JP3875578B2 - Communication terminal, program, recording medium, wireless communication network, and communication control method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a security technique for a wireless communication terminal.
[0002]
[Prior art]
In recent years, various wireless LANs having communication terminals such as mobile computers and PDAs having a wireless communication function and a plurality of base stations (also called access points) that perform wireless communication with the communication terminals have been put into practical use. Yes. In such a wireless LAN, a communication terminal is connected to another communication terminal in the wireless LAN or connected to the wireless LAN via a base station that covers the wireless area in which the terminal is located. You can access the Internet.
[0003]
[Problems to be solved by the invention]
By the way, with the development of information communication technology, miniaturization and cost reduction of base station facilities in wireless LANs have been progressing rapidly in recent years. Such a situation brings many benefits to the spread of wireless LANs, but it makes it relatively easy for a malicious third party to impersonate a legitimate base station by setting up a fake base station, for example. There are also points to be worried about. If a fake base station is installed by a malicious third party, the fake base station may contain, for example, advertisement information that is not normally received by a communication terminal or a computer virus. There is a risk that a program or the like distributed to a communication terminal or personal information stored in the communication terminal is secretly stolen.
[0004]
The present invention has been made in view of the circumstances described above, and an object thereof is to improve the security function of a wireless communication terminal.
[0005]
[Means for Solving the Problems]
In order to solve the above problems, the present invention provides: Communication network identification information for identifying a wireless communication network to which the communication terminal belongs, and base station identification information of one or more base stations that constitute the wireless communication network and are permitted to perform wireless communication with the communication terminal. First receiving means for receiving by wired communication, storage control means for storing the communication network identification information and base station identification information received by the first receiving means in the storage means, This This From a base station that covers the wireless area where the communication terminal is located , The base station belongs Wireless communication network Communication network identification information and base station identification information of the base station By wireless communication Receive first 2 Receiving means, and the first 2 The communication network identification information received by the receiving means matches the communication network identification information stored in the storage means, and 2 Determining means for determining whether or not the base station identification information received by the receiving means matches any of the base station identification information stored in the storage means, and the base station according to the determination result by the determining means Determination means for determining whether or not communication is possible Ru A communication terminal is provided.
[0006]
In addition, this invention Through Front terminal Writing In a wireless communication network having one or more base stations that perform wireless communication with a communication terminal, each of the base stations includes: Identify the wireless communication network Communication network identification information and base station identification information for identifying the base station wireless Has a transmission means to transmit, before Writing The communication terminal Wired communication between communication network identification information of a wireless communication network to which the communication terminal belongs, and base station identification information of one or more base stations constituting the wireless communication network and permitted to perform wireless communication with the communication terminal First receiving means for receiving the communication network identification information and base station identification information received by the first receiving means. Storage means Storage control means for storing This This From the base station covering the wireless area where the communication terminal is located, by the transmission means wireless Sent Tadori Receives network identification information and base station identification information Second Receiving means; and Second The communication network identification information received by the receiving means matches the communication network identification information stored in the storage means, and the Second Determining means for determining whether or not the base station identification information received by the receiving means matches any of the base station identification information stored in the storage means; and the base station according to the determination result by the determining means A wireless communication network having a determination unit that determines whether or not communication is possible.
[0007]
In addition, this invention A communication terminal is a communication network identification information for identifying a wireless communication network to which the communication terminal belongs, and a base station of one or more base stations constituting the wireless communication network and permitted to perform wireless communication with the communication terminal A first step of receiving identification information by wired communication; a second step of storing the communication network identification information and base station identification information received in the first step by the communication terminal in a memory; The base station is a wireless communication network to which the base station belongs. of Communication network identification information and base station concerned of Base station identification information wireless Send Third Process, Above The communication terminal This From the base station covering the wireless area where the communication terminal is located Third Sent in the process Tadori Receives network identification information and base station identification information 4th Process and before Writing Communication terminal 4th The network identification information received in the process is Stored in the memory Matches the network identification information, and 4th The base station identification information received in the process is Any of those stored in the memory Base station identification information News and Determine whether they match 5th Process and before Writing Communication terminal 5th In the process Oke Determine whether communication with the base station is possible 6th A communication control method having a process is provided.
[0008]
According to this invention , Through The communication terminal authenticates the base station using the communication network identification information and the base station identification information, and determines whether or not communication with the base station is possible.
[0011]
In addition, this invention Through In the computer equipped with the communication terminal, Communication network identification information for identifying a wireless communication network to which the communication terminal belongs, and base station identification information of one or more base stations that constitute the wireless communication network and are permitted to perform wireless communication with the communication terminal. A first step of receiving by wire communication, a second step of storing the communication network identification information and base station identification information received in the first step in a memory, From the base station that covers the wireless area where the communication terminal is located , The base station belongs Wireless communication network Communication network identification information and the base station of Base station identification information By wireless communication Receive You Ru Third Step and said Third To step The The received network identification information is Stored in the memory Matches the network identification information, and Third To step The The received base station identification information Any of those stored in the memory Base station identification information News and Determine whether they match 4th Step and said 4th To step Oke According to the discrimination result Before Base station With Decide whether communication is possible 5th A program for executing the steps is provided.
[0012]
According to this invention , Through When the computer provided in the communication terminal executes the program , Through The communication terminal authenticates the base station using the communication network identification information and the base station identification information, and determines whether or not communication with the base station is possible.
[0013]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings. In addition, the same code | symbol is attached | subjected to the common part in each figure.
