JP2015204499A - Communication system, access point device, server device, gateway device, and communication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication system that enables devices at both ends of a communication path to reliably obtain IP addresses of the respective opposite devices when a secure communication path is established.SOLUTION: A communication system includes an access point device and a server device. The access point device comprises: means for transmitting an acquisition request for address information on an opposite device to the server device; means for receiving the address information on the opposite device transmitted by the server device in response to the acquisition request; and means for establishing a secret communication path to the opposite device on the basis of the address information on the opposite device. The server device comprises: means for storing the address information on the opposite device to which the access point device should connect; and means that refers to the address information storage means, identifies the address information on the opposite device, and transmits the address information as a response to the acquisition request to the access point device when the acquisition request for the address information on the opposite device is received from the access point device.

Description

  The present invention relates to a communication system, an access point device, a server device, a gateway device, and a communication method for establishing a secure communication path.

  Conventionally, it is known to securely configure a secure network by distributing information related to the configuration and setting of secure communication (see, for example, Patent Document 1). In order to configure the network safely, in Patent Document 1, the server device can communicate with the information processing device connected to the network, and the address of the authenticated information processing device and the authenticated information processing device. And communication setting information for enabling establishment of secure communication between the storage means. The information processing apparatus that has notified the address is stored in the storage means and the registered information processing apparatus is authenticated. Then, by distributing the address of the authenticated information processing apparatus and the communication setting information to the information processing apparatus connected to the network, a security-protected network can be configured safely.

JP 2008-276686 A

  By the way, in recent years, with the spread of public wireless access points (hereinafter referred to as APs), public wireless LAN usage scenes such as Wi-Fi (registered trademark, the same applies hereinafter) are being used not only in homes but also in various places. It is increasing. FIG. 18 is a diagram illustrating an example of a usage form of a public wireless LAN. In the usage form shown in FIG. 18, it is expected that a plurality of users belong to a single public wireless AP and communicate. Therefore, when a malicious user (owner) operates a public wireless AP, there is a possibility that the guest user's communication may be intercepted by the malicious user.

  In order to solve such a problem, a secure communication path such as IPsec (Security Architecture for Internet Protocol) is established between an AP and a device facing the AP (for example, Wi-Fi GW (gateway)). Effective communication is effective. IPsec can be established from any of the devices at both ends of the communication path.

  However, when establishing a secure communication path using IPsec, the IP address of the opposite device must be acquired. 19 and 20 are diagrams illustrating a network configuration in the case where a secure communication path is established between an AP and a Wi-Fi GW (Wi-Fi gateway). For example, when establishing an IPsec communication path with the Wi-Fi GW using the AP as an initiator, after the AP is authenticated by the authentication server, the IP address of the IPsec termination router connected to the Wi-Fi GW is set. It needs to be acquired (see FIG. 19). In addition, when the Wi-Fi GW serves as an initiator to establish an IPsec communication path with the AP, after the AP is authenticated by the authentication server, the IPsec termination router connected to the Wi-Fi GW is the IP of the AP. An address needs to be acquired (see FIG. 20). Note that the IPsec termination router may be included in the Wi-Fi GW.

  As described above, in the network configuration shown in FIGS. 19 and 20, when a secure communication path is established between the AP and the Wi-Fi GW, the IP address of the opposite device is acquired through the secure communication path. There is a need to. In the network configuration according to the prior art, there is a problem that the IP address of the opposite device cannot be easily obtained.

  The present invention has been made in view of such circumstances, and in establishing a secure communication path, a communication system that can reliably acquire the IP addresses of the opposing apparatuses in the apparatuses at both ends of the communication path. An object is to provide an access point device, a server device, a gateway device, and a communication method.

  The present invention is a communication system including an access point device that connects a user terminal to a communication network, and a server device, and the access point device transmits an address information acquisition request of the opposite device to the server device. Based on the address information of the opposing device, the address information receiving means for receiving the address information of the opposing device transmitted by the server device in response to the acquisition request, and the address information of the opposing device. Communication path establishing means for establishing a secret communication path, wherein the server device stores address information of the opposing device to which the access point device is to be connected, and the access point device to the opposing device. When the address information acquisition request is received, the address information storage means is referred to Identify the address information of the apparatus, characterized by comprising an address information transmitting means for transmitting to the access point device the address information as a response to the acquisition request.

  The present invention is characterized in that the address information acquisition request of the opposite apparatus is transmitted at a predetermined timing.

  According to the present invention, the address information acquisition request of the opposing device is included in an authentication request when the server device authenticates the user terminal, and the address information of the opposing device is included in the authentication result information for the authentication request. It is characterized by including.

