JP5178690B2 - Communication system, portable terminal of the system, and center of the system - Google Patents

Description

  The present invention relates to a communication system that prevents a wireless LAN terminal (mobile terminal) from unintentionally connecting to a fake access point (unauthorized access point, impersonation access point), a mobile terminal of the system, and the system Related to the center.

  In a public wireless LAN service of a wireless LAN system, there is an access point that provides wireless connection to an unspecified number of wireless LAN terminal users (hereinafter referred to as terminal users) as a so-called hot spot (R: registered trademark). Public wireless LAN services have a variety of forms of provision, such as commercial services requiring a contract and free services provided to customers by restaurants and the like.

  In the case of a commercial service that requires a contract, the terminal user can make a contract mainly with the operator installing the hotspot on the Internet, and when the contract is made, the user ID and password can be assigned or set. The SSID (Service Set Identifier), WEP (Wired Equivalent Privacy) key, and MAC (Media Access Control address) address of the operator access point can be known on the, my page, and the like.

  The SSID is a service set identifier and is a number (name) for identifying an access point. The WEP key is a key for encrypting communication in the wireless LAN section. The MAC address is a physical address that is uniquely assigned to the hardware of the network device.

  The wireless LAN terminal reads the SSID, WEP key, MAC address, etc. in the beacon signal distributed by the access point according to the lower layer procedure, recognizes that the access point is the carrier, and performs connection processing. After connecting to the access point, the operator center login screen is displayed on the wireless LAN terminal in the upper layer procedure, the terminal user enters the user ID and password, and the operator center on the access point side has contracted It recognizes that it is a terminal user and makes it usable. Thereby, the validity of the wireless LAN terminal which is the one-way authentication seen from the provider side is determined.

  By the way, the SSID, WEP key, and MAC address used for the connection authentication between the wireless LAN terminal and the access point are not limited to the contractor but by a special tool or other method for intercepting and decoding communications. It may be obtained illegally. Then, there is a problem that a malicious person creates and installs a fake access point having the same SSID, WEP key, and MAC address as the access point of the business operator.

  A terminal user connects to a fake access point without being aware of it, and is guided by a fake server login screen, leaking a user ID and password, stealing personal information and data, or sending a virus. There is a risk of phishing. Therefore, it is important to determine the validity of the access point as viewed from the wireless LAN terminal side.

  There is a communication system that prevents connection with such a fake access point (see, for example, Patent Document 1). In the communication system of Patent Document 1, a user carries a mobile phone and a wireless LAN terminal. The mobile phone and the wireless LAN terminal may be the same device. Then, as shown in FIG. 5 of Patent Document 1, this cellular phone directly transmits user identification information and location identification information to a wireless LAN server by a mail transmission function of the cellular phone network. The wireless LAN server transmits user identification information to an authentic managed access point corresponding to the location identification information, and the authentic access point transmits the received user identification information to the user's wireless LAN terminal. . The wireless LAN terminal recognizes that the access point is valid if the received user identification information matches the user identification information held in advance.

JP 2008-22209 A (paragraphs 0011, 0021, 0044 to 0054, FIG. 5)

  In Patent Document 1, the authentic access point transmits the received user identification information to the user's wireless LAN terminal. However, the authentic access point may be intercepted and decoded by a special tool, and a fake access point may be installed. .

  The present invention provides a communication system capable of preventing a mobile terminal (wireless LAN terminal) from connecting to a fake access point even if a fake access point is installed, a mobile terminal of the system, and a center of the system The purpose is to provide.

  In order to achieve the above object, a communication system according to the present invention includes a first access point of a wireless LAN that transmits a beacon signal concealing first access point identification information, and a pair relationship with the first access point. The second access point of the wireless LAN that broadcasts a beacon signal that discloses the second access point identification information, and the second access point identification information is received by wireless LAN communication, and the information is transmitted to the wireless LAN communication The first access point identification information and the encryption key transmitted by the wireless LAN center as a response are received by the second communication in response to the second communication. A portable terminal that performs connection processing with the first access point by wireless LAN communication, and the portable terminal transmits Second access point identification information is received by the second communication, and as a response, the first access point identification information and the encryption key paired with the second access point identification information are sent to the second communication. And a wireless LAN center for transmission to the portable terminal.

