JP7274400B2 - Wireless communication control system and wireless communication control method - Google Patents

Description

The present invention relates to a radio communication control system and radio communication control method.

Even in places where high confidentiality is required, such as nuclear power plants, it has become necessary to introduce wireless communication infrastructure and manage work progress in real time. When introducing a wireless communication infrastructure into a nuclear power plant, it is necessary to deal with risks such as the leakage of internal information and the issuance of unauthorized work instructions due to the inclusion of unauthorized wireless access points.

In order to prevent connection to unauthorized access points, conventionally, digital certificates for access authorization have been introduced to both wireless access points and wireless terminals. However, many man-hours are required to introduce and operate digital certificates in a large number of wireless access points and wireless terminals at a site such as a plant.

Therefore, it is desirable to be able to detect unauthorized wireless access points without using digital certificates. For example, Patent Literature 1 describes an invention for secure handoff.

Japanese Patent Publication No. 2010-502132

In the invention described in US Pat. No. 6,200,004, a temporary master key is derived for low latency handoff and secure authentication between a new access point and an access terminal. However, if the temporary master key is broken, there is a risk that unauthorized wireless access points cannot be determined.

Accordingly, it is an object of the present invention to determine whether or not a wireless access point is an unauthorized wireless access point by using information that is difficult for an attacker to guess instead of a certificate in a wireless communication control system and wireless communication control method.

In order to solve the above-described problems, a wireless communication control system of the present invention transmits a connection request to a first wireless access point that provides access to a network via a wireless communication path , and sends a request to the first wireless access point. a wireless terminal for transmitting work item information and, when a second wireless access point is newly discovered , notifying the identification information of the second wireless access point to the outside; and detecting an unauthorized wireless access point. When the function is turned off, the work item information transmitted by the wireless terminal is received and stored as a white list. a management means for receiving the work item information, collating the received work item information with the white list , and determining that the second wireless access point is unauthorized if the collation result is different. It is characterized by

In the wireless communication control method of the present invention, a wireless terminal transmits a connection request to a first wireless access point that provides access to a network via a wireless communication path and connects to the first wireless access point, a step of transmitting work item information; and a step of receiving the work item information transmitted by the wireless terminal and storing the work history as a whitelist when the server has turned off the detection function of unauthorized wireless access points. a step of , when the wireless terminal newly discovers a newly discovered second wireless access point , notifying the identification information of the second wireless access point to the outside; When the detection function is turned off, a step of receiving the work item information transmitted by the wireless terminal ; and determining that the second wireless access point is unauthorized if the result of the comparison is different.
Other means are described in the detailed description.

According to the present invention, instead of a certificate, an attacker can use information that is difficult to guess to determine whether or not the wireless access point is unauthorized.

1 is a configuration diagram of a radio communication control system according to this embodiment; FIG. FIG. 4 is a diagram showing an example of normal history information stored in a work history database; FIG. 10 is a flowchart showing normal work history information registration processing when an unauthorized access point detection function is disabled; FIG. FIG. 11 is a flow chart showing processing when an unauthorized access point detection function is enabled; FIG. FIG. 11 is a sequence diagram showing an example of a normal work history information registration operation when an unauthorized access point detection function is disabled; FIG. 10 is a sequence diagram showing an example of operations when a function for detecting unauthorized access points is enabled; 10 is a flowchart of processing for displaying unauthorized access points on the screen; It is an example of a screen displaying the positions of unauthorized access points. It is an example of a screen for registering work items. FIG. 4 is a diagram showing an example of normal history information stored in a work history database; FIG. 10 is a flowchart showing normal work history information registration processing when an unauthorized access point detection function is disabled; FIG. FIG. 11 is a flow chart showing processing when an unauthorized access point detection function is enabled; FIG. FIG. 11 is a sequence diagram showing an example of a normal work history information registration operation when an unauthorized access point detection function is disabled; FIG. 10 is a sequence diagram showing an example of operations when a function for detecting unauthorized access points is enabled;

EMBODIMENT OF THE INVENTION Henceforth, the form for implementing this invention is demonstrated in detail with reference to each figure.
The present invention relates to a system in which a worker uses a wireless terminal to manage work progress. In generating the authentication information (key) of the wireless access point that the wireless terminal accesses next, the movement history, work route, and work progress/performance information such as procedures/items related to the work are used. Connection to an unauthorized wireless access point can be prevented, and work omission can be prevented because the next task cannot proceed unless the work within the accessible range of the wireless access point is completed.

FIG. 1 is a configuration diagram of a radio communication control system S according to this embodiment.
The wireless communication control system S is configured by connecting a work management server 1, an access point management server 2, a work history database 3, and wireless access points 4a to 4e so as to be able to communicate with each other. This wireless communication control system S is for managing the work progress of each worker in real time, for example, in a nuclear power plant. In the drawing, the access point management server 2 is abbreviated as "AP management server".