  The present invention is a communication system including an access point device that connects a user terminal to a communication network, a gateway device that connects an access point device to the communication network, and a server device, wherein the access point device includes the user Authentication request transmission means for transmitting the terminal authentication request including its own address information to the server device is provided, and the server device is configured to cooperate with the gateway device by DHCP at the time of authentication of the user terminal. Address information transmitting means for transmitting address information of the access point device to the gateway, the gateway device receiving address information of the access point device from the server device, and the access point device Address information Hazuki, characterized in that it comprises a communication path establishment means for establishing a secret communication channel to the access point.

  The present invention provides an access point device for connecting a user terminal to a communication network, address information storage means for storing address information of a counter device to which the access point device is to be connected, and address information of the counter device from the access point device Address information for identifying the address information of the opposing device with reference to the address information storage means and transmitting the address information to the access point device as a response to the acquisition request when the acquisition request is received An access point device in a communication system including a server device including a transmission unit, an acquisition request transmission unit that transmits an acquisition request for address information of the opposite device to the server device, and responding to the acquisition request And receiving the address information of the opposite device transmitted by the server device. Address information receiving means, based on the address information of the opposite device, characterized by comprising a communication path establishment means for establishing a secret communication path to the opposite apparatus.

  In the present invention, in order to connect a user terminal to a communication network, an acquisition request transmission unit that transmits an acquisition request for address information of a counter device to a server device, and the server device transmits the request in response to the acquisition request An access point device comprising: address information of the opposite device; address information receiving means for receiving; and communication path establishment means for establishing a secret communication path for the opposite device based on the address information of the opposite device; and the server An address information storage means for storing address information of the opposing device to be connected to the access point device, and acquisition of the address information of the opposing device from the access point device When the request is received, the address information storage means is referred to and the address of the opposing device is referred to. Identify distribution, characterized by comprising an address information transmitting means for transmitting to the access point device the address information as a response to the acquisition request.

  The present invention relates to an access point device comprising an authentication request transmitting means for transmitting a user terminal including its own address information to a server device in order to connect the user terminal to a communication network, and an access point device For connecting to the communication network, an address information receiving means for receiving address information of the access point device, and a communication path for establishing a secret communication path for the access point based on the address information of the access point device An address information of the access point device when cooperating with the gateway device by DHCP at the time of authentication of the user terminal, the server device in a communication system including a gateway device comprising an establishing means and a server device Sent to the gateway Characterized in that it comprises the less information transmitting means.

  The present invention relates to an access point device comprising an authentication request transmitting means for transmitting a user terminal including its own address information to a server device in order to connect the user terminal to a communication network, and an access point device And a gateway device that connects to the communication network and a server comprising address information transmitting means for transmitting address information of the access point device to the gateway when cooperating with the gateway device by DHCP at the time of authentication of the user terminal An address information receiving means for receiving address information of the access point device from the server device, and the access point based on the address information of the access point device. Secret Characterized in that it comprises a communication path establishment means for establishing a communication path.

  The present invention provides communication performed by a communication system including an access point device that connects a user terminal to a communication network, and a server device that includes address information storage means for storing address information of the opposite device to which the access point device is to be connected. An acquisition request transmission step in which the access point apparatus transmits an acquisition request for address information of the opposing apparatus to the server apparatus, and the server apparatus transmits address information of the opposing apparatus from the access point apparatus. Address information for identifying the address information of the opposing device with reference to the address information storage means and transmitting the address information to the access point device as a response to the acquisition request when the acquisition request is received A transmission step, and the access point device responds to the acquisition request. , Address information receiving step of receiving and address information of the opposite device transmitted by the server device, and communication in which the access point device establishes a secret communication path to the opposite device based on the address information of the opposite device And a path establishing step.

  The present invention is a communication method performed by a communication system including an access point device that connects a user terminal to a communication network, a gateway device that connects the access point device to the communication network, and a server device, the access point device An authentication request transmission step of transmitting the authentication request of the user terminal including its own address information to the server device, and the server device cooperates with the gateway device by DHCP at the time of authentication of the user terminal. An address information transmitting step of transmitting address information of the access point device to the gateway, an address information receiving step of receiving the address information of the access point device from the server device, and the gateway Equipment Based on said address information of the access point device, and having a communication path establishment step of establishing a secret communication channel to the access point.

  According to the present invention, a secure communication path can be established by acquiring the address of the opposite device, so that when a guest user uses a public wireless LAN, there is no worry of communication interception by the AP owner. The effect that it becomes possible to communicate.

