JP2010263310A - Wireless communication apparatus, wireless communication monitoring system, wireless communication method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To monitor wireless communication where an access point which is unknown whether it is reliable. <P>SOLUTION: In a wireless LAN terminal 10, a trusted AP (access point) management unit 12 discriminates whether the connected access point is already registered as a trusted one; and if it is yet to be registered; a communication control unit 11 transmits connection destination information received from the access point to a server, receives rule information specifying an action and a monitoring method regarding to the connection with the access point; a rule information analysis unit 14 analyses the rule information; a rule applying unit 16 executes the action (connection interrupt by a communication control unit 11, alarm display control by a display control unit 17, communication log recording by a log management unit 18, registration at trusted access point by the trusted AP management unit 12) specified by the rule information, based on the analysis result; and if the action is the recording of the communication logs, it establishes a monitoring method specified by the rule information in a log management unit 18. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention provides a wireless communication apparatus that automatically connects to an access point to perform wireless communication by setting information on an access point to be used when performing wireless communication in advance, and performs wireless communication by the wireless communication apparatus. The present invention relates to a wireless communication monitoring system to be monitored, a wireless communication method and program in the wireless communication apparatus.

In most systems equipped with a wireless LAN (Local Area Network) device, information on a wireless LAN access point to be used (hereinafter simply referred to as “access point”) is registered in advance, so that it can be in a connectable area. An automatic connection function that automatically puts the system online is implemented. Here, the access point information includes, for example, an ESS-ID (Extended Service Set Identifier), an encryption method, and a password.
For access points with normal security settings, connection is not permitted unless the encryption method and password match, but the encryption method and password are not mandatory setting items. An access point that does not set these items can be installed. It is also possible to install an access point so as to permit connection only by receiving information even if the encryption method and password do not match.
Furthermore, some public wireless LAN services that are currently popular are in a DHCP (Dynamic Host Configuration Protocol) environment and access point information is shared among users. Since the same information is used for shared access points in different regions in this way, the user terminal is set up so that it can be easily connected to the access point using the automatic connection function described above. There are many things. For this reason, a malicious access point can easily be disguised as a normal public wireless LAN service access point.
When such a malicious access point exists, the system in which the automatic connection function is implemented is brought online. In other words, there is a risk of connecting to an unreliable network. In particular, when an attacker connects to an access point managed by an attacker, there is a possibility of various attacks such as wiretapping of communication data or guidance to an unauthorized site.

  Therefore, conventionally, even when a fake access point for the purpose of eavesdropping a packet is installed, there is a wireless LAN device that detects an unauthorized access point and avoids connection (for example, see Patent Document 1). In the technique of Patent Document 1, a storage device holds a connection history to a normal access point, and when there is a wireless LAN connection instruction, identification information of a beacon issued by a surrounding access point and a connection history in the storage device If there is an access point with the same identification information or an access point that is not in the connection history, further check the beacon signal strength and / or encryption status to avoid connection as an unauthorized access point. ing.

JP 2008-074022 A

As described above, there has been a technique for avoiding connection to an unauthorized access point.
However, the technique of Patent Document 1 merely avoids connection to an unauthorized access point, and does not record a log of communication with the unauthorized access point. Therefore, there is a problem that it is impossible to perform monitoring activities for the purpose of, for example, preservation of evidence regarding an access point whose reliability is unknown.

  An object of the present invention is to monitor wireless communication with an access point whose reliability is unknown.

  For this purpose, the present invention provides an automatic connection in a wireless communication apparatus having an automatic connection function for automatically connecting to an access point by setting in advance information on the access point used when performing wireless communication. Receiving means for receiving identification information for identifying a specific access point from a specific access point when the information indicating that the specific access point connected by the function is a reliable access point is not registered; Registration means for registering information indicating that the specific access point is a reliable access point when the reliability of the specific access point satisfies the first criterion based on the identification information received by the means; The reliability of the specific access point is determined based on the identification information received by the receiving means. If it is determined to satisfy the standards, to provide a radio communication apparatus having a recording means for recording a log of communication through the specific access point.