[0014]
[A-1. Configuration of Embodiment]
<1. Wireless LAN Configuration>
FIG. 1 is a block diagram illustrating the configuration of a wireless LAN 1 according to the present invention. As shown in the figure, the wireless LAN 1 includes a gateway server 10, a control server 20, base stations 30a and 30b, and a communication terminal 40. In FIG. 1, only the predetermined gateway server 10, the predetermined base stations 30a and 30b, and the predetermined communication terminal 40 configuring the wireless LAN 1 are shown in order to prevent the drawing from becoming complicated. Hereinafter, in the present specification, the base stations 30a and 30b are referred to as the base station 30 and the basic service areas 35a and 35b are referred to as the basic service area 35, unless particularly distinguished.
[0015]
The gateway server 10 has a function for interconnecting the wireless LAN 1 and the Internet. In addition, the control server 20 includes, for each communication terminal 40 subscribing to the packet communication service provided by the wireless LAN 1, a terminal ID of the communication terminal 40 and a basic service area in which the communication terminal 40 is currently located. 35, the base station ID of the base station 30 covering 35 is registered.
[0016]
The base station 30 performs wireless communication with the communication terminal 40 in the basic service area 35 covered by the own station 30, and transmits and receives packet data. The base station 30 periodically broadcasts a beacon including an SSID (Service Set IDentification) and a MAC (Media Access Control) address to be described later in the basic service area 35 of the own station 30.
[0017]
The extended service area 36 shown in FIG. 1 is an area in which the basic service areas 35 of the base stations 30 constituting the wireless LAN 1 are collected, and the communication terminal 40 enjoys packet communication services using the wireless LAN 1. It shows the entire area that can be used.
[0018]
The communication terminal 40 is a mobile device that receives a packet communication service provided by the wireless LAN 1, and is, for example, a mobile computer or a PDA having a wireless communication function. The communication terminal 40 performs wireless communication with the base station 30 covering the basic service area 35 where the terminal 40 is located, and communicates with other communication terminals 40 and the Internet in the wireless LAN 1 via the base station 30. It has a function of performing packet communication with various connected communication devices. Further, the communication terminal 40 has a base station authentication function for authenticating the base station 30 used as a relay device in packet communication.
[0019]
<2. Base station configuration>
FIG. 2 is a block diagram illustrating a hardware configuration of the base station 30 shown in FIG. As shown in the figure, the base station 30 includes a wired communication interface 301, a storage unit 302, a wireless communication unit 306, and a CPU 307, and these units are connected by a bus 308. The storage unit 302 includes a ROM 303, a RAM 304, and a nonvolatile memory 305.
[0020]
The wired communication interface 301 controls wired communication performed by the base station 30 with the gateway server 10, the control server 20, or another base station 30. This wired communication interface 301 controls communication in a so-called Ethernet conforming to IEEE (Institute of Electrical and Electronic Engineers) 802.3, and is a ROM provided in the wired communication interface 301 and not shown. Is written with the MAC address 301a.
[0021]
Here, the data structure of the MAC address 301a will be described with reference to FIG. In the figure, the MAC address 301a is expressed in hexadecimal notation, and each byte is separated by a colon. The MAC address 301a has a data length of 6 bytes, the upper 3 bytes are vendor IDs assigned by IEEE for each vendor, and the lower 3 bytes are product IDs assigned by the vendor for each product. In this embodiment, this MAC address 301 a is used as base station identification information for identifying the base station 30.
[0022]
Returning to FIG. 2, the ROM 303 stores a program for performing basic control of each part of the base station 30. The RAM 304 is used as a work area for the CPU 307, and temporarily stores programs executed by the CPU 307 and various data. The CPU 307 controls various units connected via the bus 308 by executing various programs stored in the storage unit 302.
[0023]
The nonvolatile memory 305 stores programs and data for the base station 30. The nonvolatile memory 305 is provided with an SSID storage area 305a. In this SSID storage area 305a, the SSID for identifying the wireless LAN to which the base station 30 belongs, or if each base station 30 constituting the wireless LAN 1 is divided into a plurality of groups, the base station 30 The SSID for identifying the group to which the belongs is stored. This SSID is set by the administrator of the wireless LAN 1 when the base station 30 is installed, and stored in the SSID storage area 305a.
[0024]
In addition to this, the nonvolatile memory 305 belongs to the same group as the base station 30 in the wireless LAN 1 or the terminal ID of each communication terminal 40 subscribing to the packet communication service by the wireless LAN 1, for example. A subscription terminal list in which the terminal ID of each communication terminal 40 is registered is stored. This subscribed terminal list is used for the base station 30 to authenticate the communication terminal 40 that has accessed the base station 30.
[0025]
The wireless communication unit 306 controls wireless communication performed with the communication terminal 40. Under the control of the CPU 307, the wireless communication unit 306 generates a beacon including the SSID stored in the SSID storage area 305a and the MAC address 301a stored in the wired communication interface 301. Broadcasts periodically in the basic service area 35 of the own station 30. In addition, the wireless communication unit 306 generates a transmission signal on which packet data is superimposed and transmits the transmission signal to the communication terminal 40 in the basic service area 35, and demodulates the wireless signal received from the communication terminal 40 to obtain packet data and the like. .