It is a block diagram which shows the structure of one Embodiment of this invention. It is a block diagram which shows the detailed structure of the communication system shown in FIG. It is explanatory drawing which shows the address acquisition method by a 1st method. It is a sequence diagram which shows operation | movement of the communication system shown in FIG. It is a flowchart which shows the processing operation of AP1 shown in FIG. It is a flowchart which shows the processing operation of the authentication server 4 shown in FIG. It is explanatory drawing which shows the address acquisition method by a 2nd method. It is explanatory drawing which shows the address acquisition method by a 3rd method. It is explanatory drawing which shows the address acquisition method by the 4th method. It is a sequence diagram which shows operation | movement of the communication system shown in FIG. It is a flowchart which shows the processing operation of AP1 shown in FIG. It is a flowchart which shows the processing operation of the connecting point information server 5 shown in FIG. It is explanatory drawing which shows the address acquisition method by the 5th method. It is a sequence diagram which shows operation | movement of the communication system shown in FIG. It is a flowchart which shows the processing operation of AP1 shown in FIG. It is a flowchart which shows the processing operation of the authentication server 4 shown in FIG. It is a flowchart which shows the processing operation of Wi-Fi GW6 shown in FIG. It is a figure which shows an example of the utilization form of public wireless LAN. It is a figure which shows the network structure in the case of establishing a secure communication path between AP and Wi-Fi GW. It is a figure which shows the network structure in the case of establishing a secure communication path between AP and Wi-Fi GW.

  Hereinafter, a communication system according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the embodiment. In this figure, reference numeral 1 denotes an AP serving as one end when establishing a secure communication path. Reference numeral 2 denotes a user terminal that performs communication with the AP 1 via a wireless LAN using Wi-Fi. Reference numeral 3 denotes a network to which AP1 is connected.

  Reference numeral 4 denotes an authentication server that is connected to the network 3 and authenticates the user terminal 2. Reference numeral 5 denotes a connection destination information server that is connected in the network 3 and provides connection destination information to the user terminal 2. Reference numeral 6 denotes a Wi-Fi GW that is connected to the network 3 and serves as the other end when establishing a secure communication path. Reference numeral 7 denotes an ISP (Internet Services Provider) which is a connection destination to which the user terminal 2 is connected. The user terminal 2 is connected to the Internet via the ISP 7.

  Next, the detailed configuration of the communication system shown in FIG. 1 will be described with reference to FIG. FIG. 2 is a block diagram showing a detailed configuration of the communication system shown in FIG. In this figure, it is assumed that the connection destination information server 5 is built in the authentication server 4. Here, detailed configurations of the AP 1, the authentication server 4, and the Wi-Fi GW 6 will be described. In FIG. 2, reference numeral 11 denotes a security function unit that establishes a secure communication path, and includes an IPsec termination function unit 111 that performs IPsec termination processing.

  Reference numeral 12 denotes a Radius function unit that authenticates the user terminal 2 by making an inquiry to the authentication server. Reference numeral 121 denotes an authentication function unit that authenticates the user terminal 2. Reference numeral 122 denotes a connection destination information acquisition function unit that acquires connection destination information from the connection destination information server 5. Reference numeral 123 denotes an authentication result database (DB) that stores information on the authentication result of the user terminal 2. Reference numeral 13 denotes a WAN IF (interface) that connects the Wi-Fi GW 6 or the authentication server 4. Reference numeral 14 denotes a WLAN IF (interface) that connects the user terminal 2.

  Reference numeral 41 denotes a connection destination URI database (DB) that stores a connection destination URI (Uniform Resource Identifier). Reference numeral 42 denotes a WAN IF (interface) for connecting to the AP1. Reference numeral 61 denotes a security function unit that establishes a secure communication path, and includes an IPsec termination function unit 611 that performs IPsec termination processing. Reference numeral 62 denotes a WAN IF (interface) that connects the ISP 7. Reference numeral 63 denotes a WAN IF (interface) for connecting to the AP1.

  Note that the IPsec termination function unit 611 may be connected by a separate device. Further, the connection destination information server 5 may be installed separately from the authentication server 4.

<First method>
Next, an address acquisition method according to the first method will be described. FIG. 3 is an explanatory diagram showing an address acquisition method according to the first method. The first method pays attention to “Radius Access Accept” used for authentication result notification, and assigns the end address of Wi-Fi GW 6 to the authentication result information returned from authentication server 4 to AP 1, thereby opposing device of AP 1. The IP address of Wi-Fi GW6 is notified to AP1. The authentication server 4 can add the address information of the Wi-Fi GW 6 to the attribute of the Radius packet of the authentication result, so that the AP 1 can know the address that becomes the connection destination when establishing a secure communication path by IPsec. Become.

  The lower diagram shown in FIG. 3 is a diagram showing the format of the Radius Access Accept. Information whose tag is “1” is information for connecting the Wi-Fi GW 6 and includes notification of a tunnel destination address, designation of a tunnel type, designation of a transfer protocol, and priority information of multiple tunnel information. Information whose tag is “2” is information on the end address of IPsec, and similarly includes notification of a tunnel destination address, designation of a tunnel type, designation of a transfer protocol, and priority information of multiple tunnel information. AP1 acquires the IPsec end address from the information whose tag is “2”, and establishes a secure communication path by IPsec.

  Next, the operation of the communication system shown in FIGS. 1 and 2 will be described with reference to FIG. FIG. 4 is a sequence diagram showing an operation of the communication system shown in FIGS. First, when the user terminal 2 belongs to AP1 (step S1), the user terminal 2 requests user authentication from the AP1 (step S2). In response to this, the authentication function unit 121 transmits a Radius Access Request (authentication request) to the authentication server 4 (step S3). This authentication request includes the user terminal ID, password, and MAC address.