Here, the apparatus is a blocking unit that blocks a connection with a specific access point when it is determined that the reliability of the specific access point satisfies the third standard based on the identification information received by the receiving unit. It may be provided further.
A warning means for giving a warning when continuing the connection with the specific access point when it is determined that the reliability of the specific access point satisfies the fourth standard based on the identification information received by the receiving means; Further, it may be provided.

Further, in this apparatus, the receiving means may receive identification information including position information indicating a position where a specific access point is installed.
Furthermore, this apparatus uses the identification information received by the receiving means when the other access point that can communicate with other than the specific access point is registered as a reliable access point. Further comprising a transmission means for transmitting to the information processing apparatus via the information processing apparatus, wherein the determination that the reliability of the specific access point satisfies the first criterion or the second criterion is based on the identification information transmitted by the transmission means It may be made by an information processing device.

Furthermore, this apparatus may further include a transmission unit that transmits the log recorded by the recording unit to the information processing apparatus.
In that case, when information indicating that another access point that can communicate with other than the specific access point is a reliable access point is registered, the transmission unit displays the log recorded by the recording unit as another access point. It may be transmitted to the information processing apparatus via.

  In addition, the present invention provides a wireless communication apparatus having an automatic connection function for automatically connecting to an access point by setting information on an access point used when performing wireless communication in advance, and wireless communication by the wireless communication apparatus A wireless communication device that monitors a specific access point from a specific access point when information indicating that the specific access point connected by the automatic connection function is a reliable access point is not registered. The first receiving means for receiving the identification information for identifying the point, the first transmitting means for transmitting the identification information received by the first receiving means to the monitoring device, and the reliability of the specific access point is An access point that a specific access point can trust when a determination result indicating that the first criterion is satisfied is transmitted from the monitoring device And a log of communication through a specific access point when a determination result indicating that the reliability of the specific access point satisfies the second standard is transmitted from the monitoring device. Recording means for recording the information, and the monitoring device has a second receiving means for receiving the identification information transmitted by the first transmitting means and a specific information based on the identification information received by the second receiving means. Wireless communication monitoring comprising: determination means for determining whether the reliability of the access point satisfies the first standard or the second standard; and second transmission means for transmitting a determination result by the determination means to the wireless communication device A system is also provided.

  Furthermore, the present invention provides a wireless communication apparatus having an automatic connection function for automatically connecting to an access point by setting in advance information on the access point to be used when performing wireless communication. A step of receiving identification information for identifying a specific access point from a specific access point when information indicating that the specific access point is a trusted access point is not registered, and based on the received identification information If it is determined that the reliability of the specific access point satisfies the first criterion, the step of registering information that the specific access point is a reliable access point and the identification based on the received identification information If the access point reliability is determined to satisfy the second criterion, Wireless communication method comprising the step of recording a log of communication through the Seth points are also provided.

  Furthermore, the present invention connects to a wireless communication apparatus having an automatic connection function that automatically connects to an access point by setting in advance information on the access point to be used when performing wireless communication. If the information indicating that the specified access point is a trusted access point is not registered, the function for receiving the identification information for identifying the specific access point from the specific access point and the received identification information Based on the received identification information and the function of registering information that the specific access point is a reliable access point when it is determined that the reliability of the specific access point satisfies the first criterion When it is determined that the reliability of a specific access point satisfies the second criterion, the specific access point Program for realizing a function of recording the communication log via the door is also provided.

  According to the present invention, it is possible to monitor wireless communication with an access point whose reliability is unknown.

1 is an overall configuration diagram of a computer system to which this exemplary embodiment is applied. It is the block diagram which showed the function structural example of the wireless LAN terminal in this Embodiment. It is the figure which showed the example of the trusted access point information memorize | stored in this Embodiment. It is the block diagram which showed the function structural example of the server in this Embodiment. It is the figure which showed the example of the action definition referred in this Embodiment. 5 is a flowchart illustrating an operation example of a wireless LAN terminal according to the present embodiment. It is the flowchart which showed the operation example of the server in this Embodiment. It is a hardware block diagram of the computer to which this Embodiment is applied.

Embodiments of the present invention will be described below in detail with reference to the accompanying drawings.
First, a computer system to which this embodiment is applied will be described.
FIG. 1 is a diagram showing an example of the overall configuration of such a computer system.
As shown in the figure, this computer system includes a wireless LAN terminal 10, a server 20, and access points 75a and 75b. The access points 75a and 75b are connected to the mobile communication networks 70a and 70b, respectively. The mobile communication networks 70a and 70b are connected to the server 20 via the Internet 80.

