Abstract:
The present invention provides a LAN device  20  having an internal function of controlling communication. A management representative of the LAN device  20  sets a protocol applicable for communication with regard to each of MAC addresses or IP addresses allocated to transmitter terminals and each of IP addresses allocated to receiver terminals. The LAN device transmits data in the case of the protocol applicable for communication, while not transmitting data in the case of any protocol inapplicable for communication.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is a continuation of U.S. patent application Ser. No. 10/232,945 filed Aug. 30, 2002 in the name of Takashi Ishidoshiro and entitled “WIRELESS LAN DEVICE,” which is incorporated herein by reference in its entirety and for all purposes. 
     
    
     BACKGROUND OF THE INVENTION 
       [0002]    1. Field of the Invention 
         [0003]    The present invention relates to a LAN device with which multiple clients are connected. 
         [0004]    2. Description of the Related Art 
         [0005]    In a network service based on the always-on connection as in the case of the Internet, a local area network (LAN) like an intranet is constructed in each facility, such as a company or a university campus. The LAN provides the environment of always-on connection with a wide area network (WAN) like the Internet via a router or a gateway. In such a LAN system, clients (computers or their users) that access the LAN can be specified. A LAN access service has been proposed recently to give permission of access to a LAN to unspecified clients. A LAN is constructed, for example, in a shop, and the users of the shop freely access the LAN to gain access to the external Internet. With recent advancement of wireless LAN, such a service is acceptable without connection of the computer to the network via cable. 
         [0006]    A small-scaled LAN access service is readily constructed by utilizing a router for wireless LAN. A wireless LAN device is typically capable of connecting with several to ten-odd clients, and may further connect with several computers via cable. In one practical application, the wireless LAN device is installed in a small shop, such as a coffee shop or a beauty shop. A computer connected to the wireless LAN device via cable is used as a management server for controlling the LAN, and wireless access is permitted to the users of the shop. 
         [0007]    Ensured security is an important issue in such LAN access service. In the general intranet, clients that access the intranet are relatively fixed, and a representative manager identifies users of the intranet. Each device that accesses the LAN is identified with an MAC address uniquely allocated to the device. It is accordingly easy to set permission and prohibition to each specific service. In the LAN access service, on the other hand, clients that access the LAN are unspecified, and management with MAC addresses is impractical. Non-limitation of access, however, enables each client to access data even in the management server, which may cause troubles. 
         [0008]    One possible measure to this problem locates the management server in a different network from the LAN for the LAN access service. Another possible measure provides a VLAN switch or a firewall at a point of connection of the management server with the LAN. These measures, however, require additional equipment and are against the recent trend of providing the easy, small-scaled LAN access service. 
       SUMMARY OF THE INVENTION 
       [0009]    The object of the present invention is thus to solve the drawbacks discussed above and to provide a LAN device that fulfills two requirements, that is, easy access to the LAN device and ensured security. 
         [0010]    In order to attain at least part of the above and the other related objects, the present invention is directed to a LAN device that connects with multiple clients to construct a LAN. The LAN device includes: a communication reception module that receives a requirement of communication transmitted from each of the multiple clients to another client in the LAN or to another network; a registration module that registers a specified client among the multiple clients of the LAN; a decision module that determines whether or not the requirement of communication requests communication to the specified client; and a restriction module that, when the decision module determines that the requirement of communication requests communication to the specified client, restricts a protocol of the communication so as to limit the communication. 
         [0011]    The arrangement of the invention ensures restriction of access from a terminal belonging to the LAN to a predetermined terminal. Changing the specification of the restriction of the protocol according to the terminal that transmits the requirement of communication attains diverse restrictions of access. Changing the specification of the restriction of the protocol according to the terminal that is the target of the requirement of communication also attains diverse restrictions of access. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0012]      FIG. 1  illustrates a LAN access system  22 ; 
           [0013]      FIG. 2  shows the internal structure of a management server  30 ; 
           [0014]      FIG. 3  shows the internal structure of a LAN device  20 ; 
           [0015]      FIG. 4  shows contents of a trader database  75 ; 
           [0016]      FIG. 5  shows contents of a transmission database  85  in a first embodiment; 
           [0017]      FIG. 6  is a flowchart showing a series of processing executed by the LAN device  20  in the first embodiment; 
           [0018]      FIG. 7  shows contents of the transmission database  85  in a second embodiment; 
           [0019]      FIG. 8  is a flowchart showing a series of processing executed by the LAN device  20  in the second embodiment; 
           [0020]      FIG. 9  shows contents of the transmission database  85  in a third embodiment; and 
           [0021]      FIG. 10  is a flowchart showing a series of processing executed by the LAN device  20  in the third embodiment. 
