JP6318640B2 - Wireless connection apparatus, method for controlling wireless connection apparatus, and network system - Google Patents

Description

  The present invention relates to a wireless connection device.

  In a wireless connection device such as an access point, connection to a wireless network isolated from a normal network (hereinafter referred to as a “customer wireless network”) has conventionally been made by inputting an SSID (Service Set Identifier) and a password. Anyone could do that. However, the conventional method has a problem of security concerns such as unauthorized access when a password is leaked. In this regard, if the SSID for the visitor's wireless network is invalidated in the wireless connection device, the unauthorized access as described above can be avoided. However, in order to invalidate the SSID for the visitor's wireless network, it is necessary to perform an operation from the management screen of the wireless connection device, and thus there is a problem that it takes a complicated work.

  In Patent Document 1, in order to simplify the setting of a gateway device and the like for connection from a WAN (Wide Area Network) side network to a LAN (Local Area Network) side network in which security settings have been performed, It describes that information used when connecting to a network is stored in a portable storage device. Patent Document 2 describes a technique for specifying a VLAN (Virtual Local Area Network) to which a client can connect by authentication using device information stored in a security token. Patent Document 3 describes that the validity of a usage right is determined twice based on certification information and authentication information included in the usage right information transmitted from the user terminal.

WO2010 / 073405 JP 2002-366522 A JP 2006-350512 A JP 2007-043644 A JP 2006-074742 A

  In Patent Documents 1 to 3, no consideration is given to improving the security of the wireless connection device existing on the LAN side.

  Therefore, in the wireless connection device, the security in the wireless network for visitors is improved by reducing the risk of unauthorized access to the wireless network for visitors (specifically, the SSID for the wireless network for visitors), and Therefore, it has been desired that a wireless network for visitors can be easily used.

SUMMARY An advantage of some aspects of the invention is to solve at least a part of the problems described above, and the invention can be implemented as the following forms or application examples.
A first aspect of the present invention is a wireless connection device,
A detection unit for detecting the proximity of the storage medium mounted with an IC chip capable of reading information based on NFC to the wireless connection device by an NFC interface;
A limitation that allows a wireless terminal to connect to a visitor wireless network that is a wireless network isolated from other networks among a plurality of networks provided by the wireless connection device while detecting the proximity. A connection,
Equipped with a,
The plurality of networks are wireless networks using different SSIDs .
A second aspect of the present invention is a network system,
A wireless connection device;
A wireless terminal equipped with an IC chip capable of reading information based on NFC, and provided with a storage medium in which authentication information is stored in advance as the information;
With
The wireless connection device is:
A detection unit for detecting proximity of the storage medium to the wireless connection device by an NFC interface;
While detecting the proximity, the wireless terminal can be connected to a wireless network for a visitor that is a wireless network isolated from other networks among a plurality of networks provided by the wireless connection device. A limited connection,
Equipped with a,
The plurality of networks are wireless networks using different SSIDs .
The present invention can also be realized as the following forms.

(1) According to an aspect of the present invention, a wireless connection device is provided. The wireless connection device includes: a detection unit that detects proximity of a storage medium to the wireless connection device by short-range wireless communication; and a plurality of networks provided by the wireless connection device while detecting the proximity. And a limited connection unit that enables a wireless terminal to connect to a wireless network for visitors, which is a wireless network that is isolated from other networks. According to the wireless connection device of this aspect, the limited connection unit can connect to the wireless network for the visitor by the wireless terminal only while the wireless connection device and the storage medium storing the authentication information are close to each other. And In this way, if a restriction is imposed that a storage medium is required for the connection of the wireless network for visitors, even if the SSID for the wireless network for visitors leaks, , Can not connect to the wireless network for visitors. Furthermore, even if a legitimate user has lost the storage medium, or the storage medium has been forged by a malicious third party, the physical proximity of the wireless connection device and the storage medium Due to the limited distance, a third party who obtains the storage medium cannot connect to the wireless network for the visitor remotely. As a result, in the wireless connection device, it is possible to improve security in the visitor wireless network by reducing the risk of unauthorized access to the visitor wireless network. Further, in order to use the wireless network for visitors, the user only needs to bring the storage medium and the wireless connection device close to each other, so that the wireless network for visitors can be easily used in the wireless connection device. be able to.

(2) The wireless connection device of the above aspect further includes: an acquisition unit that acquires authentication information from the storage medium by the short-range wireless communication; the detection unit can acquire the authentication information by the acquisition unit In this case, it may be determined that the wireless connection device and the storage medium are close to each other. According to the wireless connection device of this aspect, the detection unit determines that the wireless connection device and the wireless terminal are close to each other when the authentication information can be acquired by the acquisition unit. For this reason, the physical distance limitation of “proximity between the wireless connection device and the storage medium” is limited to several centimeters to 1 meter, depending on the range of information read / write by the short-range wireless communication method employed. Can be arbitrarily adjusted between.

(3) In the wireless connection device of the above aspect, the limited connection unit further restricts communication from the wireless terminal connected to the visitor-facing wireless network to the other network, so that the wireless The communication destination by the terminal may be limited to the Internet. According to the wireless connection device of this aspect, the limited connection unit restricts communication from the wireless terminal connected to the visitor's wireless network to another network. In other words, the visitor's wireless network can be separated from other networks (for example, LANs) composed of other wireless terminals connected to the wireless connection device. For this reason, the unauthorized access to the other network from the wireless terminal connected to the wireless network for visitors can be suppressed, and the security in the wireless connection device can be further improved.

(4) In the wireless connection device according to the above aspect, the limited connection unit further includes a network device between the wireless connection device and the Internet via the wireless connection device. Connection to the visitor's wireless network may be permitted. According to the wireless connection device of this aspect, the limited connection unit further includes, when there is a network device between the wireless connection device and the Internet, a wireless for a visitor via the wireless connection device with respect to the network device. Allow connection to the network. Therefore, even when there is a network device between the wireless connection device and the Internet, communication from the wireless terminal connected to the visitor's wireless network to the Internet can be realized.

