JP2001144812A - Authentication processing system for wireless ip terminal - Google Patents

Abstract

PROBLEM TO BE SOLVED: To simplify the authentication processing of a new wireless IP terminal in wireless LAN while security is secured. SOLUTION: In the authentication processing system of a wireless IP terminal WT in wireless LAN connected to IP network IPN through a gateway GW, an IP terminal management server ISP which is conencted to IPN, is informed by a secure communication means and registers and holds the corresponding list of the IP address of GW of LAN and ID of WT which is to be connected to LAN is installed, and GW his a means informing ISP of the combination of ID of WT and the IP address of GW in accordance with a connection request comprising ID from WT and a means executing a connection processing to LAN of WT to which connection permission from ISP is informed. ISP has a means collating the informed combination with the corresponding list and informing GW of connection permission when they are matched.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a wireless LAN.
(Local area network) and a new wireless IP (internet protocol)
l) Regarding network authentication processing when connecting a terminal.

[0002]

2. Description of the Related Art When a network is constructed in a wireless LAN, network authentication processing must be performed.
Security cannot be secured from an unauthorized access person who intrudes into the vicinity of the wireless LAN. Therefore, the access point AP connected to the wireless LAN
(Access point) and the wireless IP terminal require an authentication procedure, and the access point AP needs to run wireless authentication server software,
In addition, every time a new wireless IP terminal is added, it is necessary to perform registration work of the wireless IP terminal.

FIGS. 5 to 7 are diagrams showing an example of an authentication processing procedure for connecting a new wireless IP terminal to a wireless LAN according to the related art.

As shown in FIGS. 5 and 6, first, an access point AP connected to a wireless LAN
Next, the ID number attached to the wireless IP terminal purchased by the user is registered. The access point AP creates and holds a list of connectable IP terminals as shown in FIG. 7 from the ID numbers set in this way (1).

[0005] Access point A of wireless IP terminal
The connection process to the P is performed when the wireless IP terminal is turned on or the connection start operation is performed with the wireless IP terminal in an area where the connection with the access point AP is possible, or when the wireless connection to the access point AP is disabled. This is started when the wireless IP terminal is moved from a safe area to a wireless connectable area. When the connection process is started, first, the wireless IP terminal synchronizes with the access point AP and transmits a connection request message including the terminal ID to the access point AP at the data link level (2). The access point AP receives the connection request message from the wireless IP terminal, and checks whether or not the transmitted terminal ID is a connectable wireless IP terminal with the list of connectable IP terminals. If the terminal ID is registered in the list, the access point AP permits the wireless IP terminal to connect at the data link level (3), and transmits a connection authentication message to that effect at the data link level as the connection authentication message. Transmit to the IP terminal (4).

[0006] When the connection with the access point AP at the data link level is completed, the wireless IP terminal sets an IP address preset in the wireless IP terminal itself or a DHCP (Dynamic Host Con- trol) defined in RFC2131 of the gateway GW.
A connection at the IP level is established by the IP address assigned by the server unit (figure protocol), and the IP communication is enabled (5).

[0007]

However, in the above prior art, as shown in the above authentication processing, the wireless LA
In order to ensure security in N, a troublesome operation of registering the wireless IP terminal with the access point AP occurs, and the access point AP needs to have wireless authentication software and has a burden of performing authentication processing. As a result, high performance is required and the cost is increased. Since many access points AP are installed, an increase in the cost of the access point leads to an increase in the cost of the entire system. Further, in a wireless LAN such as a home network in which there is no administrator having specialized knowledge, it is very difficult to perform the above-mentioned registration work.

In view of the above problems, an object of the present invention is to provide
It is an object of the present invention to provide a wireless IP terminal authentication processing method that simplifies a procedure for authentication processing of a new wireless IP terminal in a wireless LAN while reducing security and reduces a burden on an access point AP of the wireless IP terminal LAN. is there.

