JP7794446B2 - Wireless LAN access point, communication method and program - Google Patents

Description

This disclosure relates to wireless LAN access points.

Patent Document 1 describes a wireless access point device that can automatically cause a wireless client to use the optimal SSID (Service Set Identifier) by determining that the SSID with setting information closest to the optimal setting information predetermined for the type of wireless client device is the optimal SSID for the wireless client device.

JP 2013-131993 A

However, wireless LAN (Local Area Network) access points have the problem of being used illegally, even if an administrator has configured the wireless LAN connection settings and security settings.

For example, if a wireless LAN access point is operated with the default settings from the time it was installed, or if low-security encryption is used, an unauthorized third party may learn the wireless LAN access point's SSID and encryption key and use the wireless LAN access point illegally.

In addition, wireless LAN access point administrators often do not notice when unauthorized third parties are using their wireless LAN access points illegally, and once a third party connects to a wireless LAN access point, there is a risk that it may continue to be used illegally.

The purpose of this disclosure is to provide a wireless LAN access point, communication method, and program that are more secure connection means to prevent third parties not authorized by the administrator from connecting to and using the wireless LAN access point.

In one embodiment, the wireless LAN access point includes an attribution management unit that manages attribution of wireless LAN client devices, a client connection control unit that controls the connection of the wireless LAN client devices, an authentication SSID unit that manages an authentication SSID, and a main connection communication SSID unit that manages an SSID for main connection communication. When a request from the wireless LAN client device includes the authentication SSID, the client connection control unit performs authentication and controls communication to be performed using the main connection SSID after authentication is performed. The client connection control unit controls to reject requests from the wireless LAN client device using the authentication SSID while the wireless LAN client device is communicating using the main connection SSID.

In one embodiment, the communication method performs authentication when a request from a wireless LAN client device includes an authentication SSID, and after the authentication is performed, controls the device to communicate using the primary connection SSID, and while the wireless LAN client device is communicating using the primary connection SSID, controls the device to reject requests from the wireless LAN client device using the authentication SSID.

In one embodiment, the program causes a computer to perform the following steps: when a request from a wireless LAN client device includes an authentication SSID, perform authentication, and after performing authentication, control communication so that communication is performed using the primary connection SSID; and, while the wireless LAN client device is communicating using the primary connection SSID, reject requests from the wireless LAN client device that use the authentication SSID.

The wireless LAN access point, communication method, and program disclosed herein can further enhance security by preventing third parties not authorized by the administrator from connecting to and using the wireless LAN access point.

1 is a block diagram showing a configuration of a wireless LAN access point according to a first embodiment; FIG. 2 is a sequence diagram illustrating an example of an operation of the wireless LAN access point according to the first embodiment. 4 is a flowchart illustrating an example of an operation of the wireless LAN access point according to the first embodiment; 4 is a flowchart illustrating an example of an operation of the wireless LAN access point according to the first embodiment;

First Embodiment
The present embodiment will be described below with reference to the drawings. Fig. 1 is a block diagram showing the configuration of a wireless LAN access point according to the first embodiment. In Fig. 1, a wireless LAN access point 101 includes an association management unit 102, a client connection control unit 103, an authentication SSID unit 104, a main connection communication SSID unit 105, and a router unit 106.

The association management unit 102 monitors the association status of the wireless LAN terminal 107 of the authentication SSID 104. The association management unit 102 also monitors the association status of the wireless LAN terminal 107 of the main connection communication SSID 105. Furthermore, the association management unit 102 notifies the terminal connection control unit 103 of the association status of the wireless LAN terminal 107.

When the client connection control unit 103 receives notification from the belonging management unit 102 that the wireless LAN client 107 has belonged to the authentication SSID unit 104, it registers the MAC address (Media Access Control address) of the wireless LAN client 107 in the connection refusal list 141 and the connection permission list 151. As a result, the wireless LAN client 107 can no longer connect to the authentication SSID unit 104, but can connect to the main connection communication SSID unit 105.

In addition, when the client connection control unit 103 receives a notification from the association management unit 102 that the wireless LAN client device 107 has been removed from the main connection communication SSID 105, it deletes the MAC address of the wireless LAN client device 107 from the connection refusal list 141 and the connection permission list 151.

The authentication SSID unit 104 manages authentication SSIDs. An authentication SSID is an SSID with stealth and ANY connection refusal enabled that can be connected to by wireless LAN devices 107 that are not registered in the connection refusal list 141. SSID stealth is a function that stops the transmission of beacon signals that notify surrounding areas of the device's own SSID. By enabling SSID stealth, the possibility of a third party discovering the authentication SSID can be reduced.

