JP2006041594A - Mobile communication system and authentication method of mobile terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To decrease interruption of communication in the case of handover by utilizing an existing mobile terminal in a wireless LAN system. <P>SOLUTION: The wireless LAN system is provided with a plurality of access points, wherein authentication information of the mobile terminal is distributed in advance to a surrounding access point to which the mobile terminal is possible to make handover and in the case of the handover, authentication is carried out between the access point and the mobile terminal. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a mobile terminal authentication technique in a wireless LAN system. In particular, the present invention relates to an authentication technique when a mobile terminal performs handover between a plurality of wireless access points in a wireless LAN system.

  A mobile terminal in a wireless LAN system is connected to an external network via a wireless access point (hereinafter referred to as wireless AP) installed in the wireless LAN system.

  In the wireless LAN system, a plurality of wireless APs are arranged, and the mobile terminal is connected to an external network via the wireless AP that covers the area of the current position, and the destination terminal and data connected to the external network Send and receive.

  If the mobile terminal moves during transmission / reception of data, this time, the mobile terminal is connected to an external network via a wireless AP whose destination is the management area. The switching of the wireless AP relayed by the mobile terminal as it moves is called handover.

  FIG. 1 shows an image diagram of a wireless LAN system. As shown in this figure, wireless APs 201, 202, 203... 215 are arranged in the wireless LAN system. Hereinafter, when it is not necessary to distinguish between them, these are represented by the wireless AP 200. As the mobile terminal 100 moves, the mobile terminal 100 is connected to an external network via the wireless AP 200 that covers the current position.

  By the way, since the wireless LAN does not require a cable as a transmission path, the LAN can be easily constructed. On the other hand, since the reach of radio waves is invisible, there is also a risk that unauthorized intrusion can be attempted by a malicious third party. In order to avoid this, security measures are indispensable for the wireless LAN system.

  As a security measure, for example, there is a method of authenticating the mobile terminal 100 to be connected and permitting the connection only when the authentication is successful. A typical example is a method defined in IEEE801.1x.

  According to IEEE802.1x, the wireless LAN system includes an authentication server 300 that authenticates the mobile terminal 100 attempting to connect via the wireless AP 200. The wireless AP 200 that has received the authentication request for connection from the mobile terminal 100 authenticates the validity of the mobile terminal 100 by executing a predetermined authentication procedure with the authentication server 300. When the authentication is successful, the encryption key is distributed to the mobile terminal 100, and the mobile terminal 100 performs wireless communication encrypted using the encryption key.

  The validity of the mobile terminal 100 is determined based on whether or not there is an access authority to the external network registered in the authentication server 300 in advance. For example, in the case where the authentication server 300 is a RADIUS server that authenticates access according to the RADIUS (Remote Authentication Dial In User Service) protocol, if the user has been registered in advance, it is determined that the user has access authority. Judged as none.

  In the wireless LAN system shown in FIG. 1, a system configuration in the case where the wireless AP 201, the wireless AP 202, and the authentication server 300 are provided as an example is shown in FIG.

  As shown in the figure, the authentication server 300 is connected to the wireless APs 201 and 202 via a wired line. The wireless APs 201 and 202 are connected to the external network 500 via the gateway 400. The counterpart terminal 600 is connected to the external network 500. The mobile terminal 100 transmits and receives data to and from the counterpart terminal 600 connected to the external network 500 via the wireless AP 200.

  According to the access control according to the IEEE 802.1x standard, the wireless AP 200 accesses the authentication server 300 and authenticates the mobile terminal 100 every time an authentication request from the mobile terminal 100 is received.

  FIG. 13 is a diagram for explaining an outline of a conventional general authentication procedure when a handover occurs in the wireless LAN system.

  As shown in this figure, when the mobile terminal 100 moves to the area managed by the wireless AP 201, the mobile terminal 100 issues an authentication request to the wireless AP 201 (S001), and then the wireless AP 201 moves the request source to and from the authentication server 300. The terminal 100 is authenticated (S002). After successful authentication, the mobile terminal 100 can perform data communication with the counterpart terminal 600.

  When the mobile terminal 100 moves to the area of the wireless AP 202, the mobile terminal 100 makes an authentication request to the wireless AP 202 this time (S003), and in response, the wireless AP 202 communicates with the authentication server 300 of the mobile terminal 100. Authentication is performed (S004). After successful authentication, the mobile terminal 100 can perform data communication with the counterpart terminal 600.

  Here, an authentication operation when the mobile terminal 100 issues an authentication request to the wireless AP 201 and then hands over to the wireless AP 202 will be described. FIG. 14 is a sequence of this authentication operation. Here, an authentication operation by EAP (Extensive Authentication Protocol) -MD5 in accordance with the IEEE 802.1x standard will be described as an example.

  PPP EAPOL-Start: The mobile terminal 100 transmits an authentication start message, which is an authentication request, to the wireless AP 201 as PPP EAPOL start processing (step (1)).

