JP6607643B2 - Relay device - Google Patents

Description

  The present invention relates to a relay device that relays between communication terminals performed in a network.

  In recent years, with the spread of computers, education support systems that conduct classes using devices equipped with communication functions such as electronic blackboards and tablet terminals have become widespread. Such a system is required to be able to communicate between a communication terminal used by a teacher (hereinafter also referred to as a teacher terminal) and a communication terminal used by a plurality of students (hereinafter also referred to as student terminals).

  These communication terminals also have an interface for wireless communication. Therefore, a relay device that enables wireless communication between a plurality of communication terminals is known (Non-Patent Document 1). This relay device is wired to an electronic blackboard or a school network, and can be viewed on a plurality of student terminals by wireless communication while displaying image information displayed on the teacher's terminal on the electronic blackboard.

  In addition, this relay device displays the input information made at the student terminal on the screen of the teacher terminal, and shares the information with other students by transmitting the input information from the teacher terminal to the electronic blackboard Can do. In this manner, the teacher terminal and the student terminal communicate with each other (bidirectional) via the relay device, so that the lesson can be smoothly and efficiently advanced.

  On the other hand, there are some educational sites where infrastructure (for example, a school network, the Internet, etc.) for utilizing the system described above has not yet been established. Under such an environment, it is conceivable to use a dedicated device (for example, a mobile router) for connection to a wide area network (the Internet, a server of a mobile terminal company, etc.).

  Here, in the system described above, when it is possible to connect to the Internet from the teacher terminal using a dedicated device, the teacher terminal and the student terminal can communicate with each other. It becomes possible to connect to. Such connection to the Internet by a student terminal that is not intended by the teacher has problems in terms of increased costs such as line usage fees and security.

  In Patent Document 1, when a wireless LAN access point uses a VLAN (Virtual Local Area Network) and a computer virus occurs, the spread of computer virus infection to wireless LAN communication terminals is prevented, and a communication service is provided. It is described that it will continue to be provided. In response to the above-mentioned problems in the education field, the technology described in Patent Document 1 is applied to the above-described system, and a VLAN is constructed between the teacher terminal, the student terminal, the relay device, and the wide area network, and virtually It is conceivable to divide the communication path of a specific communication terminal and the communication path other than the terminal by logically dividing the LAN network.

  Patent Document 2 describes that filtering can be set with a specific pattern of MAC addresses to simplify the setting of filtering and enable communication only for specific MAC addresses. By using such a conventional technique and registering and filtering the MAC address of the teacher terminal in the relay device, it is possible to allow only the teacher terminal that wants to connect to the Internet to connect to the Internet.

Japanese Patent Laid-Open No. 2004-248023 JP 2009-065610 A

Silex Technology Co., Ltd.SX-ND-4350WAN Plus <http://www.silex.jp/products/netda/sxnd4350wan_plus.html>

  However, when the technique described in Patent Document 1 is applied to the above-described system, it is necessary to provide a network hub capable of supporting VLAN on a wired route (between the relay device and the wide area network), and the cost of introducing a new device It will increase. In addition, when the technique described in Patent Document 2 is applied to the above-described system, it is necessary to set in advance the MAC addresses of all teacher terminals that may be connected to the installed relay device. In particular, when multiple relay devices are installed in the school (for example, in each classroom), it is necessary to set the MAC addresses of teacher terminals that may be connected to all the relay devices. There is a problem that the introduction of the above-described system is complicated and time-consuming.

  The relay apparatus according to the present invention is a relay apparatus that relays communication performed between a plurality of wireless communication terminals and communication performed between itself and a communication apparatus connected to itself, and is capable of using a plurality of SSIDs. The plurality of wireless communication terminals relay using one or a plurality of sub SSIDs that are SSIDs other than the main SSID including the first terminal group that can communicate with the relay apparatus using the main SSID and the terminals other than the first terminal group. A second terminal group communicable with the device, the storage unit storing specific connection permission information, which permits or denies access to the communication device under a predetermined condition, and the second based on the specific connection permission information And a control unit that rejects access to communication devices for communication data originating from wireless communication terminals belonging to the terminal group.

Here, “reject access to the communication device of communication data originating from a wireless communication terminal belonging to the second terminal group” specifically means that the destination IP included in the communication data is described later. If the address is an IP address of a device that does not belong to either the main SSID or the sub SSID and is an IP address of a device that needs to be transmitted to the communication device 4 through the communication path R1, the control unit performs the communication This means that the data is discarded and the communication data is not transmitted to the communication device.