  The wireless LAN terminal 10 is a terminal device used by a user, and has a wireless LAN interface compliant with IEEE802.11a / b / g / n or the like in order to transmit and receive data via the access points 75a and 75b. For example, it is realized by a notebook personal computer, PDA (Personal Digital Assistants), or other computer devices. In the figure, only one wireless LAN terminal 10 is shown, but two or more wireless LAN terminals 10 may be included. In the present embodiment, a wireless LAN terminal 10 is provided as an example of a wireless communication device.

  The server 20 manages policy information indicating whether to connect the wireless LAN terminal 10 to the access points 75a and 75b according to the setting of the administrator, and is based on the information sent from the wireless LAN terminal 10 and the policy information. Thus, a rule to be applied to the wireless LAN terminal 10 is determined. At this time, the wireless LAN terminal 10 is configured such that the setting cannot be changed, and the server 20 is configured so that the administrator forcibly applies the rules. In addition, when the rule to be applied to the wireless LAN terminal 10 is determined to record a log, the log is transferred from the wireless LAN terminal 10 and the log is analyzed (monitored). For example, it is realized by a personal computer, a workstation, or other computer devices. In the present embodiment, a server 20 is provided as an example of an information processing device or a monitoring device.

The access points 75a and 75b are wireless LAN devices that enable connection from the wireless LAN terminal 10 to the Internet 80, and have the same wireless interface as the wireless LAN interface that the wireless LAN terminal 10 has. Although the access points 75a and 75b are shown in the drawing, they may be referred to as access points 75 when it is not necessary to distinguish them. Although only two access points 75 are shown in the figure, three or more access points 75 may be provided.
The mobile communication networks 70 a and 70 b are communication networks for connecting the wireless LAN terminal 10 to the Internet 80. Although the mobile communication networks 70a and 70b are shown in the figure, they may be referred to as the mobile communication network 70 when it is not necessary to distinguish them. In the figure, only two mobile communication networks 70 are shown, but three or more mobile communication networks 70 may be provided.
The Internet 80 is a worldwide computer network (The Internet) constructed using TCP / IP.

By the way, when setting to automatically connect to the access point by registering the ESS-ID name of the reliable access point in the wireless LAN terminal 10, it connects to the unreliable access point having the same ESS-ID name without permission. May end up.
For example, it is assumed that the mobile communication network 70a is an unreliable communication network, the mobile communication network 70b is a reliable communication network, and the ESS-ID names of the access points 75a and 75b are both “AP”. Further, it is assumed that the ESS-ID name “AP” is registered in the wireless LAN terminal 10 so as to automatically connect to the access point 75b within an area where the Wi-Fi radio wave of the mobile communication network 70b reaches. . In such a situation, it is assumed that the wireless LAN terminal 10 enters an area where the Wi-Fi radio wave reaches the mobile communication network 70a. Here, if the access point 75a is configured to permit all connection requests regardless of the success / failure of password authentication, the wireless LAN terminal 10 automatically connects to the access point 75a. If the mobile communication network 70a is an unauthorized network, an attack (such as malware infection activity or wiretapping) is performed on the wireless LAN terminal 10 after the connection is completed.

Therefore, in the present embodiment, the wireless LAN terminal 10 and the server 20 cooperate to monitor communication with the unreliable access point 75.
First, the functional configuration of the wireless LAN terminal 10 will be described.
FIG. 2 is a block diagram illustrating a functional configuration example of the wireless LAN terminal 10.
As illustrated, the wireless LAN terminal 10 includes a communication control unit 11, a trusted access point management unit (hereinafter referred to as "trusted AP management unit") 12, and a trusted access point information storage unit (hereinafter referred to as "trusted AP management unit"). 13 ”). Further, it includes a rule information analysis unit 14, a rule information generation unit 15, a rule application unit 16, a display control unit 17, and a log management unit 18.