[0009]

The present invention employs the following means in order to solve the above-mentioned problems.

The first means is that the IP network and the I network
A wireless LAN connected to the P network via a gateway, and in the authentication processing method for a wireless IP terminal in the wireless LAN, the IP
An IP terminal management server that is connected to a network and is notified by a secure communication means, and registers and holds a correspondence list of an IP address of a gateway of a wireless LAN and an ID of a wireless IP terminal to be connected to the wireless LAN. Means for notifying the IP terminal management server of a combination of the ID of the wireless IP terminal and the IP address of the gateway in response to a connection request including an ID from the wireless IP terminal, Means for performing connection processing or disconnection processing of the wireless IP terminal with the wireless LAN in response to the connection permission or connection rejection notified from the IP terminal management server, wherein the IP terminal management server The matched combination is compared with the correspondence list, The connection permission if the, if it does not match; and a means for notifying the connection rejection to the gateway.

[0011] The second means is a wireless LA connected to an IP network and an access point and connected to the IP network via a gateway.
N in the wireless LAN
In the P terminal authentication processing method, the correspondence between the IP address of the gateway of the wireless LAN and the ID of the wireless IP terminal to be connected to the wireless LAN is notified by the communication means secured to the IP network and secured. An IP terminal management server for registering and holding a list, wherein the access point notifies the gateway of a connection request including the ID of the wireless IP terminal, and a connection permission or connection rejection notified from the gateway. According to the wireless IP
Means for performing a connection process or a disconnection process of the terminal to the wireless LAN, wherein the gateway responds to a connection request including the ID from the access point and the ID of the wireless IP terminal and the IP of the gateway.
Means for notifying the IP terminal management server of the combination with the address; and means for notifying the access point of connection permission or connection rejection to the access point in response to the connection permission or connection rejection notified from the IP terminal management server. The IP terminal management server includes means for checking the transmitted combination with the correspondence list, and notifying the gateway of connection permission when the combination is matched and rejection of connection when the combination is not matched. Features.

[0012] A third means is that in any one of the first means and the second means, the gateway, when notified of connection permission from the IP terminal management server, communicates with the wireless IP terminal. It is characterized by having means for performing an IP address assignment process.

[0013]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS One embodiment of the present invention will be described with reference to FIGS.

FIG. 1 shows a wireless IP according to this embodiment.
FIG. 2 is a diagram illustrating a terminal authentication processing method, and FIG. 2 is a diagram illustrating a processing procedure in the wireless IP terminal authentication processing method according to the present embodiment.

In FIG. 1, the GW has an IP address (#G
1) has a routing (route control) function on an IP network, and has an IP (internet) in addition to a data link layer protocol.
protocol), and can dynamically assign an IP address to a wireless IP terminal described later. The AP has a function of receiving a radio message from a wireless IP terminal and transferring the message to the gateway GW at the data link level. When the IP is implemented, the AP transmits the message to the gateway GW or another IP terminal at the IP level. It is an access point that can also transfer messages. However, here, the authentication software for the wireless IP terminal is not installed in the access point AP. IP terminal Y and IP terminal Z
The IP terminal and the IP terminal X that have already been connected to the wireless LAN, have completed the predetermined authentication processing, and have been assigned respective IP addresses (#B and #A) are newly assigned to the wireless LA.
N, a wireless IP terminal and an ISP to which an authentication process is performed and an IP address (#C) is assigned is connected to an IP network such as the Internet. An IP terminal management server that has a correspondence list and performs authentication processing of a new wireless IP terminal, for example, an IP terminal management service provider.

FIGS. 3 (a) and 3 (b) show different examples of correspondence lists of IP addresses and IP terminal IDs of registered gateways held by the IP terminal management server ISP, and FIG. 4 shows gateways. FIG. 4 is a diagram illustrating an example of a correspondence list of IP addresses and IP terminal IDs of IP terminals held by the GW.