  Preferably, the relay device according to the present invention further includes an identifier assigning unit that assigns an IP address to the wireless communication terminals belonging to the second terminal group.

More preferably, the IP address of the wireless communication terminal belonging to the first terminal group is given by the communication device.
More preferably, the specific connection permission information is based on at least the IP address information of the transmission source terminal.

  More preferably, the communication device is connected to a wide area communication network.

  The relay device according to the present invention secures a communication path between a wireless communication terminal belonging to a specific terminal group and a plurality of other wireless communication terminals, and has a relatively simple configuration, so that a specific terminal group is assigned. It is also possible to secure a communication path that can be used only by the wireless communication terminal to which it belongs.

FIG. 1 is an overall system diagram according to an embodiment of the present invention. FIG. 2 is a hardware configuration of the relay device according to the embodiment of the present invention. FIG. 3 is a functional block diagram of the relay device according to the embodiment of the present invention. FIG. 4 is an example of an operation flow (1) of the relay device according to the embodiment of the present invention. FIG. 5 is an example of an operation flow (2) of the relay device according to the embodiment of the present invention.

  Hereinafter, embodiments will be specifically described with reference to the drawings.

  Numerical values, constituent elements, arrangement positions of constituent elements, and the like shown in the following embodiments are merely examples, and various modifications and changes can be made within the scope of the invention.

(Embodiment)
FIG. 1 is an overall view of a device control system according to an embodiment of the present invention.

  As illustrated in FIG. 1, a system 100 according to an embodiment of the present invention includes devices such as a relay device 1, a wireless communication terminal 2, a wireless communication terminal 3, a communication device 4, and a wide area network 5.

The relay device 1 is wirelessly connected to the communication device 4 through the communication route R1, and further connected to the wide area network 5 through the communication device 4 through the communication route R2. The relay device 1 has an access point function, and is connected to the wireless communication terminals 2 and 3 through the networks W1 and W2 through a wireless communication interface. Here, the communication path R1 is described as a wireless communication network in the embodiment of the present invention, but may be performed in a wired communication network using a wired communication interface. The communication path R2 may be any path that allows the communication device 4 to communicate with the wide area network 5 in order to use the wide area network . In the embodiment of the present invention, mobile communication (for example, 3G communication, LTE (Long Term Evolution)) is described as an example, but other communication (wired LAN communication, wireless LAN communication, etc.) may be used.

  Further, the relay device 1 has a function that can use a plurality of network identifiers (SSID (Service Set Identifier)). The relay device 1 has a function capable of distinguishing between a segment of SSID1 and a segment of SSID2 set in advance and enabling wireless communication only within each segment.

  The wireless communication terminal 2 includes at least a wireless communication interface and can perform wireless communication with the wireless communication terminal 3 via the relay device 1. The wireless communication terminal 2 is, for example, a notebook PC, a tablet, a smartphone, or the like. The wireless communication interface is realized by a wireless LAN that conforms to, for example, the IEEE 802.11 standard.

  In addition, the wireless communication terminal 2 is positioned as a main terminal in the system 100 according to the embodiment of the present invention. For example, when the system 100 according to the embodiment of the present invention is applied in a school, the main terminal corresponds to a teacher wireless communication terminal used in a classroom. Hereinafter, the wireless communication terminal 2 is also referred to as a main terminal. The main terminal communicates with the relay device 1 through a main SSID described later. The number of main terminals is not limited to one, and a network group (first terminal group) may be constructed with a plurality of other main terminals.

  Similarly to the wireless communication terminal 2, the wireless communication terminal 3 includes at least a wireless communication interface and can perform wireless communication with the wireless communication terminal 2 via the relay device 1. The wireless communication terminal 3 is, for example, a notebook PC, a tablet, a smartphone, or the like.

  The wireless communication terminal 3 is positioned as a sub terminal in the system 100 according to the embodiment of the present invention. For example, when the system 100 according to the embodiment of the present invention is applied in a school, the sub-terminal corresponds to a student wireless communication terminal used in a classroom. The sub terminal communicates with the relay device 1 through a sub SSID described later. The number of sub-terminals is not limited to one, and an individual network group (second terminal group) may be constructed by using a plurality of other sub-terminals and SSIDs. The sub-terminals are, for example, wireless communication terminals 3a, 3b, 3c belonging to the sub-SSID shown in FIG. One or a plurality of sub terminal groups may exist, and may communicate with the relay device 1 using different sub SSIDs.

