JP6551266B2 - Wireless communication device, wireless communication method and program - Google Patents

Description

  The present invention relates to a wireless communication device, a wireless communication method, and a program.

  In recent years, the spread of wireless communication devices is remarkable, and wireless LANs are built in ordinary homes, and a wide range of networks, such as the Internet, are widely connected by wireless communication from a plurality of users from terminals such as computers, tablets or smartphones. It is done. Some wireless LANs can handle both channels in the 2.4 GHz frequency band conventionally used and channels in the 5 GHz frequency band, and those that can use multiple SSIDs for each band are also known. .

  In a wireless LAN that can operate a plurality of SSIDs, it has been conventionally attempted to limit users who can access each port specified by the SSID. In the wireless LAN, since anyone can receive radio waves within the wireless area, it is required to restrict the access of the user who does not have the right to use. Various techniques for such access restriction have been proposed (see, for example, Patent Documents 1 to 4 below).

  As an example of access restriction, access restriction is performed so that one of multiple SSIDs usable in the wireless LAN can be used to operate the wireless LAN in the home and the other can not be connected to the wireless LAN in the home At the same time, there is an operation such that it can be connected to the Internet and is released to guests. This can be said to be a function of isolating a user for each SSID. Also, in an environment where a plurality of users using wireless LANs are mixed, there is a request to have another LAN environment inside that is separated from other users, that is, cannot be accessed by other users, So-called VLAN technology has been developed and used in offices. Recently, the use of wireless LAN in homes, share houses, etc. has progressed, and the demand for building another LAN environment isolated and concealed from other users inside the wireless LAN has increased as described above. ing.

Patent No. 4908819 JP 2012-242990 JP 2005-252717 Patent No. 3522284

  However, in the existing isolation function, the user is isolated for each SSID, and can not communicate with a slave unit connected to a different SSID or an apparatus wired to a router of a wireless LAN or the like. On the other hand, as a result of trying to strictly restrict access, the VLAN technology has a problem that a lot of equipment is required for use in a normal home and setting is not easy. Furthermore, recently, channel bonding technology has been developed that bundles adjacent channels of the same frequency band and is used to contribute to speeding up of communication speed, but channels of different frequency bands are operated collectively and Could not be shared by multiple users.

  The present invention has been made to solve at least a part of the above-mentioned problems, and can be realized as the following aspects or embodiments.

(1) As a first embodiment of the present invention, a wireless communication apparatus capable of operating a plurality of SSIDs and enabling communication between terminal apparatuses using each SSID is provided. The wireless communication device is a port as an interface to which the terminal device can be connected, and the communication unit communicates with the terminal device using three or more distinguishable ports including the plurality of SSIDs; A table in which at least two of the above ports can be grouped, and a unique identifier for identifying the terminal device is registered in at least two of the groupable ports. Here, when the grouping of the at least two ports is designated, the communication unit permits communication between the terminal devices registered in the table, and the communication unit is connected to the ungrouped ports. Communication between the terminal device and the terminal device registered in the table may not be permitted.

  According to such a wireless communication device, when grouping is specified, communication between terminal devices registered using a unique identifier in the table is possible, but communication with terminal devices not registered in the table is not possible. It can be in the state of. Such grouping may be specified by the user, or it may be specified from the beginning which port is to be grooved.

(2) In the wireless communication apparatus, different SSIDs of different frequency bands may be assigned to each of the at least two ports that can be grouped among the three or more ports. In this way, communication can be performed between terminal devices connected to ports to which different SSIDs of different frequency bands are assigned, and communication can not be performed with other terminal devices.

(3) In the wireless communication device, one of the three or more ports is a port to which a terminal device can be connected by wire, and the one port is included in the groupable ports As well. In this way, when the wireless communication apparatus is provided with a wired communication port, terminals connected by wired connection can also be added to the grouping.

(4) In such a wireless communication apparatus, the combination of the at least two ports that can be grouped may be set in advance. In this way, there is no need to set grouping at once.

(5) In such a wireless communication device, a setting screen of the wireless communication device is displayed on the terminal device by designating a predetermined address by a browser operating on the terminal device connected to one of the ports; The grouping may be designated by operating a designation button provided on the setting screen. In this way, it is possible to specify the grouping from the terminal device.

(6) In the above wireless communication apparatus, a default gateway connected to a wide area network may be assigned in advance to one of the ports to be grouped. In this way, the default gateways can be grouped without showing them one by one. If default gateways are grouped, access to the default gateway is restricted from ungrouped terminals, so that the settings of the default gateway can be viewed or changed from ungrouped terminals Can not in principle. For this reason, the security of the whole LAN connected to the default gateway can be enhanced.

