WO2016080398A1 - Connection management control device, wireless connection system, method for managing wireless connection to network, and program for managing wireless connection to network - Google Patents

Abstract

A connection management control device that manages wireless connection of a communication device to a prescribed network by transmitting and receiving wireless setting information, which is for wireless connection to the prescribed network, to and from a communication device that is external to the prescribed network. The communication device acquires the wireless setting information from an existing communication device that is already wirelessly connected to the prescribed network via the connection management control device. In addition, the connection management control device manages acquisition path information that pertains to an acquisition path with which the wireless setting information corresponding to each of the communication devices is acquired by the communication devices. If an unauthorised connection state is detected, wireless communication between the unauthorised communication device and the connection management control device is blocked on the basis of the acquisition path information. Thus, communication devices that perform unauthorised connection via the connection management control device can easily be disconnected.

Description

Connection management control device, wireless connection system, wireless connection management method to network, and management program for wireless connection to network

The present invention relates to a connection management control device that manages wireless connection to a network, a communication device that performs wireless communication with the connection management control device, and a wireless connection system that includes the connection management control device.

When a predetermined communication device is wirelessly connected to a network such as a LAN or the Internet, wireless communication is performed with a connection management control device such as a wireless LAN access point or router that manages the connection to the network, and there A predetermined process such as authentication is required. In order to simplify the process for wireless connection to the network, there are technologies such as AOSS (Airstation One-touch Secure System) and WPS (WiFi Secured Setup). When these technologies are used, the setting of the wireless LAN is completed simply by pressing a predetermined button such as a router or the button of the wireless communication apparatus.

Also, when wirelessly connecting to a network, there are cases in which input of wireless communication information (wireless setting information) such as an ID and password for the wireless connection may be required. In such a case, the user of the communication device inputs the information, and the connection management control device determines whether or not wireless connection to the network is possible based on the information. Here, in order to save time and effort required for the user to input the wireless setting information, the wireless setting information may be recorded in advance on the communication device side. However, if the user can visually recognize the wireless setting information, there is a concern about unauthorized use of the information. Therefore, a technology for preventing the information from being visually recognized in the communication device has been developed (for example, Patent Document 1). See).

Japanese Patent No. 4296217

When wireless setting information for wireless connection to a network is recorded in advance in the communication device, the user can easily connect the communication device to the network corresponding to the wireless setting information. However, this ease is exhibited only for a network corresponding to wireless setting information recorded in advance, and lacks versatility for many networks.

In addition, when a communication device exchanges wireless setting information with a connection management control device in order to establish a wireless connection to a network, for example, both devices are connected by wire for exchange, or both devices are exchanged for transmission / reception. From the viewpoint of the operation of the device, such as the necessity of performing predetermined processing at the same time, the distance between the communication device and the connection management control device may be required to be within a certain distance. However, there are cases where it is difficult to easily change the physical position of a network or connection management control device that is already operating, or to bring the communication device close to the connection management control device.

On the other hand, if the wireless connection through the connection management control device by the communication device is facilitated, the wireless setting information for the wireless connection spreads unnecessarily, which is undesirable from the viewpoint of network security, network load, etc. There is a risk of allowing connection (illegal connection). Access by such a communication device that performs unauthorized connection should be excluded, but if the number of communication devices wirelessly connected to the network increases, it is not easy to eliminate the access.

The present invention has been made in view of such a problem, and provides a management technology for a wireless connection to a network that can easily disconnect a communication device that performs unauthorized connection via a connection management control device. With the goal.

In the present invention, in order to solve the above problems, the communication device acquires wireless setting information for wireless connection to a network from a communication device that has already performed wireless connection to the network. Based on the information related to the acquisition path of the wireless setting information, a configuration is adopted in which wireless communication by an unauthorized communication device performing unauthorized connection is blocked. As a result, unauthorized wireless communication can be easily blocked.

Specifically, the present invention transmits / receives wireless setting information for wireless connection to a predetermined network to / from a communication device outside the predetermined network, so that the communication device can wirelessly connect to the predetermined network. It is a connection management control device that performs management. Then, the communication device transmits a wireless setting information for wirelessly connecting the communication device to the predetermined network via the connection management control device. According to the setting information, it is configured to acquire from an existing communication device that is already wirelessly connected to the predetermined network via the connection management control device. Further, the connection management control device is configured to acquire the wireless setting information corresponding to each of one or a plurality of communication devices performing wireless communication with the connection management control device by the respective communication devices. Management means for managing acquisition path information relating to, unauthorized detection means for detecting an unauthorized connection state in which one or a plurality of communication devices are illegally connected to the connection management control device, and the unauthorized connection status by the unauthorized detection means And detecting means for blocking wireless communication between the one or more unauthorized communication devices and the connection management control device based on the acquired route information managed by the management means.

In order for a communication device to wirelessly connect to a predetermined network, the communication device uses the wireless setting information for allowing wireless connection by the connection management control device managing the predetermined network, and the communication device is connected to the connection management control device. Need to access. Here, examples of the wireless setting information include identification information for identification in a predetermined network, a password corresponding to the identification information, and the like. For wireless connection to a predetermined network, the communication device is configured to acquire its own wireless setting information from an existing communication device that is already wirelessly connected to the predetermined network via the connection management control device. The Therefore, the communication device can acquire the wireless setting information not only from the connection management control device but also from the existing communication device, and the processing of wireless connection to the predetermined network becomes easy.

On the other hand, according to such facilitation of wireless connection processing, the possibility that a predetermined network is exposed to an unintended wireless connection increases. Such an unintended wireless connection is referred to as an unauthorized connection in the present invention, and is targeted for blocking wireless communication with the connection management control device by the blocking means. As an unauthorized connection, for example, not only a wireless connection represented by unauthorized acquisition of wireless setting information but also a communication device that has performed an appropriate wireless connection accidentally performs an unauthorized wireless connection for some reason. An accidental illegal connection such as a case where the illegal connection has occurred is also included, and a communication device that performs the illegal connection is referred to as an unauthorized communication device. An unauthorized connection state that is an unauthorized connection state by such an unauthorized communication device is detected by the unauthorized detection means. The determination of the unauthorized connection state by the unauthorized detection means is performed based on detection of an event (for example, information flow or network load) in a predetermined network or unauthorized acquisition processing itself of wireless setting information by an unauthorized communication device. .

Also, the connection management control device manages the acquired route information by the management means. This acquisition route information is information on which route the communication device performing wireless communication has acquired the wireless setting information. In other words, it is wirelessly connected to a predetermined network via the connection management control device. It is also information indicating the correlation between one or a plurality of communication devices related to the acquisition of the respective wireless setting information. Therefore, by using this acquisition path information, if an unauthorized connection state is detected by the unauthorized detection means, one or more unauthorized communication devices related to the unauthorized connection state are transferred to the wireless configuration information acquisition path. It becomes possible to grasp easily from a viewpoint. Therefore, based on this acquired route information, the blocking means blocks wireless communication between one or more unauthorized communication devices and the connection management control device, thereby easily disconnecting the unauthorized communication device from wireless connection to a predetermined network. Therefore, management of wireless connection by the connection management control device can be suitably performed.

Here, in the above connection management control device, the communication device communicates with the predetermined network via the connection management control device according to predetermined wireless setting information that enables wireless communication with the connection management control device. Setting for requesting self-radio setting information which is the radio setting information for self-existing communication device that enables wireless communication with the connection management control device to an existing communication device that has already established a wireless connection Received by the setting information receiving means, the setting information receiving means for receiving from the existing communication apparatus the self-radio setting information prepared by the existing communication apparatus according to the request by the setting information requesting means, and the setting information receiving means And executing means for executing wireless communication to the connection management control device based on the self wireless setting information. When the communication device performs wireless communication with the connection management control device using the self-radio setting information by the execution unit, the management unit performs the self-communication by the communication device based on the self-radio setting information. The acquisition path of wireless setting information is set as a new management target.

Here, the communication device has setting information requesting means and setting information receiving means, so that its own wireless setting information (self wireless setting information) is already wirelessly connected to a predetermined network via the connection management control device. Configured to obtain from existing communication devices. In other words, the communication device requests the existing communication device for its own wireless setting information necessary for the communication device itself to wirelessly connect to a predetermined network via the connection management control device by the setting information requesting means. To do. The existing communication device is a device that is already wirelessly connected to a predetermined network via the connection management control device when the communication device attempts to make a wireless connection to the predetermined network. Therefore, the existing communication device has already been granted a wireless connection to the predetermined network by the connection management control device. For example, the existing communication device is exchanged with the connection management control device or other communication devices such as the communication device. After exchanging with the communication device, it has predetermined wireless setting information for the existing communication device. The setting information request means pays attention to the fact that the existing communication device already has the predetermined wireless setting information, and requests the existing communication device to exchange the wireless setting information instead of the connection management control device. is there.

In addition, when the request by the setting information request means arrives at the existing communication device, the existing communication device prepares self-radio setting information for the communication device. Regarding the preparation of the self-radio setting information, the existing communication device may make the preparation for all requests, or determine whether to make the preparation for each request according to a predetermined judgment criterion. You may make the preparation after having done. Examples of the predetermined determination criterion include a criterion set to allow wireless connection from the viewpoint of security of a predetermined network. In any case, the self-radio setting information prepared by the existing communication device is sent to the communication device side and received by the setting information receiving means.