  The communication device 4 performs mobile communication (for example, 3G, LTE, etc.) with the wide area network (wide area communication network) 5 via the communication path R2. Further, the communication device 4 can communicate with the relay device 1 via the communication path R1. The communication device 4 is used so that the wireless communication terminal 2 can communicate with the wide area network 5.

  The wide area network 5 may be any network to which the system 100 according to the embodiment of the present invention can be connected. For example, the Internet.

  FIG. 2 is a hardware configuration diagram of relay device 1 and radio communication terminals 2 and 3 according to the embodiment of the present invention.

  As shown in FIG. 2, these devices include a CPU (Central Processing Unit) 20, a ROM (Read Only Memory) 21, a RAM (Random Access Memory) 22, a storage device 23, a WNIC (Wireless Network Interface Card 24 IC). (Network Interface Card) 25 and an internal bus 26 for connecting each component. Note that the relay device 1 and the wireless communication terminals 2 and 3 are not necessarily provided with the NIC 25.

  The CPU 20 is a processor that executes a control program stored in the ROM 21.

  The ROM 21 is a read-only storage area that holds a control program and the like.

  The RAM 22 is a storage area used as a work area used when the CPU 20 executes a control program.

  The storage device 23 is a storage area for temporarily storing a control program, control information, device information, or information.

  The WNIC 24 includes a wireless communication interface that performs wireless communication. For example, a wireless LAN communication interface conforming to the IEEE802.11a, b, g, n, and ac standards.

  The NIC 25 includes a wired communication interface that performs wired communication. For example, a wired LAN communication interface conforming to the IEEE 802.3 standard or the like.

  The internal bus 26 is a bus that electrically connects the CPU 20, ROM 21, RAM 22, storage device 23, WNIC 24, and NIC 25 to exchange signals.

  FIG. 3 is a functional block diagram of the relay device 1 according to the embodiment of the present invention.

  3 includes a first communication unit 31, a second communication unit 32, a first relay unit 33, a second relay unit 34, an identifier setting unit 35, an identifier assigning unit 36, a determination unit 37, and a control unit 38. Etc.

The first communication unit 31 manages communication with the communication device 4, and transmits communication data (various information related to data and communication (for example, control information)) received from the first relay unit 33 to the communication device 4 through the communication path R <b> 1. Send.
In addition, the first communication unit 31 notifies the first relay unit 33 or the second relay unit 34 of communication data transmitted from the communication device 4 through the communication path R <b> 1 based on an instruction from the control unit 38.
The first communication unit 31 is realized by the CPU 20, ROM 21, RAM 22, WNIC 24, NIC 25, and the like.

  The second communication unit 32 manages communication with the wireless communication terminal (2 or 3), and manages a plurality of wireless communication networks using network identifiers (SSIDs). Communication data is received from a plurality of wireless communication terminals configured in a network for each SSID, and notified to the determination unit 37. The communication data notified from the first relay unit 33 or the second relay unit 34 is transmitted to the wireless communication terminal that is the transmission destination. Here, the transmission destination of the communication data is determined based on an instruction from the control unit 38. The second communication unit 32 is realized by the CPU 20, ROM 21, RAM 22, WNIC 24, and the like.

  The first relay unit 33 is also referred to as a wireless communication terminal (hereinafter referred to as “wireless communication terminal belonging to the main SSID”) that communicates with the relay device 1 using a specific SSID (for example, SSID 1) based on an instruction from the control unit 38. The communication data addressed to the communication device 4 is received from the second communication unit 32 and the communication data is notified to the first communication unit 31.

  Further, the first relay unit 33 receives communication data addressed to the main terminal from the first communication unit 31 based on an instruction from the control unit 38 and notifies the second communication unit 32 of the communication data. As described above, the first relay unit 33 relays communication performed between the first communication unit 31 and the second communication unit 32 based on an instruction from the control unit 38.

Further, when receiving the communication data addressed to the main terminal from the sub terminal from the second relay unit 34, the first relay unit 33 notifies the second communication unit 32 of the communication data based on an instruction from the control unit 38.
The first relay unit 33 is realized by the CPU 20, the ROM 21, the RAM 22, the storage device 23, and the like.