  The communication control unit 11 controls communication between the wireless LAN terminal 10 and the access point 75. That is, reception of information related to the access point 75 (hereinafter referred to as “connection destination information”) from the access point 75, transmission of information related to the wireless LAN terminal 10 (hereinafter referred to as “terminal information”) and connection destination information to the server 20. The reception of the rule information generated based on the terminal information and the connection destination information from the server 20 is controlled. The connection destination information will be described later. The terminal information is information for identifying the wireless LAN terminal 10, and for example, a MAC address can be used. In this embodiment, connection destination information is used as an example of identification information for identifying a specific access point, and the communication control unit 11 is used as an example of a receiving unit that receives the identification information or an example of a first receiving unit. Is provided. The communication control unit 11 is provided as an example of a transmission unit that transmits identification information or a log to the information processing device, and further as an example of a transmission unit or a first transmission unit that transmits identification information to the monitoring device. . Furthermore, a communication control unit 11 is provided as an example of a blocking unit that blocks connection with a specific access point.

The trusted AP management unit 12 determines whether or not the access point 75 is trusted based on information stored in the trusted AP information storage unit 13 or when it is found that the new access point 75 can be trusted In addition, information indicating that the access point 75 is trusted is stored in the trusted AP information storage unit 13. In this embodiment, the trusted AP management unit 12 is provided as an example of a registration unit that registers information indicating that the access point is reliable.
The trusted AP information storage unit 13 stores information related to the trusted access point 75 (trusted access point information).

The rule information analysis unit 14 analyzes the rule information received from the server 20 or the rule information generated by the wireless LAN terminal 10 and determines an action and a monitoring method.
The rule information generation unit 15 generates rule information based on information held on the wireless LAN terminal 10 side in an environment in which rule information cannot be generated by transmitting terminal information and connection destination information to the server 20 To do.
The rule application unit 16 executes the action determined by the rule information analysis unit 14 or sets the monitoring method determined by the rule information analysis unit 14.
The display control unit 17 controls the display mechanism so as to display a warning when the rule application unit 16 performs an action to execute a warning. In the present embodiment, the display control unit 17 is provided as an example of warning means for giving a warning.
The log management unit 18 collects and records a communication log (traffic log) from the communication control unit 11 when the rule application unit 16 executes logging as an action. In this embodiment, a log management unit 18 is provided as an example of a recording unit that records a communication log.

Here, the trusted access point information stored in the trusted AP information storage unit 13 will be described.
FIG. 3 is a diagram showing a specific example of trusted access point information.
As shown in the figure, the trusted access point information is associated with ESS-ID (Extended Service Set Identifier), communication method, encryption method, MAC address, and logical address information.

Among these, the ESS-ID is an identifier of a network in the IEEE802.11 series wireless LAN.
The communication system indicates a standard name in the IEEE 802.11 series, and IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.11n, and the like are set.
The encryption method indicates the standard name of the encryption method in the wireless LAN, and includes “WEP (Wired Equivalent Privacy)”, “WPA (Wi-Fi Protected Access)”, “WPA2 (Wi-Fi Protected Access 2)”, “None” or the like is set.
The logical address information includes an IP address assigned to the access point 75 in a DHCP (Dynamic Host Configuration Protocol) environment, a network address that is a part of the IP address, and an IP address of a gateway that connects the mobile communication network 70 and the Internet 80. Address, the IP address of the DNS server used for address resolution in the mobile communication network 70, and the like.

  Of the trusted access point information, information other than the ESS-ID may be hashed and stored. That is, the trusted access point information may be held as a combination of an ESS-ID and a hash value.

Next, the functional configuration of the server 20 will be described.
FIG. 4 is a block diagram illustrating a functional configuration example of the server 20.
As illustrated, the server 20 includes a reception unit 21, a rule information generation unit 22, an action definition storage unit 23, and a transmission unit 24.