  According to the present invention, even if a fake access point is installed, it is possible to prevent the wireless LAN terminal from connecting to the fake access point.

The figure explaining the communication system which concerns on each Example of this invention. The block diagram of the wireless LAN center 500 which concerns on each Example of this invention. The figure explaining the table in the wireless LAN center 500 which concerns on each Example of this invention. The block diagram of 1st AP100 (2nd AP200) of wireless LAN which concerns on each Example of this invention. The block diagram of the portable terminal 400 which concerns on each Example of this invention. The communication sequence diagram which concerns on Example 1 of this invention (at the time of no fake AP). The communication sequence diagram which concerns on Example 1 of this invention (at the time of false AP presence). FIG. 5 is a communication sequence diagram according to the first embodiment of the present invention (when a false AP is present) continued. The communication sequence diagram which concerns on Example 2 of this invention.

  FIG. 1 is a diagram illustrating a communication system according to each embodiment of the present invention. The communication system includes a wireless LAN communication system and a mobile phone communication system. Further, the second embodiment includes a GPS communication system. The wireless LAN communication system includes a wireless LAN center 500, first AP 100, second AP 200, fake AP 300, and portable terminal 400 as access points. The inside of the elliptical dotted line is a public wireless LAN service area, so-called hot spot. The mobile phone communication system is used for communication between the wireless LAN center 500 and the mobile terminal 400 via a mobile phone network. The GPS communication system includes a GPS satellite 600, a mobile terminal 400, an assist GPS function of a base station (not shown) of a mobile phone network, and the like.

  The wireless LAN center 500 manages the first AP 100 and the second AP 200 which are regular pairs of APs. 1st AP100 transmits the beacon signal which concealed SSID (access point identification information). The second AP 200 is installed in the vicinity of the first AP 100 and is in a pair relationship with the first AP 100, and broadcasts a beacon signal disclosing the SSID.

  The fake AP 300 is an AP that does not normally exist but may be installed by a malicious person. It is possible that a malicious person obtains the SSID of the authorized second AP by some means and creates and installs a fake AP 300 that broadcasts a beacon signal that discloses the same SSID.

The mobile terminal 400 is a terminal having wireless LAN communication means and mobile phone communication means.
The purpose of the pair of the legitimate first AP 100 and the second AP 200 is that when the mobile terminal 400 detects the second AP 200 by searching for an AP by wireless LAN communication, the mobile terminal 400 displays the SSID of the second AP 200 before performing connection processing with the second AP 200. The wireless LAN center 500 notifies the wireless LAN center 500 by mobile phone communication, and the wireless LAN center 500 responds to the mobile terminal 400 with the SSID of the first AP 100 that is paired with the second AP 200 by mobile phone communication. In this way, the first AP 100 is connected. The second AP 200 is used for the purpose of advertisement for guiding the mobile terminal user by simply disclosing the SSID, and finally, the mobile terminal 400 is connected to the first AP 100.

  Thereby, even if the portable terminal 400 searches for the AP and detects the fake AP 300, the connection with the fake AP 300 can be prevented.

  The mobile phone communication system is not limited to mobile phone communication, and may be anything other than wireless LAN communication (second communication).

  FIG. 2 is a block diagram of the wireless LAN center 500 according to each embodiment of the present invention. The wireless LAN center 500 includes a control unit 51, an AP communication unit 54, a mobile phone communication unit 55, and the like. The control unit 51 includes a pair AP table 52 (only in the first embodiment), an AP position information table 53 (only in the second embodiment), a CPU (not shown), and the like, and performs control by the CPU.

  The AP communication unit 54 is an interface that performs communication with an AP (first AP 100 or second AP 200) for wireless LAN communication. The mobile phone communication unit 55 is an interface connected to the mobile phone network side, and communicates with the wireless LAN center 500 and other mobile terminals connected via the mobile phone network.

