JP2003318922A - Wireless network access system, terminal, wireless access point, remote access server, and authentication server - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a wireless network access system capable of designating an access destination network by each wireless LAN user. <P>SOLUTION: When a terminal 1 of a wireless LAN user transmits information to authenticate the wireless LAN user to a wireless AP (Access Point) 2, the wireless AP 2 informs an authentication function 4 about this information. When the authentication function 4 authenticates the wireless LAN user, encrypted communication between the terminal 1 and the wireless AP 2 is established. Then the terminal 1 transmits authentication information for network access to a network for an ISP (Internet Service Provider) or an in- enterprise network or the like. A RAS (Remote Access Server) 3 decides a network terminator 6-1 or 6-2 for containing an access destination network from the network access authentication information and performs routing. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a wireless network connection system in which a user terminal connects to a network via a wireless access point.

[0002]

2. Description of the Related Art In recent years, a wireless LAN (Local Area Network)
With the spread of k), a wireless LAN base unit (wireless access point) for connecting to the Internet will be installed in places where people gather, such as public facilities, and individuals will be able to use PCs from outside.
Use this wireless AP (access point) by using a mobile computer with a wireless LAN cordless handset such as a card attached.
There is a wireless Internet connection system that can connect to the Internet by connecting to.

However, conventionally, the ISP (Internet provider) or the like at the connection destination is fixed for each wireless AP, and all the wireless LAN users who have accessed are fixed ISPs.
However, it was not possible to select a connection destination for each individual wireless LAN user. Therefore, a wireless LAN user may not be able to use a network that is not allowed to connect via the ISP or a corporate private network that is not open to the public on the Internet.

Further, conventionally, a provider of a wireless Internet connection system has not been able to grasp how many wireless LAN users share an access line between a wireless AP and the Internet. Therefore, many wireless LANs
In order to prevent a decrease in throughput due to simultaneous use by users, it has been desired to limit the number of wireless LAN users who can simultaneously use the wireless AP.

Further, the wireless AP installer sets the wireless L of the wireless AP.
When restricting AN users, it is necessary to set authentication information for each wireless LAN user for each wireless AP. This was very cumbersome for AP installers.

[0006]

SUMMARY OF THE INVENTION The present invention has been made in consideration of such circumstances, and its purpose is to provide a wireless L
It is an object of the present invention to provide a wireless network connection system in which a connection destination network can be designated for each AN user and a wireless access point can authenticate a wireless LAN user with a network function.

[0007]

The present invention has been made to solve the above problems, and the invention according to claim 1 is a terminal device, a wireless access point accessed by the terminal device, and A wireless network connection system comprising a wireless access point and an authentication server for authenticating the terminal device, and a remote access server for routing to a network designated by the terminal, wherein the terminal device is the wireless access point. Wireless communication means for wirelessly communicating with the terminal device, terminal authentication information transmitting means for transmitting the terminal authentication information of the terminal device to an authentication server installed in an internet protocol network, and encryption key information received from the authentication server, An encrypted wireless communication means for encrypting the communication of the wireless communication means and a network including the network identification information. The network user authentication information transmitting means for transmitting the work user authentication information to the user authentication function of the network; and the network communication means for communicating with the network by the IP address assigned from the network user authentication function, The wireless access point includes a wireless communication unit that wirelessly communicates with the plurality of terminal devices, a communication unit that communicates with a remote access server, and an interface conversion unit that mutually converts the interfaces of the wireless communication unit and the communication unit. Encryption remote communication means for receiving encryption key information from the authentication server and encrypting communication of the wireless communication means, wherein the remote access server has an interface for communicating with a wireless access point, and an internet protocol. To communicate with the web Interface conversion means for converting interfaces to each other, and based on the network identification information included in the network user authentication information received from the terminal device, a communication device accommodating the connection destination network is determined and the network user authentication information is transmitted. And routing means for determining the destination,
The authentication server includes a terminal authentication database that stores terminal authentication information of a terminal device, a terminal device authentication unit that receives the terminal authentication information from the terminal device, and performs authentication using the terminal authentication database, and the terminal device authentication unit. When the terminal device is authenticated, the terminal device and the wireless access point generate encryption key information for performing encrypted communication, and the wireless access point and an encryption key information transmission unit for notifying the terminal device are provided. A wireless network connection system comprising:

The invention described in claim 2 is the wireless network connection system according to claim 1, wherein the wireless access point, the wireless access point, and the wireless access point authentication information of the wireless access point. Authentication means for transmitting to an authentication server, wherein the communication means establishes communication according to the Internet protocol using the IP address assigned by the authentication server, and the authentication server is a wireless access point wireless. A wireless access point authentication database that stores access point authentication information, a wireless access point authentication unit that receives the wireless access point authentication information, and authenticates with the wireless access point authentication database, and the wireless access point authentication unit is the wireless access When authenticating the Into comprises a address notification means for sending the IP address assigned to the wireless access point, characterized in that.