[0026]
In the present embodiment, a case where the MAC address 301a stored in the wired communication interface 301 is broadcast and included in a beacon will be described. For example, wireless communication is performed in a memory in the wireless communication unit 306 that is not illustrated. The MAC address 301a for the unit 306 is stored in advance, and instead of the MAC address 301a stored in the wired communication interface 301, the MAC address 301a stored in the wireless communication unit 306 is included in the beacon. The form to broadcast may be sufficient. Also, for example, beacons are periodically broadcast at a rate of about several times per second, but are not necessarily broadcast at the same period, and are broadcast at a timing deviating from a predetermined period. There is also.
[0027]
<3. Configuration of communication terminal>
FIG. 4 is a block diagram illustrating a hardware configuration of the communication terminal 40 shown in FIG. As shown in the figure, the communication terminal 40 includes a wireless communication unit 401, an operation input unit 402, a liquid crystal display unit 403, a wired communication interface 404, a storage unit 405, and a CPU 409. These units are connected by a bus 410. In addition, the storage unit 405 includes a ROM 406, a RAM 407, and a nonvolatile memory 408 such as an SRAM (Static-RAM), an EEPROM (Electrically Erasable Programmable-ROM), or a hard disk.
[0028]
The wireless communication unit 401 controls wireless communication performed with the base station 30. The wireless communication unit 401 generates a transmission signal on which, for example, packet data is superimposed and transmits the transmission signal to the base station 30 under the control of the CPU 409. The wireless communication unit 401 receives a beacon broadcast from the base station 30 or a wireless signal transmitted from the base station 30 to the terminal 40, demodulates them, and includes the base station 30 included in the beacon. SSID and MAC address 301a, or packet data addressed to the terminal 40 is obtained.
[0029]
The operation input unit 402 has a keyboard and a pointing device for inputting characters, operation instructions, and the like, and outputs a command corresponding to the operation input to the CPU 409. The liquid crystal display unit 403 includes a liquid crystal display panel and a drive circuit that performs display control of the liquid crystal display panel. The wired communication interface 404 controls wired communication performed between the communication terminal 40 and various communication devices connected to the Internet, for example. The ROM 406 stores a program for performing basic control of each part of the communication terminal 40. The RAM 407 is used as a work area for the CPU 409, and temporarily stores programs executed by the CPU 409 and various data.
[0030]
The nonvolatile memory 408 stores various programs and data such as an operating system and application programs for the communication terminal 40 and a terminal ID of the communication terminal 40, for example. The nonvolatile memory 408 has an SSID storage area 408a, a base station address storage table 408b, and a visited area ID storage area 408c.
[0031]
Here, the SSID storage area 408a stores an SSID for identifying the wireless LAN 1 to which the communication terminal 40 belongs, or an SSID for identifying the group of the wireless LAN 1 to which the communication terminal 40 belongs. This SSID is assigned to the communication terminal 40 according to the subscription contract of the packet communication service, and is stored in the SSID storage area 408a.
[0032]
The base station address storage table 408b is a data table used for the communication terminal 40 to perform authentication processing of the base station 30 used as a relay device in packet communication. In the base station address storage table 408b, as shown in FIG. 5, the MAC address 301a of each base station 30 constituting the wireless LAN 1 to which the communication terminal 40 belongs, or the same as the communication terminal 40 in the wireless LAN 1 The MAC address 301a of each base station 30 belonging to the group is stored.
[0033]
This base station address storage table 408b is downloaded to the communication terminal 40 via the Internet from a service management center (not shown) operated by the communication carrier of the wireless LAN 1 and stored in the nonvolatile memory 408, for example. The base station address storage table 408b may be downloaded from the service management center to the communication terminal 40 by wireless communication via the wireless LAN 1.
[0034]
Returning to FIG. 4, in the area ID storage area 408c, the MAC address 301a of the base station 30 is stored as the area ID for identifying the basic service area 35 in which the communication terminal 40 is currently located. . In addition, when the communication terminal 40 is outside the extended service area 36 of the wireless LAN 1 or in a place where radio waves do not reach, data indicating that the communication terminal 40 is out of service is stored in the service area ID storage area 408c.
[0035]
The CPU 409 controls each unit connected via the bus 410 by executing various programs stored in the storage unit 405. The CPU 409 decodes the SSID and the MAC address 301a from the beacon of the base station 30 received by the wireless communication unit 401 as processing unique to the present embodiment, and first stores the decoded SSID and the SSID storage area 408a. The base station 30, which is the broadcast source of the received beacon, is discriminated whether or not it belongs to the same wireless LAN 1 or the same group as the own terminal 40.
[0036]
When the CPU 409 determines that the base station 30 that is the broadcast source of the received beacon belongs to the same wireless LAN 1 or the same group as the own terminal 40, then the MAC address 301a decoded from the beacon is It is determined whether or not it matches any one of the MAC addresses 301a stored in the address storage table 408b. When the CPU 409 determines that the MAC address 301a decoded from the beacon matches any one of the MAC addresses 301a in the base station address storage table 408b, the CPU 409 sets the base station 30 serving as the broadcast source of the received beacon to the wireless LAN 1 Is authenticated as a valid base station 30, and communication with this base station 30 is permitted.
The above is the configuration of the wireless LAN 1 according to the present embodiment.
[0037]
[A-2. Operation of the embodiment]
Next, the operation of this embodiment will be described.
<1. Download base station address storage table>
A user who subscribes to a packet communication service using the wireless LAN 1 needs to first download the base station address storage table 408 b to the communication terminal 40. For this reason, for example, the user connects a communication cable to the wired communication interface 404 of the communication terminal 40 and accesses the service management center operated by the wireless LAN 1 telecommunications carrier via the general public network or the Internet. To do.