(5) The wireless connection device of the above aspect may further include an authentication unit that authenticates the validity of the storage medium using the acquired authentication information. According to the wireless connection device of this aspect, the authentication unit can authenticate the validity of the storage medium using the authentication information stored in the storage medium. For this reason, it is possible to adopt measures such as prohibiting connection using the storage medium when the validity of the storage medium cannot be confirmed, for example, the storage medium has been forged by a malicious third party. Become. As a result, security in the wireless connection device can be further improved.

(6) The wireless connection device of the above aspect may further include an authentication unit that transmits the acquired authentication information to an external device, and acquires the authentication result of the validity of the storage medium from the external device. According to the wireless connection device of this aspect, the authentication unit authenticates the validity of the storage medium by transmitting the authentication information to the external device and acquiring the authentication result of the validity of the storage medium from the external device. For this reason, it is also possible to adopt measures such as prohibiting connection using the storage medium when the validity of the storage medium cannot be confirmed, such as when the storage medium has been forged by a malicious third party. Become. As a result, security in the wireless connection device can be further improved.

(7) In the wireless connection device of the above aspect; the authentication unit may further generate a temporary key that is temporarily valid, and store the generated temporary key in the storage medium by short-range wireless communication. According to the wireless connection device of this aspect, the authentication unit can generate a temporary key that is temporarily valid, and store the generated temporary key in the storage medium by short-range wireless communication.

(8) In the wireless connection device of the above aspect; the acquisition unit acquires the temporary key stored in the storage medium; the authentication unit replaces the authentication information or together with the authentication information; The validity of the storage medium may be authenticated using the temporary key. According to the wireless connection device of this aspect, the authentication unit authenticates the validity of the storage medium using the temporary key instead of the authentication information or together with the authentication information. A temporary key that is only temporarily valid has higher security strength than authentication information continuously stored in a storage medium. By authenticating the validity of the storage medium using such a temporary key, the reliability of authentication can be further improved. As a result, security in the wireless connection device can be further improved.

(9) The wireless connection device of the above aspect may further include: a virtualization request unit that requests the network device to establish a communication path using a virtual private network. According to the wireless connection device of this aspect, the virtualization request unit establishes a communication path using a virtual private network for the network device when there is a network device between the wireless connection device and the Internet. Request. In a communication path using a virtual private network, communication contents via the Internet are encapsulated and encrypted. For this reason, the security in communication between the wireless terminal connected to the wireless network for visitors and the communication counterpart device of the wireless terminal can be improved.

(10) According to one aspect of the present invention, a network system is provided. The network system includes: a wireless connection device; a wireless terminal including a storage medium in which authentication information is stored in advance; the wireless connection device; the storage medium for the wireless connection device by short-range wireless communication A detection unit that detects proximity; and a wireless network for a visitor that is a wireless network isolated from other networks among a plurality of networks provided by the wireless connection device while detecting the proximity, And a limited connection unit that enables connection of a wireless terminal.

  A plurality of constituent elements of each embodiment of the present invention described above are not essential, and some or all of the effects described in the present specification are to be solved to solve part or all of the above-described problems. In order to achieve the above, it is possible to appropriately change, delete, replace with a new component, and partially delete the limited contents of some of the plurality of components. In order to solve some or all of the above-described problems or achieve some or all of the effects described in this specification, technical features included in one embodiment of the present invention described above. A part or all of the technical features included in the other aspects of the present invention described above may be combined to form an independent form of the present invention.

  For example, one embodiment of the present invention can be realized as a method including a part or all of the two elements of the detection unit and the limited connection unit. That is, this apparatus may or may not have a detection unit. Moreover, this apparatus may have a limited connection part and does not need to have it. Such a device can be realized as a wireless connection device, for example, but can also be realized as a device other than the wireless connection device. Any or all of the technical features of each form of the wireless connection device described above can be applied to this device.

  The present invention can also be realized in various forms other than the wireless connection device. For example, it is realized in the form of a method for controlling a wireless connection device, a network system including the wireless connection device, a computer program that realizes part or all of these methods, a non-temporary recording medium that records the computer program, and the like. can do.

It is explanatory drawing which shows a mode that a user connects to the visitor's wireless network using the wireless connection apparatus as one Embodiment of this invention. It is a block diagram which shows the structure of a wireless connection apparatus and a storage medium functionally. It is a flowchart which shows the procedure of a process for visitors. It is explanatory drawing which shows a mode that a user connects to the wireless network for visitors using the wireless connection apparatus of 2nd Embodiment. It is a block diagram which shows functionally the structure of the wireless connection apparatus of 2nd Embodiment, and a storage medium. It is a flowchart which shows the procedure of the process for visitors in 2nd Embodiment. It is explanatory drawing which shows a mode that a user connects to the wireless network for visitors using the wireless connection apparatus of 3rd Embodiment. It is a block diagram which shows functionally the structure of the wireless connection apparatus and storage medium of 3rd Embodiment. It is a flowchart which shows the procedure of the process for visitors in 3rd Embodiment. It is a block diagram which shows functionally the structure of the wireless connection apparatus and storage medium of 4th Embodiment. It is a flowchart which shows the procedure of a temporary key issue process. It is a flowchart which shows the procedure of the process for visitors in 4th Embodiment. It is explanatory drawing which shows a mode that a user connects to the wireless network for visitors using the wireless connection apparatus of 5th Embodiment.

  Next, an embodiment of the present invention will be described based on the embodiment.

A. First embodiment:
A-1. System outline:
FIG. 1 is an explanatory diagram showing a state in which a user connects to a visitor's wireless network using a wireless connection device as an embodiment of the present invention. In FIG. 1, for convenience, other network relay devices, lines, terminals, and the like that are not necessary for description are not shown.

  The wireless connection device 10 is an access point device that conforms to the IEEE 802.11 standard and the IEEE 802.3 standard. Hereinafter, the wireless connection device 10 is also referred to as “AP10”. The AP 10 also functions as a router and is connected to the Internet INT via a wired cable. The AP 10 includes an NFC interface 120 as an interface for short-range wireless communication.

  The AP 10 according to the present embodiment executes the process for a visitor described later, so that only when the NFC interface 120 detects the storage medium 20 within the detection range, the access to the visitor wireless network CN is performed. Enable connection. For this reason, the user of the AP 10 uses the wireless network CN for the customer using an arbitrary wireless terminal such as the personal computer 30 only while the storage medium 20 possessed by the AP 10 is in proximity to the NFC interface 120 of the AP 10. Can be connected to. In the following description, the wireless terminal connected to the visitor's wireless network CN of the AP 10 is also simply referred to as “guest terminal”.