A third aspect of the present invention is the wireless network connection system according to the first or second aspect, wherein the remote access server allows the wireless access point to allow simultaneous connection of terminal devices. A connection means for storing the number, a connecting terminal number counting means for counting the number of terminal devices connected to the wireless access point, and a wireless access point accessed by the terminal device that is the transmission source of the terminal authentication information. When the number of terminal devices is equal to or more than the number of simultaneous connections, the device further comprises a simultaneous connection number control means for rejecting the connection of the terminal devices.

The invention according to claim 4 is the wireless network connection system according to any one of claims 1 to 3, wherein the authentication server is a terminal to which the wireless access point permits connection. A list of devices and a use permission confirmation means for judging whether or not the wireless access point accessed by the terminal device as the transmission source of the terminal authentication information is available for the terminal device, and notifying the terminal device authentication means. The terminal device authenticating means authenticates the terminal device according to the connection availability information notified from the usage permission confirming means.

According to a fifth aspect of the present invention, wireless communication means for wirelessly communicating with a wireless access point, and terminal authentication information transmission for transmitting the terminal authentication information of the terminal device to an authentication server installed in the Internet protocol network. Means, an encryption wireless communication means for receiving encryption key information from the authentication server, and encrypting communication of the wireless communication means, and network user authentication information including network identification information, to a user authentication function of the network. And a network communication unit that communicates with the network by using an IP address assigned by the network user authentication function.

According to a sixth aspect of the present invention, a wireless communication means for wirelessly communicating with a plurality of terminal devices, a communication means for communicating with a remote access server, and an interface between the wireless communication means and the communication means are mutually converted. And an encryption wireless communication unit that receives encryption key information from an authentication server and encrypts communication of the wireless communication unit.

The invention according to claim 7 is the wireless access point according to claim 6, further comprising authentication information transmitting means for transmitting the wireless access point authentication information of the wireless access point to the authentication server. The communication means establishes communication by Internet protocol using the IP address assigned by the authentication server,
It is characterized by

According to an eighth aspect of the present invention, an interface for communicating with a wireless access point and an interface converting means for mutually converting an interface for communicating with an internet protocol network, and the wireless access point permit connection. Storage means for storing the number of simultaneously connected terminal devices; connected terminal number counting means for counting the number of terminal devices connected to the wireless access point;
The number of terminal devices connected to the wireless access point accessed by the terminal device that transmitted the terminal authentication information,
A remote access server comprising: a simultaneous connection number control means for rejecting the connection of the terminal device when the number of simultaneous connections is equal to or more.

According to a ninth aspect of the present invention, there is provided a terminal authentication database for storing terminal authentication information of the terminal device, and terminal device authentication means for receiving the terminal authentication information from the terminal device and authenticating with the terminal authentication database. When the terminal device authenticating unit authenticates the terminal device, the terminal device and the wireless access point generate encryption key information for performing encrypted communication, and the wireless access point and the terminal accessed by the terminal device. And a cryptographic key information transmitting unit for notifying the device.

The invention according to claim 10 is the authentication server according to claim 9, wherein a wireless access point authentication database for storing wireless access point authentication information of the wireless access point and a wireless access point to wireless access point. A wireless access point authenticating unit that receives authentication information and authenticates with the wireless access point authentication database, and an IP address to be assigned to the wireless access point when the wireless access point authenticating unit authenticates the wireless access point. And an address notifying means for transmitting.

The invention according to claim 11 is the authentication server according to claim 9 or 10, wherein a list of terminal devices permitted to be connected by the wireless access point and a transmission source of the terminal authentication information. It is provided with a use permission confirmation means for determining whether the wireless access point accessed by the terminal device can be used from the list and notifying the terminal device authentication means, wherein the terminal device authentication means is The terminal device is authenticated based on the connection availability information notified from the terminal device.