  Next, the authentication server 4 authenticates the user terminal 2 and returns the result to the AP 1 as a Radius Access Accept (authentication result) (step S4). As described above, the authentication result includes the end address. By receiving this authentication result, AP1 can acquire a termination address for establishing a communication path by IPsec. Subsequently, the AP 1 and the authentication server 4 exchange Radius Accounting Request (START) / Response (step S5).

  Next, the AP 1 establishes a communication path by IPsec with the Wi-Fi GW 6 by the following processing operation (steps S6 to S18). At this time, a communication path is established by IPsec using the acquired termination address. Since the operation for establishing a communication path by IPsec is a known operation, it will be briefly described here. First, the IPsec termination function unit 111 transmits an ISAKMP-SA proposal (step S6). In response to this, the IPsec termination function unit 611 returns ISAKMP-SA selection (step S7).

  Next, the IPsec termination function unit 111 performs key information exchange (step S8). The IPsec termination function unit 611 exchanges key information (step S9). Subsequently, the IPsec termination function unit 111 performs ID / authentication information notification (step S10). In addition, the IPsec termination function unit 611 performs ID / authentication information notification (step S11).

  Next, the IPsec termination function unit 111 transmits NOTIFICATION (Initial-contact) (step S12). Also, the IPsec termination function unit 611 transmits NOTIFICATION (Initial-contact) (step S13). Subsequently, the IPsec termination function unit 111 performs IP-sec SA proposal, SPI value notification, ID data notification, and authentication information notification (step S14). Further, the IPsec termination function unit 611 performs IP-sec SA proposal, SPI value notification, ID data notification, and authentication information notification (step S15).

  Next, the IPsec termination function unit 111 performs secret key generation (step S16). Also, the IPsec termination function unit 611 generates a secret key (step S17). Then, the IPsec termination function unit 111 and the IPsec termination function unit 611 perform IKE (notification of authentication information) (step S18). With this processing operation, a communication path by IPsec is established between AP1 and Wi-Fi GW6. And AP1 and Wi-Fi GW6 start the encrypted data communication (step S19).

  Next, operations of the communication system shown in FIGS. 1 and 2 will be described with reference to flowcharts shown in FIGS. FIG. 5 is a flowchart showing the processing operation of AP1 shown in FIG. FIG. 6 is a flowchart showing the processing operation of the authentication server 4 shown in FIG. First, when the user terminal 2 belongs to AP1 (step S21), AP1 starts authentication (step S22). Then, the AP 1 transmits an authentication request to the authentication server 4.

  In response to this, the authentication server 4 receives an authentication request from the AP 1 (step S31). The authentication server 4 performs authentication confirmation (step S32). If the confirmation is OK, the authentication server 4 determines an address to which the AP 1 is connected from the connection destination URI DB 41 (step S33). Then, the authentication server 4 gives a connection destination address and returns an authentication result to the AP 1 (step S34). On the other hand, if the result of the authentication confirmation is confirmation NG, the connection destination address is not given and the authentication result (failure) is returned to AP1 (step S35).

  Next, AP1 receives the authentication result from the authentication server 4 (step S24). And AP1 confirms an authentication result (step S25), and if it is OK, it will be determined whether IPsec is not established in a target address (step S26). If not established, AP1 establishes IPsec (step S27). On the other hand, if it has been established, the process of step S27 is skipped.

  Next, AP1 pays out DHCP (Dynamic Host Configuration Protocol) to the user terminal 2 (step S28). And AP1 starts data communication (step S29). On the other hand, if the authentication result is NG, the authentication fails (step S30).

  As described above, since the end address is included in the authentication result, when establishing a secure communication path, the devices at both ends of the communication path can reliably acquire the IP addresses of the opposing apparatuses.

<Second method>
Next, an address acquisition method according to the second method will be described. FIG. 7 is an explanatory diagram showing an address acquisition method according to the second method. Similar to the first method, the second method pays attention to “Radius Access Accept” used for the authentication result notification, and notifies the AP 1 by giving the end address of the Wi-Fi GW 6 to the authentication result. However, unlike the first method, AP1 can know the end address that is the connection destination of IPsec by adding address information in the attribute of “Ex-User-Prefix” that can set any item. It becomes.

  The lower diagram shown in FIG. 7 is a diagram showing the format of the Radius Access Accept. In the second method, the end address of IPsec is notified using Vender Specific (26). AP1 acquires the IPsec end address from this information, and establishes a secure communication path by IPsec.

  Compared to the first method, the second method does not use a tag, so the number of attributes can be reduced and processing can be reduced.

  The processing operation when the second method is used is the same as the processing operation shown in FIGS. 4 to 6 (processing operation when the first method is used), and thus detailed description thereof is omitted here. To do.