  Based on an instruction from the control unit 38, the second relay unit 34 communicates with the relay device 1 using a secondary SSID (eg, SSID 2) from the main terminal (hereinafter referred to as “wireless communication belonging to the secondary SSID”). Communication data addressed to “terminal” or “sub-terminal”) is received through the first relay unit 33. Then, the second relay unit 34 notifies the second communication unit 32 of the communication data. The second relay unit 34 also receives communication data addressed to the main terminal from the sub terminal from the second communication unit 32. Then, the second relay unit 34 notifies the first relay unit 33 of the communication data. In this way, communication transmitted from the wireless communication terminal belonging to other than the secondary SSID and performed via the relay device 1 is always performed via the second relay unit 34. The second relay unit 34 is realized by the CPU 20, the ROM 21, the RAM 22, the storage device 23, and the like.

  The identifier setting unit 35 acquires the IP address assigned by the communication device 4 from the first communication unit 31 and individually transmits to the wireless communication terminal (main terminal) belonging to the main SSID (for example, SSID 1) through the second communication unit 32. Notify In addition, the identifier setting unit 35 notifies the identifier giving unit 36 to urge a given IP address to be assigned to each sub-terminal belonging to the sub SSID. The identifier setting unit 35 is realized by the CPU 20, the ROM 21, the RAM 22, the storage device 23, and the like.

  Based on the notification from the identifier setting unit 35, the identifier assigning unit 36 assigns an IP address individually to the wireless communication terminals (sub-terminals) belonging to the sub SSID through the second communication unit 32 according to a preset rule. That is, the identifier assigning unit 36 has a DHCP (Dynamic Host Configuration Protocol) function, and when a sub SSID (for example, SSID 2) is set, an IP address is individually assigned to a sub terminal belonging to the sub SSID. Grant dynamically. Further, when a plurality of usable SSIDs (plural sub SSIDs) are set by the user, the identifier assigning unit 36 can dynamically assign IP addresses individually to sub terminals belonging to the respective SSIDs. May be. The identifier setting unit 36 is realized by the CPU 20, ROM 21, RAM 22, storage device 23, and the like.

The determination unit 37 makes the following determination and notifies the control unit 38 accordingly.
(1) It is determined whether or not setting information (also referred to as specific connection permission information) indicating that only a device belonging to the main SSID (for example, SSID 1) may connect to the communication device 4 is stored in the storage device 23. . The specific connection permission information is set by a user tool, Web input, or the like.
(2) It is determined whether or not SSID setting information that can be used for the secondary SSID is stored in the storage device 23.
(3) It is determined whether or not the communication device 4 and itself (relay device 1) are connected through the communication path R1.
(4) It is determined whether or not an IP address is assigned from the communication device 4 to the main terminal belonging to the main SSID through the first communication unit 31.
(5) It is determined whether or not the transmission destination IP address included in the communication data from the main terminal or the sub terminal notified through the second communication unit 32 is an IP address of a device belonging to the sub SSID.
(6) It is determined whether or not the transmission destination IP address included in the communication data transmitted from the first relay unit 33 is an IP address of a device belonging to the main SSID.
(7) It is determined whether or not the transmission source IP address included in the communication data is an IP address of a device belonging to the main SSID.

  The determination unit 37 is realized by the CPU 20, the ROM 21, the RAM 22, and the like.

Based on the determination by the determination unit 37, the control unit 38 notifies each functional unit as follows.
(1) When an IP address is assigned from the communication device 4 to the main terminal belonging to the main SSID (for example, SSID 1), the fact is notified to the identifier setting unit 35.
(2) If the destination IP address included in the communication data from the main terminal or sub-terminal notified through the second communication unit 32 is the IP address of the device belonging to the main SSID, the destination device (main SSID) The communication data is transmitted to the first relay unit 33 and the communication data is controlled. If the transmission destination IP address included in the communication data from the main terminal or the sub terminal is an IP address belonging to the sub SSID, the communication data is transmitted to the sub terminal of the transmission destination IP address and the communication data is Notify the relay unit 34.
(3) For the communication data notified to the first relay unit 33, the transmission destination IP address is an IP address of a device that does not belong to either the main SSID or the sub SSID, and the transmission source IP address does not belong to the main SSID. If it is, the communication data is discarded. That is, if the destination IP address included in the communication data is for the wide area network and is the IP address of the device that needs to be transmitted to the communication device 4 through the communication path R1, the control unit 38 Discards the communication data and does not transmit the communication data to the communication device 4.