Next, an authentication processing procedure in an authentication processing method for a wireless IP terminal according to the present embodiment will be described with reference to FIGS.

The procedure for authenticating the wireless IP terminal X obtained by purchase or the like to the wireless LAN is as shown in FIG.
As shown in (a) and FIG. 2, before wirelessly connecting the wireless IP terminal to the LAN, the ID (X) attached to the wireless IP terminal X and the IP address of the gateway GW of the wireless LAN to be connected from now on (# G1) is transferred to a secure communication means such as a postcard, a facsimile, a dedicated line, or the like.
Tell the terminal management service provider. The IP terminal management service provider transmits the transmitted wireless LAN gateway G.
W IP address (# 1) and wireless IP terminal ID
Based on (X) on the IP terminal management server ISP, FIG.
A correspondence list of IDs of IP terminals connectable to the registration gateway GW as shown in FIG. 3A or FIG. 3B is created and held (1).

Next, the procedure for connecting the wireless IP terminal X to the wireless LAN is as shown in FIGS. 1 (b) and 2, by first synchronizing the new wireless IP terminal X with the access point AP. A connection request message including the terminal ID (X) at the data link level is transmitted to the access point AP (2). The access point AP
From the connection request message, the wireless IP terminal X
D (X) is extracted, and a connection request message including this ID (X) is transferred to the gateway GW (3). This message transfer may be at the data link level or at the IP level. However, when transferring at the IP level, it is necessary to mount the IP on the access point AP.

Next, when the gateway GW receives the message from the access point AP, it creates a connection request message including the ID (X) of the wireless IP terminal X and the IP address (# G1) of the gateway GW itself. The information is transmitted to the IP terminal management server ISP connected to the Internet (4).

From the connection request message sent from the gateway GW, the IP terminal management server ISP sends the wireless LAN requesting connection to the wireless LAN.
The ID (X) of the P terminal and the IP address (# G1) of the gateway GW of the wireless LAN are taken out, and the correspondence list of the IDs of the IP terminals that can be connected to the already-registered gateway GW is transmitted. It is checked whether or not the combination of the received IP address (# G1) and ID (X) allows connection (5).

If the connection is permitted as a result of the check, the IP terminal management server ISP sends a connection permission message to the gateway GW at the IP level (6).

Upon receiving the connection permission message from the IP terminal management server ISP, the gateway GW determines an IP address to be assigned to the wireless IP terminal X (7), and sends the connection permission message including this IP address to the access point AP. Depending on the protocol level implemented, the data link level or I
The message is transmitted to the access point AP as a P-level message (8).

The access point AP is a wireless IP
The terminal X has an IP assigned to the wireless IP terminal X.
A connection permission message including the address is transmitted at the data link level, and the process of connecting the wireless IP terminal X to the wireless LAN is completed (9).

If the IP terminal management server ISP first determines that the connection is not permitted as a result of the investigation, it transmits a connection rejection message instead of the connection permission message, and transmits a wireless message at the gateway GW. The process of allocating the IP address to the IP terminal is not performed. If the message received by the wireless IP terminal is a connection rejection message, the connection to the wireless LAN is not performed.

In this embodiment, the gateway GW
Although the example in which the access point AP and the access point AP are separately provided has been described, the gateway GW may have the function of the access point AP.

[0027]

According to the first aspect of the present invention, the IP terminal management service provider is notified by a secured communication means, and the IP terminal management server notifies the IP terminal management server of the ID of the wireless IP terminal and the gateway to be connected thereto. IP
As long as the address is registered, the process of connecting the wireless IP terminal to the wireless LAN can be performed easily and with security maintained. That is, by replacing the troublesome authentication processing on the conventional wireless LAN with the IP terminal management server owned by the service provider having the specialized knowledge, the connection processing of the wireless IP terminal is automatically performed on the wireless LAN. Wireless LA without special expertise
Even N administrators can easily perform the registration processing of the wireless IP terminal.