  PPP EAPOL-Request / Identity: The wireless AP 201 that has received the authentication start message transmits a PPP EAP request for requesting an identifier (ID) of the mobile terminal 100 to the mobile terminal 100 (step (2)).

  PPP EAP-Response / Identity: The mobile terminal 100 that has received the PPP EAP request notifies the wireless AP 201 of the user name, which is its own ID, as a PPP EAP response (step (3)).

  RADIUS Access Request: The wireless AP 201 that has received the PPP EAP response notifies the authentication server 300 of the ID of the mobile terminal 100 as an access request according to the RADIUS protocol (step (4)).

  RADIUS Access Challenge: Upon receiving the ID of the authentication request source mobile terminal 100, the authentication server 300 generates a random number and transmits the generated random number as a RADIUS access challenge to the access request transmission source wireless AP 201. Further, the authentication server 300 holds in advance authentication information of the mobile terminal 100 that is permitted to access the external network. The authentication information is searched using the received ID of the mobile terminal 100 as a key, and the transmitted random number is associated with the corresponding data and managed (step (5)).

  PPP EAP-Request / MD5-Cha11enge: The wireless AP 201 transmits the received random number to the mobile terminal 100 as a PPP EAP request (step (6)).

  PPP EAP-Response / MD5-Cha11enge: The mobile terminal 100 uses the random number notified from the authentication server 300 via the wireless AP 201, its own identifier (ID), and the password to obtain the MD5 message digest function value. Calculate and notify the wireless AP 201 (step (7)).

  RADIUS Access-Request: The wireless AP 201 transmits the message digest function value of MD5 received as the RADIUS access request to the authentication server 300 (step (8)). The received authentication server 300 calculates a message digest function value using the ID and password held as authentication information by itself and the random number transmitted in step (5), and compares the calculated value with the received value. I do.

  RADIUS Access-Accept: The authentication server 300 notifies the wireless AP 201 of authentication success or failure (step (9)).

  PPP EAP-Success / Failure: The wireless AP 201 notifies the mobile terminal 100 of the success or failure of the received authentication. Here, when the authentication is unsuccessful, the steps (6) and the subsequent steps are repeated again, or the process is terminated (step (10)).

  PPP EAPOL-Key: When authentication is successful in step (10), the wireless AP 201 transmits encryption key information to the mobile terminal 100 (step (11)). Thereafter, the mobile terminal 100 can communicate with the external network 500 by encrypting data to be transmitted using the encryption key.

  The mobile terminal 100 establishes a communication path with the counterpart terminal 600 connected to the external network through a wireless AP 201 by a call control procedure such as SIP, and transmits / receives data (step (12)). For example, when the mobile terminal 100 and the counterpart terminal 600 are IP telephones, a VoIP call is performed.

  Area movement: Here, it is assumed that a handover occurs from the wireless AP 201 to the wireless AP 202 due to the movement of the mobile terminal 100 during data transmission / reception (step (13)).

  PPP EAPOL-Start: When the mobile terminal 100 moves to an area managed by the wireless AP 202, the mobile terminal 100 transmits an authentication request for accessing the external network to the wireless AP 202 (step (14)). .

  Thereafter, the procedure from step (2) to step (11) is performed via the wireless AP 202 instead of the wireless AP 201 (step (14) to step (24)), and the mobile terminal 100 is successfully authenticated and encrypted. After obtaining the key from the wireless AP 202, data can be transmitted / received to / from the counterpart terminal 600.

  Processing from step (1) to (11) or steps (13) to (24) of the above procedure is required from when the mobile terminal 100 requests authentication to the wireless AP 200 until the authentication is successful. These processes may take several seconds. Therefore, for example, when the mobile terminal 100 is handed over from the wireless AP 201 to the wireless AP 202, since the mobile terminal is not authenticated during the processing from step (13) to (24) of the above procedure, data transmission / reception is not possible. It may be interrupted.

  As a method for avoiding interruption of data transmission / reception at the time of handover, there is a method in which the encryption key assigned by the wireless AP 200 before handover is continuously used until authentication is established (see, for example, Patent Document 1). .

  Here, before the handover, the encryption key used for communication with the handover source wireless AP is distributed to the handover destination wireless AP, and the handover destination wireless AP moves using the authentication server. While the terminal is being authenticated, communication is continued using the encryption key.

JP 2003-259417 A

  By using the technique of Patent Document 1, the state in which communication is interrupted, that is, the period of silence is reduced. However, in order to realize the method of Patent Document 1, it is necessary to implement new functions such as a function of holding information for distinguishing whether the encryption key is temporarily used or normally used in the mobile terminal. is there. That is, it is not possible to reduce the interruption of communication, that is, the period of silence, using the mobile terminal currently used as it is.

  Therefore, it is desired to reduce the period of silent state at the time of handover without adding a new configuration to the mobile terminal.

  The present invention has been made in view of the above circumstances, and in a wireless LAN system including a plurality of access points, authentication information of the mobile terminal is transmitted in advance to an access point where the mobile terminal may be handed over. At the time of handover, authentication is performed only between the mobile terminal and the access point.