[0038]
The service management center manages the base station address storage table 408b as part of the service for the user, and transmits the base station address storage table 408b to the communication terminal 40 in response to a download request from the communication terminal 40. When receiving the base station address storage table 408b via the wired communication interface 404, the communication terminal 40 stores the base station address storage table 408b in the nonvolatile memory 408.
[0039]
As described above, downloading of the base station address storage table 408b may be performed by wireless communication via the wireless LAN 1, and is not downloaded but distributed from the service management center to the communication terminal 40. It may be a form. However, in any case, data is encrypted or personal authentication is performed at the time of download or distribution in order to prevent the base station address storage table 408b from being leaked to a third party due to eavesdropping or the like.
[0040]
<2. Beacon broadcast processing>
The base station 30 broadcasts a beacon including the SSID of the local station 30 and the MAC address 301a at regular intervals. The processing performed by the base station 30 to broadcast a beacon will be described. First, the CPU 307 of the base station 30 and the SSID stored in the SSID storage area 305 a and the MAC address 301 a stored in the wired communication interface 301. Are transferred to the wireless communication unit 306.
[0041]
The wireless communication unit 306 stores the transferred SSID and MAC address 301a in a RAM (not shown) provided in the wireless communication unit 306. Next, the wireless communication unit 306 generates beacon signal data including the SSID and MAC address 301a stored in the RAM, and when the predetermined period is reached, the beacon is broadcast in the basic service area 35 of the own station 30. To do.
[0042]
<3. Base station decision processing>
Next, base station determination processing executed by the CPU 409 in the communication terminal 40 will be described. FIG. 6 is a flowchart showing the operation of the base station determination process. This base station determination process is executed by the CPU 409 at regular intervals by a timer interrupt or the like.
[0043]
As shown in the figure, first, the CPU 409 causes the wireless communication unit 401 to scan all channels capable of receiving beacons broadcasted by the base station 30 (step S101). Next, the CPU 409 determines the presence or absence of a receivable beacon based on the scanned result (step S102). If there is no receivable beacon (step S102: No), the CPU 409 determines that the communication terminal 40 is out of range. Then, after storing the data indicating the out of service area in the located area ID storage area 408c (step S103), the base station determination process is terminated.
[0044]
If the CPU 409 determines that there are at least one type of beacon that can be received (step S102: Yes), the CPU 409 first causes the wireless communication unit 401 to receive one or more types of beacons. In this specification, beacons broadcast from different base stations 30 are defined as different types of beacons. That is, when there are a plurality of types of beacons that can be received, for example, a part of the basic service area 35 between the adjacent base stations 30 in the wireless LAN 1 is overlapped, When the communication terminal 40 is located, the basic service area 35 of the base station 30 of the wireless LAN 1 overlaps with the basic service area of another base station of the wireless LAN, and the overlapping area of this basic service area This is the case where the communication terminal 40 is present.
[0045]
Next, the CPU 409 determines whether or not a plurality of types of beacons have been received by the wireless communication unit 401 (step S104). If only one type of beacon has been received, the process proceeds to step S108. If the CPU 409 determines that a plurality of types of beacons have been received, the CPU 409 then causes the radio communication unit 401 to measure the radio wave reception intensity of each type of beacon (step S105), and determines the radio wave reception intensity based on the measurement value. Each beacon is ranked in order of strength (step S106).
[0046]
Thereafter, the CPU 409 first selects the beacon having the highest rank among the ranked beacons, that is, the beacon having the strongest radio wave reception intensity (step S107), and decodes the beacon to the wireless communication unit 401. (Step S108). By this decoding process, the CPU 409 can obtain the SSID and MAC address 301a of the base station 30 included in the beacon. If there is only one type of received beacon, naturally this one type of beacon will be decoded.
[0047]
After this, the CPU 409 Z Then, it is determined whether or not the SSID obtained by decoding the beacon matches the SSID stored in the SSID storage area 408a (step S109). As a result, when the SSID obtained by decoding the beacon does not match the SSID stored in the SSID storage area 408a, the CPU 409 determines that the base station 30 that is the broadcast source of this beacon is the wireless to which the communication terminal 40 belongs. It is determined that the base station 30 is not the LAN 1 base station 30 or belongs to the same group as the communication terminal 40, and the process returns to step S107.
[0048]
Here, after returning to step S107, the CPU 409 selects the beacon having the next highest rank from the beacons that have been collated with the previous SSID from among the ranked beacons, and is shown in steps S108 and S109. Run the process again. When there is no selectable beacon, the CPU 409 determines that the communication terminal 40 is out of the service area, moves to step S103, and stores data indicating that the communication terminal 40 is out of service area in the service area ID storage area 408c. Thereafter, the base station determination process is terminated.
[0049]
On the other hand, if the CPU 409 determines in step S109 that the SSID obtained by decoding the beacon matches the SSID stored in the SSID storage area 408a, the base station 30 that is the broadcast source of the beacon The base station 30 of the wireless LAN 1 to which the communication terminal 40 belongs, or the base station 30 that belongs to the same group as the communication terminal 40 is determined, and the base station authentication process is executed (step S110).
[0050]
<4. Base station authentication processing>
Next, base station authentication processing executed by CPU 409 of communication terminal 40 as a subroutine of base station determination processing (see FIG. 6) will be described with reference to FIG. As shown in the figure, first, the CPU 409 acquires the MAC address 301a of the base station 30 decoded from the beacon in step S108 of the base station determination process (step S201).