<Third method>
Next, an address acquisition method according to the third method will be described. FIG. 8 is an explanatory diagram showing an address acquisition method according to the third method. As in the first and second methods, the third method pays attention to “Radius Access Accept” used for notification of the authentication result, and notifies the AP 1 by giving the end address of the Wi-Fi GW 6 to the authentication result. To do. However, unlike the first method, by adding address information in the attribute of “Ex-User-Prefix” in which an arbitrary item can be set, it is possible for the AP to know the address to which the IPsec is connected. Become.

  In the third method, as shown in the lower diagram of FIG. 8, only the Vender Specific (26) is used to notify both the tunnel connection destination and the IPsec end address.

  Compared to the first and second methods, the third method does not use a tag, so the number of attributes can be reduced and processing can be reduced.

  The processing operation when the third method is used is the same as the processing operation shown in FIGS. 4 to 6 (processing operation when the first method is used), and thus detailed description thereof is omitted here. To do.

<Fourth method>
Next, an address acquisition method according to the fourth method will be described. FIG. 9 is an explanatory diagram showing an address acquisition method according to the fourth method. Unlike the first to third methods, the fourth method is not at the time of authentication, but the connection destination information server 5 notifies the AP 1 of the IPsec end address in advance. In the fourth method, the connection destination information server 5 notifies the IPsec end address in advance using a Radius packet at a timing such as startup.

  In the fourth method, as shown in the lower diagram of FIG. 9, only the Vender Specific (26) is used to notify the end address of IPsec.

  Next, with reference to FIG. 10, an operation in which the communication system shown in FIGS. 1 and 2 acquires a termination address using the fourth method will be described. FIG. 10 is a sequence diagram showing an operation of the communication system shown in FIGS. In this figure, the same parts as those shown in FIG. The operation shown in this figure is different from the operation shown in FIG. 4 in that processing operations in steps S41 and S42 are added.

  First, the connection destination information acquisition function unit 122 transmits a connection destination information request (Radius Access Request (IPsec connection destination information acquisition)) to the connection destination information server 5 (step S41). In response to this, the connection destination information server 5 reads the connection destination address from the connection destination URI DB 41, and returns a response including this connection destination address (Radius Access Accept (connection destination information response)) to the AP 1 (step S42). With this operation, the end address can be acquired.

  Next, when the user terminal 2 belongs to AP1 (step S1), the user terminal 2 requests user authentication from the AP1 (step S2). In response to this, the authentication function unit 121 transmits a Radius Access Request (authentication request) to the authentication server 4 (step S3). This authentication request includes the user terminal ID, password, and MAC address.

  Next, the authentication server 4 authenticates the user terminal 2 and returns the result to the AP 1 as a Radius Access Accept (authentication result) (step S4). As described above, the authentication result includes the end address. By receiving this authentication result, AP1 can acquire a termination address for establishing a communication path by IPsec. Subsequently, the AP 1 and the authentication server 4 exchange Radius Accounting Request (START) / Response (step S5).

  Next, the AP 1 establishes a communication path by IPsec with the Wi-Fi GW 6 by the following processing operation (steps S6 to S18). At this time, a communication path is established by IPsec using the acquired termination address. Since the operation for establishing a communication path by IPsec is a known operation, it will be briefly described here. First, the IPsec termination function unit 111 transmits an ISAKMP-SA proposal (step S6). In response to this, the IPsec termination function unit 611 returns ISAKMP-SA selection (step S7).

  Next, the IPsec termination function unit 111 performs key information exchange (step S8). The IPsec termination function unit 611 exchanges key information (step S9). Subsequently, the IPsec termination function unit 111 performs ID / authentication information notification (step S10). In addition, the IPsec termination function unit 611 performs ID / authentication information notification (step S11).

  Next, the IPsec termination function unit 111 transmits NOTIFICATION (Initial-contact) (step S12). Also, the IPsec termination function unit 611 transmits NOTIFICATION (Initial-contact) (step S13). Subsequently, the IPsec termination function unit 111 performs IP-sec SA proposal, SPI value notification, ID data notification, and authentication information notification (step S14). Further, the IPsec termination function unit 611 performs IP-sec SA proposal, SPI value notification, ID data notification, and authentication information notification (step S15).

  Next, the IPsec termination function unit 111 performs secret key generation (step S16). Also, the IPsec termination function unit 611 generates a secret key (step S17). Then, the IPsec termination function unit 111 and the IPsec termination function unit 611 perform IKE (notification of authentication information) (step S18). With this processing operation, a communication path by IPsec is established between AP1 and Wi-Fi GW6. And AP1 and Wi-Fi GW6 start the encrypted data communication (step S19).