As described above, the communication device according to the present invention acquires the self-radio setting information through the exchange with the existing communication device, instead of directly exchanging the radio setting information with the connection management control device. As a result, the communication apparatus can acquire the self-radio setting information from other than the connection management control apparatus, and can easily connect to a predetermined network by radio. Then, in a situation where the communication device can easily acquire the self-radio setting information in this way, the connection management control device, if there is a communication device that has made a new access according to the acquired self-radio setting information, the communication means The acquisition route of the device's own wireless setting information is newly managed. As a result, when the unauthorized connection state is detected later by the unauthorized detection means, the unauthorized communication device can be easily disconnected as described above.

Here, in the connection management control device described above, when the unauthorized connection state is detected by the unauthorized detection means, a predetermined function relating to wireless communication between the one or more unauthorized communication devices and the connection management control device. The communication function restriction means for restricting a part of the communication function restriction means may be further provided. In this case, the restriction by the communication function restriction means is executed before the wireless communication is interrupted by the interruption means. In the present invention, unauthorized connection refers to an unintended wireless connection in a predetermined network. Therefore, even if an unauthorized connection state is detected, wireless communication by the unauthorized communication device can be permitted in a predetermined network by restricting a part of the wireless communication function of the unauthorized communication device by the communication function restricting means. For example, it may not be necessary to block the wireless connection by the unauthorized communication device. Conversely, when an originally normal communication device accidentally becomes an unauthorized communication device, the predetermined processing by the wireless communication function of the original communication device is useful for the predetermined network even after becoming the unauthorized communication device. There may be cases. In such a case, it is possible to maintain a profit that can be enjoyed as a predetermined network by limiting a part of the predetermined function related to wireless communication by the communication function limiting unit. As long as wireless communication between the connection management control device and the unauthorized communication device is restricted, the predetermined function may be a function on the connection management control device side or a function on the unauthorized communication device side. Also good.

Note that even if some benefits can be obtained by restricting a part of the wireless communication function of the unauthorized communication device, the unauthorized connection itself by the unauthorized communication device is not preferable for a given network. Therefore, even when the restriction by the communication function restriction unit is performed, the wireless communication of the unauthorized communication device is blocked by the blocking unit.

Here, two forms of restriction can be exemplified as forms of restriction of the wireless communication function by the communication function restriction means. First, in the above connection management control device, the communication function restriction unit prohibits information transmission from the one or more unauthorized communication devices to the connection management control device, and from the connection management control device. Restricting a part of predetermined functions related to wireless communication between the one or more unauthorized communication devices and the connection management control device in such a format that information transmission to the one or more unauthorized communication devices is permitted. . Second, in the above connection management control device, the communication function restriction unit is configured to transmit the transmission based on the content of transmission information transmitted from the one or more unauthorized communication devices toward the connection management control device. A part of a predetermined function related to wireless communication between the one or more unauthorized communication devices and the connection management control device is limited in a format for determining whether or not information can be transmitted. In the former restriction mode, the wireless communication function of the unauthorized communication device is restricted based on the transmission direction of the transmission information, and as a result, information transmission from the connection management control device to the unauthorized communication device is maintained. Thus, a state where management control of the unauthorized communication device by the connection management control device is possible is maintained. In the latter restriction mode, the wireless communication function of the unauthorized communication device is restricted based on the content of the transmission information, for example, based on whether or not the information has useful content. The transmission of information required by the network side is maintained. If the wireless communication function of the unauthorized communication device is restricted and some benefits can be enjoyed for a predetermined network, other restricted forms can be employed.

Here, when the connection management control device includes a communication function restriction unit, the connection management control device is a part of the wireless communication function for the connection management control device of the one or more unauthorized communication devices by the communication function restriction unit. In the state where the restriction is performed, a recovery means for recovering at least a part of the unauthorized connection state among the one or more unauthorized communication devices to a normal connection state may be further provided. In this way, the cancellation of the unauthorized connection state by the recovery unit and the restoration to the normal connection state are performed, so that it is not necessary to block the wireless communication by the blocking unit. As a result, the communication device that has been restored to the normal connection state can be prevented from being disconnected from the predetermined network, and wireless connection to the predetermined network can be continued.

Also, the present invention can be grasped from the aspect of a wireless connection system for performing wireless connection to a predetermined network. In this case, the wireless connection system transmits / receives wireless setting information for wireless connection to a predetermined network to / from a communication device outside the predetermined network, so that the wireless connection of the communication device to the predetermined network is performed. A connection management control device that manages the network, and an existing wireless connection already established to the predetermined network via the connection management control device according to predetermined wireless setting information that enables wireless communication with the connection management control device A communication device, and a communication device configured to acquire wireless setting information for wireless connection to the predetermined network via the connection management control device from the existing communication device. Then, the connection management control device obtains the wireless setting information corresponding to each of one or a plurality of communication devices performing wireless communication with the connection management control device by the respective communication devices. Management means for managing acquisition path information relating to, unauthorized detection means for detecting an unauthorized connection state in which one or a plurality of communication devices are illegally connected to the connection management control device, and the unauthorized connection status by the unauthorized detection means And detecting means for blocking wireless communication between the one or more unauthorized communication devices and the connection management control device based on the acquired route information managed by the management means. It should be noted that the technical idea disclosed with respect to the invention of the connection management control device can be applied to the invention of the wireless connection system as long as there is no technical flaw.

In addition, the present invention manages and controls wireless connection of the communication device to the predetermined network by transmitting and receiving wireless setting information for wireless connection to the predetermined network to and from a communication device outside the predetermined network. It may be understood from the aspect of the management method by the connection management control device. In this case, in this method, the wireless setting information corresponding to each of one or a plurality of communication devices performing wireless communication with the connection management control device is acquired with respect to the acquisition path acquired by each communication device. A management step for managing path information; an unauthorized detection step for detecting an unauthorized connection state in which one or a plurality of communication devices are illegally connected to the connection management control device; and the unauthorized connection state is detected in the unauthorized detection step. And a blocking step of blocking wireless communication between the one or more unauthorized communication devices and the connection management control device based on the acquired route information managed in the management step. It should be noted that the technical idea disclosed regarding the invention of the connection management control device can be applied to the invention of the management method as long as there is no technical flaw.

In addition, the present invention manages and controls the wireless connection of the communication device to the predetermined network by transmitting and receiving wireless setting information for wireless connection to the predetermined network to and from a communication device outside the predetermined network. It may be understood from the aspect of a management program for wireless connection to the network executed by the connection management control device. In this case, the communication apparatus transmits a wireless setting information for wirelessly connecting the communication apparatus to the predetermined network via the connection management control apparatus. According to the wireless setting information, it is configured to acquire from an existing communication device that is already wirelessly connected to the predetermined network via the connection management control device. Then, the management program is connected to the connection management control device.
A management step of managing the acquisition path information related to the acquisition path acquired by each of the communication apparatuses, wherein the wireless setting information corresponding to each of one or a plurality of communication apparatuses performing wireless communication with the connection management control apparatus And an unauthorized detection step for detecting an unauthorized connection state in which one or a plurality of communication devices are illegally connected to the connection management control device, and when the unauthorized connection state is detected in the unauthorized detection step, the management step And a blocking step for blocking wireless communication between the one or more unauthorized communication devices and the connection management control device. It should be noted that the technical idea disclosed regarding the invention of the connection management control device can be applied to the management program invention as long as there is no technical flaw.

It becomes possible to provide a management technology for wireless connection to a network that can easily disconnect a communication device that performs unauthorized connection via the connection management control device.

It is a figure which shows schematic structure of the wireless connection system which concerns on 1st Example of this invention. It is a 1st functional block diagram of the communication apparatus contained in the wireless connection system shown in FIG. It is a 2nd functional block diagram of the communication apparatus contained in the wireless connection system shown in FIG. FIG. 2 is a functional block diagram of a router included in the wireless connection system shown in FIG. 1. It is a flowchart of the wireless connection process performed with a communication apparatus. It is a flowchart of the setting information provision process performed with a communication apparatus. FIG. 2 is a first sequence diagram regarding information exchange between a communication device and a router in the wireless connection system shown in FIG. 1. 6 is a diagram schematically showing a data structure of a request command and wireless setting information transmitted / received between communication apparatuses in order to acquire wireless setting information in each process shown in FIGS. 4 and 5. FIG. FIG. 6 is a second sequence diagram regarding information exchange between the communication device and the router in the wireless connection system shown in FIG. 1. It is a figure which shows schematic structure of the radio | wireless setting information for management with which a router is provided. It is a figure which shows schematic structure of the wireless connection system which concerns on 2nd Example of this invention. It is a flowchart of the acquisition path | route information management process performed with the router shown in FIG. It is a figure which shows the database structure of the acquisition route information produced | generated by the acquisition route information management process. It is a 1st flowchart of the interruption | blocking process performed with the router shown in FIG. FIG. 11 is a second flowchart of a blocking process executed by the router shown in FIG. 10. It is a figure which shows another database structure of acquisition path | route information.

The wireless connection system according to the present invention and the communication device included in the wireless connection system will be described with reference to the drawings. The configuration of the following embodiment is an exemplification, and the present invention is not limited to the configuration of this embodiment.