[0051]
Next, the CPU 409 checks the acquired MAC address 301a, that is, the MAC address 301a obtained by decoding the beacon, with the base station address storage table 408b (step S202). Then, the CPU 409 determines whether or not the MAC address 301a obtained by decoding the beacon matches any MAC address 301a in the base station address storage table 408b (step S203).
[0052]
As a result, if the CPU 409 determines that the MAC address 301a obtained by decrypting the beacon does not match any MAC address 301a in the base station address storage table 408b, the base station 30 may, for example, It determines with it being a fake base station installed by a certain 3rd party, and returns to step S107 of the base station determination process mentioned above. Then, the CPU 409 selects the beacon having the next highest rank after the beacon for which the previous SSID has been collated, and executes the processing after step S108.
[0053]
That is, even when the communication terminal 40 is near the fake base station, the communication terminal 40 avoids communication with the fake base station, and the valid base station 30 of the wireless LAN 1 to which the own terminal 40 belongs or The legitimate base station 30 belonging to the same group as the terminal 40 is searched. If a fake base station is detected in step S203, the communication terminal 40 notifies the user that a fake base station has been detected, or a service management center operated by a wireless LAN 1 carrier. May be notified that a fake base station has been detected.
[0054]
On the other hand, if the CPU 409 determines in step S203 that the MAC address 301a obtained by decoding the beacon matches one of the MAC addresses 301a in the base station address storage table 408b, the beacon broadcaster A certain base station 30 is authenticated as a legitimate base station 30 of the wireless LAN 1 to which the own terminal 40 belongs, or a legitimate base station 30 belonging to the same group as the own terminal 40 (step S204). Communication with the station 30 is permitted (step S205). Then, the CPU 409 stores the MAC address 301a of the base station 30 in the area ID storage area 408c (step S206), and ends the base station authentication process.
[0055]
The MAC address 301a stored in the area ID storage area 408c is stored in the base station determination process (see FIG. 6) and the base station authentication process (see FIG. 6) when the communication terminal 40 moves to another basic service area 35. After the authentication of the destination base station 30 is executed, the MAC address 301a of the base station 30 is rewritten.
[0056]
The CPU 409 of the communication terminal 40 is connected to, for example, another communication terminal 40 in the wireless LAN 1 or the Internet via the base station 30 when, for example, the user instructs execution of packet communication by an operation input. When starting packet communication with a communication device, the base station 30 specified by the MAC address 301a stored in the area ID storage area 408c is accessed, and packet communication is performed via the base station 30. . When data indicating that it is out of service area is stored in the in-service area ID storage area 408c when starting packet communication, the CPU 409 determines that the communication terminal 40 is out of service area, and out of service area. Therefore, a message indicating that packet communication is not possible is displayed on the liquid crystal screen.
[0057]
As described above, according to the present embodiment, the communication terminal 40 decodes the SSID and MAC address 301a of the base station 30 included in the received beacon, and the SSID obtained by decoding the beacon is the SSID storage area. By determining whether the MAC address 301a that matches the SSID stored in 408a and the MAC address 301a obtained by decoding the beacon matches any MAC address 301a in the base station address storage table 408b, The base station 30 is authenticated. Further, when the own terminal 40 is in an area where a plurality of basic service areas 35 overlap, the communication terminal 40 measures the radio wave reception intensity of the beacon received from each base station 30 and determines the radio wave reception intensity. Authentication of the base station 30 is performed in order of strength.
[0058]
Thus, by providing the communication terminal 40 with the authentication function of the base station 30 using the SSID and the MAC address 301a, the security function of the communication terminal 40 can be improved.
[0059]
[B. Modified example]
As mentioned above, although embodiment of this invention was described, this invention can be implemented with another various form, without deviating from the main characteristic. The above-described embodiments are merely examples of one aspect of the present invention. , Example For example, Modified example Can be considered.
[0060]
<Modification 1>
In the above-described embodiment, the case where the base station 30 broadcasts a beacon at regular intervals has been described. However, the base station 30 and the communication terminal 40 may perform communication according to the procedure shown in the sequence chart of FIG.
[0061]
As shown in the figure, first, when a packet communication request is generated in the communication terminal 40, the communication terminal 40 broadcasts a probe packet including the terminal ID of the terminal 40 from the wireless communication unit 401 (step S301). Receiving this probe packet, the base station 30 transmits a probe response including the SSID of the local station 30 and the MAC address 301a from the wireless communication unit 306 to the communication terminal 40 (step S302). When the communication terminal 40 receives the probe response from the base station 30, the communication terminal 40 uses the probe response instead of the beacon to execute the process after step S104 of the base station determination process (see FIG. 6).
[0062]
Moreover, the base station 30 and the communication terminal 40 may communicate according to the procedure shown in the sequence chart of FIG. In this case, the SSID and MAC address 301a of the base station 30 are included in the probe response transmitted from the base station 30 in step S403, and the communication terminal 40 uses this probe response to perform base station determination processing (FIG. 6) is executed after step S104.
[0063]
As described above, the SSID and MAC address 301a of the base station 30 may be included in a radio signal other than a beacon such as a probe response. In the sequence chart shown in FIG. 9, the beacon may include the SSID of the base station 30 and the probe response may include the MAC address 301a of the base station 30.
[0064]
<Modification 2>
In the above-described embodiment, the case where each base station 30 constituting the wireless LAN 1 is divided into a plurality of groups and the SSID is used as identification information of the group is, for example, the extended service area 3 of the wireless LAN 1 6 The , Basic service area 3 5 May be divided into a plurality of regional areas, and a different SSID may be assigned to each base station 30 for each regional area. In this case, the base station address storage table 408b stored in the communication terminal 40 may store the MAC address 301a of each base station 30 only in the area where the communication terminal 40 is currently located. Good. In this way, the amount of data in the base station address storage table 408b can be reduced.