       
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     First Embodiment  
       [0022]    (1) Construction 
         [0023]    One mode of carrying out the present invention is described below with reference to the drawings.  FIG. 1  schematically illustrates the general construction of a system for providing LAN access service (hereafter referred to as LAN access system  22 ). The LAN access service provides an environment of attaining connection between a LAN constructed by a LAN device  20  with a WAN  50 . The LAN access system  22  includes the LAN device  20 , a management server  30 , a trader client  35 , and general clients  40 . The management server  30  represents a terminal used to manage the LAN access system  22 . The trader client represents a terminal of a trader, such as a coffee shop or a beauty shop, that provides the LAN access system  22 , and is used by the trader to gain access to the WAN  50  via the LAN access system  22 . The general client represents a terminal of each user who utilizes the LAN access system  22 . The management server  30 , the trader client  35 , and the general clients  40  are generically called LAN access terminals. All of the LAN access terminals belong to an identical physical segment. 
         [0024]    The LAN device  20  connects with a provider via an ADSL line  25  and further with the WAN  50  via the provider. Each of the LAN access terminals connects with the LAN device  20  by air or via cable to access the WAN  50  via the LAN device  20 . The LAN device  20  also enables mutual communication between LAN access terminals. TCP/IP is applied for a protocol of communication. The IP protocol is used on the network layer, and the TCP protocol is used on the transport layer. Fixed private IP addresses are allocated to the management server  30  and the trader client  35 , whereas private IP addresses are dynamically allocated to the general clients  40  by the LAN device  20 . The LAN device  20  converts each private IP address into a global IP address in communication of the LAN access terminal with the WAN  50 . 
         [0025]    The internal structure of the management server  30  is discussed with reference to  FIG. 2 . The management server  30  includes a network interface (NT-I/F)  70  that controls data transmission to and from the WAN  50  via the LAN device  20 , a CPU  80  that executes diverse series of processing, a ROM  90  that stores processing programs and static data, a RAM  100  that functions as a work area, a timer  110  that manages time, a display circuit  130  that is in charge of display on a monitor  165 , a hard disk (HD)  120  that accumulates text data in the form of a database, and an input interface (I/F)  140  that works as an interface with a keyboard  150  and a mouse  160 . 
         [0026]    The hard disk  120  is illustrated as an internal element in this embodiment, but may be a removable external unit. A removable storage medium (for example, a CD-ROM, a CD-R, a CD-RW, a DVD-ROM, a DVD-RAM, or a flexible disk) may be used in addition to the hard disk  120 . In the structure of the embodiment, the processing programs are stored in the ROM  90  of the management server  30 . In another application, the processing programs are stored in the hard disk  120  and are extracted on the RAM  100  to be executed at the time of activation. The processing programs may otherwise be read from the removable storage medium or read from another terminal via the LAN device  20  to be executed. It is not required that all the required data are stored in the hard disk  120 . Vast amounts of data may be stored in a distributive manner, updated, and managed by another terminal connected via the LAN device  20 . Each of the trader client  35  and the general clients  40  has the internal structure practically similar to that of the management server  30 . 
         [0027]      FIG. 3  shows the internal structure of the LAN device  20 . The LAN device  20  includes a controller  95 , a memory  105 , and an input-output unit  65 . Two databases used in this embodiment, that is, a trader database  75  and a transmission database  85 , are stored in the memory  105 . A password given to a management representative of the LAN access system  22  is required for registration and deletion of data into and from these databases. Only the management server  30  is allowed to manage these databases (for example, registration and deletion of data). 
         [0028]      FIG. 4  shows contents of the trader database  75  as an example. The trader database  75  stores therein MAC addresses and IP addresses in the LAN, that is, private IP addresses, assigned to the management server  30  and the trader client  35 . 
         [0029]      FIG. 5  shows contents of the transmission database  85 . The transmission database  85  stores therein protocols applicable for communication by the general clients  40 . Each of the LAN access terminals in the LAN access system  22  uses one fixed port corresponding to one protocol. A mapping of protocols to port numbers is accordingly stored in the transmission database  85 . The term ‘protocol’ in the following discussion represents a protocol on the application layer in the TCP/IP protocol. The input-output unit  65  shown in  FIG. 3  includes a WAN module  45  that is in charge of input and output from and to the WAN  50 , a wireless module  55  that is in charge of input and output of wireless communication, and a wire module  60  that is in charge of input and output of wired communication. The wireless module  55  and the wire module  60  are in charge of input and output from and to the LAN access terminals of the LAN access system  22 . The controller  95  controls the internal operations of the LAN device  20 . 