FIG. 1 is a diagram showing a schematic configuration of a wireless connection system that is a system for wirelessly connecting to a predetermined network 10. The predetermined network 10 is an arbitrary network such as a LAN or the Internet, and the router 1 is a device that manages and controls wireless connection to the predetermined network 10. The communication devices 3 and 4 have already made a wireless connection to the predetermined network 10 via the router 1. In the wireless connection via the router 1, the communication devices 3 and 4 have already exchanged wireless setting information with the router 1. The wireless setting information is information necessary for wireless connection to a predetermined network 10, and is formed of, for example, identification information for the predetermined network 10 and a password for wireless connection to the network. In the wireless connection system shown in FIG. 1, each of the communication devices 3 and 4 that are already wirelessly connected to the predetermined network 10 via the router 1 stores wireless setting information for realizing the wireless connection in the memory of the device. In the figure, the wireless setting information of the communication device 3 is referred to by 3a, and the wireless setting information of the communication device 4 is referred to by 4a.

The router 1 is a device that manages and controls the wireless connection of a communication device that is wirelessly connected to a predetermined network 10 via the router 1. Therefore, management wireless setting information is stored as information for management control of the wireless connection and stored in the memory of the router 1. The management wireless setting information is denoted by reference numeral 1a in FIG. 1, and its specific configuration is disclosed in FIG. 9 to be described later. Here, in order to exchange wireless setting information directly with the router 1 so that the communication apparatus wirelessly connects to the predetermined network 10, the communication apparatus needs to be located within a certain distance from the router 1. This is because the router 1 is a device for exchanging wireless setting information by the WPS (WiFi Protected Setup) method, and the user must operate the router 1 and the communication device at the same time. Then, it is assumed that the communication devices 3 and 4 have already established a wireless connection to the predetermined network 10 via the router 1 by exchanging wireless setting information with the router 1 by this WPS method.

Here, when a new communication device 2 tries to establish a wireless connection to a predetermined network 10, it is the same as the communication devices 3 and 4 as long as the distance from the router 1 can be brought close to the range necessary for processing for wireless connection. As described above, wireless connection to a predetermined network 10 is possible by directly exchanging wireless setting information with the router 1. However, when the communication device 2 cannot sufficiently approach the router 1 due to restrictions on the place of use or the like, it is difficult to exchange wireless setting information with the router 1 like the communication devices 3 and 4. Therefore, in the wireless connection system according to the present invention, the communication device 2 that is in a situation where it is difficult to exchange such wireless setting information is not connected to the router 1 but is already wirelessly connected to the predetermined network 10 via the router 1. It is configured to exchange alternative wireless setting information with a communication device (for example, the communication device 3) that realizes the above. The communication device (for example, the communication device 3) that exchanges this alternative wireless setting information in place of the router 1 is a communication device that has already made a wireless connection to the predetermined network 10, and the existing communication device according to the present invention. It corresponds to a communication device.

Hereinafter, a wireless setting information exchange process performed by the communication apparatus 2 in order for the communication apparatus 2 to establish a wireless connection to the predetermined network 10 via the router 1 will be described. Note that the wireless setting information exchange process is formed by each process shown in FIGS. 4 and 5 to be described later, and various communication apparatuses 2 and 3 that perform these processes are shown. In order to explain the functions, FIG. 2A shows a functional block diagram in which some of the functions of the communication device 2 are imaged, and FIG. 2B shows a functional block diagram in which some of the functions of the communication device 3 are imaged. . FIG. 3 shows a functional block diagram in which some of the functions of the router 1 are imaged. The functions shown in these functional block diagrams are realized by executing predetermined control programs by the communication devices 2 and 3, the arithmetic device included in the router 1, a memory, and the like. Although a functional block diagram relating to the communication device 4 is not disclosed in this specification, the communication device 4 has functions equivalent to those of the communication device 3.

Hereinafter, the functions of the communication devices 2 and 3 will be described in order based on FIGS. 2A and 2B, respectively. First, the communication device 2 includes a control unit 20, a communication unit 21, and a wireless setting information storage unit 22 as functional units. The control unit 20 is a functional unit that performs various controls in the communication device 2, and particularly includes a communication control unit 201, a setting information request unit 202, and a setting information reception unit 203. The communication control unit 201 transmits / receives information to / from the communication device 3 necessary for acquiring self-radio setting information, which will be described later, and obtains self-radio setting information and wirelessly connects to a predetermined network via the router 1. It is a functional unit that performs transmission / reception of various information such as transmission / reception of information after being established. In the present embodiment, the wireless setting information corresponding to the communication device 2 that newly attempts to establish a wireless connection to the predetermined network 10 via the router 1 is referred to as self wireless setting information. Before the communication device 2 is wirelessly connected to the predetermined network 10, the communication device 2 does not hold self-radio setting information for wireless connection to the predetermined network 10.

In addition, the setting information request unit 202 makes a self-communication (communication) to the communication device 3 that has already established a wireless connection in order for the communication device 2 to establish a wireless connection to the predetermined network 10 via the router 1. It is a functional unit that transmits a request signal so as to transmit the self-radio setting information used by the device 2). The request signal generated by the setting information request unit 202 is transmitted to the communication device 3 under the control of the communication control unit 201. The setting information reception unit 203 is a functional unit that receives the self-radio setting information transmitted from the communication device 3 in response to the request signal generated by the setting information request unit 202. The reception of the self wireless setting information is also performed under the control of the communication control unit 201. Note that the setting information receiving unit 203 not only receives the self-radio setting information transmitted by the request signal, but in a situation where the communication apparatus 2 can directly exchange the radio setting information with the router 1, the WPS method is used. Obtained self-radio setting information is also received.

Next, the communication unit 21 controls transmission / reception of information to / from the outside through an antenna mounted on the communication device 2. Specifically, according to control from the communication control unit 201, the communication unit 2 and the external device Transmit / receive information to / from devices (communication device 3, router 1, etc.). In the present embodiment, transmission / reception of information to / from an external device is all performed by wireless communication. The wireless setting information storage unit 22 is a functional unit that stores the self-radio setting information received by the setting information receiving unit 203. By following the stored self-radio setting information, the communication device 2 can wirelessly connect to a predetermined network 10 via the router 1.

Next, functional units in the communication device 3 will be described with reference to FIG. 2B. The communication device 3 includes a control unit 30, a communication unit 31, and a wireless setting information storage unit 32 as functional units. The control unit 30 is a functional unit that performs various controls in the communication device 3. In particular, the control unit 30 includes a communication control unit 301, a setting information request unit 302, a setting information receiving unit 303, and a setting information preparation unit 304. Yes. Here, the communication unit 31 and the wireless setting information storage unit 32 are substantially the same as the communication unit 21 and the wireless setting information storage unit 22 of the communication device 2, and the communication control unit 301 and setting that the control unit 30 has. The information requesting unit 302 and the setting information receiving unit 303 are substantially the same as the communication control unit 201, the setting information requesting unit 202, and the setting information receiving unit 203 that the control unit 20 of the communication device 2 has. I will omit the explanation of the details. Note that, as described above, the communication device 3 directly exchanges wireless setting information with the router 1. In this case, the function by the setting information request unit 302 is not exhibited, and the communication device 3 is not connected to the router 1. Wireless setting information is acquired from

Here, the control unit 30 of the communication device 3 further includes a setting information preparation unit 304 as a functional unit. When the setting information preparation unit 304 receives a request signal related to the self-radio setting information from another communication device (communication device 2 or the like), the setting information preparation unit 304 relates to preparation for transmitting the requested self-radio setting information to the request source. It is a functional unit that performs processing. There are various preparation modes for the preparation of the self-radio setting information, and an appropriate preparation mode can be adopted in consideration of security on wireless connection to a predetermined network 10. Details of the preparation of the self-radio setting information will be described later.

Note that the functional block diagrams of the communication devices 2 and 3 shown in FIGS. 2A and 2B are examples. Therefore, each communication device may have a functional unit other than the illustrated functional unit. For example, the control unit 20 in the communication device 2 may have substantially the same function unit as the setting information preparation unit 304 in the communication device 3. In this case, when the communication device 2 has already exchanged the wireless setting information directly with the router 1 and receives a request signal related to the self wireless setting information from a communication device other than the communication device 2, the communication device 2 Self-radio setting information for the communication device is prepared.

Next, functional units formed in the router 1 will be described with reference to FIG. The router 1 includes a communication unit 11, a management wireless setting information storage unit 12, and a connection management unit 13. The communication unit 11 is a functional unit for communicating with a communication device wirelessly connected to a predetermined network 10. The management wireless setting information storage unit 12 is a functional unit that stores management wireless setting information for managing communication apparatuses that perform wireless communication via the communication unit 11. The management wireless setting information includes information such as identification information of a communication device to be managed and authority for wireless connection given to the communication device (for details, refer to FIG. 9 described later). . Based on these management wireless setting information, the connection management unit 13 performs management control of wireless connection to a predetermined network.

More specifically, the connection management unit 13 includes an acquisition path information management unit 131, a fraud detection unit 132, and a blocking management unit 133. The acquired route information management unit 131 is a functional unit that manages a route through which the communication device wirelessly connected to the predetermined network 10 via the router 1 has acquired the wireless setting information used at the time of the wireless connection. The fraud detection unit 132 is a functional unit that detects an unauthorized connection state in which an unauthorized wireless connection is performed in the wireless connection to the predetermined network 10 via the router 1. The unauthorized connection state in the present invention refers to a state of wireless connection that is not intended in the predetermined network 10. The blocking management unit 133 is a functional unit that performs processing related to blocking wireless communication between the communication device performing the unauthorized connection and the router 1 when the unauthorized detection state is detected by the unauthorized detection unit 132. is there. In addition to the blocking process itself, the process related to the blocking of the wireless communication includes a predetermined process (a wireless communication function restriction process or a restoration process described later) for a communication device that performs an unauthorized connection before the blocking process is executed. Processing).