[0065]
For example, when the communication terminal 40 is in the Kanto area, the base station address storage table 408b storing the MAC address 301a of each base station 30 only in the Kanto area is stored in the non-volatile memory 408. When 40 is in the Kansai area, the base station address storage table 408b storing the MAC address 301a of each base station 30 only in the Kansai area is stored in the non-volatile memory 408. However, in such a case, when the communication terminal 40 moves to a different area, it is necessary to acquire the base station address storage table 408b for the destination area. Note that the size of the area is not limited to the above example and is arbitrary.
[0066]
<Modification 3>
In the above-described embodiment, the case where the communication terminal 40 acquires the base station address storage table 408b by communication has been described. However, the base station address storage table 408b is distributed to packet communication service subscribers by a recording medium such as a floppy disk (hereinafter abbreviated as FD) and stored in the nonvolatile memory 408 of the communication terminal 40, for example. It may be. In this case, for example, as shown in FIG. 10, the communication terminal 41 is provided with an FD drive 421, and the base station address storage table 408b read from the FD 50 attached to the FD drive 421 is stored in the nonvolatile memory 408. Stored in
[0067]
Note that the MAC address 301a of the base station 30 is 6 bytes in total, and assuming that the storage capacity of the FD 50 is 1.4 Mbytes, the MAC address 301a of the base station 30 for approximately 230,000 stations is transmitted to the communication terminal by one FD 50. 40 can be provided. Note that the recording medium for distributing the base station address storage table 408b is not limited to the FD, and may be any recording medium such as a CD-ROM, a DVD, or a memory card. It is.
[0068]
<Modification 4>
In the above-described embodiment, the case where the MAC address 301a of the base station 30 that covers a total of 6 bytes is used when the base station 30 is authenticated has been described. However, as shown in FIG. 3, the MAC address 301a of the base station 30 is composed of a vendor ID of upper 3 bytes and a product ID of lower 3 bytes. Here, the vendor ID of the MAC address 301 a of each base station 30 is assigned to the manufacturer that manufactures the base station 30, the wired communication interface 301 of the base station 30, the Ethernet controller incorporated in the wired communication interface 301, or the like. It is limited to the vendor ID or the vendor ID assigned to the telecommunications carrier operating the wireless LAN 1.
[0069]
Therefore, the base station 30 may be authenticated using only the upper 3 bytes corresponding to the vendor ID in the MAC address 301a of the base station 30. Further, the base station 30 may be authenticated using the upper 3 bytes corresponding to the vendor ID and a part of the lower 3 bytes corresponding to the product ID in the MAC address 301a of the base station 30. Good. If the base station 30 is authenticated by using only a part of the MAC address 301a in this way, the data capacity of the base station address storage table 408b and the data amount of beacons broadcast from the base station 30 are reduced. can do.
[0070]
<Modification 5>
When a subscriber of a packet communication service using the wireless LAN 1 has a mobile computer, a PDA, or the like in advance, the communication carrier can use a wireless LAN card that provides a wireless communication function, a recording medium on which a communication control program is recorded, Is provided to the applicant, the present invention can be realized using a mobile computer or PDA owned by the applicant.
[0071]
In this case, for example, as illustrated in FIG. 11, a wireless LAN card 60 that controls wireless communication performed with the base station 30 is mounted in the card slot 422 provided in the communication terminal 42. Further, the communication terminal 42 is provided with an FD drive 421. From the FD 50 attached to the FD drive 421, control of base station determination processing (see FIG. 6) and base station authentication processing (see FIG. 7) which is a subroutine thereof are performed. A communication control program describing the procedure is read and installed in the nonvolatile memory 408. The recording medium for storing the communication control program is arbitrary, and the communication control program may be provided to the communication terminal 42 by wired communication or wireless communication.
[0072]
Furthermore, the present invention can be realized by providing only a wireless LAN card to a subscriber who has a mobile computer or PDA in advance. In such a case, FIG. 12 shows the hardware configuration of the wireless LAN card provided by the communication carrier to the applicant for subscription.
[0073]
As shown in the figure, the wireless LAN card 61 includes a wireless communication unit 601, a nonvolatile memory 602, a CPU 603, a RAM 604, and an input / output interface 605, which are connected by a bus 606. ing. The nonvolatile memory 602 includes a communication control program 602a, an SSID storage area 602b, and a base station address storage table 408b.
[0074]
The wireless communication unit 601 controls wireless communication performed with the base station 30. The communication control program 602a stored in the nonvolatile memory 602 is a program in which the control procedures of the base station determination process (see FIG. 6) and the base station authentication process (see FIG. 7) described above are described. In the SSID storage area 602b, the SSID for identifying the wireless LAN 1 permitted to communicate with the wireless LAN card 61, or when the base stations 30 constituting the wireless LAN 1 are divided into a plurality of groups. The SSID for identifying the group permitted to communicate with the wireless LAN card 61 is stored.
[0075]
Further, in the base station address storage table 408b, the MAC address 301a of each base station 30 constituting the wireless LAN 1 permitted to communicate with the wireless LAN card 61, or the same group as the wireless LAN card 61 in the wireless LAN 1. The MAC address 301a of each base station 30 to which it belongs is stored. The CPU 603 executes processing related to authentication of the base station according to the communication control program 602a, and outputs an authentication result, that is, whether communication with the base station 30 is possible or not to the communication terminal 42 via the input / output interface 605.