(7) Such a wireless communication apparatus can be realized as an access point of a wireless LAN or an extender that extends the wireless communication range by the access point. In this way, communication can be performed between the terminal devices registered in the table by the access point of the wireless LAN alone or the extender alone, but communication with the terminal devices not registered in the table can not be performed. can do.

(8) As a second embodiment of the present invention, there is provided a wireless communication method capable of operating a plurality of SSIDs and performing communication between terminal devices using the SSIDs. This wireless communication method has the same effect as the above wireless communication apparatus.

(9) As a third embodiment of the present invention, a computer that can operate a plurality of SSIDs, is loaded into a wireless communication device that performs communication between terminal devices using the SSID, and is built in the wireless communication device Provides an executable program. This program has the same effect as the above wireless communication apparatus. Such a program may be provided as recorded in a recording medium, but may be provided at a site on a wide area network and downloaded to a wireless communication device connected to the wide area network. With such a program, the above function can be newly added to an existing wireless communication apparatus.

BRIEF DESCRIPTION OF THE DRAWINGS The schematic block diagram of the wireless LAN system of embodiment. 1 is a schematic configuration diagram of a wireless LAN relay device (extender) included in a wireless LAN according to an embodiment. Functional block diagram of the bridge in the extender. The flowchart which shows a personal mode setting process routine. Explanatory drawing which shows an example of the setting screen displayed on the terminal side. Explanatory drawing which shows typically the table reflecting the setting in personal mode. Explanatory drawing which shows an example of table TBL which matches the MAC address of a terminal with an input port, and registers it, and an example of matching according to group according to port. The flowchart which shows an example of the operation | movement in an extender.

  An embodiment of the present invention will be described. FIG. 1 is a schematic block diagram of a wireless LAN system 100 including a wireless LAN relay device 30 corresponding to the wireless communication device of the present invention. The wireless LAN system 100 includes an access point (AP) 20 connected to a wide area network (WAN) 25 and a wireless LAN relay device 30. AP 20 comprises its own local area network LN1. The AP 20 and the wireless LAN relay device 30 are connected using a method of WDS (Wireless Distribution System). The wireless LAN relay device 30 is connected to the AP 20 by WDS, thereby expanding the area of the local area network formed by the AP 20. Therefore, hereinafter, the wireless LAN relay device 30 is referred to as an extender 30. Note that the WAN 25 is the Internet in this embodiment.

  The AP 20 has a DNS (Domain Name System) server function and a NAT (Network Address Translation) function, and a terminal from the terminal included in its own local area network LN 1 and a terminal included in the local area network LN 2 formed by the extender 30. Accept the request from If the request from the terminal is a request to various servers connected to the WAN 25 (for example, the WWW server 60), the AP 20 translates the IP address of the request source terminal by the NAT function, and further performs DNS resolution to the WAN 25. It requests responses from the various connected servers and delivers the obtained information to the requested terminal.

  In the example shown in FIG. 1, the first PC 57 is connected to the extender 30 by wire, and the terminals 51 and 52 which are two mobile phones, the terminal 54 which is a tablet, and the second PC 55 are connected wirelessly. It is done. That is, three terminals 51, 52, 54 and two PCs 55, 57 are connected to the local area network LN2 formed by the extender 30. These terminals and PCs correspond to subordinate concepts of the terminal device.

  Next, the configuration of the extender 30 will be described. FIG. 2 is a block diagram showing the internal configuration of the extender 30. As illustrated, the extender 30 includes an antenna 31 for wireless communication in the 2.4 GHz band and an antenna 32 for wireless communication in the 5 GHz band, and performs wireless communication in each frequency band via these antennas 31 and 32. The wireless communication unit 33 for 2.4 GHz and the wireless communication unit 34 for 5 GHz are provided. The wireless communication unit 33 is compatible with multi-SSID, and can operate two SSIDs of SSID 1g and SSID 2g, and wireless communication in the 2.4 GHz band is possible using these. Similarly, the wireless communication unit 34 also supports multiple SSIDs, and two SSIDs, SSID1a and SSID2a, can be operated, and wireless communication in the 5 GHz band is possible using these.