In addition, the connection management unit 13 performs management control of the wireless connection not only after the wireless connection is established but also in the previous stage, for example, processing when the communication device 3 exchanges wireless setting information by the WPS method, It is also responsible for the preparation process of the self-radio setting information of the communication device 2 performed in cooperation with the setting information preparation unit 304 of the communication device 3 (see FIG. 8 described later).

Next, processing for exchanging wireless setting information performed between the communication device 2 and the communication device 3 will be described with reference to FIGS. 4 and 5. This exchange process is formed by a wireless connection process executed by the communication apparatus 2 shown in FIG. 4 and a setting information provision process executed by the communication apparatus 3 shown in FIG. Shows a sequence relating to transmission and reception of signals between the communication devices 2 and 3 and the router when each processing is performed.

FIG. 7 shows information (message information for requesting wireless setting information (hereinafter referred to as “request message information”) transmitted and received between the communication device 2 and the communication device 3 for exchanging wireless setting information. And the data structure of reply message information (hereinafter referred to as “reply message information”) corresponding to the request. FIG. 7A discloses a data structure common to information sent from the communication device 2 to the communication device 3 and information sent from the communication device 3 to the communication device 2. The information is roughly divided into eight areas. In the present embodiment, among the eight regions, five particularly important regions a1 to a5 will be described. An area a1 (Start Symbol) is a specific byte string indicating the start of message information. Area a2 (Destination Address) represents the address of the destination to which the message information is finally transmitted (the communication device 3 is the destination in the case of request message information, and the communication device 2 is the destination in the case of reply message information). . The area a3 (Source Address) represents the address of the message information transmission source (in the case of request message information, the communication device 2 is the transmission source, and in the case of reply message information, the communication device 3 is the transmission source).

Next, data corresponding to each message information is stored in the area a4 (Data). Specifically, as shown in FIG. 7B, the area a4 is divided into three areas a41, a42, and a43. Has been. The area a41 stores identification information of message information, and can identify whether the data is request message information data or reply message information data based on the identification information. The area a42 stores specific data corresponding to each message information. Specifically, in the case of request message information, a command for requesting the self-radio setting information of the communication device 2 is stored. In this case, the data of the self-radio setting information of the communication device 2 is stored as an answer to the request. In the area a43, information about the checksum is possible. An area a5 (Terminator Symbol for Data) is a specific byte string indicating the end of transmission information.

FIG. 7C discloses specific data contents of request message information transmitted from the communication device 2 to the communication device 3, and FIG. 7D shows the communication device 3 to the communication device. 2 discloses the specific data contents of the reply message information transmitted. Reference numbers a1 to a5 and a41 to a43 in FIGS. 7C and 7D correspond to the reference numbers of the data areas shown in FIGS. 7A and 7B. As can be seen from these specific data contents, the identification information of the communication device 2 is “2001”, and the identification information of the communication device 3 is “3001”. When the identification information of the area a41 is FF, the message information is request message information. When the identification information of the area a41 is FE, the message information is reply message information. In the case of request message information (FIG. 7C), the data stored in the area a42 is information for wireless connection to a predetermined network 10 (at least identification information for identifying the network and the identification information). This is a command for inquiring a password corresponding to the password. In the case of reply message information (FIG. 7 (d)), the data stored in the area a42 is reply contents corresponding to the request command (that is, identification information and password for specifying the network).

Here, returning to FIGS. 4 to 6, the wireless setting information exchange process performed between the communication device 2 and the communication device 3 will be described. First, the wireless connection process performed by the communication device 2 will be described. In S <b> 101, self-radio setting information that is radio setting information corresponding to the communication device 2 is requested to the communication device 3. The processing of S101 is performed by the setting information request unit 202. Specifically, the request message information illustrated in FIG. 7C is transmitted to the communication device 3 via the communication unit 21. The timing at which the request message information is transmitted in S101 is timing T1 in the sequence shown in FIG. When the process of S101 ends, the process proceeds to S102.

In S102, in response to the transmission of the request message information in S101, it is determined whether or not the self wireless setting information is received from the communication device 3. In order to transmit the self-radio setting information from the communication device 3, the setting information provision processing shown in FIG. 5 is performed in the communication device 3, and this processing will be described later. The processing of S102 is determined by the communication control unit 201 upon receipt of the self-radio setting information by the setting information receiving unit 203. If an affirmative determination is made in S102, the wireless setting information storage unit 22 stores the self wireless setting information received by the setting information receiving unit 203. On the other hand, if a negative determination is made in S102, the process proceeds to S103. Note that the timing at which affirmative determination is made in S102 is timing T2 in the sequence shown in FIG.

Next, in S103, it is determined whether or not reception failure of the self-radio setting information requested in S101 has occurred. The reception failure indicates a state in which the self-radio setting information cannot be received from the requested communication device 3. For example, if the self-radio setting information cannot be received from the communication device 3 within a predetermined time after the request for the self-radio setting information in S101 is made, “reception failure” occurs. Also, in the setting information providing process described later, when the communication device 3 determines that the communication device 2 is not a suitable destination for providing the self-radio setting information, the determination result is sent to the communication device 2. Based on this, a “reception failure” occurs. In addition, the determination process in S103 may be performed in accordance with a predetermined determination criterion so that the communication device 2 that has requested the self-radio setting information does not wait for a long time to receive the self-radio setting information. If an affirmative determination is made in S103, the process proceeds to S104, an error relating to the request for the self-radio setting information is displayed on the display of the communication apparatus 2, and the user is notified that the self-radio setting information could not be acquired. If a negative determination is made in S103, the processing after S102 is performed again.

Further, when an affirmative determination is made in S102 and the received self-radio setting information is stored in the radio-setting information storage unit 22, wireless communication is executed to the router 1 using the self-radio setting information in S105. . The process of S105 is executed by the communication control unit 201. Note that the timing at which wireless communication is performed on the router 1 in S105 is timing T3 in the sequence shown in FIG. As a result, the communication device 2 can wirelessly connect to the predetermined network 10 via the router 1 after performing the wireless setting information exchange process with the communication device 3 instead of the router 1.

Here, the setting information providing process executed in cooperation with the wireless connection process in the communication device 3 will be described with reference to FIG. In S201, it is determined whether or not the request signal for the self-radio setting information, that is, the request message information illustrated in FIG. The determination process is performed by the communication control unit 301. If an affirmative determination is made in S201, the processing after S202 is performed in order to prepare the self-radio setting information for the communication device 2 in the communication device 3. On the other hand, if a negative determination is made in S201, the setting information provision process is terminated.

In S202, upon receiving the request message information from the communication device 2, the destination authentication is performed. This provision destination authentication is a process for determining whether the requesting communication apparatus 2 is an appropriate communication apparatus as the provision destination of the self-radio setting information, and is executed by the setting information preparation unit 304. In the present invention, the wireless setting information exchange process is performed not for the router 1 but for the communication apparatus 3 that is already wirelessly connected to a predetermined network via the router 1. Since the exchange processing of the wireless setting information with the communication device 3 is an alternative processing performed in place of the router 1, the self-wireless setting information is requested from the communication device 3 without limitation in consideration of network security and the like. Providing the original is not necessarily preferable. Therefore, the provision destination authentication process of S202 is performed, and a certain restriction is imposed on the provision of the self-radio setting information.

An example of providing destination authentication is performed according to a list (white list) that includes the address information of communication devices that the setting information preparation unit 304 has in advance to provide or permit self-radio setting information. The request source address included in the request message information shown in FIG. 7 (c) (in this embodiment, the address of the communication device 2) is collated with the white list that the setting information preparation 304 has, and If the address of the communication device 2 is included, the provision of the self-radio setting information to the communication device 2 is permitted. Then, based on the result of the destination authentication in S202, it is determined in S203 whether or not the self wireless setting information can be transmitted to the request source. If a positive determination is made in S203, the process proceeds to S204, and if a negative determination is made, the process proceeds to S206. In S206, a notification that the provision of the self-radio setting information by the communication device 3 is not permitted is made to the request source. Based on this notification, in S103 in the wireless connection process, it is determined that a reception failure has occurred.

And the timing at which the positive determination is made in S203 is the timing T11 in the sequence shown in FIG. In order to transmit the self-radio setting information to the request source by the setting information supply process, it is necessary to make an affirmative determination in S201. Then, in the determination of S201, it is determined whether or not the request message information in the predetermined format shown in FIG. 7 has been received. Therefore, the request source that has transmitted the request message information has a predetermined amount to know the predetermined format. It is a communication device related to the network 10, and therefore it can be considered that provision of self-radio setting information to such a request source is not an unlimited provision. Based on such an idea, the processing of S202 and S203 may not be performed.