  Specifically, a mobile communication system comprising a plurality of access points for connecting a mobile terminal to an external network and an authentication server for authenticating the mobile terminal, wherein the authentication server is one of the plurality of access points. When the authentication request from the mobile terminal is received via the one access point, the authentication means for authenticating the mobile terminal, and the authentication information of the mobile terminal after the authentication by the authentication means, Authentication information sharing instruction means for transmitting to an access point that is managed in advance as an access point that may move to its own management area, the access point from an authentication server that holds authentication information of the mobile terminal Shared authentication information holding means for holding transmitted authentication information of the mobile terminal as shared authentication information, and from the mobile terminal When the authentication request is received, it is determined whether the authentication information of the mobile terminal is held in the shared authentication information. If the authentication request is held, authentication is performed using the authentication information held in the shared information. And a mobile communication system comprising: an authentication processing unit that mediates authentication of the mobile terminal with the authentication server if not held.

  According to the present invention, in a wireless LAN system, a conventional mobile terminal can be used as it is, and the period of silence during handover can be reduced.

  Embodiments to which the present invention is applied will be described below.

  The system configuration diagram of this embodiment is the same as the conventional system configuration diagram shown in FIG. 2, and will be described using this.

  First, the outline of the authentication procedure of this embodiment will be described.

  The authentication procedure of this embodiment omits the authentication in S004 in the conventional authentication procedure (see FIG. 13).

  An outline of the authentication procedure at the time of occurrence of handover according to the present embodiment is shown in FIG.

  As shown in this figure, when the mobile terminal 100 moves to the area of the wireless AP 201, the wireless AP 201 requests authentication to the wireless AP 201 (S001a), and then the wireless AP 201 authenticates the mobile terminal 100 with the authentication server 300. Perform (S002a). After the authentication processing, while the mobile terminal 100 is transmitting / receiving data to / from the counterpart terminal 600 via the wireless AP 201, the authentication server 300 transmits authentication information of the mobile terminal 100 to the wireless AP 202 in the vicinity of the wireless AP 201 in advance ( S003a).

  When the mobile terminal 100 is handed over from the wireless AP 201 to the wireless AP 202, the wireless AP 202 authenticates the mobile terminal 100 using the authentication information received in S003a (S004a).

  According to the above method, in the present embodiment, when the mobile terminal 100 performs handover between the wireless APs 200, it is not necessary to perform authentication again via the authentication server 300 in the handover target wireless AP.

  Next, an operation sequence at the time of authentication among the mobile terminal 100, the wireless AP 200, and the authentication server 300 according to the present embodiment will be described. FIG. 4 shows an authentication sequence of the present embodiment.

  Here, a case will be described as an example where the mobile terminal 100 first makes an authentication request in an area managed by the wireless AP 201 and then moves to the area managed by the wireless AP 202. The wireless AP 202 and the wireless AP 204 are managed by the authentication server 300 as a wireless AP 200 (nearby wireless AP) that can be handed over from the wireless AP 201, and the wireless AP 204 is managed as a nearby wireless AP of the wireless AP 202. As in the conventional sequence shown in FIG. 14, an authentication operation by EAP-MD5 according to the IEEE 802.1x standard will be described as an example.

  When the mobile terminal 100 makes a new authentication request via the wireless AP 201, the authentication procedure is basically the same as the conventional sequence (steps (1) to (12)) shown in FIG. It will not be described here.

  Authentication information sharing request: When the authentication performed in response to the RADIUS access request in step (8) is successful, the authentication server 300 extracts the wireless AP 200 managed as the wireless AP 200 in the vicinity of the requesting wireless AP 201. Here, it transmits to wireless AP202 and wireless AP204 (step (13)). Then, the authentication information of the mobile terminal 100 is transmitted as an authentication information sharing request to all the extracted wireless APs 200.

  Authentication information registration: The wireless AP 202 and the wireless AP 204 that have received the authentication information sharing request from the authentication server 300 hold the received authentication information of the mobile terminal 100 as shared authentication information (step (14)).

  Authentication information sharing response: Thereafter, the wireless AP 202 and the wireless AP 204 return an authentication information sharing response to the authentication server 300 (step (15)).

  In this embodiment, the processing of steps (13) to (15) is described to be performed after the start of data transmission / reception between the mobile terminal 100 and the counterpart terminal 600, but the authentication of step (9) is described. As long as it is after the success and before the area movement of the mobile terminal 100 of (16), it may be anytime.

  Area movement: The mobile terminal 100 during data transmission / reception moves from the area managed by the wireless AP 201 to the area managed by the wireless AP 202, and a handover occurs (step (16)).

  EAPOL Start: The mobile terminal 100 transmits an authentication start message (authentication request) to the wireless AP 202 as PPP EAPOL start processing (step (17)).

  PPP EAPOL-Request / Identity: The wireless AP 202 that has received the authentication start message (authentication request) transmits a PPP EAP request for requesting an identifier (ID) of the mobile terminal 100 to the mobile terminal 100 (step (18)).