The receiving unit 21 receives terminal information and connection destination information from the wireless LAN terminal 10. In the present embodiment, a receiving unit 21 is provided as an example of a second receiving unit that receives identification information.
The rule information generation unit 22 generates information (rule information) regarding rules to be applied regarding communication between the wireless LAN terminal 10 and the access point 75. The rule information can be created in units of groups of wireless LAN terminals 10 (hereinafter referred to as “terminal groups”). The rule information specifies an action to be executed by the wireless LAN terminal 10. Here, any one of blocking, warning, logging, and permission is set in the action. Furthermore, when logging is designated as an action, the rule information also designates a communication monitoring method in the wireless LAN terminal 10. In the present embodiment, the rule information generation unit 22 is provided as an example of a determination unit that determines whether the reliability of a specific access point satisfies the first criterion or the second criterion.
The action definition storage unit 23 stores an action definition that is referred to when the rule information generation unit 22 determines an action specified by the rule information.
The transmission unit 24 transmits the rule information generated by the rule information generation unit 22 to the wireless LAN terminal 10. In the present embodiment, the transmission unit 24 is provided as an example of a second transmission unit that transmits the determination result.

Here, the action definition memorize | stored in the action definition memory | storage part 23 is demonstrated.
FIG. 5 is a diagram showing a specific example of action definition.
As shown in the figure, the action definition defines an action to be executed by the wireless LAN terminal 10 for a combination of a terminal group and an environment level.
Here, the terminal group is a group of wireless LAN terminals 10. In the figure, “A”, “B”, and “C” are shown as terminal groups, but what kind of terminal group is provided, how many terminal groups are provided, etc. are managed by the server 20. The person can set it freely.
The environment level is an index indicating how reliable the mobile communication network 70 is. “High” indicates the most reliable environment, and “Low” indicates the least reliable environment.

Next, the operation of the present embodiment will be described.
As described above, the present embodiment is executed by the wireless LAN terminal 10 and the server 20.
First, the operation of the wireless LAN terminal 10 will be described. Prior to this operation, the wireless LAN terminal 10 is installed with an agent that monitors the IP address for detecting the switching of the connection environment and transfers the data of the connection destination environment and the trusted environment to the server 20. Shall be kept.

FIG. 6 is a flowchart showing an operation example of the wireless LAN terminal 10.
In the wireless LAN terminal 10, first, the communication control unit 11 connects to the access point 75a and starts communication (step 101). At this time, the communication control unit 11 acquires the ESS-ID, the communication method, the encryption method, and the MAC address of the access point 75a and passes them to the trusted AP management unit 12.
Next, whether or not the trusted AP management unit 12 determines that the access point 75a is reliable (trusted) using the ESS-ID, communication method, encryption method, and MAC address passed in step 101. It is determined whether or not (step 102). Specifically, it is checked whether or not the combination of the ESS-ID, the communication method, the encryption method, and the MAC address passed in step 101 is included in the trusted access point information shown in FIG.

As a result, when it is determined that the access point 75a is not trusted, the communication control unit 11 acquires the logical address information described in FIG. 3 in order to determine whether the access point 75a is reliable (step 103). Note that this logical address information can be acquired using existing technology.
On the other hand, even if it is determined that the access point 75a is trusted, it may not actually be trusted. For example, the MAC address is forged and it matches the MAC address of the trusted access point 75. In step 102, only the ESS-ID, the communication method, the encryption method, and the MAC address are checked. In such a case, the trusted AP management unit 12 determines that it is trusted even though it is not trusted. End up. Therefore, in order to more strictly determine whether or not it is trusted, the communication control unit 11 acquires logical address information and transfers it to the trusted AP management unit 12 (step 104). Then, the trusted AP management unit 12 determines whether or not the access point 75a is trusted using this logical address information (step 105). Specifically, it is checked whether or not the logical address information passed in step 104 is included in the trusted access point information shown in FIG.

If “No” is determined in step 102 or “No” is determined in step 105, it is not known whether the access point 75 a is new and reliable. Accordingly, processing for analyzing whether or not the access point 75a is reliable is performed using the connection destination information acquired in step 101 and step 103 or step 101 and step 104.
However, the processing here differs depending on whether or not there is a trusted access point 75 b near the wireless LAN terminal 10. Therefore, first, the communication control unit 11 determines whether there is a trusted access point 75b nearby (step 106).

  As a result, if there is a trusted access point 75b nearby, it is determined by inquiring the server 20 whether the access point 75a is reliable. That is, first, the communication control unit 11 transmits terminal information stored in a memory (not shown) and connection destination information received by itself to the server 20 via the trusted access point 75b and the mobile communication network 70b. Then, a response waiting state is set (step 107). Thereafter, as will be described later with reference to FIG. 7, the server 20 generates rule information indicating rules to be applied to the wireless LAN terminal 10 and transmits the rule information to the wireless LAN terminal 10. The communication control unit 11 receives this rule information (step 108).

