Abstract:
In the case of limiting access by the MAC address, it is necessary to register the MAC address for each machine possessed by customers, even though customers are allowed to connect to the access-unlimited outside WAN. This needs cumbersome works. In the case of limiting access by using WEP, it is necessary to inform customers of the highly secret key.  
     In the case where the access-limited area (such as the in-house LAN  20  access to which should be limited for outside persons) and the access-unlimited area (such as the internet  30  access to which should be allowed for outside persons) are connected through a single wireless LAN access point  10 , it is possible to limit connection to the in-house LAN while simply allowing connection to the outside WAN without individual setting for outside persons, because when encipherment such as WEP can be utilized, if there is a request for connection accompanied by effective WEP from the wireless client  22  (who is an insider), connection to both the in-house LAN  20  and the internet  30  is allowed, but if there is a request for connection not accompanied by effective WEP from the wireless client  23  (which is an outsider), connection only to the internet is allowed.

Description:
BACKGROUND OF THE INVENTION  
         [0001]    1. Field of the Invention  
           [0002]    The present invention relates to a access point for wireless LAN, a method for providing wireless LAN services, and a medium storing a program to provide wireless LAN services.  
           [0003]    2. Description of the Prior Art  
           [0004]    It is a recent practice to connect LAN to WAN in order for users not only to hold in-house data in common but also to access the internet (WAN outside the company) as the occasion may demand. This serves the convenience of users.  
           [0005]    On the other hand, the recent development of wireless LAN systems permits any user to easily join the network system when he is in a communication area. There are some institutions which, as their services, allow their customers to connect to the outside WAN through their internal LAN. In this case, it is necessary to prevent customers from unlimitedly accessing the in-house LAN which needs a high degree of secrecy although customers may be allowed to access the outside WAN which is not so serious about secrecy. us  
           [0006]    A conventional way to limit accessing is to use the MAC address or encryption by WEP. The former is achieved by registering the MAC address of the machines connected to the in-house LAN, thereby determining whether or not a customer may access for each MAC address. The latter is achieved by registering the key for a series of specific characters, thereby encrypting the customer&#39;s communication by means of the key and substantially limiting the customer&#39;s accessing.  
           [0007]    The above-mentioned conventional wireless LAN access point has the following problem. In the former case (limiting by the MAC address), it is necessary to register the MAC address for each machine possessed by customers, even though customers are allowed to access the outside WAN unlimitedly. This needs cumbersome works. In the latter case (which uses WEP), it is necessary to inform customers of the highly secret key.  
         SUMMARY OF THE INVENTION  
         [0008]    The present invention was completed in view of the foregoing. It is an object of the present invention to provide a wireless LAN access point which permits easy connection to the external WAN but can limit connection to the internal LAN, a method for proving wireless LAN services, and a medium storing a program to provide wireless LAN services.  
           [0009]    The present invention to achieve the above-mentioned object is directed to a wireless LAN access point to provide network services through wireless signals, to establish access-limited areas and access-unlimited areas, and limit access by appropriate encryption, said wireless LAN access point comprising an encryption judging means to judge whether or not there is said encryption in access demand and an access object limiting means to allow access to access-limited areas and access-unlimited areas when said encryption judging means judges that there is said encryption and also allow access only to access-unlimited areas when said encryption judging means judges that there is not said encryption.  
           [0010]    It is assumed that the wireless LAN access point of the present invention, which is constructed as mentioned above, can provide network services through wireless signals, establish access-limited areas and access-unlimited areas, and limit access by appropriate encryption.  
           [0011]    The encryption judging means judges whether or not there is said encryption in access demand. When the encryption judging means judges the presence or absence of encryption in access demand, the access object limiting means carries out the following process. If there is encryption, it allows access to both access-limited areas and access-unlimited areas. If there is not encryption, it allows access only to access-unlimited areas.  
           [0012]    In this way it is possible to limit access without necessitating the registration of MAC address and disclosing the key for encryption.  
           [0013]    As mentioned above, the wireless LAN access point of the present invention allows access to access-limited areas or access-unlimited areas in accordance with only the presence or absence of encryption. Therefore, it permits unspecified persons very easily to access access-unlimited areas.  
           [0014]    The wireless LAN access point may be constructed such that said encryption is made in the data link layer.  
           [0015]    If the wireless LAN access point is constructed as mentioned above, encryption is accomplished in the data link layer and hence it is possible to judge the presence or absence of encryption regardless of the protocol in the upper layer.  
           [0016]    By using encryption in the data link layer in this way it is possible to provide services regardless of the protocol in the upper layers.  
           [0017]    In addition, the wireless LAN access point may be constructed such that said encryption is accomplished in conformity with WEP.  
           [0018]    If the wireless LAN access point is constructed as mentioned above, WEP is used for encryption in place of any other special method.  
           [0019]    In this way it is possible to use the wireless LAN access point in any wireless LAN system that employs WEP.  
           [0020]    The above-mentioned access-limited area my be a LAN.  
           [0021]    In the above-mentioned construction, the wireless LAN access point limits access to a small-scale network area such as LAN.  
           [0022]    In addition, the above-mentioned access-unlimited area may be a WAN.  
           [0023]    If the wireless LAN access point is constructed as mentioned above, it does not limit access to a large-scale WAN such as the internet.  
           [0024]    The technique of limiting what to access in accordance with the presence or absence of encryption is not necessarily restricted by tangible devices; but it is easily understood that the technique may manifest itself as a method.  
           [0025]    Therefore, the present invention is also directed to a method of providing network services through wireless signals, establishing access-limited areas and access-unlimited areas, and limiting access by appropriate encryption, said method comprising an encryption judging step to judge whether or not there is said encryption in access demand and an access object limiting step to allow access to access-limited areas and access-unlimited areas when said encryption judging step judges that there is said encryption and also allow access only to access-unlimited areas when said encryption judging step judges that there is not said encryption.  
           [0026]    In other words, the present invention is directed a tangible device as well as a method for using it.  
           [0027]    The wireless LAN access point of the present invention may exist alone or may be incorporated into a certain machine. The concept of the present invention may embrace various embodiments; it may be either software or hardware.  
           [0028]    In the case where the concept of the present invention is embodied in software for the wireless LAN access point, it naturally exists in the form a recoding medium which stores such software and it is used as software.  
           [0029]    For example, the present invention may be directed to a medium storing a program of providing network services through wireless signals, establishing access-limited areas and access-unlimited areas, and limiting access by appropriate encryption, said program permitting the computer to realize an encryption judging function to judge whether or not there is said encryption in access demand and an access object limiting function to allow access to access-limited areas and access-unlimited areas when said encryption judging function judges that there is said encryption and also allow access only to access-unlimited areas when said encryption judging function judges that there is not said encryption.  
           [0030]    Needless to say, the recording medium may be a magnetic recording medium or a magneto-optical recording medium or any one which would be developed in the future. It also includes primary and secondary duplicates in any form.  
           [0031]    In addition, the concept of the present invention may be realized partly in the form of software and partly in the form of hardware. Alternatively, it may exist in such a form that a portion is recorded on a recording medium and read time to time as occasion demands. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0032]    [0032]FIG. 1 is a schematic diagram showing the construction of the network system to which is applied the wireless LAN access point pertaining to one embodiment of the present invention.  
         [0033]    [0033]FIG. 2 is a block diagram showing the construction of the wireless LAN access point.  
         [0034]    [0034]FIG. 3 is a flowchart showing the processing at the wireless LAN access point.  
         [0035]    [0035]FIG. 4 is a flowchart showing another example of the processing at the wireless LAN access point.  
         [0036]    [0036]FIG. 5 is a flowchart showing a modified example of the processing at the wireless LAN access point.  
         [0037]    [0037]FIG. 6 is a flowchart showing a modified example of the processing at the wireless LAN access point conforming to general-purpose encryption. 
     
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0038]    The embodiments of the present invention will be described with reference to the accompanying drawings.  
         [0039]    (1) The First Embodiment:  
         [0040]    [0040]FIG. 1 is a schematic diagram showing the construction of the network system to which is applied the wireless LAN access point pertaining to one embodiment of the present invention. In this embodiment, the network is a wireless LAN and a wired LAN in a company and is capable of accessing the outside internet.  
         [0041]    In FIG. 1, the wireless LAN access point  10  is connected to the in-house LAN  20  and the internet (WAN)  30  through cables. To the in-house LAN  20  is connected the wired client  21  through a cable as well as the wireless client  22  through the wireless LAN access point  10 . The wireless LAN access point  10  is physically capable of connecting to the wireless client  23 ; however, the wireless LAN access point  10  and the wireless client  22  have the common “key” for WEP. Thus there is a connecting environment with encryption by WEP. By contrast, the wireless client  23  does not have the common “key” for WEP.  
         [0042]    In other words, the wireless client  22  is a terminal for an inside person who can teach the key of WEP, whereas the wireless client  23  is a terminal which allows access to only the outside internet through the in-house wireless infrastructure.  
         [0043]    [0043]FIG. 2 is a block diagram showing the construction of the wireless LAN access point  10 .  
         [0044]    This wireless LAN access point  10  has three interfaces, that is, the Ethernet interface (IF)  11  capable of connecting to a network environment of Ethernet; the router part  12  for connection to the outside internet through an optical cable in the wired environment; and the wireless part  13  capable of network connection to outside wireless terminals through the wireless medium. It also has a CPU  14 , ROM  15 , and RAM  16 . The CPU  14  reads firmware and data written in the ROM  15  and accesses the RAM  16  time to time to store data temporarily, thereby mediating communications between network machines connected through the interface.  
         [0045]    These interfaces can be realized with existing circuits based on general-purpose technologies. The wireless part  13  is suitable for data transmission ciphered by WEP.  
         [0046]    The WEP converts a 5-byte or 13-bit character string (key) into a hexadecimal number and uses a 64-bit or 128-bit long value (with a 24-bit initializing vector) as a stream cipher.  
         [0047]    The initializing vector is a numerical value which serves as the base of a random number sequence, and a 64-bit or 128-bit long value forms a random number sequence. The XOR operation is performed on this random number sequence and the “original text” (data) and the resulting cipher text is transmitted in the form of stream cipher. Decipherment is accomplished by performing the XOR operation again on the “cipher text” by using the 64-bit or 128-bit long value generated by the same “key” as used for encipherment. Thus it is possible to obtain the “original text” as data.  
         [0048]    This WEP sets up the “key” at the access point and tells it only to those who are allowed to connect to the in-house LAN (access-limited area), so that only the terminal which has set up the “key” can access the access-limited area.  
         [0049]    [0049]FIG. 3 is a flowchart showing the processing at the wireless LAN access point which is executed when the wireless clients  22  and  23  issued a request for connection to the wireless LAN access point.  
         [0050]    In step S 100 , a judgment is made as to whether the request for connection is the one for WAN  30  or the one for in-house LAN  20 . If the request for connection is the one for in-house LAN  20  instead of the one for WAN  30 , then a judgment is made (in step S 105 ) as to whether it is accompanied by encryption by effective WEP. If WEP is effective, connection to in-house LAN  20  is allowed in step S 110 , and if WEP is not effective, connection to in-house LAN  20  is not allowed, and the subsequent processes are omitted.  
         [0051]    On the other hand, if the request for connection is the one for WAN  30 , connection to WAN  30  is allowed in step S 115  regardless of the presence or absence of encryption by WEP.  
         [0052]    The following explains the action of the embodiment constructed as mentioned above.  
         [0053]    Referring to FIG. 1, it is assumed that the wireless client  22  is going to connect to in-house LAN  20  through the wireless LAN access point  10 . Since the request for connection from the wireless client  22  to the wireless LAN access point  10  is the one for in-house LAN  20 , a judgment is made in step S 100  that it is “not the request for connection to WAN” and then a judgment is made in step S 105  as to whether it is accompanied by an effective WEP. Since the wireless client  22  is an in-house terminal, it has the same “key” as that of the wireless LAN access point  10 , and a judgment is made that it is accompanied by an effective WEP and connection to in-house LAN  20  is allowed in step S 110 .  
         [0054]    Also, in the case where this wireless client  22  intends to connect to the internet (WAN) through the wireless access point  10 , then the request for connection to the wireless LAN access point  10  from the wireless client  22  is the one for WAN  30 , a judgment is made in step S 100  that “it is the request for connection to WAN” and connection to WAN  30  is allowed in step S 115  without inquiring the validity of WEP.  
         [0055]    On the other hand, it is assumed that the wireless cliu ent  23  temporarily enters the communication range of wireless LAN and is allowed to connect only to the internet. In this case, too, if it is to connect to the internet (WAN) through the wireless LAN access point  10 , the request for connection to the wireless LAN access point  10  is the one for connection to WAN  30 , and hence a judgment is made (in step S 100 ) that “it is a request for connection to WAN”, and connection to WAN  30  is allowed in step S 115  without inquiring the validity of WEP. In other words, the arrangement makes it possible to connect to the internet (WAN) very easily from the terminal for which the WEP key has not yet been set up.  
         [0056]    By contrast, in the case where the wireless client  23  attempts to access to the in-house LAN  20  (access to which is not yet allowed), the following steps are carried out.  
         [0057]    By contrast, if the wireless client  23  attempts to access the in-house LAN  20  access to which is not yet approved, the following steps are taken. That is, it is assumed that the wireless client  23  attempts to connect to the in-house LAN  20  through the wireless LAN access point  10 . Since the request for connection to the wireless LAN access point is the request for connection to the in-house LAN  20 , a judgment is made in step S 100  that it is “not the request for connection to WAN” and a judgment is made in step S 105  as to whether it is accompanied by effective WEP.  
         [0058]    Since the wireless client  23  is an in-house terminal, it does not know the “key” of WEP and a judgment is made that it is not accompanied by effective WEP. Connection to the in-house LAN  20  is not allowed in step S 110 , and the processing terminates. In other words, unless effective encipherment like WEP is accompanied, access to the access-limited area is definitely limited.  
         [0059]    (2) The Second Embodiment  
         [0060]    There are several methods for deciphering the cipher such as WEP. An example of them is explained in the following.  
         [0061]    [0061]FIG. 4 illustrates the processing in the case where it is possible to previously judge whether or not effective WEP is accompanied.  
         [0062]    A judgment is made in step S 200  as to whether the request for connection from either the wireless client  22  or  23  is accompanied by effective WEP. If the request for connection from the wireless client  22  is accompanied by effective WEP, the enciphered data is deciphered in step S 205 . And, the requested connection is executed in step S 210  according to the deciphered data. This request for connection may be either the request for connection to the in-house LAN  20  or the request for connection to the WAN  30 .  
         [0063]    On the other hand, if the request for connection from the wireless client  23  is not accompanied by effective WEP, a judgment is made in step S 215  as to whether it is the request for connection to the WAN  30 . If the result of judgment is “Yes”, the requested connection is executed in step S 210 . In the case of the request for connection from the wireless client  22 , regardless of whether it is a request for connection to the in-house LAN  20  or a request for connection to the WAN  30 , it is processed in the same way. However, the request for connection from the wireless client  23  is executed in step S 210  only when it is the request for connection to the WAN  30 . And, if the request for connection from the wireless client  23  is not a request for connection to the WAN  30 , then connection is rejected in step S 220 .  
         [0064]    (3) The Third Embodiment  
         [0065]    Another modified embodiment with WEP is explained in the following. FIG. 5 is a flowchart showing the processes in the modified embodiment.  
         [0066]    In FIG. 5, decipherment by WEP is executed in step S 300 , and a judgment is made (in step S 305 ) as to whether the deciphered data are effective. If the result of judgment is affirmative, the requested connection is executed (in step S 310 ) in accordance with the deciphered data. This request for connection may be either the request for connection to the in-house LAN  20  or the request for connection to the WAN  30 .  
         [0067]    On the other hand, if the deciphered data is not effective, a judgment is made (in step S 315 ) as to whether it is the request for connection to the WAN  30 . If it is the request for connection to the WAN  30 , connection is executed (in step S 320 ) in accordance with the data before decipherment. Also, if the deciphered data is not effective and it is not the request for connection to the WAN  30 , the processing terminates without executing the request for connection.  
         [0068]    (4) The Fourth Embodiment  
         [0069]    In the above-mentioned embodiments, encipherment is accomplished by WEP; however, it is also possible to accomplish encipherment in other ways. An example is shown in FIG. 6.  
         [0070]    In step S 400 , a judgment is made as to whether or not the data is enciphered. If the result of judgment is affirmative, the cipher is verified in step S 405 . And, in step S 410 , a judgment is made as to whether or not encipherment is effective. If the result of judgment is affirmative, communication with the specified partner is executed in step S 415 . Therefore, in the case where connection is made from an in-house terminal to the wireless LAN access point as mentioned above, effective encipherment is completed and hence communication with the specified partner is executed regardless of the in-house LAN  20  or the internet  30 .  
         [0071]    Also, in the case where the data is enciphered but the enciphered data is not effective, its validity remains doubtful and hence communication is rejected in step S 420  and an appropriate process (such as security alert) is executed.  
         [0072]    On the other hand, in the case where a judgment is made (in step S 400 ) that the data is not enciphered, a judgment is made (in step S 425 ) as to whether the communication partner is the WAN  30  or the LAN  20 . In this case, the former indicates the access-unlimited area and the latter indicates the access-limited area. And, if it is the WAN which is the access-unlimited area, communication with the specified partner is executed in step S 430 . However, if it is the LAN which is the access-limited area, communication is rejected in step S 420  (in the same way as above) and an appropriate process (such as security alert) is executed.  
         [0073]    Therefore, in the case of the wireless client  23  which temporarily enters the communication range of the wireless LAN and is allowed to connect only to the internet, it is not accompanied by encipherment, and communication is executed only if the communication partner is the access-unlimited area (such as internet) and communication is rejected if the communication partner is the access-limited area.  
         [0074]    As mentioned above, the present invention produces the following effect. In the case where the access-limited area (such as the in-house LAN  20  access to which should be limited for outside persons) and the access-unlimited area (such as the internet  30  access to which should be allowed for outside persons) are connected through a single wireless LAN access point  10 , it is possible to limit connection to the in-house LAN while simply allowing connection to the outside WAN without individual setting for outside persons, because when encipherment such as WEP can be utilized, if there is a request for connection accompanied by effective WEP from the wireless client  22  (who is an insider), connection to both the in-house LAN  20  and the internet  30  is allowed, but if there is a request for connection not accompanied by effective WEP from the wireless client  23  (which is an outsider), connection only to the internet is allowed.