Next, in S204, the setting information preparation unit 304 prepares the self-radio setting information provided to the requesting communication device 2. Several preparation modes can be exemplified for the preparation of the self-radio setting information. First, the wireless setting information used when the communication apparatus 3 is currently wirelessly connected to the predetermined network 10 is prepared as the self-radio setting information used by the requesting communication apparatus 2 as it is. Therefore, in this first preparation mode, the communication device 3 can easily prepare the self-radio setting information. On the other hand, if the communication device 2 is provided with the self-radio setting information prepared in this way and uses it to access the router 1, the router 1 uses the same radio setting information to perform a plurality of communications. Since the device is in an access state, it becomes difficult for the router 1 to distinguish between the communication devices using the wireless setting information. Such a situation may be undesirable in the management of the wireless connection of the communication device by the router 1.

In the second preparation mode, the wireless setting information is different from the wireless setting information used when the communication device 3 is currently wirelessly connected to the predetermined network 10 and is requested by the setting information providing process. The wireless setting information separately stored in the wireless setting information storage unit 32 for providing the original is prepared as self-radio setting information used by the requesting communication device 2. At this time, the “wireless setting information separately stored in the wireless setting information storage unit 32 for provision to the request source” may be different wireless setting information for each request source, or shared by a plurality of request sources. Wireless setting information used in If it is the self-radio setting information prepared by the second preparation mode, the router 1 can distinguish and grasp at least access by the communication device 2 and access by the communication device 3. In particular, when the self-radio setting information is different for each request source, the router 1 accesses the communication device 2, and when another communication device acquires the self-radio setting information by the setting information providing process, It is also possible to distinguish from accesses by other communication devices. On the other hand, when the self-radio setting information is commonly used by a plurality of requesters, it is difficult to distinguish the access of the communication apparatus using the common self-radio setting information according to the radio setting information.

When the preparation of the self-radio setting information is completed in S204, the process proceeds to S205, and the prepared self-radio setting information is transmitted to the requesting communication apparatus 2 in S205. This transmitted information is the reply message information shown in FIG. The timing for completing the preparation of the self-radio setting information and transmitting it is timing T12 in the sequence shown in FIG. After the process of S205, the setting information provision process ends.

As a result of the sequence shown in FIG. 6 being performed by the wireless connection process and the setting information providing process up to the above, the communication apparatus 2 replaces the wireless setting information exchange process with the router 1 and performs the self wireless setting from the communication apparatus 3. Information can be acquired and wirelessly connected to a predetermined network 10 via the router 1 using the information. Therefore, the communication device 2 can be wirelessly connected to the predetermined network 10 via the router 1 without being affected by the distance between the communication device 2 and the router 1. Network participation becomes easy.

If the communication device 2 uses the self-radio setting information to make a wireless connection to the predetermined network 10 via the router 1 after acquiring the self-radio setting information from the communication device 3, the communication device 2 directly In addition, wireless communication with the router 1 may be performed. Alternatively, the communication device 2 may perform wireless communication with the router 1 with a relay device interposed between the communication device 2 and the router 1. In this case, for example, the communication device 2 may perform wireless communication with the router 1 via the communication device 3 that provided the self-radio setting information, or alternatively, via the router 1 as with the communication device 3. Wireless communication with the router 1 may be performed via the communication device 4 that is already wirelessly connected to the predetermined network 10. In the former case, since wireless communication for exchanging self-radio setting information was performed between the communication device 2 and the communication device 3, wireless communication from the communication device 2 to the router 1 can be easily performed. it is conceivable that. On the other hand, in the latter case, since the communication device that the communication device 2 directly wirelessly communicates with is acquired by the acquisition of the self-radio setting information and the wireless connection to the predetermined network 10 after the acquisition, the specific communication device It is possible to prevent the load from concentrating on.

<Modification 1>
A modification of the preparation mode of the self-radio setting information in the setting information providing process will be described with reference to FIG. FIG. 8 shows a sequence related to transmission / reception of signals between the communication apparatuses 2 and 3 and the router 1 when the wireless connection process and the setting information provision process are performed, as in FIG. 6. The difference between the sequence shown in FIG. 8 and the sequence shown in FIG. 6 is a preparation mode of the self-radio setting information in the communication device 3. In the preparation mode according to the present modification, the communication device 3 requests the router 1 to issue self-radio setting information for the requesting communication device 2 after the provision destination authentication ends. That is, in the preparation mode according to this modification, the communication device 3 does not prepare the self-radio setting information directly, but the communication device 3 acquires the self-radio setting information from the router 1 and sends it to the communication device 2. It is to provide. Note that the timing at which the communication device 3 requests self-radio setting information from the router 1 is the timing T21 in the sequence shown in FIG.

The advantage of causing the router 1 to issue the self-radio setting information of the communication device 2 in this way is that the router 1 that manages and controls the wireless connection to the predetermined network 10 recognizes the existence of the communication device 2 and then sets the self-radio setting. Since the information is provided to the communication device 2 via the communication device 3, the management control of the wireless connection by the router 1 can be suitably performed. Therefore, in order for the router 1 to issue the self-radio setting information, the communication device 3 delivers the address of the communication device 2 included in the request message information to the router 1 together with the issue request. Then, the router 1 issues self-radio setting information dedicated to the communication device 2 in association with the address of the communication device 2. Thus, when the communication device 2 accesses the router 1 using the self-radio setting information, the router 1 identifies that the access is made by the communication device 2 and the router 1 It is also possible to grasp the circumstances that the self-radio setting information is acquired via the communication device 3. This makes the management control of the wireless connection by the router 1 more suitable. Note that the wireless setting information issuance timing by the router 1 is timing T22 in the sequence shown in FIG.

When the communication device 3 receives the issuance of self-radio setting information for the communication device 2 by the router 1, the received self-radio setting information is transmitted to the communication device 2 at timing T2 as prepared self-radio setting information. Thereafter, as described above, the communication device 2 performs wireless communication with the router 1 using the self-radio setting information received from the communication device 3 and wirelessly connects to the predetermined network 10. As described above, also in this modification, since the communication device 2 actually exchanges the wireless setting information is the communication device 3 and not the router 1, the communication device 2 and the router 1 are exchanged as in the above-described embodiment. The communication device 2 can wirelessly connect to the predetermined network 10 without being affected by the distance between the two.

<Modification 2>
In the embodiments described above, the wireless connection process and the setting information provision process are executed by performing wireless communication between the communication device 2 and the communication device 3 by the communication unit 21 and the communication unit 31. Instead of this aspect, wired communication may be formed between the communication device 2 and the communication device 3 in order to perform wireless connection processing and setting information provision processing. In this case, for example, by electrically connecting the communication device 2 and the communication device 3 directly with a cable, information can be transmitted and received between the two devices. At this time, when the cable is connected, the confirmation process of the connection target is executed in each of the two devices, and a state in which wired communication for executing the wireless connection processing and the setting information providing processing is established between the two devices is formed. A determination is made whether or not. By this determination processing, the transmission destination of information is specified in both apparatuses.

As described above, the wireless connection processing and the setting information provision processing are performed after the state in which wired communication is possible between the communication device 2 and the communication device 3, and wireless communication is performed as in the above embodiment. The communication apparatus 2 can easily acquire the self-radio setting information from the communication apparatus 3 as in the case where both processes are performed via Further, since the transmission destination of the self-radio setting information is uniquely specified by the wire through the wired communication in this way, it is possible to safely transmit the self-radio setting information.

<Other examples>
Here, FIG. 9 schematically shows the data structure of the management wireless setting information 1 a possessed by the router 1. This management wireless setting information is information for managing and controlling the wireless connection of each communication device that is currently wirelessly connected to the predetermined network 10 via the router 1. Specifically, whether the management wireless setting information is information obtained by directly exchanging the identification information (ID) of the wirelessly connected communication device and the wireless setting information used for wireless connection with the router 1. An information type that is a flag indicating whether or not and a communication permission period during which wireless connection by the communication device is permitted are configured as fields. As for the information type, S0 is obtained when the wireless setting information is directly acquired from the router 1, and S1 is obtained when the wireless setting information is obtained via a communication device that is already wirelessly connected. Therefore, in this embodiment, the information type is set to S1 for the communication device 2 and the information type is set to S0 for the communication devices 3 and 4.

Also, the communication permission period is set according to the information type flag. The communication permission period is a relative period (for example, one week from the time of wireless connection) applied from the time when each communication apparatus is wirelessly connected to the predetermined network 10 for the first time via the router 1. be able to. In this embodiment, when the information type is S0, T0 is set for the communication permission period, and when the information type is S1, T1 is set for the communication permission period. The communication permission period T0 is longer than the communication permission period T1. The communication device 2 whose information type is S1 does not acquire the wireless setting information directly from the router 1, but acquires it from the communication device 3. In such a case, the wireless connection by the communication device 2 is often temporary and sufficient, and the setting information providing process according to FIG. 6 involves the router 1 in providing the self-wireless setting information for the communication device 2. Therefore, it is not necessarily preferable that the wireless connection by the communication device 2 is continued without limitation. Therefore, by making the communication permission period of the communication device 2 with the information type S1 shorter than the communication permission period of the communication devices 3 and 4 with the information type S0, it is possible to prevent the inadvertent wireless connection from continuing. .

Also, as another method of setting the communication permission period, the communication permission period may be expressed by setting a specific date and time as the last access time limit. For example, the last date and time when access is permitted as of October 31, 2014 may be input to the communication permission period of the management wireless setting information 1a as the last day of the communication permission period. In this case, the period of the communication device 2 is set to be shorter than the period of the communication devices 3 and 4 with respect to the access period calculated based on the final deadline of the input access and the first wireless connection.