  On the other hand, if there is no trusted access point 75b nearby, information cannot be transmitted to the server 20 safely, so whether or not the access point 75a can be trusted is determined locally without inquiring the server 20. . That is, the rule information generation unit 15 performs the same processing as the rule information generation unit 22 in the server 20 to generate rule information that specifies an action and a monitoring method (step 109). However, since the wireless LAN terminal 10 cannot store as much data as the server 20 and the data in the wireless LAN terminal 10 and the data in the server 20 cannot always be synchronized, the rule information in the rule information generation unit 15 Compared with the generation of rule information in the rule information generation unit 22 in the server 20, the generation of is a simple process.

After that, the rule information analysis unit 14 analyzes the rule information received in step 108 or the rule information generated in step 109, specifies an action and a monitoring method, and passes them to the rule application unit 16 (step 110). ).
Here, actions include blocking, warning, logging, and permission. Therefore, the rule application unit 16 determines whether or not the action is permitted (step 111).

  As a result, if the action is not permitted, that is, if the action is any one of blocking, warning, and logging, the rule applying unit 16 performs a corresponding process (step 112). Specifically, if the action is blocking, the rule application unit 16 instructs the communication control unit 11 to block the connection with the access point 75a, and the communication control unit 11 connects accordingly. Shut off. If the action is a warning, the rule application unit 16 instructs the display control unit 17 to control the display of the warning, and the display control unit 17 controls the display of the warning accordingly. On the other hand, when an instruction to block / continue connection is input, processing corresponding to the instruction is performed. Further, if the action is logging, the rule application unit 16 instructs the log management unit 18 to record a communication log, and the log management unit 18 records the communication log accordingly.

  Next, when the communication log is recorded in step 112, the rule application unit 16 sets the monitoring method specified in step 110 to the log management unit 18 (step 113). Here, the monitoring method includes a log transfer method, a log analysis method, a log monitoring method, and the like. In the following, the log transfer method will be described as an example. As the log transfer method, one of “transfer log in real time”, “transfer log when connected to trusted environment”, “transfer log when connected to specific environment”, etc. is set. For example, if “transfer log in real time” is set, the log management unit 18 transfers the communication log to the server 20 in real time via the trusted access point 75b and the mobile communication network 70b. However, if communication is not possible via the trusted access point 75b, the communication log is not transferred. If “transfer log when connected to trusted environment” is set, the log management unit 18 transfers the communication log to the server 20 when communication is enabled via the trusted access point 75b. If “transfer log when connected to specific environment” is set, the log management unit 18 transfers the communication log to the server 20 when communication is enabled via the specific access point 75. When the communication log is transferred in this way, the server 20 starts analyzing the communication log, detects unauthorized access, or generates information for confirming the usage status.

  On the other hand, if the action is permitted in step 111, the communication control unit 11 passes the received connection destination information to the trusted AP management unit 12, and the trusted AP management unit 12 trusts the received connection destination information. It is stored in the completed AP information storage unit 13 (step 114).

  By the way, in the case of “Yes” in Step 105 described above, there is a very high possibility that the access point 75a is trusted. Therefore, in this case, the connection state is maintained, and blocking, warning, and logging are not performed. However, if the log transfer method “transfer log when connected to trusted environment” is specified in the rule information received from the server 20 first, the wireless LAN terminal 10 sends the accumulated communication log to the server 20 at this time. Will be transferred. The flowchart shows the processing at this time. That is, the log management unit 18 transfers the communication log collected in the previous communication to the communication control unit 11, and the communication control unit 11 transfers the communication log to the server 20 via the access point 75a and the mobile communication network 70a. (Step 115).

Next, the operation of the server 20 will be described.
FIG. 7 is a flowchart illustrating an operation example of the server 20.
In the server 20, first, the receiving unit 21 receives terminal information and connection destination information from the wireless LAN terminal 10, and passes them to the rule information generating unit 22 (step 201).

