN access point to which the terminal device in the unauthorized state is connected. Then, the setting change unit 102 changes the setting of the specified wireless LAN access point to limit the terminal devices that can be connected to the specified wireless LAN access point to the terminal devices that have been determined to be in an unauthorized state (step B2). ).

  Subsequently, the setting change unit 43 operates the L2 switch 20 to connect only the wireless LAN access point specified in step B2 to the isolated network 12 (step B3). As a result, only the terminal device in an unauthorized state is connected to the isolated network 12 via the wireless LAN access point specified in step B2. As a result, the normal terminal device 31 connected to the wireless LAN access point characterized in step B2 cannot connect to the wireless LAN access point, and thus starts searching for a new wireless LAN access point. .

[Effect of Embodiment 2]
As described above, according to the second embodiment, only one terminal device can be connected to the isolated network 12 in the same manner as in the first embodiment. It is possible to prevent virus infection between terminal devices.

  In the example of FIG. 5, only one isolation network 12 is illustrated. However, in the second embodiment, a plurality of isolation networks may be constructed as in the first embodiment. In this case, the setting change unit 101 selects one isolated network, and connects only one wireless LAN access point to which the terminal device in an unauthorized state is connected to the selected isolated network.

  Furthermore, as described above, when a plurality of isolated networks are constructed, in the second embodiment, the connection management apparatus 100 can limit the number of wireless LAN access points connected to the isolated network. . In this aspect, when a computer virus is prevalent, the number of terminal devices in an unauthorized state increases, and as a result, the number of access points connected to the quarantine network 12 increases, an access point to which a terminal device in a normal state can connect Can be avoided.

Specifically, the maximum connection number of wireless LAN access points is a, the number of wireless LAN access points is n, and m of the terminal device connected to the network. The setting change unit 102 preferably performs processing so that the number of wireless LAN access points connected to the isolated network 12 is equal to or less than A calculated by the following equation (1).
A = (an−m) / (a−1) (1)

[program]
The program in the second embodiment may be a program that causes a computer to execute steps B1 to B3 shown in FIG. By installing and executing this program on a computer, the connection management apparatus 100 and the connection management method in the second embodiment can be realized. In this case, a CPU (Central Processing Unit) of the computer functions as an unauthorized state determination unit 101 and a setting change unit 102 to perform processing.

  Here, a computer that realizes the connection management apparatus by executing the program according to the first and second embodiments will be described with reference to FIG. FIG. 7 is a block diagram illustrating an example of a computer that implements the connection management apparatus according to Embodiments 1 and 2 of the present invention.

  As shown in FIG. 7, the computer 110 includes a CPU 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These units are connected to each other via a bus 121 so that data communication is possible.

  The CPU 111 performs various calculations by developing the program (code) in the present embodiment stored in the storage device 113 in the main memory 112 and executing them in a predetermined order. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). Further, the program in the present embodiment is provided in a state of being stored in a computer-readable recording medium 120. Note that the program in the present embodiment may be distributed on the Internet connected via the communication interface 117.

  Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and an input device 118 such as a keyboard and a mouse. The display controller 115 is connected to the display device 119 and controls display on the display device 119.

  The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, and reads a program from the recording medium 120 and writes a processing result in the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and another computer.

  Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic storage media such as a flexible disk, or CD- An optical storage medium such as ROM (Compact Disk Read Only Memory) can be used.

  As described above, according to the present invention, terminal devices can be individually isolated under a wireless LAN environment. The present invention is useful in various networks in which a wireless LAN environment is established.