Also, ANY connection refusal is a function that prevents a response to a probe request from a wireless LAN client device unless the SSID of the wireless LAN access point is directly specified. By enabling ANY connection refusal, a wireless LAN access point 101 having the functions disclosed herein can prevent a response if the probe request from a wireless LAN client device 107 does not contain SSID information from the authentication SSID section 104.

The connection refusal list 141 is a list used to reject connections from wireless LAN devices 107 with specific MAC addresses to the authentication SSID 104 using MAC address filtering.

The SSID unit for main connection communication 105 manages the SSIDs to which the wireless LAN terminal 107 can connect. Specifically, the SSID unit for main connection communication 105 manages the SSIDs to which the wireless LAN terminal 107 having a MAC address registered in the connection permission list 151 can connect.

The connection permission list 151 is a list used to allow connection of wireless LAN devices 107 with specific MAC addresses to the main connection communication SSID 105 using MAC address filtering.

The router unit 106 relays communications from the wireless LAN terminal 107 to a different network. The router unit 106 also determines the route through which communications should be relayed or forwarded. The router unit 106 also relays communications from a different network to the wireless LAN terminal 107.

When the MAC address of the wireless LAN handset 107 is registered in the connection permission list 151, the wireless LAN handset 107 can belong to the main connection communication SSID and communicate using the SSID and encryption key in the main connection communication SSID section 105.

If the wireless LAN adapter 107 is no longer associated with the main connection communication SSID 105, the MAC address of the wireless LAN adapter 107 is deleted from the connection denial list 141 and the connection permission list 151. As a result, the wireless LAN adapter 107 can no longer connect to the main connection communication SSID 105, but can connect to the authentication SSID 104.

Therefore, in order for the wireless LAN adapter 107 to reconnect to the main connection communication SSID 105, it must connect to the authentication SSID 104.

With the above configuration, if the administrator's wireless LAN terminal is absent, the MAC address of that terminal has already been deleted from the connection permission list 151, preventing unauthorized access using a spoofed MAC address.

Next, the operation of the wireless LAN terminal 107 to connect to a wireless LAN access point will be described. Figure 2 is a sequence diagram showing an example of the operation of a wireless LAN access point according to the first embodiment. Figure 2 shows a typical sequence from when the wireless LAN terminal 107 sends a Probe Request until it connects to a wireless LAN access point.

First, in step S201, the wireless LAN terminal 107 sends a probe request to the wireless LAN access point 101.

Next, in step S202, the wireless LAN access point 101 returns a probe response.

Then, in step S203, the wireless LAN client device 107 and the wireless LAN access point 101 perform connection setup processing, completing the connection setup and allowing the device to belong to the wireless LAN access point 101.

Next, we will explain the operation of the wireless LAN access point. Figure 3 is a flowchart showing an example of the operation of the wireless LAN access point in embodiment 1.

In step S301, the wireless LAN access point 101 repeats reception until it receives a Probe Request from the wireless LAN terminal 107. If a Probe Request is received from the wireless LAN terminal 107, the process proceeds to step S302.

In step S302, the SSID included in the Probe Request is determined. If the Probe Request received from the wireless LAN terminal 107 does not include the SSID of the authentication SSID 104, the process returns to step S301. If the Probe Request received from the wireless LAN terminal 107 includes the SSID of the authentication SSID 104, the process proceeds to step S303.

In step S303, the wireless LAN access point 101 returns a probe response to the wireless LAN terminal 107. Then, the process proceeds to step S304.

In step S304, the wireless LAN access point 101 checks whether the MAC address of the wireless LAN terminal 107 is registered in the connection refusal list 141. If the MAC address of the wireless LAN terminal 107 is registered in the connection refusal list 141, the process returns to step S301. If the MAC address of the wireless LAN terminal 107 is not registered in the connection refusal list 141, the process proceeds to step S305.

In step S305, the wireless LAN access point 101 performs connection setup processing to allow the wireless LAN client device 107 to associate with the authentication SSID 104. Then, the process proceeds to step S306.

In step S306, the wireless LAN handset 107 determines whether the connection setup process with the wireless LAN access point 101 has been completed. If the wireless LAN handset 107 has completed the connection setup process with the wireless LAN access point 101, the process proceeds to step S307. If the connection setup process with the wireless LAN access point 101 has not been completed, the wireless LAN handset 107 returns to step S301.