Also, the information type may be further subdivided, and the communication permission period may be set in detail accordingly. For example, in the setting information providing process according to FIG. 8, the router 1 is involved in providing the self-radio setting information for the communication device 2. Therefore, compared with the setting information providing process according to FIG. From this aspect, it can be considered preferable. Therefore, when the communication apparatus 2 acquires the self-radio setting information by the setting information providing process according to FIG. 8, the information type is set to S2, and the corresponding communication permission period is longer than T1 and shorter than T0. It may be set.

In addition, about the setting of said communication permission period, you may employ | adopt settings other than the above-mentioned form. For example, the same communication permission period may be set for any communication device regardless of the information type. Further, a period during which wireless connection by the communication device 2 is possible may be managed on the communication device 2 side. In this case, the self-radio setting information of the communication device 2 includes information regarding a communicable period during which the communication device 2 can wirelessly connect using the self-radio setting information. Accordingly, a wireless connection to a predetermined network 10 is performed via the router 1.

<Specific example of wireless connection system to which the present invention is applied>
A specific example of a wireless connection system to which the present invention shown in the above embodiments is applied will be shown.
(Example 1)
The present invention can be applied to a wireless connection to a LAN via a router that manages access to the LAN provided in a home or office. For example, if the router is installed in a place near the ceiling where it is difficult to reach, if there is a PC terminal that exchanges wireless setting information with the router in advance, a new PC terminal or tablet device Etc. can perform wireless connection to the LAN by performing the above-described wireless connection processing and setting information provision processing with the PC terminal already performing wireless connection.

(Example 2)
A wireless network operated in a factory may be installed in a place where a router or the like is not conspicuous so as not to hinder the work in the factory. In such a wireless network, there is a case where a management terminal is brought in for confirmation of manufacturing progress in a factory and management of manufacturing equipment. However, since the management terminal is used for other purposes outside the factory, it cannot be incorporated in the wireless network in the factory in advance. Therefore, in such a case, the above wireless connection processing and setting information provision processing are performed between the communication device and the management terminal that are already wirelessly connected to the wireless network via the router, so that the wireless network is installed in the factory. Can be wirelessly connected to the wireless network.

FIG. 10 shows a schematic configuration of the wireless connection system according to the second embodiment of the present invention. The communication device included in the wireless connection system is a transmission module equipped with sensors for measuring various external environment parameters (temperature, etc.). FIG. 10 shows six transmission modules 52 to 57. Each of the transmission modules 52 to 57 wirelessly communicates with the router 1 using its own wireless setting information so that the measured external environment parameters are collected by the server 50 connected to the predetermined network 10. Transmit external environmental parameters measured through it.

The measurement by the sensors mounted on the transmission modules 52 to 57 and the transmission of the measurement data to the server 50 are performed after the power is turned on in each transmission module in order to realize continuous information collection. Are executed repeatedly at regular intervals (for example, at regular intervals). In addition, the transmission modules 52 to 57 have all the functional units shown in FIG. 2B. In addition, the sensor functional units for measuring the measurement target (reference numbers 52b to 57b in the transmission modules 52 to 57, respectively). A function unit that records and processes measured information, and a power supply function unit that supplies power for a control circuit, a memory, and the like from a built-in battery without receiving power supply from the outside. Configured as a small device.

Examples of sensors mounted on the transmission modules 52 to 57 include physical sensors such as a temperature sensor, a humidity sensor, an acceleration sensor, an illuminance sensor, a flow sensor, a pressure sensor, a ground temperature sensor, and a particle sensor, and CO _2. There are chemical sensors such as sensors, pH sensors, EC sensors, and soil moisture sensors. In the present embodiment, in order to simplify the explanation, it is assumed that each transmission module is equipped with a temperature sensor for measuring the external temperature at the position where each transmission module is disposed, and the measured temperature data Is transmitted to the server 50.

The process of forming the wireless connection system shown in FIG. 10 will be described. The transmission module 52 is wirelessly connectable to a predetermined network 10 via the router 1 at the earliest time among the transmission modules shown in FIG. 10. The transmission module 52 receives wireless setting information from the router 1. Get directly. Therefore, the transmission module 52 does not acquire the wireless setting information by executing the wireless connection process, but acquires the wireless setting information from the router 1 according to the WPS method, for example.

Next, for the transmission module 53, the wireless connection process is executed in the transmission module 53, and the setting information providing process is executed in response to the transmission module 52 that is already wirelessly connected at that time. Thus, wireless setting information usable by the transmission module 53 is acquired from the transmission module 52. Similarly, the transmission module 54 acquires wireless setting information that can be used by the transmission module 54 from the transmission module 53. The transmission modules 53 and 54 that have acquired the wireless setting information in this way start wireless communication with the router 1 using the wireless setting information and start wireless connection to the predetermined network 10. Acquisition of each wireless setting information by these transmission modules 52, 53, and 54 follows a predetermined acquisition method, and does not constitute unauthorized acquisition. Acquisition of such formal wireless setting information is indicated by a white arrow in FIG.

Here, in the wireless connection system shown in FIG. 10, each transmission module uses wireless setting information used for wireless connection to a predetermined network 10 via the router 1 including identification information (login name) and a password. It is formed. The password is used in common for all transmission modules connected wirelessly. Also, the login name is formed by adding the sub-identification information of the own transmission module and the sub-identification information corresponding to the acquisition destination from which the transmission module has acquired the wireless setting information each time the acquisition of the wireless setting information is repeated. Shall be. For example, since the transmission module 52 acquires the wireless setting information from the router 1, the login name is RRAA by adding the sub-identification information AA of the transmission module 52 itself to the sub-identification information RR corresponding to the router 1. Next, since the transmission module 53 acquires the wireless setting information from the transmission module 52, the login name is RRAABB in which the sub-identification information BB of the transmission module 53 itself is added to the login name RRAA of the transmission module 52. Similarly, the login name of the transmission module 54 is RRAABBCC obtained by adding the sub-identification information CC of the transmission module 54 itself to the login name RRAABB of the transmission module 53.

Here, the transmission module 55 illegally acquired the wireless setting information usable by the transmission module 55 from the transmission module 54 via wireless communication with the transmission module 54 without performing the wireless connection process. Shall. Specifically, the transmission module 55 does not request the transmission module 54 for wireless setting information in a predetermined format, that is, without transmitting the request message information shown in FIG. By unauthorized access to 54, the wireless setting information possessed by the transmission module 54 is illegally stolen. As a result, the transmission module 55 creates its own login name RRAABBCCXX using the login name RRAABBCCC of the transmission module 54 that has been illegally accessed and the sub-identification information XX of the transmission module 55 itself, and a common password together with the login name. Is used to create wireless setting information for the transmission module 55, and wireless communication to the router 1 is executed using the wireless setting information. Acquisition of the wireless setting information by the transmission module 55 is illegal, and is indicated by a solid arrow in FIG. 10 to distinguish it from the above-mentioned formal acquisition.

Further, in the wireless connection system shown in FIG. 10, the transmission modules 56 and 57 acquire the wireless setting information from the transmission module 55. The acquisition by the transmission modules 56 and 57 is acquisition from the transmission module 55 that has acquired the unauthorized wireless setting information, whether it is the above-described formal acquisition or unauthorized acquisition. For this reason, the password held by the transmission modules 56 and 57 is considered to be stolen from other transmission modules in the same manner as the password held by the transmission module 55. Therefore, acquisition of the wireless setting by the transmission modules 56 and 57 is indicated by a solid arrow as in the transmission module 55. The sub-identification information corresponding to each of the transmission modules 56 and 57 is YY and ZZ. Therefore, the login names of the transmission modules 56 and 57 are RRAABBCCCXYY and RRAABBCCXXZZ, respectively.

<Acquisition route information management processing>
Here, in the router 1, when any one of the transmission modules acquires the wireless setting information, starts wireless communication to the router 1, and attempts to wirelessly connect to a predetermined network 10, the transmission module uses the transmission module. An acquisition route information management process is performed to manage the route through which the wireless setting information is acquired. This acquisition route information management processing is executed by the acquisition route information management unit 131, and the flow of the processing is shown in the flowchart of FIG. The acquired route information management process is performed for each access to the router 1 of each transmission module, whereby the income route information database shown in FIG. 12 is formed. These will be described in detail below.

In S301, it is determined whether or not the access to the router 1 by each transmission module is a new access using the wireless setting information of the transmission module. The determination of S301 is performed based on whether or not the wireless setting information that each transmission module uses for wireless communication with the router 1 is the first use. If an affirmative determination is made in S301, the process proceeds to S302, and if a negative determination is made, this process ends.