[0076]
<Modification 6>
In the above-described embodiment, the mobile terminal or the PDA having the wireless communication function is exemplified and described as the communication terminal 40. However, wireless communication terminals to which the present invention can be applied include, for example, mobile phones, PHS (Personal Handyphone System: registered trademark) terminals, and HomeRF (Home Radio Frequency) and Bluetooth (registered trademark) as short-range wireless communication functions. It may be a portable electronic device or a car navigation device. Further, it may be a wireless communication terminal that does not move, such as a stationary personal computer having a wireless communication function. The wireless communication network to which the present invention is applicable may be, for example, a PDC (Personal Digital Cellular) network or a PHS network.
[0077]
【The invention's effect】
As described above, according to the present invention, the security function of the wireless communication terminal can be improved by adding the authentication function of the base station to the wireless communication terminal.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating a configuration of a wireless LAN according to an embodiment of the invention.
FIG. 2 is a block diagram illustrating a hardware configuration of a base station according to the embodiment;
FIG. 3 is a diagram illustrating a data configuration of a MAC address stored in a wired communication interface in the base station according to the embodiment.
FIG. 4 is a block diagram illustrating a hardware configuration of a communication terminal according to the embodiment.
FIG. 5 is a diagram illustrating a data configuration of a base station address storage table stored in a nonvolatile memory in the communication terminal according to the embodiment.
FIG. 6 is a diagram illustrating a flowchart of a base station determination process executed by a CPU in the communication terminal according to the embodiment.
7 is a diagram illustrating a flowchart of a base station authentication process executed by a CPU as a subroutine of the base station determination process shown in FIG. 6 in the communication terminal according to the embodiment.
FIG. 8 is a sequence chart illustrating operations of a communication terminal and a base station according to the first modification of the present invention.
FIG. 9 is another sequence chart illustrating operations of the communication terminal and the base station according to the first modification.
FIG. 10 is a block diagram illustrating a hardware configuration of a communication terminal according to a third modification of the present invention.
FIG. 11 is a block diagram illustrating a hardware configuration of a communication terminal according to a fifth modification of the present invention.
FIG. 12 is a block diagram illustrating a hardware configuration of a wireless LAN card according to a fifth modification of the present invention.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... Wireless LAN, 10 ... Gateway server, 20 ... Control server, 30a, 30b ... Base station, 35a, 35b ... Basic service area, 36 ... Extended service area, 40, 41, 42 ... Communication Terminal, 50 ... FD, 60, 61 ... Wireless LAN card, 301 ... Wired communication interface, 301a ... MAC address, 302 ... Storage unit, 303 ... ROM, 304 ... RAM, 305 ... Non-volatile Memory, 305a ... SSID storage area, 306 ... Wireless communication section, 307 ... CPU, 308 ... Bus, 401 ... Wireless communication section, 402 ... Operation input section, 403 ... Liquid crystal display section, 404 ... Wired communication interface, 405... Storage unit, 406... ROM, 407... RAM, 408. D storage area, 408b... Base station address storage table, 408c... Area ID storage area, 409... CPU, 410... Bus, 421 ... FD drive, 422 ... card slot, 601 ... wireless communication 602... Non-volatile memory, 602 a .. Communication control program, 602 b... SSID storage area, 603... CPU, 604.

Claims (17)

Communication network identification information for identifying a wireless communication network to which the communication terminal belongs, and base station identification information of one or more base stations that constitute the wireless communication network and are permitted to perform wireless communication with the communication terminal. First receiving means for receiving by wired communication;
Storage control means for storing communication network identification information and base station identification information received by the first reception means in a storage means;
From a base station that covers the wireless area to the serving of this vent signal terminal receives a base station identification information of the communication network identification information and the base station of a wireless communication network which the base station belongs by wireless communication A second receiving means;
The communication network identification information received by the second receiving means matches the communication network identification information stored in the storage means, and the base station identification information received by the second receiving means is stored in the storage Determining means for determining whether or not it matches any of the base station identification information stored in the means;
Communication terminal you; and a determining means for determining whether communication with the base station in accordance with the discrimination result by said discrimination means. The communication network identification information received by the second receiving means matches the communication network identification information stored in the storage means, and the base station identification information received by the second receiving means is stored in the storage The said determination means permits communication with the said base station, when the said determination means discriminate | determines that it matched with any one of the base station identification information memorize | stored in the means. communication terminal. In the event that the vent signal terminal is located to the location where the wireless area of the plurality of base stations overlap, further comprising a measuring means for measuring the electric wave reception intensity of the radio signal received from each of said plurality of base stations,
Said second receiving means receives from each of said plurality of base stations, base station identification information of the communication network identification information and the base station of a wireless communication network which the base station belongs by wireless communication,
Based on the measurement result of the measurement unit, the determination unit sequentially stores the communication network identification information received by the second reception unit in the storage unit, starting from the base station that transmitted the radio signal having the strongest radio wave reception intensity. Whether the base station identification information that matches the stored communication network identification information and the base station identification information received by the second receiving means matches any of the base station identification information stored in the storage means communication terminal according to claim 1, characterized in that to determine. In the event that the vent signal terminal is located to the location where the wireless area of the plurality of base stations overlap, further comprising a measuring means for measuring the electric wave reception intensity of the radio signal received from each of said plurality of base stations,
Said second receiving means, on the basis of the measurement results measuring means, in order to electric wave reception intensity is strongest radio signals from the transmitting base stations, network identification information of the wireless communication network which the base station belongs and communication terminal according to claim 1, characterized in that receiving by the wireless communication base station identification information of the base station. Communication service area of said radio communication network is divided into a plurality of geographical area, it said first receiving means includes a communications network identification information of the wireless communication network that those vent signal terminal belongs, the wireless communication configure the network, the local area equivalent vent signal terminal is located, and the wired communication base station identification information of one or more base stations that the wireless communication is permitted between those vent signal terminal communication terminal according to claim 1, characterized in that it receives. Characterized in that the communication network identification information, when each base station constituting a radio communication network is divided into a plurality of groups, is information for identifying the group to which those vent signal terminal or the base station belongs communication terminal according to claim 1,. The base station identification information, communication terminal according to claim 1, characterized in that the MAC address of the base station. The base station identification information, communication terminal according to claim 1, characterized in that the upper three bytes of the MAC address of the base station. The computer provided in the communication terminal,