  PPP EAP-Response / Identity: The mobile terminal 100 that has received the PPP EAP request notifies the wireless AP 202 of the user name as its own ID as a PPP EAP response (step (19)).

  PPP EAP-Request / MD5-Cha11enge: The wireless AP 202 checks whether or not the received ID is held as shared authentication information, and if so, generates a random number and moves as a PPP EAP request. It transmits to the terminal 100 (step (20)).

  PPP EAP-Response / MD5-Cha11enge: The mobile terminal 100 calculates the MD5 message digest function value using the random number notified from the wireless AP 202, its own identifier (ID), and the password, and sends it to the wireless AP 202. Notification is made (step (21)).

  PPP EAP-Success / Failure: The wireless AP 202 calculates a message digest function value using the ID and password held as shared authentication information, and the random number transmitted in step (20), and compares it with the received value. By doing so, authentication is performed. Then, the mobile terminal 100 is notified of the success or failure of the authentication. If the authentication is unsuccessful, the same processing as in the case of unsuccessful authentication during normal authentication is performed (step (22)).

  PPP EAPOL-Key: If the authentication is successful in step (22), the wireless AP 202 transmits encryption key information to the mobile terminal 100 (step (23)). Thereafter, the mobile terminal 100 can communicate with the external network 500 by encrypting data to be transmitted using the encryption key (step (24)).

  Terminal movement notification: If the received ID is held as shared authentication information in step (20), it is determined that the handover is not due to a new authentication request but is due to area movement. After transmitting the encryption key information in step (23), the wireless AP 202 transmits a terminal movement notification to notify the authentication server 300 that the terminal has moved to its own management area (step (23)). (25)). The notification process may be performed at any time until the next area movement.

  Terminal movement response: Upon receiving the terminal movement notification, the authentication server 300 transmits a terminal movement response to notify the wireless AP 200 of the transmission source that the notification has been received (step (26)).

  Authentication information release request: The authentication server 300 is managed as a wireless AP 200 (as a wireless AP 200 (here, wireless AP 201)) that is relaying the communication of the mobile terminal 100 included in the terminal movement notification before the handover. Here, an authentication information release request is transmitted to the wireless APs 202 and 204) (step (27)).

  Authentication information cancellation: The wireless AP 200 that has received the authentication information cancellation request from the authentication server 300 deletes the authentication information of the corresponding mobile terminal 100 from the shared authentication information held by itself (step (28)).

  Authentication information cancellation response: When the deletion process of step (28) is completed, the wireless AP 20 notifies the authentication server 300 as an authentication information cancellation response (step (29)).

  Authentication information sharing request: When an authentication information release response is received from each wireless AP 200 (here, wireless APs 202 and 204), the transmission source wireless AP 200 (here, wireless AP 202) of the terminal movement notification received in step (25) above. The authentication information sharing request is transmitted to the wireless AP 200 (in this case, the wireless AP 204) managed as a nearby wireless AP, the processes of the above steps (14) and (15) are performed, and the mobile terminal 100 transmits to the nearby wireless AP. Register authentication information.

  Next, details of each component of the present embodiment that realizes the processing operation will be described.

  First, the authentication server 300 of this embodiment will be described. FIG. 5 is a functional block diagram of the authentication server 300.

  As shown in the figure, the authentication server 300 includes a RADIUS server unit 301, a wired LAN control unit 302, and an authentication information sharing management unit 303.

  The wired LAN control unit 302 controls transmission / reception of the wired LAN. In the present embodiment, an access request according to the RADIUS protocol is transferred to the RADIUS server unit 301, and other authentication information sharing requests such as authentication information sharing request, terminal movement notification, authentication information release melting, and the like are stored in the authentication information sharing management unit 303. Pass to.

  The RADIUS server unit 301 performs processing as a normal RADIUS server and notifies the authentication information sharing management unit 303 of the authentication result.

  The RADIUS server unit 301 includes an authentication processing unit 3011 that performs the same authentication process as that of a normal RADIUS server, an authentication notification unit 3012 that notifies an authentication result to the authentication information sharing management unit 303, and each mobile terminal 100 registered in advance. And an authentication information table 3013 that holds the authentication information.

  Upon receiving an authentication request for the mobile terminal 100 from the wireless AP 200, the authentication processing unit 3011 confirms the validity of the requesting mobile terminal 100 by referring to the authentication information table 3013. Then, the requesting wireless AP 200 is notified of the success or failure of the authentication. These functions are the same as those of the conventional authentication server 300.

  Speaking of the above authentication sequence, in accordance with the access request received in step (4), the RADIUS access challenge process in step (5) is performed and the RADIUS access challenge is transmitted, and the RADIUS access request is transmitted in step (8). It receives, performs the above authentication, and performs a process of notifying the result in step (9).

  An example of the authentication information table 3013 is shown in FIG. As shown in this figure, the authentication information table 3013 is used to authenticate the mobile terminal 100 with an ID holding unit 3013a that holds an ID that is an identifier of the mobile terminal 100, a password holding unit 3013b that holds a password. A random number holding unit 3013c that holds a random number to be generated.