  The control unit 38 is realized by the CPU 20, the ROM 21, the RAM 22, and the like.

  FIG. 4 is an operation flow diagram from when the relay apparatus 1 according to the embodiment of the present invention starts to connect to the wide area network 5 from the main terminal via the communication apparatus 4 until communication is possible. It is assumed that SSID1 is set as the main SSID.

  In step S <b> 401, the determination unit 37 determines whether the specific connection permission information is stored in the storage device 23. If the specific connection permission information is stored, the control unit 38 is notified of this fact and the process proceeds to step S402 (Yes in step S401). If the specific connection permission information is not stored, the series of processing ends (No in step S401).

  In step S <b> 402, the determination unit 37 determines whether or not SSID setting information that can be used other than SSID <b> 1 is stored in the storage device 23. When the setting information is stored, the control unit 38 is notified of the fact and the process proceeds to step S403 (Yes in step S402). If not stored, the series of processing ends (No in step S402).

  In step S403, the determination unit 37 determines whether or not itself (the relay device 1) is connected to the communication device 4 through the communication path R1. If it is connected, the identifier setting unit 35 requests the IP address assigned to the main terminal belonging to the main SSID to the communication device 4 (for example, request by the broadcast method), and transitions to step S404 (Yes in step S403). ). If not connected, the series of processing ends (No in step S403).

  In step S <b> 404, the identifier setting unit 35 acquires the IP address assigned to the main terminal belonging to the main SSID from the communication device 4 through the first communication unit 31, and notifies the identifier assigning unit 36 to that effect. The identifier setting unit 35 requests the identifier assigning unit 36 to assign a predetermined IP address to each sub-terminal belonging to the sub SSID.

  In step S405, the identifier setting unit 35 notifies the main terminal of the IP address to be assigned to the main terminal belonging to the main SSID acquired in step S404 through the second communication unit 32. Thereby, the main terminal belonging to the main SSID (SSID1) can construct a network of the same segment configured by the communication device 4 and the main terminal belonging to the main SSID (SSID1).

  Next, in step S406, the identifier assigning unit 36, based on the request from the identifier setting unit 35 in step S404, follows the rules set in advance for each sub-terminal belonging to the sub SSID (SSID 2). Through 32, an IP address is assigned to the sub-terminal. Thereby, the network of the same segment comprised by the subterminal which belongs to SSID2 can be constructed | assembled.

  Next, FIG. 5 illustrates a case where the relay device 1 according to the embodiment of the present invention relays wireless communication performed between the main terminal and the communication device 4 or between the main terminal and the sub terminal under the following circumstances. FIG. In the following situation, as shown in FIG. 4, the IP address acquired from the communication device 4 is assigned to the main terminal belonging to the main SSID (SSID1) (step S405), and the sub-SSID is sent from the identifier assigning unit 36 of the relay device 1. This is the situation assigned to the sub-terminal belonging to (SSID2) (step S406).

  In step S <b> 500, the determination unit 37 determines whether specific connection permission information exists in the storage device 23. When the specific connection permission information exists, the process proceeds to step S501 (Yes in step S500). If the specific connection permission information does not exist, the series of processes is terminated (No in step S500).

  In step S501, the determination unit 37 determines whether the transmission destination IP address included in the communication data from the main terminal or the sub terminal notified through the second communication unit 32 is the IP address of the device belonging to the sub SSID. to decide. If the IP address of the device does not belong to the secondary SSID, the determination unit 37 notifies the control unit 38 that the communication data is transmitted to the communication device 4 that belongs to the main SSID, or another main terminal (not shown). The process proceeds to step S502 (No in step S501). If the IP address belongs to the secondary SSID, the determination unit 37 notifies the control unit 38 that the communication data is to be transmitted to the sub-terminal belonging to the secondary SSID1, and the process proceeds to step S508 (Yes in step S501).

  In step S502, the control unit 38 notifies the first relay unit 33 of the communication data based on an instruction from the determination unit 37 (No in step S501) and temporarily stores it in the memory.