         [0030]    (2) Processing 
         [0031]    The following describes a series of processing executed by the LAN device  20  to restrict a protocol for communication from each of the LAN access terminals to the management server  30  or the trader client  35  in the first embodiment with reference to  FIG. 6 . When the wireless module  55  or the wire module  60  receives data (step S 15 ), the LAN device  20  retrieves an MAC address field to the trader database  75  with an MAC address of a transmission source written in a header of the received data (step S 20 ). When the corresponding MAC address exists (step S 25 ), it means that the received data is a correspondence from either of the management server  30  and the trader client  35 . In such cases, the received data is transmitted to an address of a terminal specified as a transmission target without any limitation to the protocol for communication (step S 30 ). When the transmitted data is reply requirement data that requires a reply of data (for example, a URL in the Internet), reply data (data used to display a Web page corresponding to the URL in the above example) is transmitted in response to the reply requirement data. The LAN device  20  receives the reply data, and then transmits the received reply data to the address of the management server or the trader client that has output the reply requirement data (step S 32 ). 
         [0032]    When no corresponding MAC address exists in the trader database  75  (step S 25 ), on the other hand, it means that the received data is correspondence from one of the general clients  40 . The LAN device  20  subsequently retrieves an IP address field of the trader database  75  with an IP address of the transmission source written in the header of the received data (step S 35 ). When no corresponding IP address exists (step S 40 ), it means that the received data is data addressed to the WAN  50  or the general client  40  of the LAN access system  22 . The received data is accordingly transmitted to the address of the terminal specified as the transmission target without any limitation to the protocol for communication (step S 30 ). When the transmitted data is the reply requirement data, the LAN device  20  receives the reply data and transmits the received reply data to the address of the general client  40  that has output the reply requirement data (step S 32 ). 
         [0033]    When the corresponding IP address is present (step S 40 ), it means that the received data is correspondence to either the management server  30  or the trader client  35 . For restriction of the protocol, the LAN device  20  retrieves a port number field of the transmission database  85  with a port number written in the header of the received data (step S 45 ). When no corresponding port number is present (step S 50 ), it means that communication by the mapped protocol is prohibited. The received data is accordingly not transmitted, and the program exits from this processing routine. When the corresponding port number exists (step S 50 ), on the contrary, the LAN device  20  transmits the received data to the address of the terminal specified as the transmission target (step S 30 ). When the transmitted data is the reply requirement data, the LAN device  20  receives the reply data and transmits the received reply data to the address of the general client  40  that has output the reply requirement data (step S 32 ). 
         [0034]    The arrangement of the embodiment discussed above limits access of the general client  40  to the management server  30  or the trader client  35  without providing any additional equipment, such as another router or firewall in the system utilizing the LAN device  20 . 
       Second Embodiment  
       [0035]    A second embodiment is an example of the LAN access system  22  that changes the specification of the restriction of the protocol according to the type of the general client  40 . The management representative of the LAN access system  22  classifies the general clients  40  into upper layer clients and lower layer clients. Stricter restriction of the protocol is applied to the lower layer clients, whereas eased restriction is applied to the upper layer clients. The upper layer clients are, for example, those who pay higher connection fees of the LAN access system  22  or affordable clients. The MAC address assigned to a network device mounted on each upper layer client is stored in an upper layer database  115  in the memory  105  included in the LAN device  20 . The password of the management representative is required for such storage, and only the management server  30  is allowed to carry out the storage. In most cases, different protocols are applicable for the upper layer clients and the lower layer clients. 
         [0036]      FIG. 7  shows contents of the transmission database  85  in the second embodiment. Upper layer protocols represent applicable protocols for communication of the upper layer clients with the management server  30  or the trader client  35 . Upper port numbers represent preset port numbers used in communication by the upper layer protocol. Lower layer protocols represent applicable protocols for communication of the lower layer clients with the management server  30  or the trader client  35 . Lower port numbers represent preset port numbers used in communication by the lower layer protocol. 
         [0037]      FIG. 8  is a flowchart showing a series of processing executed by the LAN device  20  in the second embodiment. When the result of the decision process (step S 55 ) in the flowchart of  FIG. 6  shows that the transmission target is either the management server  30  or the trader client  35  (in the case of ( 3 ) in  FIG. 6 ), it is subsequently determined whether or not the general client  40  that has transmitted the received data is an upper layer client or a lower layer client. For this purpose, the LAN device  20  retrieves the upper layer database  115  with an MAC address assigned to the terminal of the transmission source and written in the header of the receive data (step S 60 ). 