  Both wireless communication units 33 and 34 are connected to a bridge 35. A wired LAN terminal 37 is also connected to the bridge 35. The bridge 35 is actually an interface circuit that exchanges signals with the wireless communication units 33 and 34 and the wired LAN terminal 37, and exchanges signals that are input and output through the interface circuit by the operation of the CPU 41. Thus, the function as the bridge 35 is realized. Specifically, the function as the bridge 35 is realized by the CPU 41 that is a one-chip computer executing a program loaded in a memory such as the ROM 42 or the RAM 43. Note that at least a part of the ROM 42 is configured as a flash ROM, and stores a table TBL described later in a nonvolatile manner. Of course, at least a part of the RAM 43 may be configured as a non-volatile memory backed up by a battery or the like, and the table TBL may be stored.

  In such an interface circuit that implements the bridge 35, units that input and output signals are referred to as input ports and output ports. In the present embodiment, the bridge 35 has two input ports and two output ports for both wireless communication units 33 and 34 of the wireless LAN. A plurality of SSIDs in this embodiment are assigned to each input port. Similarly, a plurality of, in this embodiment, two SSIDs are assigned to each output port. Even if connected to the same input port or output port, the SSID for data exchange is different, so it is possible to distinguish which SSID is used for communication. As described above, data exchange between the wireless communication units 33 and 34 and the bridge 35 is performed via the input port and the output port of the bridge 35 for each SSID. Since the physical input port and output port in the bridge 35 and the exchange of data for each SSID are distinguished, FIG. 2 distinguishes the input ports G1 and G2 of the bridge 35 for the SSID 1 g and the SSID 2 g. Port is one. Similarly, ports A1 and A2 of bridge 35 for SSID1a and SSID2a are also drawn separately. For the wired LAN terminal 37, a single port is prepared. Input / output to / from the wired LAN terminal 37 is connected to the port LAN of the bridge 35.

The bridge 35 is further provided with a port STA for exchanging data via the wireless communication unit 34. The port STA is a port used for exchanging data with the AP 20 connected to the WDS. In the wireless communication part 34, it is handled as rootAP. Data exchange with the WDS-connected AP 20 is a function realized by the AP 20,
(1) Exchange as default gateway DGW,
(2) There is exchange as Internet INT. Therefore, in the following description, these are distinguished, the port for exchanging data as a default gateway is called port DGW, and the port for exchanging data via WAN 25 which is the Internet is port INT and Call.

  Next, the basic operation of the bridge 35 will be described using FIG. FIG. 3 is a functional block diagram schematically showing an example of the operation of the bridge 35. As will be described later, the bridge 35 has a filter function, and when a specific mode is designated, the plurality of ports described above are divided into the group 1 and other groups, and data is distributed. A mode for performing such a filter function is called a personal mode. There may be a plurality of combinations of ports belonging to group 1 in the personal mode, as will be described later, but in the following, an example is shown in which SSID1a, SSID1g and wired LAN form group 1 in local area network LN2 formed by extender 30. Explain to.

  When the personal mode is designated, a port A1 for inputting data using the SSID 1a from the wireless communication unit 34, and a port G1 for inputting data using the SSID 1g from the wireless communication unit 33, as shown in FIG. The port 35 for inputting data from the wired LAN terminal 37 is collected as a group 1 in the bridge 35. On the other hand, port A 2 for inputting data using SSID 2 a from wireless communication unit 34 and port G 2 for inputting data using SSID 2 g from wireless communication unit 33 are grouped together as other than group 1 in bridge 35. .

  On the other hand, for the output port, the port A1 outputs data using the SSID 1a from the wireless communication unit 34, the port G1 outputs data using the SSID 1g from the wireless communication unit 33, and the data is output to the default gateway A port DWG, a port LAN that outputs data to the wired LAN terminal 37, and a port INT that outputs data via the WAN 25 are grouped as a group 1 in the bridge 35. Similarly, a port A2 that outputs data using the SSID 2a from the wireless communication unit 34, a port G2 that outputs data using the SSID 2g from the wireless communication unit 33, and a port INT that outputs data via the WAN 25 In the bridge 35, they are collected as other than the group 1.

  The filter function inside the bridge 35 is realized by managing the table TBL for allocating each port other than the group 1 and group 1 described above by the filter registration function when the personal mode is set. This table TBL is prepared in advance in the memory. Therefore, the process for setting the personal mode will be described first. FIG. 4 is a flowchart showing a personal mode setting process routine executed in the extender 30. This personal mode setting processing routine is started when a browser operating on one of the terminals belonging to the local area network LN2 of the extender 30 designates an address set in a setting server built in the extender 30. Ru. In the present embodiment, it is assumed that the call is made from the terminal 54.