In step S307, the wireless LAN access point 101 determines whether the wireless LAN terminal 107 belongs to the authentication SSID 104. If the wireless LAN terminal 107 belongs to the authentication SSID 104, the process proceeds to step S308. If the wireless LAN terminal 107 does not belong to the authentication SSID 104, the process returns to step S301.

In step S308, the belonging management unit 102 sends a notification to the client connection control unit 103 to notify that the wireless LAN client device 107 belongs to the authentication SSID 104. Upon receiving the notification from the belonging management unit 102, the client connection control unit 103 registers the MAC address of the wireless LAN client device 107 in the connection refusal list 141 of the authentication SSID 104. The MAC address of the wireless LAN client device 107 is registered in the connection refusal list 141 of the authentication SSID 104 because the wireless LAN client device 107 has already been authenticated and no longer needs to connect to the authentication SSID 104. Then, the process proceeds to step S309.

In step S309, upon receiving notification from the belonging management unit 102, the client connection control unit 103 registers the MAC address of the wireless LAN client 107 in the connection permission list 151 of the main connection communication SSID 105. This series of processes then ends. Note that this series of processes may be executed repeatedly.

Next, we will explain the operation when the wireless LAN terminal 107 disconnects communication with the wireless LAN access point 101. Figure 4 is a flowchart showing an example of the operation of the wireless LAN access point in embodiment 1.

First, in step S401, the association management unit 102 determines whether the wireless LAN device 107 has been removed from the association of the main connection communication SSID 105. If the wireless LAN device 107 has been removed from the association of the main connection communication SSID 105, the process proceeds to step S402. If the wireless LAN device 107 has not been removed from the association of the main connection communication SSID 105, step S401 is repeated.

In step S402, the association management unit 102 sends a notification to the slave connection control unit 103 to notify that the wireless LAN slave unit 107 has been removed from the association of the SSID 105 for main connection communication.
Upon receiving the notification from the belonging management unit 102, the handset connection control unit 103 deletes the MAC address of the wireless LAN handset 107 from the connection refusal list 141 of the authentication SSID 104. Then, the process proceeds to step S403.

In step S403, upon receiving notification from the belonging management unit 102, the client connection control unit 103 deletes the MAC address of the wireless LAN client device 107 from the connection permission list 151 of the main connection communication SSID 105.

As such, with the wireless LAN access point of embodiment 1, a wireless LAN client device cannot connect to the main connection communication SSID unless it sends a Probe Request containing information about the authentication SSID to the wireless LAN access point. Therefore, even if the information about the main connection communication SSID is known, the wireless LAN access point cannot be used fraudulently.

Furthermore, with the wireless LAN access point of embodiment 1, when a wireless LAN client device that was associated with the main connection communication SSID becomes unassociated, it cannot connect to the main connection communication SSID unless it again sends a Probe Request containing authentication SSID information to the wireless LAN access point, thereby preventing unauthorized access to the main connection communication SSID by spoofing a MAC address.

This disclosure is not limited to the above-described embodiments and may be modified as appropriate without departing from the spirit of the present disclosure.

For example, if the wireless LAN terminal 107 is a terminal that supports dual bands of 2.4 GHz and 5 GHz, the wireless LAN access point 101 can operate the authentication SSID 104 and the main connection communication SSID 105 in separate bands of 2.4 GHz and 5 GHz.

For example, the authentication SSID 104 may operate at 2.4 GHz, and the main connection communication SSID 105 may operate at 5 GHz.

By operating the authentication SSID 104 and the main connection communication SSID 105 in separate bands, 2.4 GHz and 5 GHz, it is possible to reduce the likelihood that the relationship between the authentication SSID 104 and the main connection communication SSID 105 will be discovered.

If the wireless LAN handset 107 supports dual bands, it becomes more difficult for third parties not authorized by the administrator to illegally connect to the wireless LAN access point 101, reducing the possibility of the wireless LAN access point being used illegally.

In this way, the wireless LAN access point 101 can operate the authentication SSID 104 and the main connection communication SSID 105 in separate bands, 2.4 GHz and 5 GHz.

Furthermore, each element depicted in the drawings as a functional block that performs various processes can be configured in hardware terms using a CPU, memory, and other circuits, and in software terms, can be realized by programs loaded into memory, etc. Therefore, those skilled in the art will understand that these functional blocks can be realized in various forms using hardware alone, software alone, or a combination of both, and are not limited to any one of these.