The wireless terminal 5 is, for example, a tablet terminal, and is a terminal used for inputting work progress and the like in on-site work. The wireless terminal 5 establishes a connection with any one of the wireless access points 4a to 4e to mutually communicate with the work management server 1 to synchronize work progress information and the like.

The wireless access points 4a to 4e are legitimate access points that are connected to the wireless terminal 5 and relay communication between the wireless terminal 5 and the work management server 1 or the like. Hereinafter, when the wireless access points 4a to 4e are not distinguished, they may simply be referred to as the wireless access point 4. FIG. In the drawings below, each of the wireless access points 4a to 4e may be simply abbreviated as "AP". In the drawings, the database may be abbreviated as "DB".

The identifier (SSID: Service Set Identifier) of the wireless access point 4a is "aa" and uses channel Na. The identifier of wireless access point 4b is "bb" and uses channel Nb. The identifier of wireless access point 4c is "cc" and uses channel Nc. The identifier of wireless access point 4d is "dd" and uses channel Nd. The identifier of the wireless access point 4e is "ee" and uses channel Ne.

The wireless access point 4cx is an unauthorized access point, its identifier is "cc", and it uses channel Nc. Therefore, from the wireless terminal 5, the wireless access point 4c and the wireless access point 4cx have the same identifier and the same channel. Therefore, the user of the wireless terminal 5 may mistakenly connect to the wireless access point 4cx as the wireless access point 4c.

The work management server 1 is a server that communicates with the wireless terminal 5 and manages progress information of field work.
In response to an inquiry from the wireless terminal 5, the work management server 1 and the access point management server 2 notify whether or not access to the access point is possible, authentication information required for access, and the like. The access point management server 2 is a server that manages information about the wireless access points 4a to 4e and wireless access. The work management server 1 and the access point management server 2 are connected to the wireless access points 4a to 4e and 4cx via wired communication paths, and manage them using IP (Internet Protocol) addresses, for example. Since the IP addresses of the wireless access point 4c and the wireless access point 4cx are different, the work management server 1 and the access point management server 2 can identify them as being different. However, the IP addresses only show that the wireless access point 4c and the wireless access point 4cx are different, and it is not possible to determine which is the legitimate wireless access point 4. FIG.

The work management server 1 and the access point management server 2 manage the wireless access points 4a to 4e as "A" to "E", respectively, and manage the other wireless access point 4cx as "X".

The work history database 3 is a database that stores and manages work history information in cooperation with the work management server 1 . In the case of the first embodiment, which will be described later, the connection history between the wireless terminal 5 and the wireless access points 4a to 4e is the work history. In the case of the second embodiment described later, the history of each work item input to the wireless terminal 5 becomes the work history.

Note that the work management server 1, access point management server 2, and work history database 3 may be implemented on a single piece of hardware.

<<1st Embodiment>>
The wireless communication control system S of the first embodiment detects an unauthorized wireless access point 4 using a work route history (access point usage history).
(1) When the wireless terminal 5 connects to the valid wireless access points 4a to 4e, it transmits/receives the movement history to/from the work management server 1.
(2) The work management server 1 and the access point management server 2 generate an access token from the past movement history, and transmit the access token to the next connectable wireless access point 4 and wireless terminal 5 . Access tokens are processed with standardized algorithms.
(3) Only the wireless access point 4 having the access token can be switched as the wireless access point 4 to be accessed next by the wireless terminal 5 .

FIG. 2 is a diagram showing an example of normal history information stored in the work history database 3. As shown in FIG.
Each work of periodic inspection #1, #2, . . . is registered in the work history database 3 . These periodic inspections are associated with routes permitted as work, that is, the order of connection of the wireless access points 4 . Periodic inspection #1 is associated with A→B→C→D→E. Periodic inspection #2 is associated with A→B→C→E.

A->B->C->D->E of periodic inspection #1 indicates that the normal order is for the wireless terminal 5 to connect to the wireless access points 4a, 4b, 4c, 4d, and 4e in this order.
A→B→C→E of periodic inspection #2 indicates that the order of connection of the wireless terminal 5 to the wireless access points 4a, 4b, 4c, and 4e is the regular order.

Assume that an unauthorized wireless access point 4cx is included and the route of the wireless terminal 5 (worker) is A→B→X. Normally, the wireless terminal 5 is connected in order of the radio wave strength of the wireless access point 4 . Therefore, when the radio field intensity of the unauthorized wireless access point 4cx is stronger than the radio field intensity of the wireless access point 4c, the wireless terminal 5 may connect to the unauthorized wireless access point 4cx.