A-2. Schematic configuration of wireless connection device:
FIG. 2 is a block diagram functionally showing the configuration of the wireless connection device 10 and the storage medium 20. FIG. 2A shows the configuration of the wireless connection device (AP) 10. The AP 10 includes a CPU 110, an NFC interface (I / F) 120, a RAM 130, a wireless communication interface (I / F) 140, a wired communication interface (I / F) 150, and a flash ROM 160. The elements are connected to each other by a bus.

  The CPU 110 controls the AP 10 by expanding and executing a computer program stored in the flash ROM 160 on the RAM 130. In addition, the CPU 110 implements the functions of the relay processing unit 111, the guest function 112, the acquisition unit 113, the limited connection unit 114, and the authentication unit 115.

  The relay processing unit 111 executes relay processing for transferring the packet received by the AP 10 according to the destination. The relay processing unit 111 includes a guest function 112 as a function for a guest terminal, that is, a wireless terminal connected to a visitor wireless network. The guest function 112 has a function of filtering packets received from the guest terminal. Specifically, the relay processing unit 111, when the destination of the packet received from the guest terminal is another wireless terminal connected to the AP 10, in other words, a terminal in the LAN (Local Area Network) of the AP 10 If it is, the packet is discarded. Thereby, AP10 can limit the communication destination by a guest terminal to the internet.

  The acquisition unit 113 acquires information stored in the storage medium 20 using an NFC reader of the NFC interface 120.

  The limited connection unit 114 executes a process for a visitor. The visitor process is a process for enabling connection to the visitor wireless network only while the NFC interface 120 detects the storage medium 20 within the detection range. Further, the limited connection unit 114 also functions as a “detection unit” that detects the proximity of the storage medium 20 to the AP 10 by cooperating with the NFC interface 120.

  The authentication unit 115 authenticates the validity of the storage medium 20 using the information stored in the storage medium 20 in the process for the visitor.

  The NFC interface 120 is a short-range wireless communication interface compliant with ISO / IEC14443 and ISO / IEC18092. NFC is a short-range wireless communication in which a communicable distance is limited to about 10 cm, and wireless communication is possible even in a non-contact state between communication devices having an NFC interface. Also called wireless communication. The NFC interface 120 includes an NFC reader / writer and an antenna, and reads and writes information to and from an adjacent IC chip using radio waves transmitted and received via the antenna.

  The wireless communication interface 140 includes a transmission / reception circuit, and performs demodulation and generation of data received via the antenna, and generation and modulation of radio wave transmitted via the antenna. The wired communication interface 150 is connected to a line on the Internet INT (FIG. 1) side, and is connected to another device (for example, NAS or personal computer) in the LAN through a wired cable. The wired communication interface 150 includes a PHY / MAC controller, adjusts the waveform of the received signal, and extracts a MAC frame from the received signal.

  The flash ROM 160 includes registration information 161. The registration information 161 stores in advance the same information as the authentication information stored in the legitimate storage medium 20 (in other words, the storage medium 20 issued to the legitimate user of the AP 10). The registration information 161 may store a plurality of information corresponding to a plurality of valid storage media 20.

A-3. General configuration of storage medium:
FIG. 2B shows the configuration of the storage medium 20. In the present embodiment, the storage medium 20 is realized as a card including an IC chip. The storage medium 20 includes an IC chip called an NFC tag 210, and information can be recorded in the IC chip. The NFC tag 210 includes authentication information 211 and connection information 212. Hereinafter, the authentication information 211 and the connection information 212 are collectively referred to as “medium information”.

  In the authentication information 211, information for identifying the storage medium 20 is stored in advance. The information for identifying the storage medium 20 is not particularly limited. For example, an identifier assigned to an IC tag built in the storage medium 20 or an arbitrarily assigned UUID (Universally Unique Identifier) is adopted. can do.

  In the connection information 212, setting information related to wireless communication necessary for connecting to the wireless network for the visitor of the AP 10 is stored in advance. The setting information related to wireless communication includes an SSID (Service Set Identifier) of a wireless network for visitors, an authentication / encryption method in wireless communication in the wireless network for visitors, an encryption key used for the encryption, And a wireless channel used for wireless communication in a visitor wireless network. The SSID of the visitor's wireless network is also simply referred to as “guest SSID”.

A-4. Processing for visitors:
FIG. 3 is a flowchart showing the procedure for the visitor process. In step S <b> 102, the NFC interface 120 detects a touch of the NFC tag 210 of the storage medium 20. In step S102, instead of detecting the touch, it may be detected that the NFC tag 210 of the storage medium 20 is within the readable range of the NFC reader of the NFC interface 120.

  In step S <b> 104, the acquisition unit 113 acquires medium information read by the NFC reader of the NFC interface 120, that is, authentication information 211 and connection information 212.

  In step S <b> 106, the authentication unit 115 collates the authentication information 211 acquired in step S <b> 104 with the information stored in the registration information 161 of the flash ROM 160.

  In step S <b> 108, the authentication unit 115 determines whether or not the authentication information 211 acquired in step S <b> 104 has been registered in the registration information 161. Specifically, if the acquired authentication information 211 matches the information stored in the registration information 161 as a result of the collation in step S106, the authentication unit 115 has already registered the acquired authentication information 211 in the registration information 161. Yes, it is determined that the storage medium 20 is valid. On the other hand, if the acquired authentication information 211 does not match the information stored in the registration information 161 as a result of the collation in step S106, the authentication unit 115 stores the acquired authentication information 211 that has not been registered in the registration information 161. It is determined that the medium 20 is not valid. When a plurality of pieces of information corresponding to a plurality of legitimate storage media 20 are stored in the registration information 161, the match determination in step S108 may be a partial match.

  When the authentication information 211 is not registered in the registration information 161 (step S108: NO), the authentication unit 115 shifts the process to step S102. On the other hand, when the authentication information 211 has been registered in the registration information 161 (step S108: YES), the authentication unit 115 shifts the process to step S110.