  FIG. 3A is a diagram for explaining the pair AP table 52 of the wireless LAN center 500 according to the first embodiment of the present invention. It is a table which memorize | stores the pair relationship of AP which transmits the beacon signal which concealed SSID, and AP which carries out the broadcast transmission of the beacon signal which disclosed SSID. For example, in pair 1, the first AP 100 and the second AP 200 described with reference to FIG. 1 are in a pair relationship, and each SSID, WEP key, and the like are stored in advance. In the pair 2, the first AP 101 and the second AP 201 (not shown in FIG. 1) are in a pair relationship, and each SSID, WEP key, and the like are stored in advance. The same applies to pair 3.

  FIG. 3B is a diagram illustrating the AP position information table 53 of the wireless LAN center 500 according to the second embodiment of the present invention. GPS position information indicating the installation location of the AP that transmits the beacon signal concealing the SSID is stored in advance. The position information of each AP, such as the first AP 100, the first AP 101, and the first AP 102, is stored.

Returning again to FIG.
As Example 1, when the control unit 51 of the wireless LAN center 500 receives the information 55a such as the second SSID of the second AP 200 transmitted from the mobile terminal 400 from the mobile phone communication unit 55, the control unit 51 stores the pair AP table 52 as a response. Referring to the first SSID of the paired first AP 100, information 51b is transmitted as information 51b to the portable terminal 400 via the portable telephone communication unit 55. Then, the portable terminal 400 performs connection processing with the first AP 100 based on this information received from the wireless LAN center 500.

  In addition, the control unit 51 changes the first SSID etc. in order to change the first SSID etc. information of the first AP 100 when the false AP is detected by performing the false AP detection process (described later in FIG. 7). The notification 51a is transmitted to the first AP 100 via the AP communication unit 54, and the ACK signal from the first AP 100 is received by the ACK 54a via the AP communication unit 54. Furthermore, a change notification such as the first SSID is transmitted as information 51 b to the mobile terminal 400 via the mobile phone communication unit 55. And the portable terminal 400 performs a connection process with 1st AP100 after 1st SSID etc. change.

  As Example 2, when the control unit 51 receives the mobile terminal 400's own mobile terminal location information and mobile terminal identification information information 55a transmitted from the mobile phone communication unit 55, the control unit 51 receives the location information from the mobile terminal 400. When it is confirmed that the terminal is the contractor's terminal and can be confirmed, as a response, the AP location information table 53 is referred to and information on the first SSID etc. of the first AP 100 in the vicinity of the own mobile terminal location information 51b is transmitted to the mobile terminal 400 via the mobile phone communication unit 55. And the portable terminal 400 performs a connection process with 1st AP100.

  FIG. 4 is a block diagram of the first AP 100 (second AP 200) of the wireless LAN according to each embodiment of the present invention. The first AP 100 and the second AP 200 have the same configuration, and the second AP 200 is indicated by (parentheses). The first AP 100 (second AP 200) includes a wireless LAN center communication unit 11 (21), a control unit 12 (22), a wireless LAN communication unit 13 (23), an antenna 14 (24), and the like.

  The wireless LAN center communication unit 11 (21) is an interface for performing communication with the wireless LAN center 500 for wireless LAN communication. The wireless LAN communication unit 13 (23) and the antenna 14 (24) are interfaces that perform wireless communication with the portable terminal 400.

  The control unit 12 of the first AP 100 transmits a beacon signal in which the SSID is concealed to the mobile terminal 400 via the wireless LAN communication unit 13. In addition, when the control unit 12 receives the first SSID change notification 11a transmitted from the wireless LAN center 500 from the wireless LAN center communication unit 11, the control unit 12 changes the first SSID of the first AP 100 itself and returns an ACK 12a.

  The control unit 22 of the second AP 200 broadcasts a beacon signal that discloses the SSID via the wireless LAN communication unit 23.

  FIG. 5 is a block diagram of the portable terminal 400 according to each embodiment of the present invention. The mobile terminal 400 includes an antenna 41, a wireless LAN communication unit 42, an antenna 43, a mobile phone communication unit 44, an antenna 45, a GPS receiving unit 46 (only in the second embodiment), a control unit 47, a display unit 48, an operation input unit 49, and the like. Consists of A dotted line in the control unit 47 represents a signal processing flow.