However, since the connection order permitted by the wireless communication control system S is A→B→C . The wireless access point 4cx cannot generate (disguise) an access token necessary for unauthorized connection to the wireless terminal 5 unless the owner of the wireless terminal 5 has a history of movement. Therefore, the wireless communication control system S can prevent connection between the wireless terminal 5 and the unauthorized wireless access point 4cx. The unauthorized wireless access point 4cx needs to know even the current movement history, and unless it has specific business knowledge, the attack will not be broken, and it is as safe as a certificate.

FIG. 3 is a flowchart showing normal work history information registration processing when the function of detecting unauthorized access points is disabled. At this time, it is assumed that the unauthorized wireless access point 4 does not exist in the system.
First, the administrator of the wireless communication control system S operates the work management server 1 to turn off the unauthorized wireless access point 4 detection function (S10). Then, the worker uses the wireless terminal 5 to start work at the plant site.
Then, the work management server 1 detects the start of work at the plant site using the wireless terminal 5 (S11). Here, the wireless terminal 5 synchronizes work information and the like with the work management server 1 via any one of the authorized wireless access points 4a to 4e.

In step S<b>12 , the work management server 1 receives the detection result from the wireless terminal 5 and determines whether or not the wireless terminal 5 has detected the new wireless access point 4 . If the wireless terminal 5 detects the new wireless access point 4 (Yes), the work management server 1 proceeds to the process of step S13, and if the wireless terminal 5 does not detect the new wireless access point 4, It returns to the process of step S12.

In step S13, the work management server 1 receives the identification information of the newly detected wireless access point 4 and stores it in list form.
In step S14, the work management server 1 determines whether or not the current series of work by the worker has ended. The work management server 1 synchronizes the current series of work information with the wireless terminal 5 and detects whether or not the work is completed.

If the work has not been completed (No), the work management server 1 returns to the process of step S12, and if the work has been completed (Yes), the process proceeds to step S15.
In step S15, the work management server 1 saves the list of connection order of the normal wireless access points 4 obtained as a series of work results in the work history database 3 as a white list, and ends the processing of FIG.

FIG. 4 is a flow chart showing processing when the unauthorized access point detection function is enabled.
First, the administrator of the wireless communication control system S turns on the unauthorized wireless access point 4 detection function (S20). Then, the worker uses the wireless terminal 5 to start work at the plant site. Then, the work management server 1 detects the start of work at the plant site using the wireless terminal 5 (S21).

In step S22, the work management server 1 determines whether or not the current series of work by the worker has ended. The work management server 1 synchronizes the current series of work information with the wireless terminal 5 and detects whether or not the work is completed. That is, the work management server 1 receives the work progress information transmitted by the wireless terminal 5 .

If the work is not finished (No), the work management server 1 proceeds to the process of step S23, and if the work is finished (Yes), the process of FIG. 4 is finished.

In step S<b>23 , the work management server 1 receives the detection result from the wireless terminal 5 and determines whether or not the wireless terminal 5 has detected the new wireless access point 4 . If the wireless terminal 5 detects the new wireless access point 4 (Yes), the work management server 1 proceeds to the process of step S24, and if the wireless terminal 5 does not detect the new wireless access point 4, The process returns to step S22.

In step S24, the work management server 1 receives the identification information of the newly detected wireless access point 4 and saves the access point connection history in RAM (Random Access Memory). Then, the work management server 1 collates the access point connection history with the whitelist of the work history database 3 (S25).

The work management server 1 compares the access point connection history with the whitelist in step S25 using a method such as challenge-and-response authentication that makes it impossible for a third party to decipher the access point connection history with the whitelist. do it.

That is, the work management server 1 requests a database server (not shown) that manages the work history database 3 to collate. The database server sends a different data string each time based on a random number called a "challenge." The work management server 1 combines the access point connection history and the challenge, converts them into hash values using a hash function, and returns them to the database server as a “response”.

The database server calculates a hash value by combining the whitelist and challenge from the authentication information at hand, and compares and verifies it with the response. If both match, it can be confirmed that the access point connection history managed by the work management server 1 is the same as the whitelist on the work history database 3 . In this case, since the access point connection history and the whitelist are not exchanged between the work management server 1 and the database server, a third party cannot eavesdrop on the access point connection history and the whitelist. Furthermore, even if a third party eavesdrops on the challenge or response, it would be extremely difficult to derive these access point connection histories and whitelists due to the nature of cryptographic hash functions. , can be said to be undecipherable. Since the challenge changes irregularly each time authentication is performed, it functions as a kind of one-time password and is resistant to attack techniques such as replay attacks.