  In step S110, the limited connection unit 114 enables the wireless communication interface 140. In step S112, the limited connection unit 114 validates the guest SSID, that is, the SSID of the visitor's wireless network. Through steps S110 and S112, the AP 10 transmits a beacon using the guest SSID. In step S114, the limited connection unit 114 enables the guest function 112 of the relay processing unit 111.

  In step S116, the limited connection unit 114 establishes a wireless communication CN (FIG. 1) with an arbitrary wireless terminal such as the personal computer 30, for example. Specifically, the limited connection unit 114 receives a probe request transmitted from a wireless terminal, establishes wireless communication with the wireless terminal by performing processing such as transmission of a probe response and authentication.

  After step S116, as shown in FIG. 1, the user can connect to the visitor's wireless network CN of the AP 10 using an arbitrary wireless terminal such as the personal computer 30. Note that the communication destination of the wireless terminal in the visitor wireless network CN is limited to the Internet by the guest function 112 of the relay processing unit 111.

  In step S <b> 118, the limited connection unit 114 determines whether the NFC interface 120 has detected a touch of the NFC tag 210 of the storage medium 20. In step S118, as in step S102, it may be determined whether the NFC tag 210 of the storage medium 20 is within the readable range of the NFC reader of the NFC interface 120, instead of detecting touch.

  When the touch of the NFC tag 210 is detected (step S118: YES), the limited connection unit 114 shifts the process to step S118, and whether or not the NFC interface 120 detects the touch of the NFC tag 210 of the storage medium 20. Continue monitoring. On the other hand, when the touch of the NFC tag 210 is not detected (step S118: NO), the limited connection unit 114 causes the process to transition to step S120.

  In step S120, the limited connection unit 114 disables the guest function 112 of the relay processing unit 111. In step S122, the limited connection unit 114 invalidates the guest SSID. In step S124, the limited connection unit 114 disables the wireless communication interface 140. Through steps S122 and S124, the connection of the user's wireless terminal to the visitor's wireless network CN is disconnected, and transmission of the beacon using the guest SSID from the AP 10 is stopped. As described above, the power consumption of the AP 10 can be reduced by disabling the wireless communication interface 140 while not permitting connection to the visitor's wireless network.

  As described above, according to the process for a visitor of the first embodiment, the limited connection unit 114 is only while the AP 10 (wireless connection device) and the storage medium 20 in which the authentication information 211 is stored are close to each other. The personal computer 30 (wireless terminal) can be connected to the wireless network CN for visitors. Thus, if the restriction that the storage medium 20 is necessary for connection of the wireless network CN for customers is provided, even if the SSID for guests (SSID for the wireless network for visitors) etc. leaks, A malicious third party cannot connect to the visitor's wireless network CN. Furthermore, even if a legitimate user has lost the storage medium 20 or the storage medium 20 has been forged by a malicious third party, the physicality of “proximity between the AP 10 and the storage medium 20”. Due to the limited distance, a third party who obtains the storage medium 20 cannot connect to the customer-oriented wireless network CN remotely. As a result, the security in the visitor's wireless network CN can be improved by reducing the risk of unauthorized access to the visitor's wireless network CN in the AP 10. Further, in order to use the visitor's wireless network CN, the user only needs to bring the storage medium 20 and the AP 10 close to each other, so that the visitor's wireless network CN can be easily used in the AP 10. Can do.

  Furthermore, according to the process for the visitor of the first embodiment, the limited connection unit 114 and the NFC interface 120 (detection unit), when the acquisition unit 113 can acquire the authentication information 211, the AP 10 (wireless connection device). And the storage medium 20 are determined to be close to each other. For this reason, the physical distance limitation of “proximity between the AP 10 and the storage medium 20” is limited to a few centimeters to about 1 meter depending on the range of information read / write range by the short-range wireless communication method employed. Can be adjusted arbitrarily.

  Furthermore, according to the process for the visitor of the first embodiment, the limited connection unit 114 enables the guest function 112 to connect the personal computer 30 (wireless terminal) connected to the visitor's wireless network CN. From the plurality of networks provided by the AP 10 (wireless connection device), communication to other networks is restricted. That is, the customer-facing wireless network CN can be separated from other networks (for example, a LAN or the like) composed of other wireless terminals connected to the AP 10. For this reason, the unauthorized access to the other network from the personal computer 30 (wireless terminal) connected to the visitor's wireless network CN can be suppressed, and the security in the AP 10 can be further improved.

  Furthermore, according to the process for the visitor of the first embodiment, the authentication unit 115 authenticates the validity of the storage medium 20 using the authentication information 211 stored in the storage medium 20. For this reason, when the correctness of the storage medium 20 cannot be confirmed, for example, when the storage medium 20 has been forged by a malicious third party, a measure that prohibits connection using the storage medium 20 is adopted. Can do. As a result, the security in the AP 10 (wireless connection device) can be further improved.

B. Second embodiment:
In the second embodiment of the present invention, an example in which a network configuration different from that of the first embodiment is employed will be described. Below, only the part which has a different structure and operation | movement from 1st Embodiment is demonstrated. In the figure, the same components as those of the first embodiment are denoted by the same reference numerals as those of the first embodiment described above, and detailed description thereof is omitted.

B-1. System outline:
FIG. 4 is an explanatory diagram showing a state in which a user connects to a visitor's wireless network using the wireless connection device of the second embodiment. The difference from the first embodiment shown in FIG. 1 is that an AP 10 a is provided instead of the AP 10, a storage medium 20 a is provided instead of the storage medium 20, and the AP 10 a is connected to the network device 40. is there.

  The network device 40 is an access point device that complies with the IEEE 802.11 standard and the IEEE 802.3 standard. Hereinafter, the network device 40 is also referred to as “AP40”. The AP 40 also functions as a router and is connected to the Internet INT via a wired cable.

B-2. Schematic configuration of wireless connection device:
FIG. 5 is a block diagram functionally showing the configurations of the wireless connection device 10a and the storage medium 20a of the second embodiment. FIG. 5A shows the configuration of the wireless connection device (AP) 10a. The difference from the first embodiment shown in FIG. 2A is that a CPU 110 a is provided instead of the CPU 110. The CPU 110 a includes a limited connection unit 114 a instead of the limited connection unit 114. The limited connection unit 114a is different from the first embodiment in the processing content of the process for a visitor to be executed.

B-3. General configuration of storage medium:
FIG. 5B shows the configuration of the storage medium 20a. A difference from the first embodiment shown in FIG. 2B is that an NFC tag 210 a is provided instead of the NFC tag 210. The NFC tag 210 a includes connection information 212 a instead of the connection information 212. In the connection information 212a, in addition to the setting information related to the wireless communication required for connecting to the visitor's wireless network of the AP 10a, the setting information related to the wireless communication required to connect to the visitor's wireless network of the AP 40a. Is stored in advance. The details of each setting information are as described with reference to FIG.

B-4. Processing for visitors:
FIG. 6 is a flowchart illustrating a procedure of processing for a visitor in the second embodiment. The difference from the first embodiment shown in FIG. 3 is that steps S202 and S204 are provided instead of step S116. The execution order of steps S202 and S204 described below may be reversed.

  In step S202, the limited connection unit 114a establishes wireless communication CN2 (FIG. 4) with the AP 40. Specifically, the limited connection unit 114a transmits a probe request according to a beacon transmitted from the AP 40. After receiving the probe response from the AP 40 and processing such as authentication by the AP 40, the AP 10a establishes wireless communication with the AP 40. In step S204, the limited connection unit 114a establishes wireless communication CN1 (FIG. 4) with an arbitrary wireless terminal such as the personal computer 30, for example. Specifically, the limited connection unit 114a receives the probe request transmitted from the wireless terminal, and establishes wireless communication with the wireless terminal by performing processing such as transmission of a probe response and authentication.

  After step S204, as shown in FIG. 4, the user can connect to the visitor's wireless networks CN1 and CN2 of the AP 10a using an arbitrary wireless terminal such as the personal computer 30. Note that the communication destinations of the wireless terminals in the customer wireless networks CN 1 and 2 are limited to the Internet by the guest function 112 of the relay processing unit 111. Further, in step S118 and subsequent steps, when the touch or proximity of the NFC tag 210 cannot be detected, the connection of the user's wireless terminal to the customer wireless networks CN1, 2 is cut off from the first embodiment. It is the same.

  As described above, according to the process for a visitor according to the second embodiment, the same effect as that described in the first embodiment can be obtained. Further, according to the process for the visitor of the second embodiment, the limited connection unit 114a further connects the AP 40 (network) functioning as a gateway for the Internet INT connection between the AP 10a (wireless connection device) and the Internet INT. If there is a device, the AP 40 is allowed to connect to the visitor's wireless network via the AP 10a (step S202). Therefore, even when there is a network device between the AP 10a and the Internet INT, communication from the personal computer 30 (wireless terminal) connected to the visitor's wireless network CN1 to the Internet INT can be realized. it can.

C. Third embodiment:
In the third embodiment of the present invention, an example in which LAN access from a guest terminal via the Internet is realized in the configuration described in the second embodiment will be described. Below, only the part which has a different structure and operation | movement from 2nd Embodiment is demonstrated. In the figure, components similar to those of the second embodiment are denoted by the same reference numerals as those of the second embodiment described above, and detailed description thereof is omitted.

C-1. System outline:
FIG. 7 is an explanatory diagram illustrating a state in which a user connects to a visitor's wireless network using the wireless connection device of the third embodiment. 2 differs from the second embodiment shown in FIG. 2 in that an AP 10b is provided instead of the AP 10a, a storage medium 20b is provided instead of the storage medium 20a, an AP 40b is provided instead of the AP 40, and a router 50. And a point provided with the server 60.

  The AP 40b is an access point device that conforms to the IEEE 802.11 standard and the IEEE 802.3 standard. The AP 40 also functions as a router and is connected to the Internet INT via a wired cable. The AP 40b can establish a communication path TN using a virtual private network (hereinafter also referred to as “VPN”) terminated with the AP 40b by using IPsec (Security Architecture for Internet Protocol).

  The router 50 is a router device that conforms to the IEEE 802.3 standard. The router 50 is connected to the Internet INT and the server 60 via a wired cable. Similarly to the AP 40b, the router 50 can establish a communication path TN using VPN that terminates the router 50 using IPsec.

  The server 60 includes a hard disk drive (not shown). The hard disk drive of the server 60 stores various user data such as audio data, image data, and application data.

C-2. Schematic configuration of wireless connection device:
FIG. 8 is a block diagram functionally showing the configuration of the wireless connection device 10b and the storage medium 20b of the third embodiment. FIG. 8A shows the configuration of the wireless connection device (AP) 10b. A difference from the second embodiment shown in FIG. 5A is that a CPU 110b is provided instead of the CPU 110a. The CPU 110b includes a limited connection unit 114b instead of the limited connection unit 114a, and further includes a virtualization request unit 116. The limited connection unit 114b is different from the second embodiment in the processing content of the process for a visitor to be executed. The virtualization request unit 116 requests the AP 40b to establish a communication path TN using VPN.

C-3. General configuration of storage medium:
FIG. 8B shows the configuration of the storage medium 20b. The difference from the second embodiment shown in FIG. 5B is that an NFC tag 210b is provided instead of the NFC tag 210a. The NFC tag 210b includes connection information 212b instead of the connection information 212a. The connection information 212b includes setting information related to wireless communication necessary for connecting to the wireless network for the customer of the AP 10b, setting information related to wireless communication required to connect to the wireless network for the visitor of the AP 40b, In addition, setting information necessary for the AP 40b to establish the communication path TN using VPN is stored in advance. Specifically, the setting information includes VPN setting information and a connection key.

C-4. Processing for visitors:
FIG. 9 is a flowchart illustrating a procedure of processing for a visitor in the third embodiment. The difference from the second embodiment shown in FIG. 6 is that step S302 is further provided after step S204. Note that the execution order of steps S202, S204, and S302 described below may be switched.

  In step S302, the virtualization request unit 116 transmits a VPN setting request to the AP 40b. At this time, the virtualization request unit 116 transmits the VPN setting information and the connection key included in the connection information 212b acquired in step S104 together with the VPN setting request. The AP 40b that has received the VPN setting request performs setting necessary for establishing the communication path TN according to the VPN setting information, performs a key exchange for connection with the router 50, and uses the VPN for the communication path. Establish TN.