DESCRIPTION OF SYMBOLS 10 Network 11 Business network 12 Isolation network 20 L2 intelligence switch 30 Wireless LAN access point 31 Wireless LAN access point 40 Terminal apparatus 41 Connection management apparatus (agent)
42 Unauthorized State Determination Unit 43 Setting Change Unit 50 Terminal Device 51 Connection Management Device (Agent)
52 Unauthorized state determination unit 60 Terminal device 61 Agent 70 Terminal device 71 Agent 100 Connection management device 101 Unauthorized state determination unit 102 Setting change unit 110 Computer 111 CPU
112 Main Memory 113 Storage Device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Device 119 Display Device 120 Recording Medium 121 Bus

Claims (10)

In a network in which a business network and an isolation network are constructed by a switch and a wireless LAN access point is connected to the switch, a terminal device connected to the wireless LAN access point is in an illegal state An unauthorized state determination unit that determines whether or not
When there is a terminal device determined to be in an unauthorized state, the wireless LAN access point connected to the terminal device determined to be in an unauthorized state is changed and connected to the wireless LAN access point Limit the possible terminal devices to the terminal devices determined to be in the unauthorized state, and further operate the switch to connect only the wireless LAN access point to one isolation network. And
A connection management device comprising:   The setting change unit sets the connectable number of wireless LAN access points connected to the terminal device determined to be in the unauthorized state to one, and further sets the MAC address of the connection destination as the unauthorized state. The terminal device that can be connected to the wireless LAN access point is limited to the terminal device determined to be in the unauthorized state by changing to the MAC address of the terminal device determined to be in the network. Connection management device. The connection management device is provided in the terminal device,
The connection management device according to claim 1, wherein the unauthorized state determination unit determines whether a terminal device including the connection management device is in an unauthorized state. A terminal device connectable to the wireless LAN access point in a network in which a business network and an isolation network are constructed by a switch, and a wireless LAN access point is connected to the switch,
An unauthorized state determination unit that determines whether the terminal device is in an unauthorized state;
If it is determined that the wireless LAN access point is connected to the terminal device, the terminal device that can be connected to the wireless LAN access point is limited to the terminal device. , By operating the switch to connect only the wireless LAN access point to one isolation network;
A terminal device comprising:   The setting change unit sets the connectable number of wireless LAN access points connected to the terminal device to one, and further changes the MAC address of the connection destination to the MAC address of the terminal device. The terminal device according to claim 4, wherein a terminal device connectable to the wireless LAN access point is limited to the terminal device. (A) a terminal device connected to the wireless LAN access point in a network in which a business network and an isolation network are constructed by a switch and a wireless LAN access point is connected to the switch; Determining if it is in an unauthorized state, and
(B) When there is a terminal device determined to be in an unauthorized state, the wireless LAN access point is changed by changing the setting of the wireless LAN access point connected to the terminal device determined to be in the unauthorized state Limiting terminal devices connectable to the point to terminal devices determined to be in the unauthorized state; and
(C) operating the switch to connect only the wireless LAN access point to one isolation network; and
A connection management method characterized by comprising:   In the step (b), the number of connectable wireless LAN access points connected to the terminal device determined to be in the unauthorized state is set to one, and the MAC address of the connection destination is The terminal device connectable to the wireless LAN access point is limited to the terminal device determined to be in the unauthorized state by changing to the MAC address of the terminal device determined to be in the unauthorized state. The connection management method described. On the computer,
(A) a terminal device connected to the wireless LAN access point in a network in which a business network and an isolation network are constructed by a switch and a wireless LAN access point is connected to the switch; Determining if it is in an unauthorized state, and
(B) When there is a terminal device determined to be in an unauthorized state, the wireless LAN access point is changed by changing the setting of the wireless LAN access point connected to the terminal device determined to be in the unauthorized state Limiting terminal devices connectable to the point to terminal devices determined to be in the unauthorized state; and
(C) operating the switch to connect only the wireless LAN access point to one isolation network; and
A program that executes   In the step (b), the number of connectable wireless LAN access points connected to the terminal device determined to be in the unauthorized state is set to one, and the MAC address of the connection destination is 9. The terminal device that can be connected to the wireless LAN access point is limited to the terminal device determined to be in the unauthorized state by changing to the MAC address of the terminal device determined to be in the unauthorized state. The program described. The computer is a terminal device connected to the wireless LAN access point;
In the step (a), it is determined whether the computer is in an unauthorized state,
In the step (b), when the computer is in an unauthorized state, a setting of a wireless LAN access point connected to the computer is changed, and a terminal device connectable to the wireless LAN access point is changed to the computer Limited to
The program according to claim 8 or 9.

Images