The antenna 41 and the wireless LAN communication unit 42 are interfaces that perform wireless communication with various access points. The antenna 43 and the mobile phone communication unit 44 are wireless interfaces that perform mobile phone communication with the wireless LAN center 500 via a mobile phone network. The antenna 45 and the GPS receiver 46 receive radio waves from the GPS satellite 600 and specify the current position of the mobile terminal 400.
The display unit 48 and the operation input unit 49 are input / output means between the user of the portable terminal 400.

The controller 47 performs the following various controls by a CPU (not shown).
As Example 1, the control unit 47 receives from the wireless LAN communication unit 42 the second SSID etc. information 42a broadcasted by the second AP 200, and sends it as the second SSID etc. information 45b to the wireless LAN center 500 via the mobile phone communication unit 44. Send. Then, the information such as the first SSID transmitted by the wireless LAN center 500 as a response is received via the mobile phone communication unit 44 at 44a. Next, the control unit 47 transmits the first SSID etc. information as 45a from the wireless LAN communication unit 42 to the first AP 100, and performs a connection process with the first AP 100.

  As Example 2, the control unit 47 obtains the current position information of the mobile terminal 400 itself from the position information from the GPS receiving unit 46. Then, the mobile terminal location information is transmitted to the wireless LAN center 500 via the mobile phone communication unit 44 at 45b. Then, the information such as the first SSID transmitted by the wireless LAN center 500 as a response is received via the mobile phone communication unit 44 at 44a. Next, the control unit 47 transmits information such as the first SSID 45a from the wireless LAN communication unit 42 to the first AP 100, and performs a connection process with the first AP 100.

  Hereinafter, the communication sequence will be described for each embodiment.

  FIG. 6 is a communication sequence diagram according to the first embodiment of the present invention, which is a case where there is no fake AP. The first AP 100 and the second AP 200 are a regular pair, and the first AP 100 transmits a beacon that conceals the first SSID (S1). The second AP 200 transmits a beacon that discloses the second SSID for advertisement (S2).

  The portable terminal 400 receives the beacon, acquires the disclosed second SSID and MAC address of the second AP 200 (S3), and displays it (S4). Then, an SMS (short message) for notifying the wireless LAN center including the second SSID and the MAC address information is created, and the message is transmitted to the wireless LAN center 500 by SMS communication of cellular phone communication (S5).

  The wireless LAN center 500 receives this, and refers to the pair AP table 52 to identify the first AP 100 of the pair of the second AP 200 (S6). Then, the information such as the first SSID (first SSID and WEP key) of the first AP 100 is transmitted to the portable terminal 400 by SMS communication of cellular phone communication (S7).

  The portable terminal 400 sets the received first SSID and WEP key in the wireless LAN communication unit 42 (S8), and connects to the first AP 100 (S9).

  As described above, the second AP that discloses the SSID is used for advertising purposes to guide the mobile terminal user, and finally, the mobile terminal 400 can be connected to the first AP 100.

  FIG. 7 is a communication sequence diagram according to the first embodiment of the present invention, and shows a case where there is a fake AP. The second SSID and the like of the second AP 200 are disclosed, and it is relatively easy for a malicious person to obtain. Furthermore, it is assumed that a malicious person obtains the MAC address of the second AP 200 by some means, creates a fake AP 300 having the same second SSID and MAC address, and installs it in the vicinity of the second AP 200.

  The first AP 100 and the second AP 200 transmit beacons as in FIG. 6 (S11, S12). The fake AP 300 also transmits a beacon that discloses the same second SSID as the second AP 200 (S13).

  The portable terminal 400 receives the beacon, acquires the disclosed second SSID and MAC address of the second AP 200, and the same disclosed second SSID and MAC address of the fake AP 300 (S14), and displays them (S15). Then, an SMS (short message) of the SSID and MAC address information of each of the acquired two APs is created, and the message is transmitted to the wireless LAN center 500 by SMS communication of cellular phone communication (S16).