  When the routine shown in FIG. 4 is called, the extender 30 first determines whether or not the personal mode setting page is called (step S100). If the call from the terminal 54 in the local area network LN2 is another call other than the call of the setting page of the personal mode, for example, the setting of the SSID or the setting related to WDS, the process exits to RETURN and ends this routine. . If the call from the terminal 54 is a call for a setting page in the personal mode, next, setting page data is transmitted to perform display and screen update processing (step S110). That is, in response to the call from the terminal 54, the server in the extender 30 transmits data for displaying the setting screen of the personal mode on the screen of the terminal 54. When the transmitted data is received, the terminal 54 displays this on a screen on the terminal 54 side, and when an operation on the terminal 54 side is performed on the screen, the screen is updated according to the operation.

  An example of the screen displayed on the terminal 54 side is shown in FIG. The upper part (A) of FIG. 5 is the screen display DS1 in the state where the setting of the personal mode is not made. Since the personal mode is not set in the extender 30 by default, when this setting screen is called for the first time, the screen display DS1 shown in the upper section (A) is displayed. On the side of the terminal 54 which has called this setting screen, a pointing device such as a mouse is operated to put a check mark in a check box “□” and the like. In the lower part (B) of FIG. 5, the check box in the case of being designated as valid is indicated by “■”. A check box (generally called a radio button) when only one of a plurality of setting items can be selected is indicated by “◯”, and the selected side is indicated by “「 ”.

The setting contents are as follows.
[1] Enabling / disabling personal mode [2] Using / not using wired LAN terminal When the check box is checked in [1] and personal mode is enabled, the screen shown in the lower part (B) of FIG. Switch to display DS2. In this state
[3] Use / do not use 2.4 GHz SSID as personal mode [4] Whether to use initial setting value or input value to set as SSID when using in [3] above [5] Use / not use the 5 GHz SSID as the personal mode [6] In the above [5], whether to use an initial setting value or to input a value as an SSID in the case of using.

  “PG-0010” and “PA-0010” shown in FIG. 5 as the initial setting values in the above [4] and [6] are examples of specific values corresponding to the SSID 1 g and the SSID 1 a in FIG. When the local area network LN2 is constructed using the extender 30, if the SSID used in the local area network LN2 is used with the initial setting, this initial setting value can be used as it is. If the SSID used in the local area network LN2 has been changed, it is only necessary to select “enter a value” as the changed value and enter the set SSID in the box. In the screen display DS2 for setting, as shown in the figure, although setting of a wireless authentication method, an encryption key and the like can be performed, the description thereof will be omitted.

  Operations such as check boxes on the screen are performed on the terminal 54 side. When the setting button displayed on the screen is clicked using a mouse or the like after checking each check box, the fact that the setting button is clicked and the setting information displayed on the screen is displayed from the terminal 54. It is sent to the extender 30. After transmitting the setting page in step S110 described above, the extender 30 determines whether the setting button has been clicked (step S120), and when it is detected that the setting button is clicked, the personal mode is next activated. It is determined whether or not the setting has been made (step S130).

  If the “personal mode” is set to be valid in the screen displays DS1 and DS2 shown in FIG. 5, this can be determined from the data transmitted from the terminal 54. If the personal mode is set to be effective, the setting to set the group 1 to the personal mode is made effective (step S140), and if the check box to make the personal mode setting effective is not selected, the personal mode is canceled. The setting for setting the group 1 to the personal mode is invalidated (step S150). After the above processing, the process returns to “RETURN” and ends this routine.

  Here, the process of enabling the group 1 setting (step S140) refers to checking the setting of each check box in the setting shown in FIG. 5B, and according to the setting, the filter shown in FIG. This corresponds to a filter registration function for setting the table TBL so as to realize the function. FIG. 6 is a diagram schematically showing the contents of a table TBL reflecting such settings. The upper row (A) shows ports belonging to group 1, and the lower row (B) shows ports belonging to groups other than group 1.

  For example, in the screen display shown in FIG. 5, “Use also with wired LAN terminal” and “5 GHz” are valid “■”, and if “2.4 GHz” is not valid, wired LAN terminal. Port LAN and port G1 belong to group 1, and the other ports A1, A2 and G2 belong to groups other than group 1. Note that the default gateway (port DGW) is not displayed in FIG. 6 because it is included in the group 1 if the personal mode is set, as will be described later. Since the port INT for connecting to the Internet can be connected from other than the group 1 and the group 1 regardless of whether the personal mode is enabled or not, this is also not shown in FIG.