  Next, the operation of the communication system shown in FIGS. 1 and 2 for obtaining the end address using the fourth method will be described with reference to the flowcharts shown in FIGS. FIG. 11 is a flowchart showing the processing operation of AP1 shown in FIG. FIG. 12 is a flowchart showing the processing operation of the connection destination information server 5 shown in FIG. First, AP1 transmits a connection destination information request to the connection destination information server 5 at a connection trigger timing (step S51) (step S52). The connection trigger timing can specify any connection trigger such as when the AP is activated or once a day.

  Receiving this, the connection destination information server 5 receives a connection destination request from AP1 (step S71). Subsequently, the connection destination information server 5 determines an address to which the AP 1 is connected from the connection destination URI DB 41 (step S72). Then, the connection destination information server 5 assigns a connection destination address and returns a response to the request to the AP 1 (step S73). In response, AP1 receives address information from the connection destination information server 5 (step S53).

  Next, when the user terminal 2 belongs to AP1 (step S54), AP1 transmits an authentication request to the authentication server 4 (step S55). The processing operation of the authentication server 4 here is the same as the processing operation shown in FIG. And AP1 receives an authentication result from the authentication server 4 (step S56). And AP1 confirms an authentication result (step S57), and if it is OK, it will be determined whether IPsec is not established in a target address (step S58). If not established, AP1 establishes IPsec (step S59). On the other hand, if it has been established, the process of step S27 is skipped.

  Next, AP1 issues a Dynamic Host Configuration Protocol (DHCP) to the user terminal 2 (step S60). And AP1 starts data communication (step S61). On the other hand, if the authentication result is NG, the authentication fails (step S62).

  As described above, since the address is acquired in advance, it is not necessary to transmit the address every time authentication is performed, and the processing load can be reduced.

<Fifth method>
Next, an address acquisition method according to the fifth method will be described. FIG. 13 is an explanatory diagram showing an address acquisition method according to the fifth method. The fifth method is a method in which the Wi-Fi GW 6 acquires the address of the AP1. In the fifth method, at the time of cooperation with the authentication server 4 by DHCP, the address of the AP 1 that is the connection destination is notified to the Wi-Fi GW 6. Paying attention to the parameter of the Radius access request used for user authentication, when notifying the IP address of AP1, the authentication server 4 notifies the assigned Wi-Fi GW 6 of the IP address of AP1.

  In the fifth method, as shown in the lower diagram of FIG. 13, the AP 1 notifies the authentication server 4 of its own IP address (IPsec end address) using NAS-IPv6-Address (95).

  Thereby, the Wi-Fi GW 6 can know the IPsec end address of AP1.

  Next, the operation of the communication system shown in FIGS. 1 and 2 will be described with reference to FIG. FIG. 14 is a sequence diagram showing an operation of the communication system shown in FIGS. In this figure, the same parts as those shown in FIG. The operation shown in this figure is different from the operation shown in FIG. 4 in that processing operations in steps S81 and S82 are added.

  First, when the user terminal 2 belongs to AP1 (step S1), the user terminal 2 requests user authentication from the AP1 (step S2). In response to this, the authentication function unit 121 transmits a Radius Access Request (authentication request) to the authentication server 4 (step S3). This authentication request includes the user terminal ID, password, MAC address, and AP1 IP address.

  Next, the authentication server 4 authenticates the user terminal 2 and returns the result to the AP 1 as a Radius Access Accept (authentication result) (step S4). Subsequently, the AP 1 and the authentication server 4 exchange Radius Accounting Request (START) / Response (step S5).

  Next, AP1 transmits a DHCP request to Wi-Fi GW6 (step S81). At this time, the authentication server 4 notifies the Wi-Fi GW 6 of the IP address information of AP1 (step S82). With this operation, the Wi-Fi GW 6 can acquire the IP address of the AP 1.

  Next, the AP 1 establishes a communication path by IPsec with the Wi-Fi GW 6 by the following processing operation (steps S6 to S18). At this time, a communication path is established by IPsec using the acquired termination address. Since the operation for establishing a communication path by IPsec is a known operation, it will be briefly described here. First, the IPsec termination function unit 111 transmits an ISAKMP-SA proposal (step S6). In response to this, the IPsec termination function unit 611 returns ISAKMP-SA selection (step S7).

  Next, the IPsec termination function unit 111 performs key information exchange (step S8). The IPsec termination function unit 611 exchanges key information (step S9). Subsequently, the IPsec termination function unit 111 performs ID / authentication information notification (step S10). In addition, the IPsec termination function unit 611 performs ID / authentication information notification (step S11).

  Next, the IPsec termination function unit 111 transmits NOTIFICATION (Initial-contact) (step S12). Also, the IPsec termination function unit 611 transmits NOTIFICATION (Initial-contact) (step S13). Subsequently, the IPsec termination function unit 111 performs IP-sec SA proposal, SPI value notification, ID data notification, and authentication information notification (step S14). Further, the IPsec termination function unit 611 performs IP-sec SA proposal, SPI value notification, ID data notification, and authentication information notification (step S15).

  Next, the IPsec termination function unit 111 performs secret key generation (step S16). Also, the IPsec termination function unit 611 generates a secret key (step S17). Then, the IPsec termination function unit 111 and the IPsec termination function unit 611 perform IKE (notification of authentication information) (step S18). With this processing operation, a communication path by IPsec is established between AP1 and Wi-Fi GW6. And AP1 and Wi-Fi GW6 start the encrypted data communication (step S19).

  Next, the operation of the communication system shown in FIGS. 1 and 2 for obtaining the end address using the fifth method will be described with reference to the flowcharts shown in FIGS. FIG. 15 is a flowchart showing the processing operation of AP1 shown in FIG. FIG. 16 is a flowchart showing the processing operation of the authentication server 4 shown in FIG. FIG. 17 is a flowchart showing the processing operation of the Wi-Fi GW 6 shown in FIG.

  First, when the user terminal 2 belongs to AP1 (step S91), AP1 starts authentication (step S92). AP1 transmits an authentication request for user terminal 2 to authentication server 4 (step S93). In response to this, the authentication server 4 receives an authentication request from the AP 1 (step S111). Subsequently, the authentication server 4 performs authentication confirmation (step S112). If the confirmation is OK, the authentication server 4 determines an address to which the AP 1 is connected from the connection destination URI DB 41 (step S113). Then, the authentication server 4 returns an authentication result (success) to the AP 1 (step S114). On the other hand, in the case of confirmation NG, the authentication server 4 returns an authentication result (failure) to the AP 1 (step S115).

  Next, AP1 receives the authentication result (success or failure) from the authentication server 4 (step S94). And AP1 confirms an authentication result (step S95). If the authentication result is NG, AP1 fails to authenticate (step S101). On the other hand, when the authentication is OK, AP1 transmits the DHCP request of user terminal 2 to Wi-Fi GW 6 (step S96). In response, the Wi-Fi GW 6 receives the DHCP request of the user terminal 2 from the AP 1 (step S121).

  Next, the Wi-Fi GW 6 transmits an authentication confirmation request of the DHCP requester (user terminal 2) to the authentication server 4 (step S122). The authentication server 4 receives a DHCP request from the Wi-Fi GW 6 (step S116). The authentication server 4 performs authentication confirmation (step S117). If the confirmation is OK, the authentication server 4 assigns the connection destination address and returns the authentication result to the Wi-Fi GW 6 (step S118). On the other hand, if it is confirmed NG, the authentication server 4 returns an authentication result (failure) to the Wi-Fi GW 6 (step S119).

  Next, the Wi-Fi GW 6 performs authentication confirmation (step S123). If it is confirmed NG, the Wi-Fi GW 6 returns an authentication result (failure) to the AP 1 (step S128). On the other hand, if the confirmation is OK, the Wi-Fi GW 6 requests the AP 1 to establish a communication path by IPsec (step S124). In response, AP1 receives a communication path establishment request from Wi-Fi GW 6 to IPsec (step S97), and establishes a communication path by IPsec with Wi-Fi GW 6 (step S98). In parallel with this, the Wi-Fi GW 6 establishes a communication path by IPsec (step S125).

  Next, the Wi-Fi GW 6 pays out DHCP and transmits it to the AP 1 (step S126). In response to this, AP1 receives the DHCP payout from Wi-Fi GW6 (step S99). And AP1 and Wi-Fi GW6 start data communication (step S100, S127).

  As described above, since the address of AP1 is notified to the Wi-Fi GW 6 at the time of cooperation with the authentication server 4 after DHCP, the Wi-Fi GW 6 can acquire the termination address of the AP1.

  As described above, since either the AP side or the Wi-Fi GW side becomes the initiator, the AP 1 or the Wi-Fi GW 6 can establish a secure communication path by acquiring the address of the opposite device. When a guest user uses a public wireless LAN, secure communication is possible without worrying about communication interception by the AP owner.

  The program for realizing the function of the processing unit in FIG. 2 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into the computer system and executed to perform address acquisition processing. You may go. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer system” includes a WWW system having a homepage providing environment (or display environment). The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, what is called a difference file (difference program) may be sufficient.

  When establishing a secure communication path, the present invention can also be applied to applications where it is indispensable to reliably acquire the IP address of the opposite apparatus in the apparatuses at both ends of the communication path.