The above-described program can be stored and supplied to a computer using various types of non-transitory computer-readable media. Non-transitory computer-readable media include various types of tangible recording media. Examples of non-transitory computer-readable media include magnetic recording media (e.g., flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (e.g., magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R/Ws, and semiconductor memories (e.g., mask ROMs, PROMs (Programmable ROMs), EPROMs (Erasable PROMs), flash ROMs, and RAMs (Random Access Memory)). The program may also be supplied to a computer by various types of temporary computer-readable media. Examples of temporary computer-readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable media can be supplied to a computer via wired communication paths such as electrical wires and optical fibers, or wireless communication paths.

101 Access point 102 Belonging management unit 103 Child device connection control unit 104 Authentication SSID unit 105 Main connection communication SSID unit 106 Router unit 107 Child device 141 Connection refusal list 151 Connection permission list

Claims (8)

an attribute management unit that manages the attribute of the wireless LAN terminal;
a slave connection control unit that controls the connection of the wireless LAN slave unit;
an authentication SSID unit that manages an authentication SSID;
a main connection communication SSID unit that manages a main connection communication SSID,
the slave connection control unit performs authentication when an authentication SSID is included in the request from the wireless LAN slave unit, and controls communication to be performed using a main connection communication SSID after the authentication is performed;
the slave device connection control unit performs control to reject a request from the wireless LAN slave device using the authentication SSID while the wireless LAN slave device is communicating using the main connection communication SSID;
A wireless LAN access point,
The authentication SSID is an SSID that has enabled an SSID stealth function that stops the transmission of a beacon signal to notify the surrounding area of its own SSID, and an ANY connection refusal function that prevents the SSID from responding to a probe request from a wireless LAN client device unless the SSID of the wireless LAN access point is directly specified ,
When the MAC address of the wireless LAN terminal is registered in the connection refusal list of the authentication SSID unit, the terminal connection control unit communicates with the wireless LAN terminal using the main connection communication SSID without performing authentication using the authentication SSID.
Wireless LAN access point. The wireless LAN access point of claim 1, wherein the client device connection control unit performs control to reject requests from the wireless LAN client device using the primary connection SSID when the wireless LAN client device loses its association with the wireless LAN access point using the primary connection SSID. the authentication SSID unit has the connection refusal list that stores communication partners to be refused connection;
2. The wireless LAN access point according to claim 1, wherein the main connection communication SSID section has a connection permission list that stores communication partners that are permitted to connect. The slave device connection control unit, while the wireless LAN slave device is communicating using a main connection SSID,
registering the MAC address of the wireless LAN terminal in the connection refusal list and the connection permission list;
4. The wireless LAN access point according to claim 3. When the wireless LAN terminal is released from the wireless LAN access point using the primary connection SSID,
The wireless LAN access point according to claim 3 , wherein the MAC address of the wireless LAN terminal is deleted from the connection refusal list and the connection permission list. a frequency band for communicating with the wireless LAN terminal using the authentication SSID;
The wireless LAN access point according to claim 1 , wherein the frequency bands used to communicate with the wireless LAN slave devices using the main connection communication SSID are different. If the request from the wireless LAN client device includes an authentication SSID, the authentication is performed, and after the authentication is performed, control is performed so that communication is performed using the main connection communication SSID;
performing control to reject a request from the wireless LAN terminal using the authentication SSID while the wireless LAN terminal is communicating using the main connection communication SSID;
A wireless LAN access point communication method, comprising:
The authentication SSID is an SSID that has enabled an SSID stealth function that stops the transmission of a beacon signal to notify the surrounding area of its own SSID, and an ANY connection refusal function that prevents the SSID from responding to a probe request from a wireless LAN client device unless the SSID of the wireless LAN access point is directly specified ,
If the MAC address of the wireless LAN terminal is registered in the connection refusal list of the authentication SSID section, communication with the wireless LAN terminal is performed using the main connection communication SSID without performing authentication using the authentication SSID.
A communication method for a wireless LAN access point. a step of performing authentication when a request from a wireless LAN slave device includes an authentication SSID, and controlling communication to be performed using a main connection communication SSID after the authentication is performed; and a step of rejecting a request from the wireless LAN slave device using the authentication SSID while the wireless LAN slave device is communicating using the main connection communication SSID.
A program for a wireless LAN access point,
The authentication SSID is an SSID that has enabled an SSID stealth function that stops the transmission of a beacon signal to notify the surrounding area of its own SSID, and an ANY connection refusal function that prevents the SSID from responding to a probe request from a wireless LAN client device unless the SSID of the wireless LAN access point is directly specified ,
If the MAC address of the wireless LAN terminal is registered in the connection refusal list of the authentication SSID section, the computer executes a step of communicating with the wireless LAN terminal using the main connection communication SSID without performing authentication using the authentication SSID.
Wireless LAN access point program.