According to the second aspect of the present invention, in addition to the effect of the first aspect, the access point does not need to have the authentication software, so that the load on the access point is reduced and the access point is simplified. And the cost can be reduced.

[Brief description of the drawings]

FIG. 1 is a diagram illustrating an authentication processing method of a wireless IP terminal according to an embodiment of the present invention.

FIG. 2 is a diagram showing a processing procedure in a wireless IP terminal authentication processing method according to the embodiment;

FIG. 3 shows an IP address of a registration gateway and an IP terminal I held by an IP terminal management server ISP according to the embodiment.
It is a figure showing mutually different examples of the correspondence list of D.

FIG. 4 is a diagram illustrating an example of a correspondence list of IP addresses and IP terminal IDs held by the gateway GW according to the present embodiment.

FIG. 5 is a diagram for explaining an authentication processing method for a wireless IP terminal according to the related art.

FIG. 6 is a diagram showing a processing procedure in a wireless IP terminal authentication processing method according to the related art.

FIG. 7 is a diagram showing a list of connectable wireless IP terminals of an access point AP according to the related art.

[Explanation of symbols]

X New wireless IP terminal Y, Z Existing wireless IP terminal AP Access point GW Gateway ISP IP terminal management server # G1 IP address of gateway GW #A, #B, #C IP terminal Z, IP terminal Y, IP terminal X Each IP address

Continued on the front page F term (reference) 5J104 AA07 EA16 KA02 MA04 NA24 PA07 5K030 GA04 GA15 GA17 HA08 HC14 HD03 HD06 JL01 JT02 KA06 LD20 5K033 AA08 AA09 CC01 DA01 DA06 DA17 DB18 EC02 9A001 CC05 CC06 CC07 CC08 DD10 HJ34 JJ18

Claims (3)

[Claims] An IP network and a wireless LAN connected to the IP network via a gateway
Wireless LAN in the wireless LAN.
In the authentication processing method of the P terminal, correspondence between the IP address of the gateway of the wireless LAN and the ID of the wireless IP terminal to be connected to the wireless LAN, notified by the secure communication means connected to the IP network An IP terminal management server for registering and holding a list, wherein the gateway responds to a connection request including an ID from the wireless IP terminal, and stores a combination of the ID of the wireless IP terminal and the IP address of the gateway. IP
Means for notifying the terminal management server, and means for performing connection processing or disconnection processing of the wireless IP terminal to the wireless LAN in response to the connection permission or connection rejection notified from the IP terminal management server, The IP terminal management server has means for checking the notified combination with the correspondence list, and notifying the gateway of connection permission when the combination is matched, and rejecting connection if not matched. Authentication processing method for a wireless IP terminal. 2. An authentication processing method for a wireless IP terminal in the wireless LAN, comprising: an IP network, an access point connected thereto, and a wireless LAN connected to the IP network via a gateway. The IP terminal management server is connected to the IP terminal management server and notified by the secure communication means to register and hold a correspondence list of the IP address of the gateway of the wireless LAN and the ID of the wireless IP terminal to be connected to the wireless LAN. The access point has means for notifying the gateway of a connection request including the ID of the wireless IP terminal, and the access point to the wireless LAN of the wireless IP terminal in response to the connection permission or connection rejection notified from the gateway. And means for performing connection processing or not connection processing, the gateway, in response to a connection request including the ID from the access point, wherein the combination of the ID and the IP address of the gateway of the wireless IP terminal I
Means for notifying a P terminal management server, and means for notifying the access point of connection permission or connection rejection to the access point in response to the connection permission or connection rejection notified from the IP terminal management server; Means for checking the transmitted combination with the correspondence list, and notifying the gateway of connection permission if they match, and rejecting connection if they do not match, to the gateway. Authentication processing method. 3. The gateway according to claim 1, wherein the gateway, when notified of connection permission from the IP terminal management server, assigns an IP address of the wireless IP terminal. An authentication processing method for a wireless IP terminal, comprising: