JP2003274454A - Wireless communication terminal, wireless communication module, program, recording medium, wireless communication network, and communication control method - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To improve the security function of a wireless communication terminal. A communication terminal decodes an SSID and a MAC address of a base station included in a received beacon, and obtains an SSID obtained by decoding the beacon.
Matches the SSID stored in storage area 408a,
Further, the base station 30 is authenticated by determining whether or not the MAC address obtained by decoding the beacon matches any one of the MAC addresses in the base station address storage table 408b. Further, the communication terminal 40 is the own terminal 4
If 0 is in an area where a plurality of basic service areas overlap, the radio reception intensity of the beacon received from each base station 30 is measured, and the base stations 30 are arranged in descending order of radio reception intensity.
Perform authentication.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to security technology for wireless communication terminals.

[0002]

2. Description of the Related Art In recent years, a wireless LAN having a communication terminal such as a mobile computer and a PDA having a wireless communication function and a plurality of base stations (also called access points) for wirelessly communicating with the communication terminal have been developed. It has been put to practical use. In such a wireless LAN, a communication terminal communicates with other communication terminals in the wireless LAN or is connected to the wireless LAN via a base station that covers the wireless area in which the own terminal is located. You can access the Internet etc.

[0003]

By the way, with the development of information communication technology, miniaturization and cost reduction of base station equipment in a wireless LAN have been rapidly advanced in recent years. While this kind of situation brings many benefits to the spread of wireless LAN, it makes it relatively easy for a malicious third party to install a fake base station and impersonate it as a legitimate base station. There are some points to be concerned about. If a fake base station is installed by a malicious third party, the fake base station may contain, for example, advertisement information or computer virus that a communication terminal would not normally receive. There is a risk that the stored programs will be delivered to the communication terminal, or that personal information stored in the communication terminal will be stolen secretly.

The present invention has been made in view of the circumstances described above, and an object thereof is to improve the security function of a wireless communication terminal.

[0005]

In order to solve the above problems, the present invention comprises communication network identification information for identifying a wireless communication network to which the wireless communication terminal belongs, and the wireless communication network. Storage means for storing base station identification information for identifying each of one or more base stations permitted to perform wireless communication with the wireless communication terminal, and a base station covering a wireless area in which the wireless communication terminal is located. From the first receiving means for receiving the communication network identification information to which the base station belongs and the base station identification information of the base station, and the communication network identification information received by the first receiving means in the storage means. Whether or not it matches the stored communication network identification information and the base station identification information received by the first receiving means matches any one of the base station identification information stored in the storage means. Determination means for determining , To provide a wireless communication terminal and a determining means for determining whether communication with the base station in accordance with the discrimination result by said discrimination means.

Further, according to the present invention, in a wireless communication network having a wireless communication terminal and one or more base stations performing wireless communication with the wireless communication terminal, each of the base stations belongs to the base station. The wireless communication terminal has a transmitting unit for transmitting communication network identification information and base station identification information for identifying the base station, and the wireless communication terminal includes communication network identification information of a wireless communication network to which the wireless communication terminal belongs, and the wireless communication. A storage unit that configures a communication network and stores base station identification information of one or more base stations permitted to perform wireless communication with the wireless communication terminal, and covers a wireless area in which the wireless communication terminal is located. Receiving means for receiving the communication network identification information of the base station and the base station identification information transmitted from the base station by the transmitting means, and the communication network identification information received by the receiving means are stored in the storage means. That matches the network identification information, and,
Discriminating means for discriminating whether or not the base station identification information received by the receiving means matches any of the base station identification information stored in the storing means, and the base station according to the discrimination result by the discriminating means. There is provided a wireless communication network having a determining means for determining whether or not communication with.

The present invention also provides a transmission process in which a base station transmits communication network identification information for identifying a wireless communication network to which the base station belongs and base station identification information for identifying the base station, and wireless communication. A reception step in which the terminal receives the communication network identification information and the base station identification information of the base station transmitted in the transmission step from a base station that covers a wireless area in which the wireless communication terminal is located; Wireless communication terminal
The communication network identification information received in the reception process matches the communication network identification information of the wireless communication network to which the wireless communication terminal belongs, and the base station identification information received in the reception process is The wireless communication network, which is registered in advance in the wireless communication terminal, is configured to determine whether or not it matches any one of the base station identification information of one or more base stations permitted to wirelessly communicate with the wireless communication terminal. There is provided a communication control method, comprising: a determination step for performing the determination, and a determination step for the wireless communication terminal to determine whether to communicate with the base station according to the determination result of the determination step.

According to the present invention, the wireless communication terminal authenticates the base station using the communication network identification information and the base station identification information, and determines whether or not communication with the base station is possible.

Further, according to the present invention, in a wireless communication module for providing a wireless communication function to an electronic device, communication network identification information for identifying a wireless communication network permitted to wirelessly communicate with the wireless communication module, and the wireless communication. A storage unit that stores base station identification information that configures a network and identifies each of one or more base stations permitted to perform wireless communication with the wireless communication module; and an electronic device to which the wireless communication module is attached. Receiving means for receiving communication network identification information to which the base station belongs and base station identification information of the base station from a base station covering a radio area in which the mobile station is located, and communication network identification received by the receiving means. The information matches the communication network identification information stored in the storage means, and the base station identification information received by the reception means is stored in the storage means. Discrimination means for discriminating whether or not it coincides with any base station identification information, and determines whether communication with the base station is possible or not according to the determination result by the determination means, and outputs the determined communication availability to the electronic device. And a wireless communication module having an output means for operating the wireless communication module.

According to the present invention, the wireless communication module authenticates the base station using the communication network identification information and the base station identification information, and notifies the electronic device whether or not communication with the base station is possible.

Also, the present invention provides, in a computer provided in a wireless communication terminal, communication network identification information to which the base station belongs from a base station covering a wireless area in which the wireless communication terminal is located, and the base station. A receiving step of causing the wireless communication terminal to receive base station identification information for identifying
The communication network identification information received in the receiving step matches the communication network identification information of the wireless communication network to which the wireless communication terminal belongs, and the base station identification information received in the receiving step is the wireless communication. Discrimination for determining whether or not it matches with any one of base station identification information of one or more base stations that are pre-registered in the terminal and configure the wireless communication network, and wireless communication with the wireless communication terminal is permitted A program for executing a step and a determining step of determining whether or not the wireless communication terminal can communicate with the base station according to the determination result of the determining step.

According to the present invention, the computer provided in the wireless communication terminal executes the program, so that the wireless communication terminal authenticates the base station using the communication network identification information and the base station identification information, and communicates with the base station. Determines whether or not communication is possible.

[0013]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. In addition, the same reference numerals are given to common portions in each drawing.

[A-1. Configuration of Embodiment] <1. Configuration of Wireless LAN> FIG. 1 is a block diagram illustrating the configuration of a wireless LAN 1 according to the present invention. As shown in the figure, the wireless LAN 1 is a gateway server 1.
0, the control server 20, and the base stations 30a and 30
b and the communication terminal 40. In addition, in FIG. 1, in order to prevent the drawing from becoming complicated, a predetermined gateway server 10 and a predetermined base station 3 that constitute the wireless LAN 1 are provided.
Only 0a, 30b and a predetermined communication terminal 40 are shown. Further, in the present specification, the base stations 30a and 30b are referred to as the base station 30, and the basic service areas 35a and 35b are referred to as the basic service area 35, unless otherwise specified.

The gateway server 10 is a wireless LAN 1
And has a function for interconnecting the Internet. In addition, the control server 20 includes a wireless LAN 1
The terminal ID of the communication terminal 40 and the base station of the base station 30 that covers the basic service area 35 in which the communication terminal 40 is currently located, for each communication terminal 40 that subscribes to the packet communication service provided by ID and are registered.

The base station 30 performs wireless communication with the communication terminal 40 in the basic service area 35 covered by the base station 30 and transmits / receives packet data. Also, this base station 3
0 is the SSID (Service Set IDentificatio) to be described later.
A beacon including n) and a MAC (Media Access Control) address is periodically broadcast in the basic service area 35 of the own station 30.

The extended service area 36 shown in FIG. 1 is an area in which the basic service areas 35 of the base stations 30 constituting the wireless LAN 1 are put together, and the communication terminal 40 provides a packet communication service by the wireless LAN 1. It shows the entire area that can be enjoyed.

The communication terminal 40 is a mobile device that receives a packet communication service provided by the wireless LAN 1, and is, for example,
It is a mobile computer or PDA having a wireless communication function. The communication terminal 40 performs wireless communication with the base station 30 that covers the basic service area 35 in which the own terminal 40 is located, and the wireless LAN 1 is connected via the base station 30.
It has a function of performing packet communication with other communication terminals 40 in the inside and various communication devices connected to the Internet. Further, the communication terminal 40 has a base station authentication function for authenticating the base station 30 used as a relay device during packet communication.

<2. Configuration of Base Station> FIG. 2 is a block diagram illustrating a hardware configuration of base station 30 shown in FIG. As shown in the figure, the base station 30 has a wired communication interface 301, a storage unit 302, a wireless communication unit 306, and a CPU 307, and these units are connected by a bus 308. In addition, the storage unit 302
Has a ROM 303, a RAM 304, and a non-volatile memory 305.

In the wired communication interface 301, the base station 30 is used by the gateway server 10 and the control server 2.
Controls wired communication with 0 or another base station 30. This wired communication interface 301 is an IEEE
E (Institute of Electrical and Electronic Enginee
rs) for controlling communication in so-called Ethernet (registered trademark) conforming to 802.3, and a MAC address 301a is written in a ROM (not shown) provided in the wired communication interface 301. There is.

Here, referring to FIG. 3, the MAC address 3
The data structure of 01a will be described. In the figure, the MAC address 301a is represented in hexadecimal notation as 1
Each byte is separated by a colon. MAC address 30
1a has a data length of 6 bytes, and the upper 3 bytes are I
It is a vendor ID assigned by EEE for each vendor, and the lower 3 bytes are the product ID assigned by the vendor for each product.
Is. In the present embodiment, this MAC address 301a
Is used as base station identification information for identifying the base station 30.

Returning to FIG. 2, the ROM 303 stores in the base station 3
0 A program that controls the basic control of each unit is stored. The RAM 304 is used as a work area of the CPU 307, and temporarily stores programs executed by the CPU 307 and various data. Also, C
The PU 307 controls various parts of the device connected via the bus 308 by executing various programs stored in the storage unit 302.

The non-volatile memory 305 stores programs and data for the base station 30. The nonvolatile memory 305 has an SSID storage area 305.
a is provided. In this SSID storage area 305a, the SSID that identifies the wireless LAN to which this base station 30 belongs, or each base station 3 that constitutes the wireless LAN 1
When 0 is divided into a plurality of groups, the SSID identifying the group to which this base station 30 belongs is stored. This SSID is set by the administrator of the wireless LAN 1 when the base station 30 is installed, and is stored in the SSID storage area 305a.

In addition, in the non-volatile memory 305, in addition to this, for example, the terminal ID of each communication terminal 40 that subscribes to the packet communication service by the wireless LAN 1, or the same group as this base station 30 in the wireless LAN 1. A subscriber terminal list in which the terminal IDs of the respective communication terminals 40 to which they belong are registered is stored. The subscriber terminal list is used by the base station 30 to authenticate the communication terminal 40 that has accessed the base station 30.

The wireless communication unit 306 controls wireless communication with the communication terminal 40. This wireless communication unit 306
Is an SSID storage area 305 under the control of the CPU 307.
A beacon including the SSID stored in a and the MAC address 301a stored in the wired communication interface 301 is generated, and this beacon is periodically broadcast in the basic service area 35 of the own station 30. Also,
The wireless communication unit 306 generates a transmission signal on which packet data is superimposed, and the communication terminal 40 in the basic service area 35.
The wireless signal received from the communication terminal 40 is demodulated and packet data and the like are obtained.

In this embodiment, the MAC address 301 stored in the wire communication interface 301 is stored.
A case in which a is included in the beacon for broadcasting will be described. For example, a MAC address 301a for the wireless communication unit 306 is stored in advance in a memory (not shown) in the wireless communication unit 306, and the wired communication interface 301 is used.
MAC address 3 stored in the wireless communication unit 306 instead of the MAC address 301a stored in
It may be a form in which 01a is included in a beacon and broadcast. In addition, the beacon is periodically broadcast at a rate of several times per second, for example, but it is not always broadcast in the same cycle, and when it is broadcast at a timing deviating from a predetermined cycle. There is also.

<3. Configuration of Communication Terminal> FIG. 4 is a block diagram illustrating a hardware configuration of communication terminal 40 shown in FIG. As shown in FIG.
Has a wireless communication unit 401, an operation input unit 402, a liquid crystal display unit 403, a wired communication interface 404, a storage unit 405, and a CPU 409, and these units are connected by a bus 410. . In addition, the storage unit 4
Reference numeral 05 denotes a ROM 406, a RAM 407, an S
RAM (Static-RAM) and EEPROM (Electrically
Erasable Programmable-ROM) and a non-volatile memory 408 such as a hard disk.

The wireless communication section 401 controls wireless communication with the base station 30. This wireless communication unit 401
Under the control of the CPU 409, generates a transmission signal on which, for example, packet data is superimposed and transmits the transmission signal to the base station 30. Further, the wireless communication unit 401 receives a beacon broadcast from the base station 30 and a wireless signal transmitted from the base station 30 to the own terminal 40, demodulates these, and the base station 30 included in the beacon. SSID and MAC address 30
1a or packet data or the like addressed to the terminal 40 itself is obtained.

The operation input unit 402 has a keyboard and a pointing device for inputting characters and operation instructions, and outputs a command according to the operation input to the CPU 409. Further, the liquid crystal display unit 403 has a liquid crystal display panel and a drive circuit for performing display control of this liquid crystal display panel. The wired communication interface 404 controls wired communication performed between the communication terminal 40 and various communication devices connected to the Internet, for example. ROM40
6 stores a program and the like that controls the basic control of each unit of the communication terminal 40. The RAM 407 is a CPU
It is used as a work area of the CPU 409 and temporarily stores programs executed by the CPU 409 and various data.

The non-volatile memory 408 stores various programs and data such as an operating system and application programs for the communication terminal 40 and a terminal ID of the communication terminal 40. The nonvolatile memory 408 includes an SSID storage area 408a, a base station address storage table 408b, and a location area ID.
It has a storage area 408c.

Here, in the SSID storage area 408a,
The SSID that identifies the wireless LAN 1 to which this communication terminal 40 belongs or the SSID that identifies the group of the wireless LAN 1 to which this communication terminal 40 belongs is stored. This SSID is assigned to the communication terminal 40 according to the subscription contract of the packet communication service, and is stored in the SSID storage area 408a.

The base station address storage table 408
b is a data table used by the communication terminal 40 to perform authentication processing of the base station 30 used as a relay device during packet communication. In the base station address storage table 408b, as shown in FIG. 5, the MAC address 301a of each base station 30 constituting the wireless LAN 1 to which the communication terminal 40 belongs, or the wireless LAN
In FIG. 1, the MAC address 301a of each base station 30 that belongs to the same group as this communication terminal 40 is stored.

This base station address storage table 408b
Is downloaded to the communication terminal 40 via the Internet from a service management center (not shown) operated by the communication carrier of the wireless LAN 1 and stored in the non-volatile memory 408. The base station address storage table 408b is stored in the wireless LAN from the service management center.
Alternatively, it may be downloaded to the communication terminal 40 via wireless communication via the communication terminal 1.

Returning to FIG. 4, the area ID storage area 40
In 8c, the MAC address 301a of the base station 30 is stored as a location area ID for identifying the basic service area 35 in which the communication terminal 40 is currently located. If the communication terminal 40 is outside the extended service area 36 of the wireless LAN 1 or in a place where radio waves do not reach,
Data indicating that it is out of the service area is stored in the service area ID storage area 408c.

The CPU 409 executes the various programs stored in the storage unit 405 to cause the bus 41
Control each part of the device connected via 0. This C
The PU 409 decodes the SSID and the MAC address 301a from the beacon of the base station 30 received by the wireless communication unit 401, as the processing peculiar to this embodiment.
The decrypted SSID and the SSID stored in the SSID storage area 408a are collated, and the base station 30 that is the broadcast source of the received beacon has the same wireless LAN as the own terminal 40.
It is determined whether they belong to 1 or the same group.

Then, the CPU 409 determines that the base station 30 which is the broadcast source of the received beacon has the same wireless L as the own terminal 40.
If it is determined that the device belongs to AN1 or the same group, then the MAC address 3 decoded from the beacon
It is determined whether 01a matches any one of the MAC addresses 301a stored in the base station address storage table 408b. Then, when the CPU 409 determines that the MAC address 301a decoded from the beacon matches any of the MAC addresses 301a in the base station address storage table 408b, the base station 30 that is the broadcast source of the received beacon is set to the wireless LAN 1 The base station 30 is authenticated as the legitimate base station 30 and the communication with the base station 30 is permitted. The above is the configuration of the wireless LAN 1 according to the present embodiment.

[A-2. Operation of Embodiment] Next, the operation of the present embodiment will be described. <1. Download of Base Station Address Storage Table> A user who has subscribed to the packet communication service by the wireless LAN 1 must first download the base station address storage table 408b to the communication terminal 40. Therefore, for example, the user connects a communication cable to the wired communication interface 404 of the communication terminal 40 and accesses the service management center operated by the communication carrier of the wireless LAN 1 via the general public line network or the Internet. To do.

The service management center uses the base station address storage table 408 as part of the service to the user.
b is managed, and the base station address storage table 408b is transmitted to the communication terminal 40 in response to a download request from the communication terminal 40. The communication terminal 40 stores the base station address storage table 4 via the wired communication interface 404.
Upon receiving 08b, the base station address storage table 408b is stored in the non-volatile memory 408.

Note that, as described above, the base station address storage table 408b may be downloaded by wireless communication via the wireless LAN 1, and further, it is not a download but a communication terminal from the service management center. It may be in the form of being distributed to 40.
However, in either case, the base station address storage table 4
In order to prevent the 08b from being leaked to a third party due to eavesdropping or the like, data encryption or personal authentication is performed at the time of download or distribution.

<2. Beacon broadcast processing> The base station 30
A beacon including the SSID of its own station 30 and the MAC address 301a is broadcast at regular intervals. The process performed by the base station 30 to broadcast the beacon will be described. First, the CPU 307 of the base station 30 firstly determines the SSID stored in the SSID storage area 305a and the MAC address 301a stored in the wired communication interface 301. And are read and transferred to the wireless communication unit 306.

The wireless communication unit 306 determines the transferred SS.
The ID and the MAC address 301a are assigned to the wireless communication unit 3
The data is stored in a RAM (not shown) provided inside 06.
Next, the wireless communication unit 306 uses the SSI stored in the RAM.
The signal data of the beacon including the D and the MAC address 301a is generated, and when the predetermined period is reached, the beacon is broadcast in the basic service area 35 of the own station 30.

<3. Base station determination process> Next, communication terminal 4
The base station determination process executed by the CPU 409 at 0 will be described. FIG. 6 is a flowchart showing the operation of the base station determination process. The base station determination process is executed by the CPU 409 at regular intervals by a timer interrupt or the like.

As shown in the figure, first, the CPU 40
9 causes the wireless communication unit 401 to scan all channels capable of receiving the beacon broadcast by the base station 30 (step S101). Next, the CPU 409 determines whether there is a receivable beacon based on the result of scanning (step S102), and when there is no receivable beacon (step S102: No), determines that the communication terminal 40 is out of range. Then, after storing the data indicating that it is out of the service area in the service area ID storage area 408c (step S1
03), the base station determination process ends.

When the CPU 409 determines that there are at least one type of receivable beacon (step S102: Yes), it first causes the wireless communication unit 401 to receive one or more types of beacons. In this specification, beacons broadcast from different base stations 30 are defined as different types of beacons. That is, when there are multiple types of receivable beacons, for example, wireless L
A part of the basic service areas 35 of the base stations 30 adjacent to each other in the AN1 overlap, and the communication terminal 40 is located in the area where the basic service areas 35 overlap, or the base station 30 of the wireless LAN 1 The basic service area 35 and the basic service area of another wireless LAN base station overlap each other, and the communication terminal 40 is in the area where the basic service area overlaps.

Next, the CPU 409 controls the wireless communication unit 40.
It is determined whether or not a plurality of types of beacons have been received in step 1 (step S104), and if only one type of beacon has been received, the process proceeds to step S108. Also,
When determining that a plurality of types of beacons have been received, the CPU 409 then causes the wireless communication unit 401 to measure the radio wave reception intensity of each beacon of a different type (step S10).
5) Based on the measured values, the beacons are ranked in descending order of radio wave reception strength (step S106).

After that, the CPU 409 first selects the beacon having the highest rank, that is, the beacon having the strongest radio wave reception strength, from among the respective ranked beacons (step S107), and wirelessly decodes this beacon. The communication unit 401 is made to perform (step S108). Through this decoding process, the CPU 409 can obtain the SSID and the MAC address 301a of the base station 30 included in the beacon. When only one type of beacon is received, this one type of beacon is naturally decoded.

After that, the CPU 409 first determines that the SSID obtained by decoding the beacon is the SSID storage area 408a.
It is determined whether or not it matches the SSID stored in (step S109). As a result, when the SSID obtained by decoding the beacon does not match the SSID stored in the SSID storage area 408a, the CPU 409 determines that the base station 30 that is the broadcast source of this beacon is the wireless device to which the communication terminal 40 belongs. Base station 30 that is not the base station 30 of LAN1 or that belongs to the same group as the communication terminal 40
If not, the process returns to step S107.

Here, after returning to step S107, C
The PU 409 selects the beacon having the next highest rank from the beacons whose SSID has been collated last time, among the ranked beacons, and executes the processing shown in steps S108 and S109 again. When there are no selectable beacons, the CPU 409 determines that the communication terminal 40 is out of the service area, moves to step S103, and stores data indicating that it is out of service area in the service area ID storage area 408c. After that, the base station determination process ends.

On the other hand, the CPU 409 executes the above step S1.
09, the SSID obtained by decoding the beacon is S
When it is determined that the SSID stored in the SID storage area 408a matches, the base station 30 that is the broadcast source of this beacon determines that the wireless LAN 1 to which the communication terminal 40 belongs.
It is determined that the base station 30 is the base station 30 or the base station 30 belonging to the same group as the communication terminal 40, and the base station authentication process is executed (step S110).

<4. Base Station Authentication Process> Next, the base station authentication process executed by the CPU 409 of the communication terminal 40 as a subroutine of the base station determination process (see FIG. 6) will be described with reference to FIG. As shown in the figure, first, the CPU 409 executes step S10 of the base station determination process.
The MAC address 301a of the base station 30 decoded from the beacon in 8 is acquired (step S201).

Then, the CPU 409 acquires the acquired MAC
Address 301a, that is, M obtained by decoding the beacon
The AC address 301a is stored in the base station address storage table 4
08b (step S202). And CP
U409 is the MAC address 3 obtained by decoding the beacon
It is determined whether 01a matches any MAC address 301a in the base station address storage table 408b (step S203).

As a result, the CPU 409 determines that the MAC address 301a obtained by decoding the beacon is any MAC address 301 in the base station address storage table 408b.
If it is determined that a does not match a, this base station 3
For example, 0 is determined to be a false base station installed by a malicious third party, and the process returns to step S107 of the base station determination process described above. Then, the CPU 409 uses the previous S
The beacon having the next highest rank after the beacon whose SID has been verified is selected, and the processing from step S108 is executed.

That is, the communication terminal 40 avoids communication with the fake base station even when it is near the fake base station, and the legitimate base station 30 of the wireless LAN 1 to which the self terminal 40 belongs. , Or a legitimate base station 30 belonging to the same group as the own terminal 40 is searched. If a false base station is detected in step S203, the communication terminal 40 informs the user that a false base station has been detected, or a service management center operated by a wireless LAN 1 communication carrier. May be notified that a false base station has been detected.

On the other hand, the CPU 409 executes the above step S2.
In 03, when it is determined that the MAC address 301a obtained by decoding the beacon matches any MAC address 301a in the base station address storage table 408b, the base station 30 that is the broadcast source of this beacon is The authorized base station 3 of the wireless LAN 1 to which the terminal 40 belongs
0 or authenticates that the terminal 40 is a legitimate base station 30 that belongs to the same group as the terminal 40 (step S204),
Communication with this base station 30 is permitted (step S20).
5). Then, the CPU 409 determines the MA of the base station 30.
C address 301a is located area ID storage area 408c
Then, the base station authentication process is terminated.

The MAC address 301a stored in the existing area ID storage area 408c is the same as the base station determination processing (see FIG. 6) and base station when the communication terminal 40 moves to another basic service area 35. After the authentication process (see FIG. 7) is executed to complete the authentication of the base station 30 of the moving destination, the MAC address 301a of the base station 30 is rewritten.

Then, the CPU 409 of the communication terminal 40
For example, when a user gives an instruction to execute packet communication by an operation input, the base station 30 is relayed to start packet communication with another communication terminal 40 in the wireless LAN 1 or a communication device connected to the Internet. When doing
MA stored in the area ID storage area 408c
The base station 30 specified by the C address 301a is accessed, and packet communication is performed via the base station 30.
In addition, when the data indicating the out-of-service area is stored in the existing area ID storage area 408c when the packet communication is started, the CPU 409 determines that the communication terminal 40
Determines that is out of the service area and displays a message on the LCD screen indicating that packet communication cannot be performed because the service is out of service area.

As described above, according to this embodiment,
The communication terminal 40 decodes the SSID and the MAC address 301a of the base station 30 included in the received beacon, the SSID obtained by decoding the beacon matches the SSID stored in the SSID storage area 408a, and ,
The MAC address 301a obtained by decoding the beacon is one of the MACs in the base station address storage table 408b.
The base station 30 is authenticated by determining whether or not it matches the address 301a. In addition, the communication terminal 40
When the own terminal 40 is in an area where a plurality of basic service areas 35 overlap, the radio wave reception intensity of the beacon received from each base station 30 is measured, and the base station 30 is ordered in descending order of the radio wave reception intensity. Authenticate.

In this way, the SSID and the MAC address 30
The security function of the communication terminal 40 can be improved by providing the communication terminal 40 with the authentication function of the base station 30 using 1a.

[B. Modifications] The embodiments of the present invention have been described above, but the present invention can be implemented in various other modes without departing from the main features thereof. The above-described embodiment is merely an example of one aspect of the present invention, and the scope of the present invention is as shown in the claims, and the modifications and changes belonging to the equivalent range of the claims. Are all within the scope of the present invention. In addition, as a modification, the following may be considered, for example.

<Modification 1> In the above-described embodiment, the case where the base station 30 broadcasts a beacon at regular intervals has been described. However, base station 30 and communication terminal 40 may communicate according to the procedure shown in the sequence chart of FIG.

As shown in the figure, first, the communication terminal 4
When a packet communication request is generated at 0, the communication terminal 40
Broadcasts a probe packet including the terminal ID of its own terminal 40 from the wireless communication unit 401 (step S301).
The base station 30 that has received this probe packet
The probe response including the SSID of 0 and the MAC address 301a is transmitted from the wireless communication unit 306 to the communication terminal 40.
(Step S302). Upon receiving the probe response from the base station 30, the communication terminal 40 uses the probe response instead of the beacon to execute the processes from step S104 of the base station determination process (see FIG. 6).

The base station 30 and the communication terminal 40 are
Communication may be performed according to the procedure shown in the sequence chart of FIG. In this case, the SSID and the MAC address 301a of the base station 30 are set in step S
It is included in the probe response transmitted from the base station 30 in 403, and the communication terminal 40 uses this probe response to execute the processing from step S104 of the base station determination processing (see FIG. 6).

As described above, the SSI of the base station 30
The D and MAC address 301a may be included in a wireless signal other than the beacon, such as a probe response. Further, in the sequence chart shown in FIG. 9, the beacon may include the SSID of the base station 30 and the probe response may include the MAC address 301a of the base station 30.

<Modification 2> In the above-described embodiment,
When each base station 30 configuring the wireless LAN 1 is divided into a plurality of groups and the SSID is used as the identification information of the group, for example, the extended service area 36 of the wireless LAN 1 is set to the basic service area 35 as a minimum unit. For example, there are cases where the SSID is divided into regional areas and different SSIDs are assigned to the respective base stations 30 for each regional area. In this case, the base station address storage table 408b stored in the communication terminal 40 may store the MAC address 301a of each base station 30 only in the area where the communication terminal 40 is currently located. Good. In this way, the base station address storage table 408b
The amount of data can be reduced.

For example, when the communication terminal 40 is in the Kanto area, the base station address storage table 408b storing the MAC address 301a of each base station 30 only in the Kanto area is stored in the non-volatile memory 408. When the communication terminal 40 is in the Kansai area, the base station address storage table 408b storing the MAC address 301a of each base station 30 only in the Kansai area is stored in the non-volatile memory 408. However, in such a case, when the communication terminal 40 moves to a different regional area, it is necessary to acquire the base station address storage table 408b for the destination regional area. Note that the size of the regional area is not limited to the above example and is arbitrary.

<Modification 3> In the above-described embodiment, the communication terminal 40 communicates with the base station address storage table 40.
The case where 8b is acquired has been described. However,
The base station address storage table 408b is, for example, a floppy (registered trademark) disk (hereinafter abbreviated as FD).
It may be distributed to subscribers of the packet communication service by a recording medium such as the above and stored in the non-volatile memory 408 of the communication terminal 40. In this case, for example, FIG.
As shown in FIG.
1 is provided and is attached to the FD drive 421.
Base station address storage table 4 read from D50
08b is stored in the non-volatile memory 408.

The MAC address 301 of the base station 30
a is 6 bytes in total, and the storage capacity of the FD50 is 1.4M.
If it is a bite, it will be about 23 with one FD50.
The MAC address 301a of the base station 30 for all stations can be provided to the communication terminal 40. The recording medium for distributing the base station address storage table 408b is F
The recording medium is not limited to D, but may be any recording medium such as a CD-ROM, a DVD, or a memory card.

<Modification 4> In the above embodiment, the base station 3
When 0 is authenticated, the MAC of the base station 30 reaches 6 bytes in total.
The case of using the address 301a has been described. However, as shown in FIG.
The C address 301a is composed of a vendor ID of upper 3 bytes and a product ID of lower 3 bytes. Here, the vendor I of the MAC address 301a of each base station 30
D is a vendor ID assigned to the manufacturer of the base station 30, the wired communication interface 301 of the base station 30, or the Ethernet controller incorporated in the wired communication interface 301, or the wireless LAN 1
Limited to the vendor ID assigned to the telecommunications carrier that operates

Therefore, of the MAC address 301a of the base station 30, only the upper 3 bytes corresponding to the vendor ID may be used to authenticate the base station 30. Further, in the MAC address 301a of the base station 30, the upper 3 bytes corresponding to the vendor ID and the product ID
Base station 30 using part of the lower 3 bytes corresponding to
May be authenticated. In this way, if the base station 30 is authenticated by using only a part of the MAC address 301a, the base station address storage table 4
It is possible to reduce the data capacity of 08b and the data amount of the beacon broadcast from the base station 30.

<Fifth Modification> A subscriber wishing to subscribe to the packet communication service via the wireless LAN 1 is a mobile computer or P.
If the carrier has a DA in advance, the telecommunications carrier can provide the applicant with a wireless LAN card that provides a wireless communication function and a recording medium having a communication control program recorded therein. The present invention can be implemented using a mobile computer or PDA owned by the owner.

In this case, for example, as shown in FIG. 11, the card slot 42 provided in the communication terminal 42.
A wireless LAN card 60 that controls wireless communication performed with the base station 30 is attached to the mobile station 2. Further, the communication terminal 42 is provided with an FD drive 421, and the FD 50 installed in the FD drive 421 controls the base station determination process (see FIG. 6) and the base station authentication process (see FIG. 7) which is a subroutine thereof. The communication control program in which the procedure is described is read out and installed in the non-volatile memory 408. The recording medium for storing the communication control program is arbitrary, and the communication control program may be provided to the communication terminal 42 by wired communication or wireless communication.

Furthermore, a mobile computer or PDA
The present invention can also be realized by providing only a wireless LAN card to a subscriber who already owns. In such a case, the hardware configuration of the wireless LAN card provided to the subscriber by the communication carrier is shown in FIG.
Shown in.

As shown in the figure, the wireless LAN card 6
1 is a wireless communication unit 601, a non-volatile memory 602,
It has a CPU 603, a RAM 604, and an input / output interface 605, and these respective units are connected by a bus 606. Further, the non-volatile memory 602 includes a communication control program 602a and an SSID storage area 602.
b and a base station address storage table 408b.

The wireless communication section 601 controls wireless communication with the base station 30. The communication control program 602a stored in the non-volatile memory 602 has the above-described base station determination processing (see FIG. 6) and base station authentication processing (see FIG. 7).
This is a program in which the control procedure of (see) is described. In the SSID storage area 602b, the SSID that identifies the wireless LAN 1 permitted to communicate with the wireless LAN card 61, or the base stations 3 that make up the wireless LAN 1.
When 0 is divided into a plurality of groups, the SSID for identifying the group permitted to communicate with the wireless LAN card 61 is stored.

Further, the base station address storage table 40
8b is a MAC address 301a of each base station 30 constituting the wireless LAN 1 permitted to communicate with the wireless LAN card 61, or each base station 30 belonging to the same group as the wireless LAN card 61 in the wireless LAN 1. The MAC address 301a is stored. CP
The U 603 executes a process related to the authentication of the base station according to the communication control program 602 a, and determines the authentication result, that is, whether or not the communication with the base station 30 is possible, with the input / output interface 605.
To the communication terminal 42 via.

<Modification 6> In the above-described embodiment, a mobile computer or a PDA having a wireless communication function is exemplified as the communication terminal 40 for description. However, a wireless communication terminal to which the present invention is applicable is, for example, a mobile phone, a PHS (Personal Handyphone System: registered trademark) terminal, or a HomeRF (HoS) as a short-range wireless communication function.
It may be a portable electronic device, a car navigation device or the like having a me Radio Frequency) or Bluetooth (registered trademark). Further, it may be a stationary wireless communication terminal such as a stationary personal computer having a wireless communication function. A wireless communication network to which the present invention is applicable is, for example, PDC (Personal Digital Cellular).
It may be a network or a PHS network.

[0077]

As described above, according to the present invention, the security function of the wireless communication terminal can be improved by adding the base station authentication function to the wireless communication terminal.

[Brief description of drawings]

FIG. 1 is a block diagram illustrating a configuration of a wireless LAN according to an embodiment of the present invention.

FIG. 2 is a block diagram illustrating a hardware configuration of a base station according to the same embodiment.

FIG. 3 is a diagram illustrating a data configuration of a MAC address stored in a wired communication interface in the base station according to the same embodiment.

FIG. 4 is a block diagram illustrating a hardware configuration of the communication terminal according to the embodiment.

FIG. 5 is a diagram exemplifying a data configuration of a base station address storage table stored in a nonvolatile memory in the communication terminal according to the same embodiment.

FIG. 6 shows a CPU in the communication terminal according to the embodiment.
It is a figure which illustrates the flowchart of the base station determination process performed by.

FIG. 7 is a diagram illustrating a flowchart of a base station authentication process executed by the CPU as a subroutine of the base station determination process shown in FIG. 6 in the communication terminal according to the same embodiment.

FIG. 8 is a sequence chart illustrating an operation of a communication terminal and a base station according to the first modification of the present invention.

FIG. 9 is another sequence chart illustrating operations of the communication terminal and the base station according to the first modification.

FIG. 10 is a block diagram illustrating a hardware configuration of a communication terminal according to Modification 3 of the present invention.

FIG. 11 is a block diagram illustrating a hardware configuration of a communication terminal according to Modification 5 of the present invention.

FIG. 12 is a block diagram illustrating a hardware configuration of a wireless LAN card according to Modification 5 of the present invention.

[Explanation of symbols]

1 ... Wireless LAN, 10 ... Gateway server, 20
... control server, 30a, 30b ... base station,
35a, 35b ... Basic service area, 36 ... Extended service area, 40, 41, 42 ... Communication terminal, 50
...... FD, 60,61 ...... Wireless LAN card, 301 ・ ・ ・
... Wired communication interface, 301a ... MAC address, 302 ... Storage unit, 303 ... ROM, 304 ...
RAM, 305 ... Non-volatile memory, 305a ... SS
ID storage area, 306 ... Wireless communication section, 307 ... CP
U, 308 ... Bus, 401 ... Wireless communication section, 402 ...
... operation input unit, 403 ... liquid crystal display unit, 404 ... wired communication interface, 405 ... storage unit, 406 ... R
OM, 407 ... RAM, 408 ... nonvolatile memory,
408a ... SSID storage area, 408b ... base station address storage table, 408c ... located area ID storage area, 409 ... CPU, 410 ... bus, 421 ...
FD drive, 422 …… Card slot, 601 ……
Wireless communication unit, 602 ... Non-volatile memory, 602a ...
Communication control program, 602b ... SSID storage area,
603 ... CPU, 604 ... RAM, 605 ... Input / output interface, 606 ... Bus.

Claims (23)

[Claims] 1. Communication network identification information for identifying a wireless communication network to which the wireless communication terminal belongs, and one or more base stations forming the wireless communication network and permitted to perform wireless communication with the wireless communication terminal. A storage unit for storing base station identification information for identifying each of the above, and communication network identification information to which the base station belongs from the base station covering the wireless area in which the wireless communication terminal is located and the base station. Receiving the base station identification information, the communication network identification information received by the first receiving means matches the communication network identification information stored in the storage means, and Discriminating means for discriminating whether or not the base station identification information received by the first receiving means matches any one of the base station identification information stored in the storing means, and the base according to the discrimination result by the discriminating means. With the station A wireless communication terminal, comprising: a determining unit that determines whether communication is possible. 2. A base station in which the communication network identification information received by the first receiving means matches the communication network identification information stored in the storage means and is received by the first receiving means. The determination means permits communication with the base station when the determination means determines that the identification information matches any one of the base station identification information stored in the storage means. The wireless communication terminal according to claim 1. 3. When the wireless communication terminal is located in a place where the wireless areas of a plurality of base stations overlap each other, a measuring means for measuring a radio wave reception intensity of a wireless signal received from each of the plurality of base stations is provided. Further, the first receiving means receives the communication network identification information to which the base station belongs and the base station identification information of the base station from each of the plurality of base stations, the determining means, A communication network in which the communication network identification information received by the first receiving means is stored in the storage means in order from the base station that has transmitted the radio signal having the strongest radio wave reception intensity based on the measurement result by the measuring means. It is characterized by determining whether or not the base station identification information matches the identification information and the base station identification information received by the first receiving means matches any one of the base station identification information stored in the storage means. When Wireless communication terminal according to claim 1 that. 4. When the wireless communication terminal is located at a place where the wireless areas of a plurality of base stations overlap each other, a measuring means for measuring the radio wave reception intensity of a wireless signal received from each of the plurality of base stations is provided. Further, the first receiving means includes, based on the measurement result of the measuring means, communication network identification information to which the base station belongs in order from the base station that has transmitted the radio signal having the strongest radio wave reception intensity, and the The wireless communication terminal according to claim 1, wherein the wireless communication terminal receives base station identification information of a base station. 5. Communication network identification information for identifying a wireless communication network to which the wireless communication terminal belongs and one or more base stations forming the wireless communication network and permitted to perform wireless communication with the wireless communication terminal. Second receiving means for receiving the base station identification information of No. 1 by wire communication, and communication network identification information and one or more base station identification information received by the second receiving means are stored in the storage means. The wireless communication terminal according to claim 1, further comprising a control unit. 6. The first receiving means configures the wireless communication network and communication network identification information for identifying a wireless communication network to which the wireless communication terminal belongs from the base station, and the wireless communication terminal. Further receiving base station identification information of one or more base stations permitted to wirelessly communicate with, and storing the communication network identification information and the one or more base station identification information received by the first receiving means. The storage device further comprises a storage control unit for storing the storage unit in the storage unit.
The wireless communication terminal according to. 7. Communication network identification information for identifying a wireless communication network to which the wireless communication terminal belongs, from a recording medium detachable from the wireless communication terminal, and the wireless communication network, the wireless communication network being configured. Read-out means for reading out base station identification information of one or more base stations permitted to wirelessly communicate with the terminal; communication network identification information read out by the read-out means and one or more base station identification information are stored in the memory. The wireless communication terminal according to claim 1, further comprising a storage control unit that stores the storage unit in the unit. 8. The communication service area of the wireless communication network is divided into a plurality of area areas, and the storage means stores the communication network identification information of the wireless communication network to which the wireless communication terminal belongs, Base station identification information of one or more base stations that make up a wireless communication network and are allowed to wirelessly communicate with the wireless communication terminal in the area where the wireless communication terminal is located is stored. The wireless communication terminal according to claim 1, wherein: 9. The communication network identification information is information for identifying a group to which the wireless communication terminal or the base station belongs when each base station forming the wireless communication network is divided into a plurality of groups. Claim 1 characterized by the above.
The wireless communication terminal according to. 10. The wireless communication terminal according to claim 1, wherein the base station identification information is a MAC address of the base station. 11. The wireless communication terminal according to claim 1, wherein the base station identification information is upper 3 bytes of a MAC address of the base station. 12. A wireless communication module for providing a wireless communication function to an electronic device, wherein communication network identification information for identifying a wireless communication network permitted to wirelessly communicate with the wireless communication module and the wireless communication network are configured. A storage unit that stores base station identification information for identifying each of one or more base stations permitted to perform wireless communication with the wireless communication module, and a wireless device in which the electronic device equipped with the wireless communication module is located. Receiving means for receiving communication network identification information to which the base station belongs and base station identification information of the base station from a base station covering an area, and the communication network identification information received by the receiving means is stored in the memory. Any one of the base stations that matches the communication network identification information stored in the storage unit, and has the base station identification information received by the receiving unit stored in the storage unit. A discriminating means for discriminating whether or not it coincides with the identification information, and an output means for determining whether or not the communication with the base station is possible according to the discrimination result by the discriminating means, and outputting the determined communication or non-communication to the electronic device. A wireless communication module having. 13. When the electronic device is located at a place where wireless areas of a plurality of base stations overlap each other, a measuring means for measuring a radio wave reception intensity of a radio signal received from each of the plurality of base stations is further provided. And the receiving means receives from each of the plurality of base stations the communication network identification information to which the base station belongs and the base station identification information of the base station, and the determining means measures by the measuring means. On the basis of the result, the communication network identification information received by the receiving unit matches the communication network identification information stored in the storage unit in order from the base station that has transmitted the radio signal having the highest radio wave reception intensity, and 13. The method according to claim 12, wherein it is determined whether the base station identification information received by the receiving unit matches any one of the base station identification information stored in the storage unit. Wireless communication module. 14. The wireless communication module is detachable from the electronic device.
2. The wireless communication module according to item 2. 15. A computer provided in a wireless communication terminal, wherein a communication network identification information to which the base station belongs from a base station that covers a wireless area in which the wireless communication terminal is located and a base that identifies the base station. A receiving step of causing the wireless communication terminal to receive station identification information, the communication network identification information received by the receiving step matches the communication network identification information of the wireless communication network to which the wireless communication terminal belongs, and The base station identification information received by the receiving step is registered in advance in the wireless communication terminal, constitutes the wireless communication network, and is a base of one or more base stations permitted to wirelessly communicate with the wireless communication terminal. A determination step of determining whether or not it matches any of the station identification information, and communication of the wireless communication terminal with the base station according to the determination result of the determination step A program for executing a decision step for deciding whether or not. 16. A measurement step of measuring the radio wave reception intensity of a radio signal received from each of the plurality of base stations when the wireless communication terminal is located at a place where the wireless areas of the plurality of base stations overlap each other. Furthermore, in the receiving step, from the plurality of base stations, the wireless communication terminal receives the communication network identification information to which the base station belongs and the base station identification information of the base station, and in the determining step, A wireless communication network to which the wireless communication terminal belongs, in order from the base station that has transmitted the wireless signal having the strongest radio wave reception intensity, based on the measurement result of the measuring step. The communication station identification information, and the base station identification information received in the receiving step is registered in advance in the wireless communication terminal. Configure the communication network,
The program according to claim 15, wherein it is determined whether or not the wireless communication with the wireless communication terminal matches any one of the base station identification information of one or more base stations permitted. 17. A computer-readable recording medium in which the program according to claim 15 or 16 is recorded. 18. A wireless communication network having a wireless communication terminal and one or more base stations performing wireless communication with the wireless communication terminal, wherein each of the base stations is communication network identification information to which the base station belongs. And a transmitting means for transmitting base station identification information for identifying the base station, wherein the wireless communication terminal configures the wireless communication network with communication network identification information of a wireless communication network to which the wireless communication terminal belongs. From the storage means for storing the base station identification information of one or more base stations permitted to perform wireless communication with the wireless communication terminal, and the base station covering the wireless area in which the wireless communication terminal is located. Receiving means for receiving the communication network identification information of the base station and the base station identification information transmitted by the transmitting means; and a communication network identification in which the communication network identification information received by the receiving means is stored in the storage means. Discriminating means for discriminating whether or not the base station identification information received by the receiving means coincides with any other base station identification information stored in the storage means; A wireless communication network comprising: a determining unit that determines whether to communicate with the base station according to a determination result of the unit. 19. The transmission means of each of the base stations, within a wireless area covered by the base station, includes communication network identification information to which the base station belongs and base station identification information for identifying the base station. The broadcast according to claim 18
The wireless communication network described in. 20. The communication service area of the wireless communication network is divided into a plurality of regional areas, and the storage means of the wireless communication terminal has a communication network of the wireless communication network to which the wireless communication terminal belongs. Identification information and wireless communication with the wireless communication terminal in the regional area in which the wireless communication terminal is located that constitutes the wireless communication network are permitted 1
The radio communication network according to claim 18, wherein the base station identification information of the base station is stored. 21. The communication network identification information is information for identifying a group to which the wireless communication terminal or the base station belongs when each base station forming the wireless communication network is divided into a plurality of groups. Claim 1 characterized by the above.
8. The wireless communication network according to item 8. 22. The wireless communication network according to claim 18, wherein the base station identification information is a MAC address of the base station. 23. A transmission process in which a base station transmits communication network identification information for identifying a wireless communication network to which the base station belongs and base station identification information for identifying the base station; A receiving step of receiving communication network identification information and base station identification information of the base station transmitted in the transmitting step from a base station covering a wireless area in which the wireless communication terminal is located; , The communication network identification information received in the receiving process matches the communication network identification information of the wireless communication network to which the wireless communication terminal belongs, and the base station identification information received in the receiving process is Whether or not it matches any one of the base station identification information of the one or more base stations that are pre-registered in the wireless communication terminal and configure the wireless communication network, and the wireless communication with the wireless communication terminal is permitted. Overdetermine When the communication control method in which the wireless communication terminal, and having a decision process for determining whether communication with the base station in accordance with the discrimination result by said discrimination step.