  After step S302, as shown in FIG. 7, the user can connect to the visitor's wireless networks CN1 and CN2 of the AP 10b using an arbitrary wireless terminal such as the personal computer 30. Furthermore, the contents of communication with the server 60 via the Internet INT are encapsulated and encrypted by the communication path TN using VPN. Note that the communication destinations of the wireless terminals in the customer wireless networks CN 1 and 2 are limited to the Internet by the guest function 112 of the relay processing unit 111. Further, in step S118 and subsequent steps, when the touch or proximity of the NFC tag 210 cannot be detected, the connection of the user's wireless terminal to the wireless networks CN1 and CN2 for visitors is disconnected from the second embodiment. It is the same. Furthermore, the AP 40b disconnects the VPN connection with the router 50 along with the disconnection of the visitor's wireless network CN2.

  As described above, according to the process for a visitor according to the third embodiment, the same effect as that described in the second embodiment can be obtained. Furthermore, according to the process for the visitor of the third embodiment, the virtualization requesting unit 116, when there is an AP 40b (network device) between the AP 10b (wireless connection device) and the Internet INT, , Request establishment of a communication channel TN using a VPN (virtual private network). In the communication path TN using VPN, the communication contents via the Internet INT are encapsulated and encrypted. For this reason, it is possible to improve security in communication between the personal computer 30 (wireless terminal) connected to the visitor's wireless network and the communication partner device of the wireless terminal, that is, the server 60 according to the above embodiment. Can do.

D. Fourth embodiment:
In the fourth embodiment of the present invention, a configuration for performing authentication of a storage medium using a temporary key that is temporarily valid in the configuration described in the first embodiment will be described. Below, only the part which has a different structure and operation | movement from 1st Embodiment is demonstrated. In the figure, the same components as those of the first embodiment are denoted by the same reference numerals as those of the first embodiment described above, and detailed description thereof is omitted.

D-1. System outline:
The manner in which the user connects to the visitor's wireless network using the wireless connection device of the fourth embodiment is the same as that of the first embodiment shown in FIG. However, in the fourth embodiment, an AP 10c is provided instead of the AP 10, and a storage medium 20c is provided instead of the storage medium 20.

D-2. Schematic configuration of wireless connection device:
FIG. 10 is a block diagram functionally showing the configuration of the wireless connection device 10c and the storage medium 20c of the fourth embodiment. FIG. 10A shows the configuration of the wireless connection device (AP) 10c. The difference from the first embodiment shown in FIG. 2A is that a CPU 110 c is provided instead of the CPU 110 and a flash ROM 160 c is provided instead of the flash ROM 160.

  The CPU 110c includes an acquisition unit 113c instead of the acquisition unit 113, includes a limited connection unit 114c instead of the limited connection unit 114, and includes an authentication unit 115c instead of the authentication unit 115. The acquisition unit 113c differs from the first embodiment in information acquired from the storage medium 20c. The limited connection unit 114c is different from the first embodiment in the processing content of the process for a visitor to be executed. The authentication unit 115c authenticates the legitimacy of the storage medium 20c using information stored in the storage medium 20c in the process for a visitor. Further, the authentication unit 115c of the present embodiment generates a temporary key that is temporarily valid by executing a temporary key issuance process prior to the visitor process, and the generated temporary key is stored in the storage medium 20c. Remember me. Here, the temporary key can adopt any form as long as it is a key with a time restriction or a time restriction. The temporary key may be, for example, a one-time key (one-time password) that is valid only once.

  The flash ROM 160 c includes an issued key storage unit 162 in addition to the registration information 161. The issued key storage unit stores the same information as the temporary key generated by the temporary key issuing process executed by the authentication unit 115c.

D-3. General configuration of storage medium:
FIG. 10B shows the configuration of the storage medium 20c. A difference from the first embodiment shown in FIG. 2B is that an NFC tag 210 c is provided instead of the NFC tag 210. A temporary key 213 is stored in the NFC tag 210c after a temporary key issuing process.

D-4. Temporary key issue processing:
FIG. 11 is a flowchart showing the procedure of the temporary key issuing process. The temporary key issuing process is executed prior to the visitor process shown in FIG. In step S402, the NFC interface 120 detects a touch of the NFC tag 210c of the storage medium 20c. In step S402, it may be detected that the NFC tag 210c is within the readable range of the NFC reader of the NFC interface 120, instead of detecting the touch. In order to distinguish between the trigger for starting the temporary key issuing process and the trigger for starting the process for a visitor described later, in step S402, instead of detecting the touch of the NFC tag 210c of the storage medium 20c, or detecting the touch At the same time, it is also possible to use an instruction from the user given via the setting screen of the AP 10 provided by means such as detection of a button provided in the AP 10c or means such as HTTP (HyperText Transfer Protocol).

  In step S404, the authentication unit 115c generates a temporary key. For generation of the temporary key, for example, various known methods such as a generation method using a mathematical algorithm and a time synchronization type generation method can be employed.

  In step S406, the authentication unit 115c stores the temporary key generated in step S404 in the NFC tag 210c of the storage medium 20c via the NFC writer of the NFC interface 120. Through step S406, the temporary key 213 is stored in the NFC tag 210c of the storage medium 20c.

  In step S408, the authentication unit 115c stores the temporary key generated in step S404 in the issued key storage unit 162 of the flash ROM 160c. At this time, the authentication unit 115c may store in the issued key storage unit 162 the restrictions (temporal limit, number of times limit) attached to the temporary key in addition to the information indicating the temporary key.

  As described above, according to the temporary key issuing process, the authentication unit 115c can temporarily generate a valid temporary key and store the generated temporary key in the storage medium 20c by NFC (Near Field Communication). it can. For this reason, the temporary key required in the process for visitors of the fourth embodiment can be issued easily.

D-5. Processing for visitors:
FIG. 12 is a flowchart illustrating a procedure of processing for a visitor in the fourth embodiment. The difference from the first embodiment shown in FIG. 1 is that steps S502 to S506 are provided instead of steps S104 to S108.