  The wireless LAN center 500 receives the information and refers to the pair AP table 52 to identify the first AP 100 of the second SSID pair (S17). Furthermore, since the SSID and MAC address information of a plurality of APs have been received, the duplication determination is performed. If the same second SSID is duplicated, it is determined that one is a fake AP (S18). And when duplication is confirmed, the 1st SSID of 1st AP100 and the change notification of a WEP key are transmitted to 1st AP100 (S19).

  The first AP 100 changes its SSID and WEP key (S20), and transmits a change completion notification to the wireless LAN center 500 (S21).

  The wireless LAN center 500 transmits a change notification of the first SSID and the WEP key to the mobile terminal 400 by SMS communication of mobile phone communication (S22).

  The portable terminal 400 sets the changed first SSID and WEP key in the wireless LAN communication unit 42 (S23), and establishes a connection with the first AP 100 (S24).

  The effect of changing the first SSID and WEP key of the first AP 100 in S19 will be described below. Even if this change is not performed, the portable terminal 400 can be prevented from connecting to the fake AP 300. However, the presence of the fake AP 300 may mean that a malicious person has already obtained the first SSID, MAC address, and WEP key of the first AP by some means. Therefore, it is particularly effective at the time when the presence of the fake AP 300 is confirmed in S18, and at that time, it is effective to change the first SSID and WEP key of the first AP 100 in order to increase security.

  After the portable terminal 400 can once connect to the first AP 100 in S24, it can connect directly to the first AP 100 without waiting for a notification from the wireless LAN center 500 after the second time. There is also a method of periodically changing the first SSID and the WEP key of the first AP 100, but if the change period is long, the possibility that a fake first AP is installed cannot be denied. According to the embodiment of the present invention, as long as the fake AP 300 exists, the first SSID and the WEP key of the first AP 100 are changed, so that security can be improved.

  As described above, the second AP 200 disclosing the SSID is used for advertising purposes to guide the mobile terminal user. On the other hand, there is a possibility that the fake AP 300 may be installed by being used by a malicious person. Since the first SSID is transmitted from the wireless LAN center 500 to the portable terminal 400 by SMS communication, it is possible to prevent the portable terminal user from connecting to the fake AP 300 by mistake. Furthermore, since the first SSID of the authorized first AP 100 is also changed, the security can be further enhanced.

  FIG. 8 is a communication sequence diagram according to the first embodiment of the present invention, which is a case where there is a false AP, and is a continuation of FIG. A case where the first SSID of the first AP 100 is further changed after the mobile terminal 400 and the first AP 100 are connected in S24 of the last sequence in FIG. 7 will be described.

  In S24, the portable terminal 400 and the first AP 100 are in a connected state. In this state, for example, another mobile terminal (not shown) performs the same processing as the mobile terminal 400 of FIG. 7, and as a result, the wireless LAN center 500 sends a change notification of the first SSID and WEP key of the first AP 100 to the first AP 100. (S31).

  The first AP 100 changes its SSID and WEP key (S32). As a result, the connection between the portable terminal 400 and the first AP 100 in the connected state in S24 is disconnected (S33). As a response to S31, the first AP 100 transmits a change completion notification to the wireless LAN center 500 (S34).

  The wireless LAN center 500 transmits a change notification of the first SSID and the WEP key to the mobile terminal 400 by SMS communication of mobile phone communication (S35).

  The portable terminal 400 sets the changed first SSID and WEP key in the wireless LAN communication unit 42 (S36), and reconnects to the first AP 100 (S37).

  As described above, even when the first SSID of the first AP 100 is further changed after the portable terminal 400 and the first AP 100 are in the connected state, it is possible to cope with it.

  According to the first embodiment, a first AP that transmits a beacon signal concealing an SSID and a second AP that is installed in the vicinity of the first AP as a pair and that broadcasts a beacon signal that discloses an SSID for advertisement use are provided. By the center notifying the mobile terminal of the first SSID of the first AP, it is possible to prevent the mobile terminal from connecting to the fake AP.

  FIG. 9 is a communication sequence diagram according to the second embodiment of the present invention. In the second embodiment, the second AP that discloses the SSID is not provided, and the first AP that conceals the SSID is provided. The first SSID of the first AP is performed when the wireless LAN center notifies the mobile terminal of the first SSID of the first AP based on the current location information of the mobile terminal itself.