  DESCRIPTION OF SYMBOLS 1 ... AP (access point), 2 ... User terminal, 3 ... Network, 4 ... Authentication server, 5 ... Connection destination information server, 6 ... Wi-Fi GW (Wi-Fi gateway) ), 7 ... ISP

Claims (10)

A communication system including an access point device for connecting a user terminal to a communication network, and a server device,
The access point device is
An acquisition request transmitting means for transmitting an address information acquisition request of the opposite device to the server device;
In response to the acquisition request, address information receiving means for receiving the address information of the opposite device transmitted by the server device, and
Communication path establishment means for establishing a secret communication path for the opposite device based on the address information of the opposite device;
The server device
Address information storage means for storing address information of the opposite device to which the access point device is to be connected;
When receiving the address information acquisition request of the opposite device from the access point device, the address information storage unit is referred to identify the address information of the opposite device, and the address information is used as a response to the acquisition request. An address information transmitting means for transmitting to the access point device.   The communication system according to claim 1, wherein the address information acquisition request of the opposite device is transmitted at a predetermined timing. The acquisition request for the address information of the opposite device is included in the authentication request when the server device authenticates the user terminal,
The communication system according to claim 1, wherein the address information of the opposite device is included in information of an authentication result for the authentication request. A communication system including an access point device for connecting a user terminal to a communication network, a gateway device for connecting an access point device to the communication network, and a server device,
The access point device is
An authentication request transmitting means for transmitting to the server device including its own address information in the authentication request of the user terminal;
The server device
At the time of authentication of the user terminal, when cooperating with the gateway device by DHCP, an address information transmitting means for transmitting address information of the access point device to the gateway is provided,
The gateway device is
Address information receiving means for receiving address information of the access point device from the server device;
A communication path establishing means for establishing a secret communication path for the access point device based on the address information of the access point device. An access point device for connecting a user terminal to a communication network, an address information storage unit for storing address information of a counter device to which the access point device is to be connected, and an acquisition request for the address information of the counter device from the access point device An address information transmitting means for identifying address information of the opposite device when receiving the address information and transmitting the address information to the access point device as a response to the acquisition request; The access point device in a communication system including a server device comprising:
An acquisition request transmitting means for transmitting an acquisition request for the address information of the opposite device to the server device;
In response to the acquisition request, address information receiving means for receiving the address information of the opposite device transmitted by the server device, and
An access point device comprising: communication path establishment means for establishing a secret communication path for the opposite device based on address information of the opposite device. In order to connect the user terminal to the communication network, an acquisition request transmitting unit that transmits an acquisition request for the address information of the opposite device to the server device, and the opposite device transmitted by the server device in response to the acquisition request. An access point device comprising: address information; receiving address information receiving means; and communication path establishing means for establishing a secret communication path for the opposing device based on the address information of the opposing device; and the server device The server device in a communication system,
Address information storage means for storing address information of the opposite device to which the access point device is to be connected;
When receiving the address information acquisition request of the opposite device from the access point device, the address information storage unit is referred to identify the address information of the opposite device, and the address information is used as a response to the acquisition request. Address information transmitting means for transmitting to the access point device. In order to connect a user terminal to a communication network, an access point device comprising authentication request transmission means for transmitting the user terminal authentication request including its own address information to a server device, and an access point device connected to the communication network Address information receiving means for receiving address information of the access point apparatus, and communication path establishment means for establishing a secret communication path for the access point apparatus based on the address information of the access point apparatus. The server device in a communication system including a gateway device and a server device,
A server device comprising: address information transmitting means for transmitting address information of the access point device to the gateway when cooperating with the gateway device by DHCP during authentication of the user terminal. In order to connect a user terminal to a communication network, an access point device comprising authentication request transmission means for transmitting the user terminal authentication request including its own address information to a server device, and an access point device connected to the communication network And a server device comprising address information transmission means for transmitting address information of the access point device to the gateway when cooperating with the gateway device by DHCP at the time of authentication of the user terminal. The gateway device in a communication system,
Address information receiving means for receiving address information of the access point device from the server device;
A gateway device comprising: a communication path establishment means for establishing a secret communication path for the access point device based on address information of the access point device. A communication method performed by a communication system including an access point device that connects a user terminal to a communication network and a server device that includes address information storage means for storing address information of the opposite device to which the access point device is to be connected. ,
The access point device transmits an acquisition request for address information of the opposite device to the server device;
When the server device receives the address information acquisition request of the opposite device from the access point device, the server device refers to the address information storage unit, identifies the address information of the opposite device, and stores the address information in the address information An address information transmission step for transmitting to the access point device as a response to the acquisition request;
In response to the acquisition request, the access point device receives the address information of the opposite device transmitted by the server device and an address information receiving step for receiving the information.
The communication method comprising: a communication path establishing step in which the access point apparatus establishes a secret communication path for the opposite apparatus based on the address information of the opposite apparatus. A communication method performed by a communication system including an access point device that connects a user terminal to a communication network, a gateway device that connects the access point device to the communication network, and a server device,
An authentication request transmission step in which the access point device transmits an authentication request of the user terminal to the server device including its own address information;
An address information transmission step of transmitting address information of the access point device to the gateway when the server device cooperates with the gateway device by DHCP at the time of authentication of the user terminal;
An address information receiving step in which the gateway device receives address information of the access point device from the server device;
The communication method comprising: a communication path establishing step in which the gateway apparatus establishes a secret communication path for the access point apparatus based on address information of the access point apparatus.

Images