Communication network identification information for identifying a wireless communication network to which the communication terminal belongs, and base station identification information of one or more base stations that constitute the wireless communication network and are permitted to perform wireless communication with the communication terminal. A first step of receiving by wired communication;
A second step of storing the communication network identification information and the base station identification information received in the first step in a memory;
From a base station that covers the wireless area to the serving of the communication terminal, the base station identification information of the communication network identification information and the base station of a wireless communication network which the base station belongs you received by the wireless communication 3 steps,
Consistent with the communication network identification information which the third communication network identification information hand received in step is stored in said memory, and said third base station identification information hand received in step to said memory a fourth step of determining whether or not consistent with any of the base station identification information stored,
Program for executing a fifth step of determining whether the communication with the previous SL base station according to put that determination result to the fourth step. When the communication terminal is located in a place where radio areas of a plurality of base stations overlap, the communication terminal further includes a sixth step of measuring radio wave reception strength of radio signals received from each of the plurality of base stations,
Wherein in the third step, received from each of the plurality of base stations, base station identification information of the communication network identification information and the base station of a wireless communication network which the base station belongs by wireless communication,
Wherein in the fourth step, the sixth on the basis of the put that measurement step of, in the order of electric wave reception intensity is strongest radio signals from the transmitting base stations, the third hand the received network identification to step information matches the network identification information stored in the memory, and the one of base station identification information that the third base station identification information hand received step is stored in the memory It is discriminate | determined whether it corresponds, The program of Claim 9 characterized by the above-mentioned. Computer readable recording medium recording the program according to claim 9 or 1 0. In a wireless communication network having a communication terminal, and a pre-Symbol Communication terminal and one or more base stations performing radio communication,
Each of the base stations
Transmission means for wirelessly transmitting communication network identification information for identifying the wireless communication network and base station identification information for identifying the base station;
Before Symbol communications terminal,
Wired communication between communication network identification information of a wireless communication network to which the communication terminal belongs, and base station identification information of one or more base stations constituting the wireless communication network and permitted to perform wireless communication with the communication terminal First receiving means for receiving by:
Storage control means for storing communication network identification information and base station identification information received by the first reception means in a storage means;
Second receiving means for receiving radio transmitted communications network identification information and base station identification information by said transmitting means from a base station that covers the wireless area to the serving of this vent signal terminal,
The communication network identification information received by the second receiving means coincides with the communication network identification information stored in the storage means, and base station identification information received by the second receiving means said storage Determining means for determining whether or not it matches any of the base station identification information stored in the means;
A wireless communication network, comprising: a determination unit that determines whether communication with the base station is possible according to a determination result by the determination unit. Before Symbol transmitting means, wherein said base station identification information that identifies the network identification information and the base station identifying the radio communication network, characterized by broadcasting the wireless area of the base station covers wireless communication network according to claim 1 2. Communication service area of said radio communication network is divided into a plurality of geographical area, it said first receiving means includes a communications network identification information of the wireless communication network that those vent signal terminal belongs, the wireless communication configure the network, the local area equivalent vent signal terminal is located, and the wired communication base station identification information of one or more base stations that the wireless communication is permitted between those vent signal terminal wireless communication network according to claim 1 2, characterized in that it receives. Characterized in that the communication network identification information, when each base station constituting a radio communication network is divided into a plurality of groups, which is information for identifying a group of pre-Symbol communications terminal or the base station belongs wireless communication network according to claim 1 2,. The base station identification information, the wireless communication network of claim 1 2, characterized in that the MAC address of the base station. A communication terminal is a communication network identification information for identifying a wireless communication network to which the communication terminal belongs, and a base station of one or more base stations constituting the wireless communication network and permitted to perform wireless communication with the communication terminal A first process of receiving identification information by wired communication;
A second process in which the communication terminal stores the communication network identification information and the base station identification information received in the first process in a memory;
A third step in which the base station wirelessly transmits the communication network identification information of the wireless communication network to which the base station belongs and the base station identification information of the base station;
Said communication terminal, a base station that covers the wireless area that visited the fourth receiving said third communication network identification information and base station identification information transmitted in the course of this vent signal terminal Process,
Base before Symbol communications terminal, the fourth communication network identification information received in the course of the match with the communication network identification information stored in the memory, and received by the fourth process a fifth step of the station identification information to determine whether it matches any of the base station identification information stored in said memory,
Communication control method before Symbol communications terminal, and having a sixth step of determining whether communication with the base station according to put that determination result to the fifth process.

Images