Then, the rule information generation part 22 specifies a terminal group based on the terminal information passed at step 201 (step 202). For example, if the correspondence between the identification information of the wireless LAN terminal 10 and the identification information of the terminal group to which the wireless LAN terminal 10 belongs is registered, the terminal group corresponding to the identification information passed as the terminal information is specified.
Further, the rule information generation unit 22 determines the environment level based on the connection destination information passed in Step 201 (Step 203). For example, an administrator registers connection destination information of a reliable access point in advance, and depending on how much the connection destination information passed and the connection destination information registered by the administrator match, Determine the environmental level.

Further, the rule information generation unit 22 determines an action to be performed by the wireless LAN terminal 10 based on the combination of the terminal group specified in step 202 and the environment level determined in step 203 (step 204). Specifically, the action definition storage unit 23 is referred to, and the action defined in the cell corresponding to the terminal group specified in step 202 and corresponding to the environment level determined in step 203 is extracted.
In addition, the rule information generation unit 22 extracts a monitoring method associated with the action determined in step 204 (step 205). Here, in the monitoring method, when the action is “logging”, the administrator sets what kind of monitoring is performed using the collected log. Monitoring methods include log transfer method, log analysis method, log monitoring method, etc. Among these, log transfer methods are “transfer log in real time”, “transfer log when connected to trusted environment”, “ “Transfer log when connected to specific environment” is prepared.
Thereafter, the rule information generation unit 22 generates rule information indicating the action determined in step 204 and the monitoring method extracted in step 205, and passes the rule information to the transmission unit 24 (step 206).

Then, the transmission unit 24 transmits the passed rule information to the wireless LAN terminal 10 (step 207).
Thus, the operation of the present embodiment ends.

By the way, in this embodiment, if there is a reliable access point 75 nearby, the server 20 is inquired to determine whether the new access point 75 is reliable. However, the wireless LAN terminal 10 may make the same determination from the beginning regardless of whether or not the reliable access point 75 is nearby. That is, in FIG. 6, the determination in step 106 may not be performed and the process may proceed unconditionally to step 109.
In this embodiment, the connection destination information is exemplified by ESS-ID, communication method, encryption method, access point IP address, network address, gateway IP address, DNS server IP address. Is just an example. For example, position information indicating the physical position of the place where the access point 75 is installed may be included in the connection destination information. However, when the types of information to be held are increased in this way, the security is improved, but the convenience is reduced. Therefore, it is desirable that the type of information to be held can be selected according to the application.

As described above, in this embodiment, when it is determined that an access point 75 that is unknown whether it is reliable or not can be trusted, a log of communication with the access point 75 is recorded. This makes it possible to monitor wireless communication with an access point whose reliability is unknown.
In addition, data used in the wireless LAN terminal 10 (the state of the access point 75 and its environment level) is collected in the server 20. As a result, a plurality of wireless LAN terminals 10 can share the data.

  Finally, the hardware configuration of the wireless LAN terminal 10 and the server 20 in the present embodiment will be described. FIG. 8 is a diagram showing an example of the hardware configuration of such a computer. As shown in the figure, the computer includes a CPU (Central Processing Unit) 90a which is a calculation means, a main memory 90c connected to the CPU 90a via an M / B (motherboard) chip set 90b, and an M / B chip set 90b. And a display mechanism 90d connected to the CPU 90a. Further, a network interface 90f, a magnetic disk device (HDD) 90g, an audio mechanism 90h, a keyboard / mouse 90i, and a flexible disk drive 90j are connected to the M / B chip set 90b via a bridge circuit 90e. Has been.

  In FIG. 8, each component is connected via a bus. For example, the CPU 90a and the M / B chip set 90b, and the M / B chip set 90b and the main memory 90c are connected via a CPU bus. Further, the M / B chipset 90b and the display mechanism 90d may be connected via an AGP (Accelerated Graphics Port), but if the display mechanism 90d includes a PCI Express compatible video card, the M / B The chip set 90b and this video card are connected via a PCI Express (PCIe) bus. When connecting to the bridge circuit 90e, for example, PCI Express can be used for the network interface 90f. For the magnetic disk device 90g, for example, serial ATA (AT Attachment), parallel transfer ATA, or PCI (Peripheral Components Interconnect) can be used. Furthermore, USB (Universal Serial Bus) can be used for the keyboard / mouse 90i and the flexible disk drive 90j.

DESCRIPTION OF SYMBOLS 10 ... Wireless LAN terminal, 11 ... Communication control part, 12 ... Trusted AP management part, 13 ... Trusted AP information storage part, 14 ... Rule information analysis part, 15 ... Rule information generation part, 16 ... Rule application part, 17 ... Display control unit, 18 ... Log management unit, 20 ... Server, 21 ... Reception unit, 22 ... Rule information generation unit, 23 ... Action definition storage unit, 24 ... Transmission unit

Claims (8)

In a wireless communication apparatus having an automatic connection function for automatically connecting to an access point by setting in advance information on the access point used when performing wireless communication,
When information indicating that the specific access point connected by the automatic connection function is a reliable access point is not registered, identification information for identifying the specific access point is received from the specific access point Receiving means;
When it is determined that the reliability of the specific access point satisfies the first criterion based on the identification information received by the receiving unit, information indicating that the specific access point is a reliable access point Registration means to register;
Recording means for recording a log of communication through the specific access point when it is determined that the reliability of the specific access point satisfies the second standard based on the identification information received by the receiving means And a wireless communication apparatus.   The wireless communication apparatus according to claim 1, wherein the receiving unit receives the identification information including position information indicating a position where the specific access point is installed. When information indicating that another access point that can communicate with other than the specific access point is a trusted access point is registered, the identification information received by the receiving unit is transmitted via the other access point. A transmission means for transmitting to the information processing apparatus;
The determination that the reliability of the specific access point satisfies the first criterion or the second criterion is made by the information processing device based on the identification information transmitted by the transmitting unit. The wireless communication apparatus according to claim 1, wherein:   The wireless communication apparatus according to claim 1, further comprising a transmission unit configured to transmit the log recorded by the recording unit to an information processing apparatus.   The transmission means stores the log recorded by the recording means when the information indicating that another access point capable of communication other than the specific access point is a reliable access point is registered. The wireless communication apparatus according to claim 4, wherein the wireless communication apparatus transmits the information to the information processing apparatus via an access point. A wireless communication device having an automatic connection function for automatically connecting to the access point by setting in advance information of the access point used when performing wireless communication;
A monitoring device for monitoring wireless communication by the wireless communication device,
The wireless communication device
When information indicating that the specific access point connected by the automatic connection function is a reliable access point is not registered, identification information for identifying the specific access point is received from the specific access point First receiving means;
First transmission means for transmitting the identification information received by the first reception means to the monitoring device;
Registration means for registering information that the specific access point is a reliable access point when a determination result that the reliability of the specific access point satisfies the first standard is transmitted from the monitoring device When,
A recording unit that records a log of communication through the specific access point when a determination result that the reliability of the specific access point satisfies a second criterion is transmitted from the monitoring device;
The monitoring device
Second receiving means for receiving the identification information transmitted by the first transmitting means;
Determination means for determining whether reliability of the specific access point satisfies the first criterion or the second criterion based on the identification information received by the second receiving unit;
A wireless communication monitoring system comprising: a second transmission unit configured to transmit a determination result by the determination unit to the wireless communication device. In a wireless communication apparatus having an automatic connection function for automatically connecting to an access point by setting in advance information on the access point used when performing wireless communication,
When information indicating that the specific access point connected by the automatic connection function is a reliable access point is not registered, identification information for identifying the specific access point is received from the specific access point Steps,
Registering information indicating that the specific access point is a reliable access point when it is determined that the reliability of the specific access point satisfies the first criterion based on the received identification information; ,
Recording a log of communication through the specific access point when it is determined that the reliability of the specific access point satisfies the second standard based on the received identification information. A wireless communication method. A wireless communication device having an automatic connection function for automatically connecting to an access point by setting in advance information of the access point used when performing wireless communication.
When information indicating that the specific access point connected by the automatic connection function is a reliable access point is not registered, identification information for identifying the specific access point is received from the specific access point Function and
A function of registering information indicating that the specific access point is a reliable access point when it is determined that the reliability of the specific access point satisfies the first criterion based on the received identification information; ,
To realize a function of recording a log of communication through a specific access point when it is determined that the reliability of the specific access point satisfies the second standard based on the received identification information Program.

Images