  In step S502, the acquisition unit 113c acquires medium information read by the NFC reader of the NFC interface 120, that is, authentication information 211, connection information 212, and a temporary key 213. In step S504, the authentication unit 115c collates the authentication information 211 acquired in step S502 with the information stored in the registration information 161 of the flash ROM 160c. In addition, the authentication unit 115c collates the temporary key 213 acquired in step S502 with information stored in the issued key storage unit 162 of the flash ROM 160c.

  In step S506, the authentication unit 115c determines whether both the authentication information 211 and the temporary key 213 have been registered. The method for determining whether or not the authentication information 211 has been registered is as described in step S108 in FIG. If the acquired temporary key 213 matches the information stored in the issued key storage unit 162 as a result of the collation in step S504, the authentication unit 115c has registered the acquired temporary key 213 in the issued key storage unit 162. It is determined that On the other hand, if the acquired temporary key 213 does not match the information stored in the issued key storage unit 162 as a result of the collation in step S504, the authentication unit 115c stores the acquired temporary key 213 in the issued key storage unit 162. Judge that it is not registered. Furthermore, the authentication unit 115c determines that the storage medium 20c is valid only when the authentication information 211 has been registered in the registration information 161 and the temporary key 213 has been registered in the issued key storage unit 162. In other cases, it is determined that the storage medium 20c is not valid. When the issued key storage unit 162 stores a plurality of pieces of information corresponding to a plurality of legitimate storage media 20c, the match determination in step S506 may be partially matched.

  When the authentication information 211 has been registered in the registration information 161 and the temporary key 213 has been registered in the issued key storage unit 162 (step S506: YES), the authentication unit 115c causes the process to transition to step S110. . In other cases, the authentication unit 115c shifts the process to step S502.

  As described above, according to the process for a visitor according to the fourth embodiment, the same effects as those described in the first embodiment can be obtained. Furthermore, according to the process for visitors of the fourth embodiment, the authentication unit 115c authenticates the validity of the storage medium 20c using the temporary key 213 together with the authentication information 211. The temporary key 213 that is valid only temporarily has higher security strength than the authentication information 211 continuously stored in the storage medium 20c. By authenticating the validity of the storage medium 20c using such a temporary key 213, the authentication unit 115c can further improve the reliability of authentication. As a result, the security in the AP 10c (wireless connection device) can be further improved.

E. Fifth embodiment:
In the fifth embodiment of the present invention, an example in which a configuration in which a storage medium is built in a wireless terminal is employed will be described. Below, only the part which has a different structure and operation | movement from 1st Embodiment is demonstrated. In the figure, the same components as those of the first embodiment are denoted by the same reference numerals as those of the first embodiment described above, and detailed description thereof is omitted.

  FIG. 13 is an explanatory diagram illustrating a state in which a user connects to a visitor's wireless network using the wireless connection device of the fifth embodiment. The difference from the first embodiment shown in FIG. 1 is that a wireless terminal is provided with a smartphone 70 instead of the personal computer 30 and a storage medium 20 is not provided.

  The smartphone 70 has a built-in NFC tag 210. The details of the NFC tag 210 are the same as those of the NFC tag 210 built in the storage medium 20 of the first embodiment (FIG. 2B).

  The configuration of the AP 10 of this embodiment is the same as that of the first embodiment shown in FIG. 2A, and the contents of the process for the customer executed by the AP 10 are the same as those of the first embodiment shown in FIG. is there. For this reason, the user of the AP 10 can connect to the wireless network CN for the visitor of the AP 10 using the smartphone 70 only while the smartphone 70 owned by the AP 10 is in proximity to the NFC interface 120 of the AP 10. .

  Thus, even when the configuration of the fifth embodiment is adopted, the same effects as those explained in the first embodiment can be obtained. Moreover, the structure which uses the smart phone 70 demonstrated by this embodiment as a radio | wireless terminal can be similarly used not only in 1st Embodiment but in 2nd-4th Embodiment.

F. Variations:
In the above embodiment, a part of the configuration realized by hardware may be replaced by software, and conversely, a part of the configuration realized by software may be replaced by hardware. Good. In addition, the following modifications are possible.

・ Modification 1:
In the above embodiment, an example of the configuration of the wireless connection device and the storage medium has been given. However, the structure in the said embodiment is an example to the last, and various changes are possible. For example, the deformation | transformation which abbreviate | omits a part of a component, adds a further component, or changes a part of a component is possible.

  For example, the wireless connection device may further include a holding unit for holding the storage medium. For example, the holding unit may have a pocket shape provided outside the housing of the wireless connection device and in the vicinity of the built-in NFC interface. In this way, the user can put the storage medium in the holding unit (pocket) of the wireless connection device when he / she wants to use the wireless network for visitors of the wireless connection device. As a result, convenience for the user can be improved.

  For example, the guest function of the wireless connection device may have a function other than the filtering of packets received from the guest terminal. For example, the guest function may have a function of performing virus scanning on the guest terminal. Further, the guest function may have a function of acquiring a log of packets transmitted / received to / from the guest terminal. In this way, it is possible to further improve security in the wireless network for visitors provided by the wireless connection device.

  For example, the wireless connection device may include another short-range wireless communication interface (specifically, for example, Bluetooth (registered trademark), TransferJET, or the like) instead of the NFC interface. In this case, the storage medium side is also provided with a short-range wireless communication interface (for example, Bluetooth) similar to the wireless connection device. Furthermore, it is assumed that Bluetooth pairing between the wireless connection device and the storage medium has been completed in advance. In addition, in the above-described embodiment, the location “NFC tag touch detection” can be read as “connection detection using Bluetooth”. The same applies when TransferJET is used instead of Bluetooth.

  For example, the wireless connection device of the third embodiment is assumed to realize a virtual private network (VPN) using IPsec. However, a protocol other than IPsec may be adopted as long as tunneling between at least two devices can be implemented to realize a virtual private network. For example, L2TP (Layer 2 Tunneling Protocol) may be employed, or PPTP (Point to Point Tunneling Protocol) may be employed. Further, encryption of data in a frame encapsulated in VPN may be omitted.

  For example, in the wireless connection device, the flash ROM may be composed of different storage media. For example, the wireless connection device may include a removable storage medium such as a USB memory or a USB hard disk instead of the flash ROM. For example, the information described as being stored in the flash ROM in the above embodiment may be distributed and stored in a plurality of storage media.

Modification 2
In the said embodiment, an example of the process for visitors and the temporary key issue process was shown. However, the processing procedure in the above embodiment is merely an example, and various modifications are possible. For example, some steps may be omitted, and other steps may be added. Further, the order of the steps to be executed may be changed.

  For example, in step S106 of the process for the visitor, the authentication unit transmits the authentication information acquired in step S104 to the external authentication server, causes the authentication server to authenticate the validity of the storage medium, and displays the authentication result. You may get it. In this case, the registration information in the flash ROM of the wireless connection device can be omitted. At this time, the authentication server functions as an “external device”. The authentication server may exist in the same LAN as the wireless connection device, or may exist on the Internet.

  For example, the authentication in step S106 of the process for visitors may be omitted. Further, for example, steps S110 and S124 for the visitor process may be omitted. Specifically, for example, when the wireless connection device supports a multi-SSID function, that is, a function of operating one physical access point as a plurality of logical access points using a plurality of SSIDs, By omitting steps S110 and S124, wireless communication using an SSID other than the guest SSID can be continued.

  For example, in steps S502 to S506 of the process for visitors of the fourth embodiment, the authentication of the storage medium is performed using both the authentication information acquired from the storage medium and the temporary key, but the authentication information is used. Authentication may be omitted. In this case, the registration information that is stored in the flash ROM of the wireless connection device and the authentication information that is stored in the NFC tag of the storage medium may be omitted.

・ Modification 3:
In the above embodiment, an example of a wireless terminal connected to the wireless connection device has been described. However, the wireless terminal in the above embodiment is merely an example, and various devices can be used. For example, mobile devices such as mobile phones and PDAs (Personal Digital Assistants), image input / output devices such as digital cameras, printers, network displays, and scanners, AV devices such as audio and television, refrigerators, air conditioners, and televisions Home appliances, NAS (Network Attached Storage), etc. can be used. Similarly to the example of the fifth embodiment, a storage medium (for example, an NFC tag) may be incorporated in the above-described wireless terminal.

-Modification 4:
The present invention is not limited to the above-described embodiments, examples, and modifications, and can be realized with various configurations without departing from the spirit thereof. For example, the technical features in the embodiments, examples, and modifications corresponding to the technical features in each embodiment described in the summary section of the invention are to solve some or all of the above-described problems, or In order to achieve part or all of the above-described effects, replacement or combination can be performed as appropriate. Further, if the technical feature is not described as essential in the present specification, it can be deleted as appropriate.

    DESCRIPTION OF SYMBOLS 10 ... Wireless connection apparatus 20, 20a-c ... Storage medium, 30 ... Personal computer, 40 ... Network apparatus, 50 ... Router, 60 ... Server, 70 ... Smartphone, 110, 110a-c ... CPU, 111 ... Relay processing part 112, 113c, guest function, 113, 113c, acquisition unit, 114, 114a to c, limited connection unit, 115, 115c, authentication unit, 116, virtualization request unit, 140, wireless communication interface, 150, wired communication interface, 161: Registration information, 162: Issued key storage unit, 211: Authentication information, 212, 212a, b ... Connection information, 213 ... Temporary key, CN ... Wireless network for visitors, TN ... Communication channel, INT ... Internet

Claims (11)

A wireless connection device,
A detection unit for detecting the proximity of the storage medium mounted with an IC chip capable of reading information based on NFC to the wireless connection device by an NFC interface;
A limitation that allows a wireless terminal to connect to a visitor wireless network that is a wireless network isolated from other networks among a plurality of networks provided by the wireless connection device while detecting the proximity. A connection,
Equipped with a,
The plurality of networks are wireless networks using different SSIDs.
Wireless connection device. The wireless connection device according to claim 1, further comprising:
An acquisition unit for acquiring authentication information of the information from the storage medium by the NFC interface;
The detection unit is a wireless connection device that determines that the wireless connection device and the storage medium are close to each other when the authentication information can be acquired by the acquisition unit. The wireless connection device according to claim 2, further comprising:
A wireless connection device comprising: an authentication unit that authenticates the validity of the storage medium using the acquired authentication information. The wireless connection device according to claim 2, further comprising:
A wireless connection device comprising: an authentication unit that transmits the acquired authentication information to an external device and acquires an authentication result of validity of the storage medium from the external device. The wireless connection device according to claim 3 or 4, wherein
The authentication unit further generates a temporary key that is temporarily valid, and stores the generated temporary key in the storage medium by the NFC interface. The wireless connection device according to claim 5,
The acquisition unit acquires the temporary key stored in the storage medium;
The authentication unit authenticates the validity of the storage medium using the temporary key instead of the authentication information or together with the authentication information. The wireless connection device according to any one of claims 1 to 6,
The limited connection unit further restricts communication from the wireless terminal connected to the customer-facing wireless network to the other network, thereby limiting a communication destination of the wireless terminal to the Internet. Connected device. The wireless connection device according to any one of claims 1 to 7,
The limited connection unit further permits the network device to connect to the visitor wireless network via the wireless connection device when there is a network device between the wireless connection device and the Internet. Let the wireless connection device. The wireless connection device according to claim 8, further comprising:
A wireless connection device comprising: a virtualization requesting unit that requests the network device to establish a communication path using a virtual private network. A method for controlling a wireless connection device, comprising:
Detecting the proximity of the storage medium equipped with an IC chip capable of reading information based on NFC to the wireless connection device by an NFC interface;
A step of enabling connection of a wireless terminal to a visitor's wireless network that is a wireless network isolated from other networks among a plurality of networks provided by the wireless connection device while detecting the proximity. When,
With
The plurality of networks are wireless networks using different SSIDs.
Method. A network system,
A wireless connection device;
A wireless terminal equipped with an IC chip capable of reading information based on NFC, and provided with a storage medium in which authentication information is stored in advance as the information;
With
The wireless connection device is:
A detection unit for detecting proximity of the storage medium to the wireless connection device by an NFC interface;
While detecting the proximity, the wireless terminal can be connected to a wireless network for a visitor that is a wireless network isolated from other networks among a plurality of networks provided by the wireless connection device. A limited connection,
Equipped with a,
The plurality of networks are wireless networks using different SSIDs.
Network system.

Images