  The ID and the password are registered in advance for each mobile terminal 100, and the random numbers stored in the RADIUS Access Challenge process are stored.

  If the authentication is successful, the authentication notification unit 3012 sends authentication information of the mobile terminal 100 that has been successfully authenticated and information (hereinafter referred to as a wireless AP identifier) that identifies the wireless AP 200 to be relayed to the authentication information sharing management unit 303. Notice. In the above authentication sequence, notification is made after notifying success or failure of the authentication in step (9).

  The authentication information sharing management unit 303 includes a sharing management processing unit 3031, a neighboring AP management table 3032, and a mobile terminal management table 3033.

  The neighboring AP management table 3032 manages the neighboring wireless AP 200 for each wireless AP 200 connected to the authentication server 303.

  An example of the neighboring AP management table 3032 is shown in FIG. This is an example of the neighboring AP management table 3032 when the wireless AP 200 is arranged as shown in FIG.

  As shown in the figure, the neighboring AP management table 3032 includes a wireless AP identifier storage unit 3032a that stores an identifier of the wireless AP 200 and a wireless AP 200 that manages a neighboring area of the wireless AP 200 stored in the wireless AP identifier storage unit 3032a. A proximity wireless AP identifier storage unit 3032b for storing the identifier. The nearby wireless AP identifier storage unit 3032b stores all identifiers of wireless APs 200 that may be handed over from the wireless AP 200 stored in the wireless AP identifier storage unit 3032a. This table is registered by a system designer or the like when the wireless LAN system is constructed.

  The mobile terminal management table 3033 is a table for managing the mobile terminal 100 to which the wireless AP 200 is currently relaying communication. An example is shown in FIG.

  As shown in this figure, the mobile terminal management table 3033 includes a wireless AP identifier storage unit 3033a that stores the identifier of the wireless AP 200, and an ID storage unit 3033b that stores the ID of the mobile terminal 100 in the area of the wireless AP. Prepare. This table is constructed by a share management processing unit 3031 (to be described later) receiving information from the authentication notification unit 3012 and storing it.

  The share management processing unit 3031 generates a mobile terminal management table 3033 and transmits authentication information to the nearby wireless AP 200. Further, upon receiving the terminal movement notification, an authentication information deletion instruction is transmitted.

  When the notification of successful authentication of the predetermined mobile terminal 100 is received from the authentication notification unit 3012 together with the identifier of the intervening wireless AP 200, the sharing management processing unit 3031 accesses the mobile terminal management table 3033. If the ID of the mobile terminal 100 is searched and stored in the ID storage unit 3033b, the data is deleted. Then, the received set of the identifier of the wireless AP 200 and the ID of the mobile terminal 100 is stored as new data.

  Next, the sharing management processing unit 3031 transmits the authentication information of the mobile terminal 100 as shared authentication information to the wireless AP 200 in the vicinity of the mediated wireless AP 200. The neighboring wireless AP 200 extracts from the neighboring AP management table 3032 using the identifier of the wireless AP 200 stored in the received information as a key.

  When the share management processing unit 3031 receives a terminal movement notification indicating that the mobile terminal 100 has moved to the area from the wireless AP 200 in step (25) of the authentication sequence, the share management processing unit 3031 transmits a terminal movement response and performs the following processing. That is, the processing from step (27) to step (32) of the authentication sequence is performed.

  First, the wireless AP 200 mediated before the handover is extracted from the mobile terminal management table 3033 using the ID of the mobile terminal 100 included in the terminal movement notification as a key. Next, the wireless AP 200 managed as the wireless AP 200 in the vicinity of the extracted wireless AP 200 is extracted from the neighboring AP management table 3032 and an authentication information release request is transmitted to them.

  Note that the authentication information release request includes at least an ID for identifying the mobile terminal 100 from which the authentication information is to be deleted.

  Thereafter, the identifier of the wireless AP 200 and the ID of the mobile terminal 100 included in the terminal movement notification are added to the mobile terminal management table 3033 as new data.

  Next, when authentication information cancellation responses are received from all the wireless APs 200 that transmitted the authentication information cancellation request, the neighboring AP management is performed as a wireless AP 200 in the vicinity of the wireless AP 200 using the identifier of the wireless AP 200 included in the received terminal movement notification as a key. The wireless APs 200 stored in the table 3032 are extracted, and the authentication information of the mobile terminal 100 included in the terminal movement notification is transmitted to them. The authentication information is extracted from the authentication information table 3013.

  FIG. 9 is a hardware block diagram of the authentication server 300.

  As shown in this figure, the authentication server 300 includes an MPU 81 that is a main control unit, a ROM 82 that holds programs and setting data, a RAM 83 that is a work memory, and a wired LAN module 85 that is a connection interface with a wired LAN. With.

  The functions of the RADIUS server unit 301, the wired LAN control unit 302, the authentication information sharing management unit 303, and the authentication notification unit 3012 described with reference to FIG. 5 are realized by the MPU 81 executing the program stored in the ROM 82. The authentication information table 3013, the neighboring AP management table 3032, and the mobile terminal management table 3033 are stored in the ROM 82.