This will be described in detail below. The first AP 100 transmits a beacon that conceals the first SSID (S41).
When the user of the mobile terminal 400 wants to connect to the hot spot, the user operates the operation input unit 49 to make a connection request, and the mobile terminal 400 detects this (S42). The portable terminal 400 acquires the position information of the own terminal from the GPS receiver 46 (S43). Then, the location information of the mobile terminal 400 is transmitted to the wireless LAN center 500 by SMS communication of mobile phone communication (S44).

  The wireless LAN center 500 refers to the AP position information table 53 and identifies an AP in the vicinity of the position information of the mobile terminal 400 (S45). Then, information such as the first SSID (first SSID and WEP key) of the first AP 100 is transmitted to the mobile terminal 400 by SMS communication of mobile phone communication (S46).

  The portable terminal 400 sets the received first SSID and WEP key in the wireless LAN communication unit 42 (S47), and establishes connection with the first AP 100 (S48).

  According to the second embodiment, the mobile terminal transmits its position information to the wireless LAN center 500 by SMS communication, and the wireless LAN center notifies the mobile terminal of the AP information in the vicinity of the mobile terminal by SMS communication. The mobile terminal can reliably connect to the first AP that conceals.

  In the first and second embodiments, SMS communication of cellular phone communication is used. However, any data communication means using a public network other than wireless LAN communication may be used.

11 (21) Wireless LAN center communication unit 12 (22) Control unit 13 (23) Wireless LAN communication unit 14 (24) Antenna 41 Antenna 42 Wireless LAN communication unit 43 Antenna 44 Mobile phone communication unit 45 Antenna 45
46 GPS reception unit 47 control unit 48 display unit 49 operation input unit 51 control unit 52 pair AP table 52
53 AP position information table 54 AP communication unit 55 Mobile phone communication unit 100 1st AP
200 2nd AP
300 Fake AP
400 Mobile terminal 500 Wireless LAN center 600 GPS satellite

Claims (4)

The first access point identification information and the encryption key change notification transmitted from the center of the wireless LAN are received, the first access point identification information and the encryption key of the access point are changed, and the changed first A wireless LAN first access point that transmits a beacon signal concealing the access point identification information of
And a second access point of a wireless LAN to send a beacon signal which disclosed the second access point identification information in relation of the first access point paired,
A plurality of disclosed access point identification information transmitted by a plurality of access points including the second access point is received by wireless LAN communication, and the plurality of access point identification information is received by a second communication other than the wireless LAN communication. Is transmitted to the center of the wireless LAN, and the first access point identification information and the encryption key after the change transmitted by the center of the wireless LAN as a response are received by the second communication, and based on this, the wireless LAN communication is performed. A portable terminal that performs connection processing with the first access point;
When the plurality of access point identification information transmitted by the mobile terminal is received by the second communication, and the plurality of access point identification information overlaps with the second access point identification information, The first access point identification information and the encryption key change notification are transmitted to the access point, and the changed first access point identification information and encryption key are transmitted to the portable terminal by the second communication. A communication system comprising a wireless LAN center for transmission.   The second access point broadcasts a beacon signal disclosing the second access point identification information;
  The communication system according to claim 1.   A plurality of disclosed access point identification information transmitted by a plurality of access points including a second access point paired with the first access point is received by wireless LAN communication, and the plurality of information is received by the wireless LAN. The second access other than communication is transmitted to the center of the wireless LAN, and as a response, the first access point identification information after change and the encryption key transmitted by the center of the wireless LAN are received by the second communication. A portable terminal of a communication system that performs connection processing with the first access point by wireless LAN communication based on the communication.   When a plurality of access point identification information transmitted by the mobile terminal is received by second communication other than wireless LAN communication, and the plurality of access point identification information are duplicated as the same data, The first access point identification information and the encryption key change notification are transmitted to the first access point in the pair relationship, and the changed first access point identification information and encryption are transmitted to the portable terminal. A wireless LAN center of a communication system that transmits a key by second communication.

Images