         [0038]    When the corresponding MAC address is present in the upper layer database  115 , that is, when the terminal of the transmission source is an upper layer client (step S 65 ), the LAN device  20  retrieves an upper port number field of the transmission database  85  with a port number written in the header of the received data (step S 70 ). When no corresponding port number is present (step S 75 ), it means that communication by the mapped protocol is prohibited. The received data is accordingly not transmitted, and the program exits from this processing routine. When the corresponding port number is present (step S 75 ), on the contrary, the LAN device  20  transmits the received data to the address of the terminal specified as the transmission target (step S 80 ). When the transmitted data is the reply requirement data, the LAN device  20  receives the reply data and transmits the received reply data to the address of the upper layer client that has output the reply requirement data (step S 82 ). 
         [0039]    When no corresponding MAC address is present in the upper layer database  115 , that is, when the terminal of the transmission source is a lower layer client (step S 65 ), on the other hand, the LAN device  20  retrieves a lower port number field of the transmission database  85  with a port number written in the header of the received data (step S 85 ). When no corresponding port number is present (step S 90 ), it means that communication by the mapped protocol is prohibited. The received data is accordingly not transmitted, and the program exits from this processing routine. When the corresponding port number is present (step S 90 ), on the contrary, the LAN device  20  transmits the received data to the address of the terminal specified as the transmission target (step S 80 ). When the transmitted data is the reply requirement data, the LAN device  20  receives the reply data and transmits the received reply data to the address of the lower layer client that has output the reply requirement data (step S 82 ). 
         [0040]    The arrangement of the second embodiment discussed above has the similar functions and effects to those of the first embodiment. Additionally classification of the general clients  40  and individual specification of the protocols applicable for the classified general clients  40  enables the security level to the management server  30  or the trader client  35  to be set in several stages. 
       Third Embodiment  
       [0041]    The structure of a third embodiment restricts communication with the WAN  50 , as well as communication with the management server  30  or the trader client  35 .  FIG. 9  shows contents of the transmission database  85  in the third embodiment. Upper layer WAN protocols represent applicable protocols for communication of the upper layer clients with the WAN  50 . Upper WAN port numbers represent preset port numbers used in communication by the upper layer WAN protocol. Lower layer WAN protocols represent applicable protocols for communication of the lower layer clients with the WAN  50 . Lower WAN port numbers present preset port numbers used in communication by the lower layer WAN protocol. 
         [0042]      FIG. 10  is a flowchart showing a series of processing executed by the LAN device  20  in the third embodiment. When the result of the decision process (step S 55 ) in the flowchart of  FIG. 6  shows that the transmission target is neither the management server  30  nor the trader client  35  (in the case of ( 2 ) in  FIG. 6 ), it is subsequently determined whether or not the IP address of the transmission target is a private IP address, that is, an IP address of the LAN access terminal (Step S 95 ). In the case of a private IP address (step S 100 ), the LAN device  20  transmits the received data to the address of the terminal specified as the transmission target without any restriction of the protocol (step S 105 ). When the transmitted data is the reply requirement data, the LAN device  20  receives the reply data and transmits the received reply data to the address of the general client  40  that has output the reply requirement data (step S 107 ). In the case of no private IP address (step S 100 ), on the other hand, the upper layer-lower layer transmission process of the second embodiment (step S 95 ) is carried out. In the process of retrieval of the transmission database in the upper layer-lower layer transmission process, the upper WAN port number is retrieved for the upper layer client and the lower WAN port number is retrieved for the lower layer client. 
         [0043]    The arrangement of the third embodiment has the similar functions and effects to those of the first embodiment and the second embodiment, and additionally ensures limitation of communication with the WAN  50 . 
         [0044]    The above embodiments and their applications are to be considered in all aspects as illustrative and not restrictive. There may be many modifications, changes, and alterations without departing from the scope or spirit of the main characteristics of the present invention. For example, in the case of communication from the LAN access terminal to the management server  30  or the trader client  35 , one applicable procedure distinguishes the management server  30  from the trader client  35  and sets different protocols for communication. This is effective for the requirement of different settings to the management server  30  and to the trader client  35 . 
         [0045]    The technique of the present invention is applicable to restriction of the protocol for mutual communication between the general clients  40 . This is effective for the requirement of limiting mutual access to the general clients  40 . In the above embodiments, the protocols are classified into two groups. This arrangement is, however, not restrictive, and the protocols may be classified into a greater number of groups according to the type of the LAN access terminals. 
         [0046]    In the second and the third embodiments, the upper layer clients are stored in the form of the upper layer database. This construction is, however, not restrictive. The lower layer clients may alternatively be stored in the form of a lower layer database. The database may store specific information, which allows classification of the LAN access terminals into a greater number of groups.