  Next, the wireless AP 200 of this embodiment will be described.

  FIG. 10 is a functional block diagram of the wireless AP 200 of the present embodiment. In the following description, only the components essential to explain the functions specific to the present embodiment will be extracted and described.

  As shown in the figure, the wireless AP 200 includes an authentication information registration / management control unit 21, an authentication information sharing control unit 22, a RADIUS control unit 23, an EAPOL (EAP over LAN) control unit 24, and a MAC (Media Access Control). A frame transmission / reception control unit 25, a wired LAN control unit 26, and a wireless LAN control unit 27 are provided.

  The wired LAN control unit 26 controls transmission / reception of wired LAN communication, and the wireless LAN control unit 27 controls transmission / reception of wireless LAN communication.

  The MAC frame transmission / reception control unit 25 controls Ethernet frame transmission / reception between wired and wireless. In the present embodiment, the packet transmission request requested from the authentication information sharing control unit 22, the RADIUS control unit 23, and the EAPOL control unit 24 is converted into an Ethernet frame. In addition, the Ethernet frame received from the wired LAN control unit / wireless LAN control unit is a processing unit corresponding to the data depending on the frame content / shared information state, respectively, an authentication information sharing control unit 22, a RADIUS control unit 23, Delivered to the EAPOL control unit 24. It transmits to the authentication information sharing control unit 22, the RADIUS control unit 23, and the EAPOL control unit 24.

  The wireless AP 200 according to the present embodiment employs the EAPOL protocol on the wireless side (to the mobile terminal 100 side) and the RADIUS protocol on the wired side (to the authentication server 300 side) when authenticating the mobile terminal 100 in accordance with IEEE 802.1x. Is adopted. Therefore, the wireless AP 200 operates as a RADIUS client with respect to the authentication server 300.

  Therefore, in the present embodiment, in the case of a frame in accordance with the RADIUS protocol related to the authentication process between the wireless AP 200 and the authentication server 300, the data is sent to the RADIUS control unit 23 and the authentication process between the wireless AP 200 and the mobile terminal 100 is performed. In the case of a frame according to the EAPOL protocol, the frame is transferred to the EAPOL control unit 24. Further, in the case of a frame related to processing of authentication information to be shared, the frame is transferred to the authentication information sharing control unit 22.

  The RADIUS control unit 23 performs RADIUS protocol control during authentication between the wireless AP 200 and the authentication server 300, and the EAPOL control unit 24 performs EAPOL protocol control during authentication between the wireless AP 200 and the mobile terminal 100.

  The authentication information sharing control unit 22 performs message processing related to the above-described processing exchanged between the wireless AP 200 and the authentication server 300. In this embodiment, the MAC frame transmission / reception control unit 25 and the authentication information registration / registration for data not used for RADIUS protocol control and EAPOL protocol control, such as shared authentication information transmitted / received to / from the authentication server 300, authentication information release request, terminal movement notification, etc. Relay with the management control unit 21.

  The authentication information registration / management control unit 21 holds information for authenticating the mobile terminal 100 and controls authentication processing. The authentication information registration / management control unit 21 receives the authentication request from the mobile terminal 100, and in accordance with the authentication information sharing request from the authentication processing unit 2101 that performs authentication and the authentication server 300, the shared authentication information 2104 And a deletion processing unit 2103 for deleting data designated from the shared authentication information 2104 in accordance with an authentication information release request from the authentication server 300.

  When the share registration unit 2102 receives the authentication information sharing request from the authentication server 300, the share registration unit 2102 holds the authentication information included in the request in the shared authentication information 2104. This is authentication information of the mobile terminal 100 in the area managed by the nearby wireless AP 200. That is, the process of step (14) or (31) of the authentication sequence described above is performed.

  Upon receiving the authentication information release request as the authentication information release request from the authentication server 300, the deletion processing unit 2103 deletes the authentication information of the mobile terminal 100 instructed to be deleted from the shared terminal authentication information 2104. A cancellation response is transmitted to the authentication server 300. That is, the process of step (28) of the above authentication sequence is performed.

  When receiving an authentication request from the mobile terminal 100, the authentication processing unit 2101 first searches the shared authentication information 2104. If the authentication information of the requesting mobile terminal 100 is stored, the authentication request is transmitted from the mobile terminal 100 that is currently transmitting / receiving data and has newly moved to the area managed by itself. The mobile terminal 100 is authenticated using the authentication information in the shared authentication information 2104, and a terminal movement notification is transmitted to the authentication server 300 via the authentication information sharing control unit 22.

  Note that the terminal movement notification includes at least the identifier of the wireless AP 200 and the ID of the mobile terminal 100.

  Speaking of the authentication sequence, the authentication processing unit 2101 generates a random number when receiving a PPP EAP response via the EAPOL control unit 24 in step (19), and generates an EAPOL control unit as a PPP EAP request in step (20). 24 to the mobile terminal 100. Next, in step (21), when the MD5 message digest function value is received from the mobile terminal via the EAPOL control unit 24, authentication is performed. In steps (22) and (23), the EAPOL control unit 24 performs the authentication. If the authentication result is successful, the encryption key information is transmitted.