In the table TBL managed by the filter registration function, for each port that can be handled by the extender 30, whether the MAC address (more than one) of the terminal associated with the port and the port belong to other than group 1 or group 1 , Is registered. FIG. 7A shows an example in which the data input to each port (input port) is arranged in terms of which port (output port) can or cannot be passed (discarded). Indicates Further, FIG. 7B shows the same correspondence relationship by arranging the MAC addresses of the terminals associated with each other by group and by port. As shown in FIG. 7B, in the case of a wireless LAN, MAC addresses of terminals using the same SSID are associated with the same port and registered. In this table TBL, in addition to the MAC address of each terminal, a MAC address such as a default gateway is also associated and registered. The MAC address can be treated as a unique identifier of each terminal. FIGS. 7A and 7B show the correspondence in the following conditions.
(A) The personal mode is set to be valid, and the use at the wired LAN terminal, 2.4 GHz and 5 GHz are all valid “■” (see FIG. 5).
(B) The MAC address addresses of the terminals 51, 52, 54 and the first PC 57 and the second PC 55 shown in FIG. 1 are XXX4, XXX1, XXX2, XXX3, and XXX5, respectively.
(C) The terminal 52 and the terminal 54 use the SSID 1g and the SSID 1a, and the terminal 51 and the second PC 55 use the SSID 2g and the SSID 2a.
(D) The first PC 57 is connected to the wired LAN terminal 37.
(E) The MAC address of the default gateway is associated with the DWG port.

  In the above case, as shown in FIGS. 6 and 7B, the port LAN, the port A1 (SSID1a), and the port G1 (SSID1g) belong to the group 1. Furthermore, the port DGW also belongs. On the other hand, the port A2 (SSID 2a) and the port G2 (SSID 2g) belong to groups other than the group 1. As a result, as shown in FIG. 7A, data reaching the input ports A1, G1, and LAN belonging to group 1, that is, data from terminals 52 and 54 and first PC 57 belong to the same group 1. It passes through the output ports A1, G1, LAN, and DGW, but is not passed through the output ports A2 and G2 that do not belong to the group 1 and is discarded. For this reason, all data can be exchanged between the terminals 52 and 54 and the first PC 57, and the terminals 52 and 54 and the first PC 57 can access the default gateway and the Internet INT. Data cannot be exchanged with the second PC 55 at all.

  On the other hand, data arrived at the input ports A2 and G2 belonging to other than the group 1, that is, data from the terminal 51 and the second PC 55 pass through the output ports A2 and G2 belonging to other than the group 1, but the group 1 The output ports A1, G1, LAN, and DWG belonging to are not passed but are discarded. Therefore, all data can be exchanged between the terminal 51 and the second PC 55, and the terminal 51 and the second PC 55 can access the Internet INT. However, no data can be exchanged from the terminal 51 or the second PC 55 to the terminals 52 and 54, the first PC 57, or the default gateway.

  Accordingly, communication between the terminals belonging to group 1 is permitted, but the terminals belonging to group 1 and the terminals belonging to other than group 1 are separated from each other, and their existence and The data to be exchanged is kept secret.

  The operation as the bridge 35 that exhibits the filter function will be described with reference to the flowchart of FIG. The CPU 41 of the extender 30 monitors whether or not a packet has arrived through communication with the outside. When the packet arrives, the CPU 41 executes a packet distribution process shown in FIG. When the process of FIG. 8 is started, a process of acquiring an arrived packet is performed (step S210). The packet arrives via the wireless communication units 33 and 34 and the wired LAN terminal 37.

  Next, the acquired packet is transferred to the bridge 35 (step S220). The transferred packet includes the MAC address of the terminal or the like that has transmitted the bucket, information on which input port A1, A2, G1, G2, LAN, or STA has arrived, and further includes the destination, etc. .

  Next, it is determined whether or not the personal mode is valid (step S230). If the setting for making the personal mode effective is not made by the setting processing already described (step S230: "NO"), the bridge 35 transfers all the received communication packets to each destination (step S250). In this case, communication with all the terminals 51, 52, 54 connected to the local area network LN2, the first PC 57, the second PC 55, and the default gateway is possible, and an external server via the WAN 25. Etc. can also be referred from all terminals.

  On the other hand, if the setting for enabling the personal mode has been made, the table TBL is then referenced to determine the group (step S240). In step S240, by referring to the table TBL, it is determined to which group the terminal which has transmitted the received packet belongs. In this table TBL, as shown in FIG. 7B, the MAC address of the terminal and the input port are registered in association with each other, and information on which terminal belongs to group 1 is also held. There is. When the personal mode is enabled, the MAC address is associated with the port, and if it is registered in the table TBL, the personal mode is entered and the group attribute is referenced with reference to this table TBL. It is sufficient to judge no. On the other hand, if the association is not yet registered in the table TBL at the time of enabling the personal mode, the MAC address of the terminal and the port used by the terminal are used when the terminal is accessed for the first time. Corresponding information may be registered in the table TBL to determine whether the group belongs. Further, with regard to the MAC address of the default gateway (port DGW), a request may be issued to the default gateway, and the response result may be obtained and registered to determine the group affiliation.

  Once the correspondence between the MAC address and the port is registered in the table TBL, it is assumed that the extender 30 can not be changed unless the personal mode is invalidated by initializing the extender 30. Therefore, in a state where the personal mode is enabled, for example, terminals registered as other than group 1 can not be re-registered so as to be included in group 1. When the extender 30 is initialized and the personal mode is invalidated, in this embodiment, the registration of the table TBL is discarded, so that each terminal changes the SSID to be used and then activates the personal mode. In some cases, the registration of whether group 1 or other than group 1 can be changed. As a matter of course, even if the personal mode is invalidated, the correspondence registered in the table TBL may be held. In this case, when the personal mode is enabled again, the correspondence registered in the table TBL can be used, and the correspondence between the MAC address of the terminal and the port does not have to be registered again. Further, in the embodiment of the present invention, the personal mode is invalidated only when the setting screen is called from the registered terminal except that the terminal in which the personal mode is set to be valid is registered in the table TBL and the extender 30 is initialized. It is supposed to be possible. That is, the terminal with the personal mode enabled (in this embodiment, the terminal 54) is treated as a master device having the setting authority regarding the personal mode. As a matter of course, when the extender 30 is installed, the MAC address of the terminal handled as such a master device is registered in advance, and the change of the personal mode setting from other than the terminal corresponding to the master device is restricted or prohibited. good.

  Next, based on this table TBL, it is judged whether or not the packet can be transferred (step S260). Specifically, referring to the information in the table TBL, the input port and the MAC address of the terminal that transmitted the packet arriving at the input port match the correspondence registered in the table TBL, and the output port of the destination If the MAC address of the terminal or the like connected to the output port matches the association registered in the table TBL, and the groups to which both terminals belong are the same, it is determined that the transfer is allowed. In this case, the process proceeds to step S250, and the communication packet is transferred to each destination.

  On the other hand, in the table TBL, the correspondence between the input port and the MAC address of the terminal transmitting the packet arriving at the input port, and the correspondence between the destination output port and the MAC address of the terminal connected to the output port Even if they are different from the registered ones or their correspondences match, if it is determined that they belong to different groups, it is not determined that they can be transferred. In this case, the communication packet is discarded (step S270). After transferring the packet (step S250) or discarding the bucket (step S270) described above, the process exits to “NEXT” and ends this processing routine.

  According to the first embodiment described above, in the extender 30 operating a plurality of SSIDs, only by setting the personal mode, a plurality of terminals in the local area network LN 2 formed by the extender 30 can be obtained. Among them, only those using ports registered in advance as belonging to group 1 in the table can be grouped. If grouped, data can be exchanged only between terminals registered in the table TBL in association with ports in the table TBL. Of course, it is possible to connect to a default gateway or WAN (Internet) 25 from a terminal or the like belonging to group 1, and to refer to a site of an external server 60 or the like. However, terminals that do not belong to group 1 cannot exchange data with terminals or the like that belong to group 1, and even if they try to see the local area network LN2 or the default gateway, their presence cannot be seen. In the table TBL, the MAC address of each terminal or default gateway is registered in association with the input port or DWG port to which each is connected, and the terminal associated with the port belonging to group 1 and group 1 This is because communication with a terminal associated with a port that does not belong cannot be performed. Therefore, the terminal 51 and the second PC 55 which do not belong to the group 1 can not access and can not view or change the setting of the default gateway. Therefore, the security of the entire LAN connected to the default gateway can be increased.

  As described above, the association between the MAC address and the port registered in the table TBL can not be changed until the extender 30 is initialized and the personal mode is invalidated, and therefore, it is temporarily regarded as belonging to other than group 1 Even if a terminal registered as an association tries to connect using an SSID used by a terminal belonging to group 1, data cannot be exchanged with a terminal belonging to group 1. Similarly, the default gateway cannot be accessed. The MAC address of the terminal is a unique identifier, and is registered in the table TBL in a state associated with the port. As long as a terminal or the like can be identified, the unique identifier is not limited to the MAC address. For example, other identifiers on the network such as an IP address may be combined with part or all of the MAC address.

  As described above, although terminals belonging to group 1 are concealed from terminals not belonging to group 1, among terminals not belonging to group 1 as before setting of the personal mode, Communication between devices using the same SSID is possible, and data can be exchanged freely. In addition, it is also possible to connect to the WAN (Internet) 25 and to refer to the site of the external server 60 or the like. Moreover, in the present embodiment, it is possible to group a part of each terminal while using the SSIDs of two frequency bands. Also, even if some of the terminals belonging to the group use two SSIDs and some use one SSID, grouping is possible. For this reason, it is possible to use web search and data exchange between terminals by communication at 2.4 GHz while using 5 GHz communication for streaming video.

  Such a state can be realized by a technique such as VLAN, for example, but in this embodiment, the VLAN technique is not necessary, and the port connected to the table TBL using the SSID of each frequency band to be grouped. And the MAC address of the terminal connected to this port need only be registered in association with each other. A terminal connected to the wired LAN terminal 37 can also be added to this group. Furthermore, as shown in FIG. 6, such grouping can be realized as various combinations (seven in this embodiment). Moreover, the setting can be performed very easily from the terminal side using the setting screen shown in FIG. In the example shown in FIG. 5, the minimum process required while setting the personal mode is only to designate this item as valid "■" by clicking the checkbox to enable the personal mode. .

  Hereinafter, modifications of the present invention will be described. In the above embodiment, the group to be grouped in the personal mode is only group 1, but grouping may be possible for a plurality of groups. In this case, on the setting screen shown in FIG. 5, it is possible to enable / disable the group 1, group 2,... And which port belongs to the group for each group. You just set it. Those which do not belong to any group may be treated in the same manner as those which belong to other than group 1 in the above embodiment.

  In the above embodiment, the user can freely set the combination of SSIDs in the personal mode and can select from a maximum of seven combinations. However, the selectable range may be limited. For example, one combination of ports in the personal mode may be determined in advance. In this case, setting items for enabling the personal mode are reduced, and the setting is further facilitated. In the above-described embodiment, the personal mode is not enabled by default, and is set to be enabled by calling the setting screen from the terminal 54. However, the default is set to “enable” and the setting screen is used. It may be possible to change it to “not effective”. Further, it can be realized as always effective.

  Although the embodiment as the extender 30 has been described in the above embodiment, the same function can also be realized as the AP 20. Further, both the AP 20 and the extender 30 can be operated simultaneously. In this case, a group for realizing the personal mode may be separately formed in each of the AP 20 and the extender 30, or one local area of both the AP 20 and the extender 30 connected by WDS communication may share one table TBL. Grouping across networks may also be performed.

  In the above embodiment, the correspondence between the MAC address and the port can not be changed unless the personal mode is invalidated by initializing the extender 30 once it is registered in the table TBL. The table TBL may be directly edited only when the setting screen is called from the terminal registered as the master device.

  In the above embodiment, the terminal device (first PC 57) connected to the wired LAN terminal can be grouped, but the terminal device connected to the wired LAN terminal may not be handled. Conversely, a plurality of wired LAN terminals may be provided, and a plurality of wired terminal devices may be grouped.

  In the above embodiment, the setting of the personal mode is performed by calling the setting screen from the terminal 54 side. However, the setting may be made from any terminal or may be performed from a terminal registered in advance in the extender 30. It is good. Further, the extender 30 itself may be provided with a setting button, and the setting may be made possible by operating this. For example, settings such as enabling / disabling may be assigned to a dip switch or the like, and may be designated by switching the position of the switch. Further, a switch for setting a personal mode may be provided.

  Although the above embodiment has been described as the invention implemented as a wireless LAN relay device (extender 30) that is a wireless communication device, the present invention can also be implemented as a wireless communication method. In this case, the subject to be processed may span a plurality of devices. For example, the personal mode may be enabled in the extender 30, and the table TBL may be stored in the AP 20. Also, the opposite may be applied. Further, the grouping may be performed across a plurality of wireless communication devices.

  The present invention can also be implemented as a program. In this case, the program of the present invention can be placed on a server on a network so that a wireless communication device connected to the network can be downloaded. For example, an existing access point or other wireless communication device not having the function of the personal mode functions as a wireless communication device capable of setting the personal mode by downloading this program from the server and rewriting its own firmware. It can be done.

  In the above description, the name “personal mode” is used and described in FIG. 5 etc. However, such a name is originally arbitrary, and various types such as “secret mode”, “private mode”, “simple VLAN”, etc. Is possible. The notation on the setting screen is not limited to such names.

  In the above embodiment, the terminals 52 and 54 use SSIDs in two frequency bands, but the SSID used by the terminal may be limited to one of a plurality of SSIDs in a plurality of frequency bands. . In the above-described embodiment, a large number of ports such as four ports capable of operating a plurality of SSIDs and a wired LAN port are handled. However, the present invention can be applied if there are three or more ports. It should be noted that a larger number of ports may be handled.

  Although several embodiments of the present invention have been described above, the present invention is not limited to these embodiments and can be implemented in various modes without departing from the spirit of the invention. For example, part or all of the configuration of the present invention can be realized by hardware. As hardware, for example, integrated circuits, discrete circuits, or modules combining those circuits can be used.

20 ... Access point (AP)
25. Wide area network (WAN)
30 ... Wireless LAN relay device (extender)
31, 32 ... Antenna 33, 34 ... Wireless communication unit 35 ... Bridge 37 ... Wired LAN terminal 41 ... CPU
42 ... ROM
43 ... RAM
51, 52, 54 ... terminal 55 ... second PC
57 ... First PC
60 ... Server 100 ... Wireless LAN system A1, A2, G1, G2, LAN, STA ... Port DS1, DS2 ... Screen display LN1, LN2 ... Local area network INT ... Port TBL ... Table

Claims (9)

A wireless communication device capable of operating a plurality of SSIDs and enabling communication between terminal devices using each SSID,
A communication unit which is a port as an interface to which the terminal device can be connected, and which communicates with the terminal device using three or more distinguishable ports including the plurality of SSIDs;
A table capable of grouping at least two of the three or more ports, and registering a unique identifier for identifying the terminal device in the groupable at least two ports;
When the grouping for the at least two ports is specified, the communication unit permits communication between the terminal devices registered in the table, and is connected to the ungrouped ports And a wireless communication device not permitting communication with the terminal device registered in the table.   The wireless communication apparatus according to claim 1, wherein different SSIDs of different frequency bands are respectively assigned to the at least two groups of the three or more ports that can be grouped.   3. The wireless device according to claim 1, wherein one of the three or more ports is a port to which a terminal device can be connected by wire, and the one port is included in the groupable port. Communication device.   The wireless communication device according to any one of claims 1 to 3, wherein a combination of at least two ports that can be grouped is set in advance. The wireless communication device according to any one of claims 1 to 4,
The browser operating on the terminal device connected to one of the ports causes the terminal device to display a setting screen of the wireless communication device by designating a predetermined address.
A wireless communication apparatus that designates the grouping by operating a designation button provided on the setting screen.   The wireless communication apparatus according to any one of claims 1 to 5, wherein a default gateway connected to a wide area network is assigned in advance to one of the grouped ports.   The wireless communication apparatus according to any one of claims 1 to 6, wherein the wireless communication apparatus is an access point of a wireless LAN or an extender for extending a wireless communication range by the access point. A wireless communication method capable of operating a plurality of SSIDs and performing communication between terminal devices using the SSID,
A port as an interface to which the terminal device can be connected, wherein at least two of the three or more distinguishable ports including the plurality of SSIDs can be grouped;
A unique identifier that identifies the terminal device is registered in a prepared table in at least two ports that can be grouped,
When grouping for the at least two ports is specified, communication between the terminal devices registered in the table is permitted and registered in the table with terminal devices connected to the ungrouped ports A wireless communication method that does not permit communication with a designated terminal device. A program that can be operated by a plurality of SSIDs, is loaded into a wireless communication apparatus that carries out communication between terminal devices using the SSID, and is executable by a computer built into the wireless communication apparatus,
A port as an interface to which the terminal device can be connected, and a function enabling grouping of at least two of three or more distinguishable ports including the plurality of SSIDs;
A function of registering, in a table prepared in advance, a unique identifier for identifying the terminal device in at least two ports that can be grouped;
When grouping for the at least two ports is specified, communication between the terminal devices registered in the table is permitted and registered in the table with terminal devices connected to the ungrouped ports A program for realizing in the wireless communication apparatus a function of not permitting communication with a designated terminal apparatus.

Images