In step S26, the work management server 1 determines whether or not the access point connection history follows the order of the whitelist. If the access point connection history is in order (Yes), the work management server 1 notifies both the wireless access point 4 and the wireless terminal 5 that the newly detected wireless access point 4 is accessible (S27). Return to step S22. Here, the work management server 1 notifies the wireless terminal 5 that the wireless access point 4 is authorized by transmitting the access token to the wireless access point 4 and the wireless terminal 5 from the access point management server 2. do.

If the access point connection history is different from the order (No), the work management server 1 regards the newly detected wireless access point 4 as illegal, and notifies the wireless terminal 5 that access is prohibited (S28). The processing in FIG. 4 ends abnormally.

FIG. 5 is a sequence diagram showing an example of a normal operation for registering work history information when the unauthorized access point detection function is disabled.
In step S30, the wireless terminal 5 transmits a connection request to the wireless access point 4a. In FIG. 5, the wireless access point 4a is abbreviated as "AP-A".

In step S<b>31 , the wireless access point 4 a notifies the work management server 1 of the connection of the wireless terminal 5 . Thereby, the work management server 1 recognizes that the connection destination of the wireless terminal 5 is the wireless access point 4a (S32).

In step S33, the work management server 1 stores the connection history of the wireless terminal 5 to the wireless access point 4 in the work history database 3 as a whitelist. The work management server 1 receives the storage completion notification from the work history database 3 (S34).

In step S35, the work management server 1 requests the access point management server 2 to permit connection to the wireless access point 4a. The access point management server 2 transmits connection permission to the wireless access point 4a (S36). As a result, the wireless access point 4a can be connected to the wireless terminal 5 (S37).

FIG. 6 is a sequence diagram showing an example of the operation when the unauthorized access point detection function is enabled. In FIG. 6, the wireless access point 4b is abbreviated as "AP-B", and the wireless access point 4c is abbreviated as "AP-C". Furthermore, at the start of step S40, communication has been established between the wireless terminal 5 and the wireless access point 4b. The wireless access point 4b here functions as a first wireless access point that provides access to the network via a wireless channel.

In step S40, the wireless terminal 5 newly detects the wireless access point 4c. In step S41, the wireless terminal 5 transmits a notification of the wireless access point 4c addressed to the work management server 1 to the wireless access point 4b.

Here, the wireless terminal 5 transmits the first work progress information via the wireless access point 4b (first wireless access point) that provides access to the network via the wireless communication path. Further, the wireless terminal 5 notifies the work management server 1 of the identification information of the newly discovered wireless access point 4c (second wireless access point).

The wireless access point 4b relays the notification from the wireless access point 4c to the work management server 1 (S42). As a result, the work management server 1 recognizes the new wireless access point 4c (S43).

In step S<b>44 , the work management server 1 requests the whitelist stored in the work history database 3 . The work management server 1 then receives a whitelist response from the work history database 3 (S45). Here, the whitelist received by the work management server 1 is, for example, all work path orders shown in FIG.

In step S46, the work management server 1 compares the connection history including the wireless access point 4c with the connection history of the whitelist, and transmits the comparison result to the access point management server 2 (S47). Here, the work management server 1 compares the connection history including the wireless access point 4c with the connection history of the whitelist by a method such as challenge-response authentication that cannot be deciphered by a third party.

The access point management server 2 generates an access permission/prohibition notification according to the collation result, and transmits the access permission/prohibition notification addressed to the wireless terminal 5 to the wireless access point 4b (S48). The wireless access point 4b transfers this access availability notification to the wireless terminal 5 (S49). If the notification indicates that access is permitted, the wireless terminal 5 connects to the new wireless access point 4c (S50). If this access permission/prohibition notification indicates that access is not permitted, the wireless terminal 5 does not connect to the new wireless access point 4 . The access availability notification is an access token for establishing connection between the wireless terminal 5 and the wireless access point 4c.

Here, the work management server 1 (managing means) receives the connection history (first work progress information) transmitted by the wireless terminal 5, and stores the received connection history and a predetermined white list (second work progress information). ) in a way that cannot be deciphered by a third party. If the collation result is different, the work management server 1 determines that the new wireless access point 4 is illegal.

In the first embodiment, when the order relationship before and after the wireless access point 4 to which the wireless terminal 5 is connected, that is, the relative positional relationship of the wireless access points 4 is different from normal, the new access point is regarded as illegal. . This is a different perspective from conventional wireless communication security.

Unless the attacker can estimate the order relationship of the wireless access points 4, the wireless terminal 5 cannot be connected to an unauthorized access point prepared by the attacker. In addition, since the relative position of the wireless access point 4 is used, strict position estimation is not required and can be easily realized indoors. In the case of a nuclear power plant, the wireless access point 4 can be placed on the wall or ceiling of the building, and even if there are internal changes before and after inspection, there will be no significant impact.

According to this embodiment, periodic key updating of the wireless terminal 5 and each wireless access point 4 is not required, and the low IT literacy of workers and field maintenance personnel can be compensated for.

FIG. 7 is a flowchart of processing for displaying unauthorized access points on the screen.
The wireless terminal 5 discovers an unauthorized wireless access point 4 (S60). Then, the wireless terminal 5 acquires wireless signal information emitted by the unauthorized wireless access point 4 (S61).

The work management server 1 and the access point management server 2 identify the position of the unauthorized wireless access point 4 from the normal work history order (S62). Here, the access point management server 2 stores the location of the connected wireless access point 4 as the location of the unauthorized wireless access point 4 when the collation result is different.
Further, the work management server 1 displays the location information and radio wave information of the unauthorized wireless access point 4 on the screen of FIG. 8 (S63), and terminates the processing of FIG.

FIG. 8 is an example of a map screen 51 displaying the positions of unauthorized access points. This map screen 51 is displayed on a display screen (not shown) of the work management server 1, for example.
Room areas 61 to 64 are displayed on the map screen 51, and access point icons 65a to 65e and 65cx are also displayed. Room areas 61-64 indicate the positions occupied by rooms #1-#4 in the plant.

A passage area is displayed between the room area 62 and the room area 61 . This indicates that room #2 corresponding to room area 62 is connected to room #1 corresponding to room area 61 via a passageway.

A passage area is displayed between the room area 63 and the room area 62 . This indicates that room #3 corresponding to room area 63 is connected to room #2 corresponding to room area 62 via a passageway. Similarly, between room area 64 and room area 62, a corridor area is displayed. This indicates that room #4 corresponding to room area 64 is connected to room #2 corresponding to room area 62 via a passageway.

Access point icons 65a and 65b are displayed in the room area 61, indicating that the wireless access points 4a and 4b are arranged in the room #1.

In the room area 62, an access point icon 65c and an unauthorized access point icon 65cx are displayed. indicates that there is

An access point icon 65d is displayed in the room area 63, indicating that the wireless access point 4d is located in room #3. Similarly, an access point icon 65e is displayed in the room area 64, indicating that the wireless access point 4e is located in room #4.

The work management server 1 stores the location information of the authorized wireless access points 4a-4e. If the matching result of the newly detected wireless access point 4 is different from the whitelist, the work management server 1 detects the position of the newly detected unauthorized wireless access point 4 that is currently connected based on the whitelist. Report as the position of point 4. As a result, the administrator of the wireless communication control system S can know the location of the illegal wireless access point 4 that has been mixed.

<<Second embodiment>>
The wireless communication control system S of the second embodiment detects unauthorized wireless access points 4 using work item history.
(1) When the wireless terminal 5 connects to the valid wireless access points 4a to 4e, it transmits/receives movement history and work status to/from the work management server 1.
(2) The work management server 1 and the access point management server 2 generate an access token from the past movement history and work status, and transmit the access token to the next connectable wireless access point 4 and wireless terminal 5 . Access tokens are processed with standardized algorithms.
(3) Only the wireless access point 4 having the access token can be switched as the wireless access point 4 to be accessed next by the wireless terminal 5 .

FIG. 9 is an example of the work item management screen 52 for registering work items.
This work item management screen 52 is displayed on the touch panel display of the wireless terminal 5 . The work item management screen 52 displays a table including a work number column 521 , an inspection content column 522 and a check column 523 .

In the first row of the table, "1" is displayed in the work number column 521, and "Valve open/close confirmation" is displayed in the inspection content column 522, indicating that the first work is to check the opening and closing of the valve. showing. A check is put in the check column 523, indicating that this work has been completed.

In the second row of the table, "2" is displayed in the work number column 521, "○○ flow meter is XX value or less" is displayed in the inspection content column 522, and the second work is ○○ flow meter is X This indicates that it is confirmation of whether or not it is equal to or less than the x value. The check box 523 is not checked, indicating that this work has not been completed.

The worker displays the work item management screen 52 on the wireless terminal 5 to check the progress of each work. The wireless terminal 5 and the work management server 1 are synchronized by transmitting and receiving movement history and work status.

FIG. 10 is a diagram showing an example of normal history information saved in the work history database 3. As shown in FIG.
In the work history database 3, each work of periodic inspections #11, #12, . . . is registered. These periodic inspections are associated with movement history and work status permitted as work. (#1,A)→(#2,A)→(#3,B)→(#4,B)→(#5,C)→(#6,C)→( #7,D)→(#8,E) are associated.

Note that (#1, A) → (#2, A) indicates that work #1 and work #2 are performed when connected to the wireless access point 4a.
(#3,B)→(#4,B) is to connect to wireless access point 4b after task #2, and to perform task #3 and task #4 while connecting to wireless access point 4b. indicates that it will be done.

(#5,C)→(#6,C) is to connect to wireless access point 4c after task #4, and to perform task #5 and task #6 while connecting to wireless access point 4c. indicates that it will be done.

(#7, D) indicates that connection is made to the wireless access point 4d after work #6, and that work #7 is performed while connecting to the wireless access point 4d.
(#8, E) indicates that connection is made to the wireless access point 4e after work #7, and that work #8 is performed while connecting to the wireless access point 4e.

Periodic inspection #12 includes (#11, A) → (#12, A) → (#13, B) → (#14, B) → (#15, C) → (#16, C) → ( #17,E) are associated.
(#11,A)→(#12,A) indicates that work #11 and work #12 are performed when connected to the wireless access point 4a.
(#13,B)→(#14,B) is to connect to the wireless access point 4b after work #12, and to perform work #13 and work #14 while connecting to the wireless access point 4b. indicates that it will be done.

(#15,C)→(#16,C) is to connect to the wireless access point 4c after the operation #14, and to perform the operations #15 and #16 while connecting to the wireless access point 4c. indicates that it will be done.

(#17, E) indicates that connection is made to the wireless access point 4e after work #16, and that work #17 is performed while connecting to the wireless access point 4e.

Unauthorized wireless access point 4cx is included, and the movement history and work status of wireless terminal 5 (worker) are changed from (#1,A)→(#2,A)→(#3,B)→(#4 ,B)→(#5,X). Normally, the wireless terminal 5 is connected in order of the radio wave strength of the wireless access point 4 . Therefore, when the radio field intensity of the unauthorized wireless access point 4cx is stronger than the radio field intensity of the wireless access point 4c, the wireless terminal 5 may connect to the unauthorized wireless access point 4cx.

However, if the movement history and work status permitted by the wireless communication control system S are (#1, A)→(#2, A)→(#3, B)→(#4, B)→(#5 , C) .

The wireless access point 4cx cannot generate (disguise) an access token required for unauthorized connection to the wireless terminal 5 unless the owner of the wireless terminal 5 has a history of movement and work status. Therefore, the wireless communication control system S can prevent connection between the wireless terminal 5 and the unauthorized wireless access point 4cx.

The unauthorized wireless access point 4cx needs to know the current movement history and work status, and unless it has specific business knowledge, attacks cannot be broken, and it is as safe as a certificate.

FIG. 11 is a flowchart showing normal work history information registration processing when the function of detecting unauthorized access points is disabled.
First, the administrator of the wireless communication control system S operates the work management server 1 to turn off the unauthorized wireless access point 4 detection function (S70). Then, the worker uses the wireless terminal 5 to start work at the plant site.

Then, the work management server 1 detects the start of work at the plant site using the wireless terminal 5 (S71). Here, the wireless terminal 5 synchronizes with the work management server 1 through any one of the authorized wireless access points 4a to 4e.

The worker operates the wireless terminal 5 to input the end of the work every time he finishes each work. Therefore, in step S72, the work management server 1 receives the updated content transmitted by the wireless terminal 5 each time the worker inputs the end of the work item.
The work management server 1 associates the completed work item with information on the wireless access point 4 being connected (S73).

In step S<b>74 , the work management server 1 receives the detection result from the wireless terminal 5 and determines whether or not the wireless terminal 5 has detected the new wireless access point 4 . If the wireless terminal 5 detects the new wireless access point 4 (Yes), the work management server 1 proceeds to step S75, and if the wireless terminal 5 does not detect the new wireless access point 4, The process proceeds to step S76.

In step S75, the work management server 1 receives the identification information of the newly detected wireless access point 4 and updates the information of the wireless access point 4 currently connected.
In step S76, the work management server 1 determines whether or not the current series of work by the worker has ended. The work management server 1 synchronizes the current series of work information with the wireless terminal 5 and detects whether or not the work is completed.

If the work has not been completed (No), the work management server 1 returns to the process of step S72, and if the work has been completed (Yes), the process proceeds to step S77.
In step S77, the work management server 1 saves in the work history database 3 the correspondence relationship between the work items obtained as a series of work results and the normal wireless access points 4, and the work order list as a white list. The process of FIG. 11 ends.
By the processing of FIG. 11, the wireless communication control system S can learn work items (correspondence with access points).

FIG. 12 is a flow chart showing processing when the unauthorized access point detection function is enabled.
First, the administrator of the wireless communication control system S turns on the unauthorized wireless access point 4 detection function (S80). The worker uses the wireless terminal 5 to start work at the plant site. Then, the work management server 1 detects the start of work at the plant site using the wireless terminal 5 (S81). Here, the wireless terminal 5 synchronizes with the work management server 1 through any one of the authorized wireless access points 4a to 4e.

In step S82, the work management server 1 saves the work item history of the wireless terminal 5 that is transmitted each time the work item is checked. In step S83, the work management server 1 determines whether or not the current series of work by the worker has ended. The work management server 1 synchronizes the current series of work information with the wireless terminal 5 and detects whether or not the work is completed.

In step S83, if the work has not been completed (No), the work management server 1 proceeds to the process of step S84, and if the work has been completed (Yes), the process of FIG. 12 is completed.
In step S<b>84 , the work management server 1 receives the detection result from the wireless terminal 5 and determines whether or not the wireless terminal 5 has detected the new wireless access point 4 . If the wireless terminal 5 detects the new wireless access point 4 (Yes), the work management server 1 proceeds to step S85, and if the wireless terminal 5 does not detect the new wireless access point 4, The process returns to step S82.

In step S85, the work management server 1 receives the identification information of the newly detected wireless access point 4, and stores the information of the wireless access point 4 currently connected in the RAM. The work management server 1 then checks the work item history against the whitelist. Here, the work management server 1 compares the work item history with the whitelist by a method such as challenge-and-response authentication that cannot be deciphered by a third party. Here, the work item history refers to the history of the combination of the work item and the information of the wireless access point 4 connected when the work item was executed.

In step S<b>86 , the work management server 1 determines whether or not there is an unfinished work item for the current wireless access point 4 . If there is an unfinished work item (Yes), the work management server 1 notifies both the wireless access point 4 and the wireless terminal 5 that the newly detected wireless access point 4 cannot be accessed (S87). , the process returns to step S82. If there is no unfinished work item and the work at the current wireless access point 4 is completed (No), the work management server 1 proceeds to the process of step S88.

In step S88, the work management server 1 determines whether or not the work item history follows the order of the whitelist. If the work item history is in order (Yes), the work management server 1 notifies both the wireless access point 4 and the wireless terminal 5 that the newly detected wireless access point 4 is accessible (S89). , the process returns to step S82.

If the work item history is different from the order (No), the work management server 1 regards the newly detected wireless access point 4 as illegal, and notifies the wireless terminal 5 that access is prohibited (S90). 12 terminates abnormally.

FIG. 13 is a sequence diagram showing an example of a normal operation of registering work history information when the unauthorized access point detection function is disabled.
In step S100, the wireless terminal 5 transmits a connection request to the wireless access point 4a. In FIG. 13, the wireless access point 4a is abbreviated as "AP-A".

In step S<b>101 , the wireless access point 4 a notifies the work management server 1 of the connection of the wireless terminal 5 . Thereby, the work management server 1 recognizes that the connection destination of the wireless terminal 5 is the wireless access point 4a (S102).

In step S<b>103 , the work management server 1 stores the connection of the wireless terminal 5 to the wireless access point 4 in the work history database 3 . The work management server 1 receives the storage completion notification from the work history database 3 (S104).

In step S105, the wireless access point 4a requests the access point management server 2 for connection permission for the wireless access point 4a.
Since the function of detecting unauthorized access points is disabled here, the access point management server 2 transmits connection permission to the wireless access point 4a (S106). As a result, the wireless access point 4a can be connected to the wireless terminal 5 (S107).

Further, the wireless terminal 5 sends the result to the server for each work item check (S108).
The wireless access point 4a relays this work item to the work management server 1 (S109).
The work management server 1 associates the work item with the current wireless access point 4a and stores them in the work history database 3 (S110), and receives a storage completion notice from the work history database 3 (S111). By repeating these processes in order, the movement history and work status whitelist can be learned.

FIG. 14 is a sequence diagram showing an example of operation when the unauthorized access point detection function is enabled.
In FIG. 14, the wireless access point 4b is abbreviated as "AP-B", and the wireless access point 4c is abbreviated as "AP-C". Furthermore, at the start of step S120, communication has been established between the wireless terminal 5 and the wireless access point 4b.

In step S120, the wireless terminal 5 sends the result to the server for each work item check. In step S121, the wireless terminal 5 newly detects the wireless access point 4c.
In step S121, the wireless terminal 5 transmits a notification of the wireless access point 4c addressed to the work management server 1 to the wireless access point 4b. The wireless access point 4b relays the notification from the wireless access point 4c to the work management server 1 (S123). As a result, the work management server 1 recognizes the new wireless access point 4c (S124).

In step S<b>125 , the work management server 1 requests normal work histories (white list) stored in the work history database 3 . The work management server 1 then receives a work history response from the work history database 3 (S126).

In step S127, the work management server 1 compares the work items up to the wireless access point 4c with the work history, and transmits the comparison result to the access point management server 2 (S128). In collating the work items and work histories up to the wireless access point 4c, the work management server 1 makes it impossible for a third party to decipher the work items and work histories up to the wireless access point 4c, such as challenge-and-response authentication. method should be checked.

The access point management server 2 generates an access permission/refusal notification according to the comparison result, and transmits the access permission/refusal notification addressed to the wireless terminal 5 to the wireless access point 4b (S129). The wireless access point 4b transfers this access availability notification to the wireless terminal 5 (S130). If this access permission/prohibition notification indicates that access is permitted, the wireless terminal 5 connects to the new wireless access point 4c (S131).

(Modification)
The present invention is not limited to the above-described embodiments, and includes various modifications. For example, the above-described embodiments have been described in detail in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the described configurations. A part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Moreover, it is also possible to add, delete, or replace a part of the configuration of each embodiment with another configuration.

Some or all of the above configurations, functions, processing units, processing means, etc. may be realized by hardware such as integrated circuits. Each of the above configurations, functions, etc. may be realized by software by a processor interpreting and executing a program for realizing each function. Information such as programs, tables, and files that implement each function can be stored in recording devices such as memory, hard disks, SSDs (Solid State Drives), or recording media such as flash memory cards and DVDs (Digital Versatile Disks). can.

In each embodiment, control lines and information lines indicate those considered necessary for explanation, and not all control lines and information lines are necessarily indicated on the product. In fact, it may be considered that almost all configurations are interconnected.

Modifications of the present invention include, for example, the following (a) to (c).
(a) The work progress information that the wireless terminal synchronizes with the work management server is not limited to movement history, movement history, and work status. For example, the contents of the work checklist may be synchronized between the wireless terminal and the work management server. The work check order of the work checklist may be used as the work progress information, and each check content of the work checklist may be grouped so that the order does not matter within each group.
(b) The work management server 1, the access point management server 2, and the work history database 3 may be implemented on a single piece of hardware, or may be implemented on a plurality of pieces of hardware. not.
(c) The access token that the access point management server transmits to each wireless access point is not limited to access key information, and may be digital signature information (also called footprint) added after authentication is completed.

1 work management server (management means)
2 Access point management server 3 Work history database 4a-4e, 4cx Wireless access point 5 Wireless terminal 51 Map screens 61-64 Room areas 65a-65e, 65cx Access point icon 52 Work item management screen 521 Work number column 522 Inspection content column 523 Check column

Claims (7)

transmitting a connection request to a first wireless access point providing access to a network over a wireless communication path to connect to said first wireless access point, transmitting work item information, and transmitting work item information; a wireless terminal that notifies the identification information of the second wireless access point to the outside when a new point is discovered;
When the unauthorized wireless access point detection function is turned off, the work item information transmitted by the wireless terminal is received, the work history is saved as a whitelist, and the unauthorized wireless access point detection function is turned on. If the work item information transmitted by the wireless terminal is received, the work history configured by the received work item information is collated with the white list , and if the collation result is different, the a management means for determining that the wireless access point of 2 is unauthorized;
A wireless communication control system comprising: The management means compares the work history composed of the work item information with the whitelist in a manner that cannot be deciphered by a third party.
The radio communication control system according to claim 1, characterized by: If the matching result matches, the management means transmits an access token to the wireless terminal and the second wireless access point.
The radio communication control system according to claim 1, characterized by: If the collation result matches, the management means transmits key information for access to the wireless terminal and the second wireless access point.
The radio communication control system according to claim 1, characterized by: The management means compares the work history configured by the work item information with the whitelist by challenge and response authentication.
The radio communication control system according to claim 1, characterized by: A storage unit that stores location information of the first wireless access point,
If the collation result is different, the management means notifies the position of the first wireless access point as the position of the second wireless access point.
The radio communication control system according to claim 1, characterized by: a wireless terminal transmitting a connection request to a first wireless access point providing access to a network over a wireless communication path to connect to said first wireless access point and transmitting work item information;
a step of receiving the work item information transmitted by the wireless terminal and storing the work history as a white list when the server has turned off the detection function of unauthorized wireless access points;
when the wireless terminal newly discovers the newly discovered second wireless access point , notifying the identification information of the second wireless access point to the outside;
receiving the work item information transmitted by the wireless terminal when the server has turned off the detection function of unauthorized wireless access points ;
a step in which the server compares the work history composed of the received work item information with the whitelist , and determines that the second wireless access point is unauthorized if the comparison result is different;
A wireless communication control method characterized by executing

Images