  On the other hand, if it is not stored in the shared authentication information 2104, it is determined as an authentication request from a terminal that newly starts transmitting / receiving data, and the authentication processing unit 2101 uses the authentication server 300 to perform relay for performing normal authentication processing. Do. That is, the RADIUS control unit 23 is requested to transmit an Access Request to the authentication server 300. In the authentication sequence, steps (1) to (11) are performed.

  FIG. 11 is a hardware block diagram of the wireless AP 200.

  As shown in the figure, the wireless AP 200 includes an MPU 71 that is a main control unit, a ROM 72 that stores programs and setting data, a RAM 73 that is a work memory, and a wireless LAN module 74 that is a connection interface with the wireless LAN. And a wired LAN module 75 which is a connection interface with the wired LAN.

  Each function of the wireless AP 200 described with reference to FIG. 10 is realized by the MPU 71 executing a program stored in the ROM 72. Various data are held in the ROM 72 or the RAM 73.

  Next, the processing of the authentication information registration / management control unit 21 when the wireless AP 200 having the above function receives some information related to the authentication processing from the authentication server 300 or the mobile terminal 100 will be described with reference to the flow of FIG. explain.

  If the received information is shared authentication information from the authentication server 300 (S01), the received shared authentication information is stored in the shared authentication information 2104 (S02).

  If it is an authentication request from the mobile terminal 100 (S03), it is determined whether it is a new authentication request or a handover (S04). This is determined based on whether or not the authentication information of the requesting mobile terminal 100 is stored in the shared authentication information 2104. If it is stored, it is determined to be a handover, and if it is not stored, a new connection is determined. Judge.

  If it is a handover, authentication is performed using the shared authentication information 2104, and the encryption key is transmitted to the request source mobile terminal 100 (S05).

  If it is a new connection, authentication is performed by the existing authentication procedure performed through the authentication server 300, and the encryption key is transmitted to the request source mobile terminal 100 (S06).

  Thereafter, the terminal movement notification is transmitted from the authentication server 300 (S07).

  If it is an authentication information release request from the authentication server 300 (S08), the authentication information of the instructed mobile terminal 100 is deleted from the shared authentication information 2104 (S09).

  As described above, according to the present embodiment, when the wireless AP 200 holds the authentication information of the mobile terminal 100 when receiving the authentication request from the mobile terminal 100, it generates a random number within itself, Authentication is performed by comparing the message digest function value returned from the mobile terminal 100 with the message digest function value generated using the authentication information in the shared authentication information 2104. .

  For this reason, it is possible to reduce the time required for the authentication process as compared with the case where the authentication server 300 is accessed and authentication is performed. Moreover, the mobile terminal 100 can be realized without adding any new functions.

  Therefore, according to this embodiment, the conventional mobile terminal can be used as it is, and the silent state period at the time of handover in the wireless LAN system can be reduced.

  In the above embodiment, the authentication information release request is sent to all wireless APs 200 registered in the nearby AP management table 3032 as wireless APs 200 (referred to as nearby wireless APs) in the vicinity of the wireless AP 200 intervening before the handover. However, the present invention is not limited to this.

  For example, the wireless AP 200 managed in the neighboring AP management table 3032 as the neighboring wireless AP of the wireless AP 200 intervening before the handover, and the wireless AP 200 managed in the table 3032 as the neighboring wireless AP of the wireless AP 200 after the handover. And may be configured to transmit only to a wireless AP 200 that is managed as a nearby wireless AP before handover and is not a nearby wireless AP after handover. In this case, the wireless AP 200 that mediates before and after the handover is also excluded from the authentication information release request transmission destination.

  In the case of this configuration, the subsequent authentication information sharing request only needs to be transmitted to the neighboring wireless AP after the handover and not the neighboring wireless AP before the handover (except for the wireless AP 200 that mediates before and after the handover).

  For example, in the example of FIG. 7, when the mobile terminal 100 moves from the management area of the wireless AP 201 to the management area of the wireless AP 202, the mobile terminal 100 is transmitted to the wireless AP 210 and the wireless AP 214.

FIG. 1 is an image diagram of the wireless LAN system of this embodiment. FIG. 2 is a diagram illustrating an example of a system configuration of the present embodiment. FIG. 3 is a diagram showing an outline of the authentication procedure of the present embodiment. FIG. 4 shows an authentication sequence according to this embodiment. FIG. 5 is a functional block diagram of the authentication server of the present embodiment. FIG. 6 is a diagram illustrating an example of the authentication information table according to the present embodiment. FIG. 7 is a diagram illustrating an example of a neighboring AP management table according to the present embodiment. FIG. 8 is a diagram showing an example of the mobile terminal management table of the present embodiment. FIG. 9 is a hardware block diagram of the authentication server of this embodiment. FIG. 10 is a functional block diagram of the wireless AP of this embodiment. FIG. 11 is a hardware block diagram of the wireless AP according to the present embodiment. FIG. 12 is a processing flow of the authentication information registration / management control unit of the present embodiment. FIG. 13 is a diagram showing an outline of a conventional authentication procedure. FIG. 14 shows a conventional authentication sequence.