  In step S503, the determination unit 37 determines whether the destination IP address included in the communication data is an IP address of a device belonging to the main SSID. If it is the IP address of the device belonging to the main SSID, the determination unit 37 notifies the control unit 38 that the communication data is to be transmitted to another main terminal belonging to the main SSID, and the process proceeds to step S507 (Yes in step S503). . If it is not the IP address of the device belonging to the main SSID, the determination unit 37 transitions to step S504 (No in step S503).

  In step S504, the determination unit 37 determines whether the data transmission source IP address is an IP address of a device belonging to the main SSID. If it is the IP address of the device belonging to the main SSID, the determination unit 37 notifies the control unit 38 of the fact and transitions to step S505 (Yes in step S504). If it is not the IP address of the device belonging to the main SSID, the determination unit 37 notifies the control unit 38 of the fact and transitions to step S506 (No in step S504).

  In step S505, the first relay unit 33 notifies the first communication unit 31 of communication data based on an instruction from the control unit 38 (Yes in step S504). Then, the first communication unit 31 transmits communication data to the communication device 4 through the communication path R1.

  In step S506, the control unit 38 discards the communication data without sending it to the first communication unit based on the notification from the determination unit 37 (No in step S504).

  In step S507, the first relay unit 33 notifies the second communication unit 32 of the communication data temporarily stored in the memory based on an instruction from the control unit 38 (Yes in step S503). And the 2nd communication part 32 transmits communication data to the main terminal (other main terminal) of the transmission destination IP address which belongs to main SSID through the communication path W1.

  In step S508, the control unit 38 notifies the second relay unit 34 of the communication data based on an instruction from the determination unit 37 (Yes in step S501) and temporarily stores it in the memory.

  In step S509, the second relay unit 34 notifies the second communication unit 32 of the communication data temporarily stored in the memory based on an instruction from the control unit 38 (step S508). And the 2nd communication part 32 transmits communication data to the subterminal of the transmission destination IP address which belongs to sub SSID through the communication path W2.

(Summary)
As described above, the relay device according to the embodiment of the present invention determines whether or not only a device belonging to the main SSID can use a communication path that is permitted to communicate, and is a destination IP of the SSID or communication data. Judgment is made based on address and source IP address. In this way, it is possible to secure a communication path that can be used only by a specific wireless communication terminal while securing a communication path between the specific wireless communication terminal and the plurality of wireless communication terminals. In addition, it is possible to reduce the time and effort of setting MAC addresses of all teacher terminals that may be connected to the relay device without increasing the cost due to the introduction of a new device.

  This is useful when a relay device that connects a specific wireless communication terminal and a plurality of wireless communication terminals secures a communication path that can be used only by the specific wireless communication terminal.

100 System 1 Relay device 2 Wireless communication terminal (main terminal)
3 Wireless communication terminals (sub-terminals)
4 Communication device 4
5 Wide area network R1, R2 Communication path W1, W2 Communication path (wireless communication)
20 CPU
21 ROM
22 RAM
23 storage device 24 WNIC
25 NIC
26 internal bus 31 first communication unit 32 second communication unit 33 first relay unit 34 second relay unit 35 identifier setting unit 36 identifier giving unit 37 determination unit 38 control unit

Claims (5)

A relay device that relays communication performed between a plurality of wireless communication terminals and a communication device connected to the wireless communication terminal and can use a plurality of SSIDs (Service Set Identifiers) .
The plurality of wireless communication terminals use one or a plurality of sub SSIDs that are SSIDs other than the main SSID including a first terminal group that can communicate with the relay apparatus using a main SSID and terminals other than the first terminal group. A second terminal group capable of communicating with the relay device,
A storage unit that stores specific connection permission information that permits or denies access to the communication device under predetermined conditions;
A determination unit that determines whether or not the source IP address included in the communication data belongs to a device belonging to the main SSID;
Communication data that permits communication between the first terminal group and the second terminal group, and uses a wireless communication terminal belonging to the second terminal group as a transmission source based on the notification of the determination unit A control unit that denies access to the communication device. The relay device according to claim 1, wherein the relay device further includes an identifier assigning unit that assigns an IP address to wireless communication terminals belonging to the second terminal group. The relay apparatus according to claim 1, wherein an IP address of a wireless communication terminal belonging to the first terminal group is given by the communication apparatus. The relay device according to claim 2, wherein the specific connection permission information is based on at least IP address information of a transmission source terminal. The relay apparatus according to claim 1, wherein the communication apparatus is connected to a wide area communication network.