In S302, the login name (identification used when the transmission module wirelessly connects to the predetermined network 10 via the router 1) included in its own wireless setting information used by the transmission module that has made a new access. Information) is extracted. As an example, the transmission module 52 is “AA”, and the transmission module 55 is “AABBCCXX”. Thereafter, in S303, the acquisition path of the wireless setting information held by each transmission module is specified from the extracted login name. The acquisition path is specified in consideration of the fact that the login name of each transmission module is formed by concatenating the sub-identification information of the transmission module that has been traced to acquire the wireless setting information. Accordingly, for example, the acquisition path of the transmission module 52 is determined from “RR” excluding the sub-identification information AA of the transmission module 52 itself given at the end of the login name. In this case, the acquisition path corresponds to “RR”. Only the router 1 to be used is the acquisition path for the wireless setting information of the transmission module 52. Further, the acquisition path of the transmission module 55 is determined from “RRABBBCC” excluding the sub-identification information XX of the transmission module 55 itself. In this case, the router 1 and the transmission modules 52, 53, and 54 are set as the acquisition paths. The

Then, after the process of S303, the process proceeds to S304, where the acquisition path of each transmission module specified in S303 is added to the acquisition path information database. A database of acquired route information generated in this way is shown in FIG. In FIG. 12, each acquisition path describes the router 1 and the transmission modules that are traced in acquiring the wireless setting information in the order of time as a first acquisition destination, a second acquisition destination, and so on. In the display of the acquisition destination, the identification number (device ID) of each device of the router 1 and the transmission module that is passed is used. In FIG. 12, the device ID of the router 1 is 0001, and the device IDs of the transmission modules 52 to 57 are 2001 to 7001, respectively. As described above, the acquisition path information management process of FIG. 11 grasps the acquisition path of the wireless setting information acquired by each transmission module in the order of the apparatus ID of the apparatus (router 1, each transmission module) that has passed through. Become.

<Blocking process>
When a plurality of transmission modules start wireless connection to a predetermined network 10 via the router 1, temperature data measured in each transmission module is transmitted to the server 50. Here, in the predetermined network 10, temporarily, the load (transmission information amount) of the predetermined network 10 excessively increases, or temperature data to be transmitted to the server 50 is sent to a destination other than the server 50. The occurrence of an event that should not occur originally is naturally undesirable from the viewpoint of network management. Here, in the wireless connection system shown in FIG. 10, the transmission module 55 illegally acquires wireless setting hand information from the transmission module 54, and as a result, an event that should not occur as described above occurs. The possibility is high. Therefore, the transmission module that has obtained the wireless setting information in an unauthorized manner is referred to as an unauthorized transmission module, and according to the description of the wireless connection system in FIG. 10, the transmission modules 55 to 57 correspond to the unauthorized transmission module. .

In the wireless connection system according to the present invention, if it is considered that an event that should not occur originally is generated by the transmission module that is wirelessly connected to the predetermined network 10 via the router 1, the event is illegal. In order to determine that it is caused by an unauthorized connection of the transmission module and to stop the wireless connection of the unauthorized transmission module to a predetermined network, a process of blocking wireless communication between the unauthorized transmission module and the router 1 is performed. This blocking process is executed by the fraud detection unit 132 and the blocking management unit 133, and the flow of the processing is described in the flowchart of FIG.

First, in S401, the fraud detection unit 132 determines whether an unauthorized connection state is detected in the wireless connection by the transmission module (in the present embodiment, the transmission modules 52 to 57) managed by the router 1. . Specifically, the fraud detection unit 132 confirms the destination of the temperature data transmitted from each transmission module, and when the destination is not the server 50 that is the original destination but another destination. In this case, the transmission module that transmits the temperature data corresponds to the unauthorized transmission module.

As an alternative, for security purposes, data transmitted from each transmission module should be encrypted, but the temperature data is sent without being subjected to cryptographic processing, or is defined. Even when transmission is performed at an extremely shorter interval than the existing transmission interval and the load on the network increases as a result, it is possible to detect that an unauthorized connection has occurred. Further, as another method, it is possible to detect that an unauthorized connection state has occurred even when the data transmitted from the transmission module is not temperature data but other data (not limited to measurement data). . If the unauthorized transmission module is set to perform a Dos attack (Denial of Service attack) for some reason, the unauthorized connection state can be detected based on such an increase in network load and data contents. . Furthermore, a user (worker) who monitors a predetermined network recognizes the occurrence of an unauthorized connection state, and inputs the occurrence of the unauthorized connection state at a management terminal electrically connected to the router 1. 1, the fraud detection unit 132 may be configured to detect the unauthorized connection state. If an affirmative determination is made in S401, the process proceeds to S402, and if a negative determination is made, the blocking process is terminated.

The next steps S402 and S403 are executed by the blocking management unit 133. First, in step S <b> 402, regarding the detected unauthorized connection state, a condition for blocking wireless communication with the router 1 is determined for disconnecting the transmission module performing unauthorized connection from the wireless connection with the predetermined network 10. Specifically, when the destination of the temperature data transmission is used in the detection of the unauthorized connection state, the device ID of the transmission module that has transmitted the temperature data whose destination is not the server 50 and the acquisition path management unit 131 The blocking condition related to the unauthorized connection state is determined using the database of acquired route information.

Therefore, an example of the process for determining the blocking condition will be described. In the detection of an unauthorized connection state by the unauthorized detection unit 302, the transmission module 55 is recognized as an unauthorized transmission module that transmits unauthorized temperature data. Then, in the acquisition path information database, the unauthorized transmission module 55, and the transmission module corresponding to the acquisition path including the device ID (5001) of the unauthorized transmission module 55 in the acquisition path of the wireless setting information are blocked transmission modules. To do. This is based on the idea that a transmission module provided with wireless setting information from a transmission module that transmits unauthorized temperature data is also likely to transmit unauthorized temperature data. Based on the above, in this embodiment, the blocking condition related to the unauthorized connection state is “transmission module with device ID 5001 in the acquisition route information database and transmission module with device ID included in the acquisition route of wireless setting information” Is the condition.

Then, in S403, wireless communication between the router 1 and the transmission module (transmission modules 55 to 57 as shown in FIG. 12 in this embodiment) that is the subject of wireless communication interruption in accordance with the interruption condition determined in S402. Are blocked all at once. Since the blocking condition is determined based on the acquisition path of the wireless setting information as described above, the transmission module to be blocked can be identified very easily. For specific wireless communication interruption, a command is transmitted from the router 1 to the transmission modules 55 to 57 so as to stop access to the router 1. As another method, the router 1 may refuse to receive signals (including temperature data) transmitted from the transmission modules 55 to 57 to the router 1.

According to the above-described blocking process, when it is detected that an unauthorized connection state is formed by the transmission module wirelessly connected to the router 1, the acquired route information database managed by the acquired route information management unit 131. Accordingly, the blocking condition for the transmission module to be blocked by wireless communication is determined. As a result, the wireless communication blocking process can be performed collectively, and the management of the wireless connection by the router 1 is facilitated.

<Modified example of blocking process>
Here, FIG. 14 shows a modification of the blocking process. Among the processes in the blocking process shown in FIG. 14, the same processes as those in the blocking process shown in FIG. 13 are denoted by the same reference numerals, and detailed description thereof is omitted. In the blocking process according to this modification, when the process of S402 ends, the process proceeds to S501.

In S501, the wireless communication function of the blocking target module (in the present embodiment, the transmission modules 55 to 57 in the present embodiment) that is the blocking target of wireless communication is limited in accordance with the blocking condition determined in S402. This restriction process is also executed by the cutoff management unit 133. The purpose of this wireless communication function restriction process is that there is a possibility that the interruption target module (illegal transmission module) may be restored to a normal transmission module by the restoration process performed in S502, which will be described later. This is in order not to be disconnected from the predetermined network 10 and to mitigate the influence on the predetermined network 10 by the blocking target module. Therefore, in the blocking target module that has been subjected to the restriction process of the wireless communication function, the wireless communication with the router 1 is still maintained in a state where it can be performed in some form.

Here, as an example of the restriction of the wireless communication function, information from the router 1 to the blocking target module can be transmitted, but information from the blocking target module to the router 1 is transmitted from the blocking target module 1 so that the information does not reach the router 1. The function may be stopped, or the router 1 may refuse to receive information from the blocking target module. As another method, the transmission function of the blocking target module may be changed based on the content of information transmitted from the blocking target module to the router 1. For example, if the module to be blocked is sending various information and control commands that should not be sent to the router 1 in addition to the temperature data to the router 1, only the temperature data is sent. Other control commands are not transmitted. When the processing of S501 ends, the process proceeds to S502.

In S502, the shutdown management unit 133 performs a recovery process. This restoration process is a process for returning the shut-off target module to a normal transmission module. For example, a restart command is transmitted to the block target module whose communication function is limited. If there is no change in the information transmission behavior of the interruption target module after waiting for a certain period of time (for example, the transmission destination of the temperature data does not return to the server 50), the restoration process is unsuccessful. If the behavior of information transmission returns to a normal behavior (for example, the transmission destination of temperature data returns to the server 50), the recovery processing is successful. Therefore, in S503, if it is determined that the restoration process has been successful, the process proceeds to S504, where the blocking condition determined in S402 is reset. Therefore, in this case, the transmission modules 55 to 57 that are the modules to be blocked continue to be wirelessly connected to a predetermined network via the router 1 as normal transmission modules. On the other hand, if it is determined in S503 that the restoration process has not been successful, the process proceeds to S403, where the block-off process for the block-target modules 55 to 57 is performed.

As described above, in the blocking process according to this modification, the blocking target module detected as being in an unauthorized connection state is not disconnected from the predetermined network 10 immediately after the detection, but is restored to a normal connection state. Therefore, if the recovery is realized, inadvertent disconnection of the transmission module is suppressed, and the temperature data collection process is not hindered.

<Another example of acquisition route information>
The acquisition path information database shown in FIG. 12 is generated based on the login name included in the wireless setting information of each transmission module by executing the acquisition path information management process shown in FIG. Instead of this mode, the acquisition path information database is also created based on the wireless setting information of each transmission module and information separately transmitted to the router 1 from the transmission module corresponding to the existing communication apparatus that provided the wireless setting information. Can be generated. For example, a transmission module corresponding to an existing communication apparatus provides the wireless setting information prepared according to the first preparation mode or the second preparation mode to the transmission module that requested the wireless setting information in the wireless connection process. At this time, the router 1 is also provided with information that can identify the transmission module, such as the device ID of the transmission module that made the request to the router 1. Then, when the transmission module that made the request accesses the router 1, the router 1 obtains the wireless setting information from which transmission module the transmission module that made the request uses the information such as the device ID provided in advance. You can see what happened.

When wireless setting information is illegally acquired from a transmission module corresponding to an existing communication device, such as the transmission module 55 described above, a device ID or the like is provided to the router 1 from the transmission module corresponding to the existing communication device. Is not done. Therefore, the router 1 does not generate acquisition path information regarding the transmission module 55. In addition, since the wireless setting information is also provided from the unauthorized transmission module 55 for the transmission modules 56 and 57, the device ID and the like are not provided from the unauthorized transmission module 55 to the router 1. Also, the acquisition route information regarding the transmission modules 56 and 57 is not generated.

As a result, the acquired route information database generated by the router 1 is only the one corresponding to the transmission modules 52 to 54 as shown in FIG. In this case, if the unauthorized connection state is detected by the unauthorized detection unit 132, the router 1 performs wireless communication between the router and the transmission module that is not included in the database based on the acquired route information database shown in FIG. Therefore, the blocking condition for blocking is determined. Then, wireless communication with the unauthorized transmission module is blocked according to the blocking condition.

Further, as another mode of generating the acquisition path information database as shown in FIG. 15, there is a generation mode when the setting information providing process according to FIG. 8 is executed. Specifically, in the setting information providing process according to FIG. 8, the router 1 substantially identifies the transmission module that requested the wireless setting information and issues the wireless setting information for that purpose. Therefore, since the router 1 can grasp in advance the transmission module that performs wireless communication with the router 1, a database of acquired route information as shown in FIG. 15 can be generated.

<Type of unauthorized connection>
As an aspect of the unauthorized connection by the transmission module, an aspect in which the transmission module performs an unauthorized connection due to virus infection or failure other than the intentional unauthorized connection aspect as described above is also conceivable. In addition, a form in which an unauthorized transmission module intentionally uses exactly the same wireless setting information as an existing transmission module and impersonates the existing transmission module is one of the forms of unauthorized connection. In this case, it becomes difficult for the router 1 to distinguish between the existing transmission module impersonated and the unauthorized transmission module, and when the above-described blocking process is performed, even the existing transmission module that is normally performing a normal wireless connection is used. However, there is a possibility that the wireless communication is interrupted. However, the present invention includes a mode in which the wireless communication is unavoidably interrupted to the existing transmission module in the scope of the right.

DESCRIPTION OF SYMBOLS 1 ... Router 2, 3, 4 ... Communication device 10 ... Predetermined network 50 ... Server 52-57 ... Transmission module

Claims (9)

1. A connection management control device that manages wireless connection of the communication device to the predetermined network by transmitting / receiving wireless setting information for wireless connection to the predetermined network to / from a communication device outside the predetermined network. There,
   The communication device has wireless setting information for allowing the communication device to wirelessly connect to the predetermined network via the connection management control device, and predetermined wireless setting information for enabling wireless communication with the connection management control device. Is configured to obtain from an existing communication device that is already wirelessly connected to the predetermined network via the connection management control device,
   The connection management control device includes:
   Management means for managing the acquisition path information relating to the acquisition path acquired by each of the communication apparatuses, wherein the wireless setting information corresponding to each of one or a plurality of communication apparatuses performing wireless communication with the connection management control apparatus When,
   Fraud detection means for detecting an unauthorized connection state in which one or a plurality of communication devices are illegally connected to the connection management control device;
   When the unauthorized connection state is detected by the unauthorized detection unit, wireless communication between the one or more unauthorized communication devices and the connection management control device is performed based on the acquired route information managed by the management unit. Blocking means for blocking;
   A connection management control device.
2. The communication device
   In accordance with predetermined wireless setting information that enables wireless communication with the connection management control device, the communication is performed with respect to an existing communication device that has already made a wireless connection to the predetermined network via the connection management control device. A setting information requesting unit for requesting self-radio setting information which is the radio setting information for the device to enable wireless communication with the connection management control device;
   Setting information receiving means for receiving from the existing communication apparatus the self-radio setting information prepared by the existing communication apparatus in accordance with a request by the setting information requesting means;
   Execution means for executing wireless communication to the connection management control device based on the self-radio setting information received by the setting information receiving means;
   Have
   When the communication device performs wireless communication with the connection management control device using the self-radio setting information by the execution unit, the management unit sets the self-radio setting by the communication device based on the self-radio setting information. The information acquisition route is a new management target.
   The connection management control device according to claim 1.
3. When the unauthorized connection state is detected by the unauthorized detection means, a communication function restriction unit that restricts a part of a predetermined function related to wireless communication between the one or more unauthorized communication devices and the connection management control device, In addition,
   The restriction by the communication function restriction unit is executed before the wireless communication is blocked by the blocking unit.
   The connection management control device according to claim 1.
4. The communication function restriction means prohibits information transmission from the one or more unauthorized communication devices to the connection management control device, and transmits information from the connection management control device to the one or more unauthorized communication devices. Restricting a part of a predetermined function related to wireless communication between the one or more unauthorized communication devices and the connection management control device in a permitted form;
   The connection management control device according to claim 3.
5. The communication function restriction means determines whether or not transmission of the transmission information is possible based on the content of transmission information transmitted from the one or more unauthorized communication devices to the connection management control device. Or a part of a predetermined function related to wireless communication between a plurality of unauthorized communication devices and the connection management control device,
   The connection management control device according to claim 3.
6. In a state in which a part of the wireless communication function of the one or more unauthorized communication devices to the connection management control device is restricted by the communication function restriction means, at least some of the one or more unauthorized communication devices Further comprising recovery means for recovering the unauthorized connection state to a normal connection state,
   The connection management control device according to claim 3.
7. A wireless connection system for performing wireless connection to a predetermined network,
   A connection management control device that manages wireless connection of the communication device to the predetermined network by transmitting / receiving wireless setting information for wireless connection to the predetermined network to / from a communication device outside the predetermined network; ,
   In accordance with predetermined wireless setting information that enables wireless communication with the connection management control device, an existing communication device that is already wirelessly connected to the predetermined network via the connection management control device;
   A communication device configured to acquire wireless setting information for wireless connection to the predetermined network via the connection management control device from the existing communication device;
   With
   The connection management control device includes:
   Management means for managing the acquisition path information relating to the acquisition path acquired by each of the communication apparatuses, wherein the wireless setting information corresponding to each of one or a plurality of communication apparatuses performing wireless communication with the connection management control apparatus When,
   Fraud detection means for detecting an unauthorized connection state in which one or a plurality of communication devices are illegally connected to the connection management control device;
   When the unauthorized connection state is detected by the unauthorized detection unit, wireless communication between the one or more unauthorized communication devices and the connection management control device is performed based on the acquired route information managed by the management unit. Blocking means for blocking;
   A wireless connection system.
8. By a connection management control device that manages and controls wireless connection of the communication device to the predetermined network by transmitting and receiving wireless setting information for wireless connection to the predetermined network to and from a communication device outside the predetermined network A management method,
   The communication device has wireless setting information for allowing the communication device to wirelessly connect to the predetermined network via the connection management control device, and predetermined wireless setting information for enabling wireless communication with the connection management control device. Is configured to obtain from an existing communication device that is already wirelessly connected to the predetermined network via the connection management control device,
   The management method is:
   A management step of managing the acquisition path information related to the acquisition path acquired by each of the communication apparatuses, wherein the wireless setting information corresponding to each of one or a plurality of communication apparatuses performing wireless communication with the connection management control apparatus When,
   A fraud detection step of detecting an unauthorized connection state in which one or a plurality of communication devices are illegally connected to the connection management control device;
   When the unauthorized connection state is detected in the unauthorized detection step, wireless communication between the one or more unauthorized communication devices and the connection management control device is performed based on the acquisition path information managed in the management step. A blocking step to block;
   including,
   A method for managing wireless connection to a network.
9. A connection management control device that manages and controls wireless connection of the communication device to the predetermined network by transmitting and receiving wireless setting information for wireless connection to the predetermined network to and from a communication device outside the predetermined network. A wireless connection management program to be executed,
   The communication device has wireless setting information for allowing the communication device to wirelessly connect to the predetermined network via the connection management control device, and predetermined wireless setting information for enabling wireless communication with the connection management control device. Is configured to obtain from an existing communication device that is already wirelessly connected to the predetermined network via the connection management control device,
   The program is stored in the connection management control device.
   A management step of managing the acquisition path information related to the acquisition path acquired by each of the communication apparatuses, wherein the wireless setting information corresponding to each of one or a plurality of communication apparatuses performing wireless communication with the connection management control apparatus When,
   A fraud detection step of detecting an unauthorized connection state in which one or a plurality of communication devices are illegally connected to the connection management control device;
   When the unauthorized connection state is detected in the unauthorized detection step, wireless communication between the one or more unauthorized communication devices and the connection management control device is performed based on the acquisition path information managed in the management step. A blocking step to block;
   A program for managing a wireless connection to a network.

Images