Explanation of symbols

100: mobile terminal, 200: wireless AP, 201-215: wireless AP, 300: authentication server, 400: gateway, 500: external network, 600: partner terminal, 301: RADIUS server unit, 302: wired LAN control unit, 303 : Authentication information sharing management unit, 3011: authentication processing unit, 3012: authentication notification unit, 3013: authentication information table, 3031: sharing management processing unit, 3032: neighbor AP management table, 3033: mobile terminal management table, 21: authentication information Registration / management control unit 22: Authentication information sharing control unit 23: RADIUS control unit 24: EAPOL control unit 25: MAC frame transmission / reception control unit 26: Wired LAN control unit 27: Wireless LAN control unit 2101: Authentication processing unit, 2102: Share registration unit 2103: Delete processing unit, 2104: Share authentication Broadcast

Claims (6)

A mobile communication system comprising a plurality of access points for connecting a mobile terminal to an external network, and an authentication server for authenticating the mobile terminal,
The authentication server is
Upon receiving an authentication request from the mobile terminal via one access point of the plurality of access points, an authentication means for authenticating the mobile terminal;
Authentication information sharing instructing means for transmitting authentication information of the mobile terminal to an access point previously managed as an access point with which the mobile terminal may move to its own management area after authentication by the authentication means; The access point comprises:
Shared authentication information holding means for holding the authentication information of the mobile terminal transmitted from the authentication server holding the authentication information of the mobile terminal as shared authentication information;
When an authentication request is received from the mobile terminal, it is determined whether or not authentication information of the mobile terminal is held in the shared authentication information. If held, authentication information held in the shared information is And a authentication processing unit that mediates authentication of the mobile terminal with the authentication server when authentication is performed and the authentication is not held. An authentication server for authenticating a mobile terminal connected to an external network via an access point,
Upon receiving an authentication request from the mobile terminal via the access point, an authentication means for authenticating the mobile terminal;
Authentication information sharing instructing means for transmitting authentication information of the mobile terminal to an access point previously managed as an access point with which the mobile terminal may move to its own management area after authentication by the authentication means; An authentication server comprising: The authentication server according to claim 2,
The authentication information sharing instruction means
Neighboring access point management that holds information on access points (hereinafter referred to as neighboring access points) that may cause the mobile terminal to move to its own management area for each access point that requests authentication from the authentication server Means,
A movement notification receiving means for receiving a movement notification when a mobile terminal has moved from the access point to the management area of the access point itself;
When the movement notification is received by the movement notification receiving means, an instruction is given to delete the authentication information of the mobile terminal to the access point and its neighboring access points that mediated communication of the mobile terminal before receiving the movement notification. Authentication information release means;
Authentication information transmitting means for transmitting authentication information of the mobile terminal to the access point that has transmitted the movement notification and its neighboring access points after instructing the authentication information canceling means to delete the authentication information. An authentication server characterized by this. The authentication server according to claim 2,
The authentication information sharing instruction means
Neighboring access point management that holds information on access points (hereinafter referred to as neighboring access points) that may cause the mobile terminal to move to its own management area for each access point that requests authentication from the authentication server Means,
A movement notification receiving means for receiving a movement notification when a mobile terminal has moved from the access point to the management area of the access point itself;
When the movement notification is received by the movement notification receiving means, the access point that has transmitted the movement notification from the access point in the vicinity of the access point that mediates communication of the mobile terminal before the movement notification is received and the access Authentication information releasing means for instructing access points excluding neighboring access points to delete authentication information of the mobile terminal;
After instructing to delete the authentication information in the authentication information release means, from an access point near the access point that has transmitted the movement notification, an access point that mediates communication of the mobile terminal before receiving the movement notification and An authentication information transmitting means for transmitting authentication information of the mobile terminal to access points excluding neighboring access points of the access point. An access point for connecting an authenticated mobile terminal to an external network,
Shared authentication information holding means for holding the authentication information of the mobile terminal transmitted from the authentication server holding the authentication information of the mobile terminal as shared authentication information;
When an authentication request is received from the mobile terminal, it is determined whether or not authentication information of the mobile terminal is held in the shared authentication information. If held, authentication information held in the shared information is And an authentication processing means for mediating authentication of the mobile terminal with the authentication server when authentication is performed and not held. A mobile terminal authentication method in a mobile communication system comprising a plurality of access points for connecting a mobile terminal to an external network, and an authentication server for authenticating the mobile terminal,
When the access point receives an authentication request from the mobile terminal,
If the authentication information of the mobile terminal that has been transmitted from the authentication server in advance and held as shared authentication information is searched and the authentication information of the mobile terminal that has transmitted the authentication request is stored in the shared authentication information, the authentication information is Authenticate using
If not, the received authentication request is transmitted to the authentication server, and authentication is performed by the authentication server.

Images