[0018]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram showing a configuration of a wireless network connection system according to an embodiment of the present invention. In this figure, 1 is a terminal device of a user, 1C is a wireless LAN card attached to the terminal device 1,
Reference numeral 2 is a wireless access point (hereinafter, wireless AP).
This wireless AP 2 is a wireless access point device (hereinafter,
The wireless AP device) 2a and the wireless LAN user authentication server connection device 2b. Reference numeral 3 is a remote access server (hereinafter referred to as RAS), and 4 is an authentication function. The authentication function 4 includes a network terminating device 4a, a wireless access point authentication server (hereinafter, wireless AP authentication server) 4b, and a wireless LA.
It is composed of an N user authentication server 4c and a cascon server 4d. Also, 5 is a distribution server, 6-1 and 6-
2 is a network terminator, and 7-1 and 7-2 are authentication servers.

The wireless LAN user owns the terminal device 1, subscribes to the wireless LAN user service of the wireless network connection provided by the communication carrier, and distributes the wireless LAN user authentication key for certifying the wireless LAN user himself. Receive. Further, the wireless LAN user subscribes to an internet service provided by an internet service provider (hereinafter, referred to as ISP) or has an access right to a corporate network of a general enterprise. Then, the terminal device 1 of the wireless LAN user operates in step S2.
By specifying the network of the connection destination as shown in 1,
It connects to the Internet M or the corporate network L via the wireless AP 2 installed by an unspecified wireless AP installer.

The wireless AP installer owns the wireless AP 2, and in order to provide the wireless LAN user with an access point for connecting to the wireless network, he / she subscribes to the host service of the AP provided by the communication carrier, Receive authentication information. Then, the access request of the terminal device 1 of the wireless LAN user is accepted, and in order to provide the connection to the Internet M or the corporate network L, the wireless LAN user is connected to the IP network N of the communication carrier.

The telecommunications carrier owns the IP network N, and the RAS 3, the authentication function 4, the distribution server 5, the network terminating device 6-1 and the network terminating device 6-2 (hereinafter referred to as the network terminating device 6) on the IP network N. -1, the network terminating device 6-2 is described as the network terminating device 6)
Set up. In addition, a wireless LAN user service that enables a wireless network connection by a wireless LAN user,
The wireless AP installer provides a host service that allows wireless LAN users to connect to a wireless network, and an interconnection service via the network terminating device 6 to ISPs and general companies. Then, the communication carrier responds to the access request from the wireless LAN user via the wireless AP 2 with the authentication function 4
AP authentication (step S22) and wireless LA in
N user authentication (step S23) is performed. afterwards,
The connection destination network designated by the wireless LAN user sends connection destination authentication information for authenticating the wireless LAN user (step S24), and also routes to the connection destination network designated by the wireless LAN user, the ISP or a general company ( Step S25).

The ISP has the authentication server 7-1 and the general enterprise has the authentication server 7-2, and the IP provided by the communication carrier.
Receive interconnection service with network N. The ISP provides the Internet service for realizing the access to the Internet M, and the general company provides the wireless LAN user with the connection to the in-company network L. ISPs and general companies use wireless LA routed from telecommunications carriers.
By authenticating the N user, communication with the wireless LAN user is enabled (step S26).

Next, each node will be described. The terminal device 1 is, for example, a personal computer, and a wireless L
It has a wireless LAN card control means for controlling the AN card 1C. In addition, the terminal device 1 uses a PPP (Point to Point).
TCP / IP (Transmission
It is equipped with a protocol that realizes communication by ControlProtocol / Internet Protocol. Further, the terminal device 1 includes a user authentication server 7-1 and a user authentication server 7-2 (hereinafter, user authentication server 7-1 and user authentication server 7-2.
Network authentication information for user authentication in the user authentication server 7).
The network user authentication information consists of: a network connection user ID (information for the connection destination network to identify the user), and a network connection password (password for the connection destination network to authenticate the user). User ID for network connection
Consists of the wireless LAN user ID followed by the identification name of the destination network under the "@" mark. For example, the wireless LAN user ID is “user1”, and the identification name of the connection destination network is “aaa.aaa”, which is indicated by the network connection user ID “user01@aaa.aaa”.

The wireless LAN card 1C is provided with a wireless communication means by a wireless system such as IEEE802.11b for communicating with the wireless AP 2, and stores a wireless LAN user authentication key for authentication in the authentication function 4. Wireless L
The AN user authentication key includes: -Wireless LAN user ID (information for identifying a wireless LAN user) -Digital certificate (issued by a third-party organization, wireless LA
N user authentication information).

In the wireless AP 2, the wireless AP device 2a
Is a peripheral LS including a CPU and a memory.
The CPU implements the following functions by reading the program recorded in the memory and sequentially executing it. The wireless access point device 2a includes a wireless communication means for communicating with the terminal device 1 by a wireless system such as IEEE802.11b. Also, TCP
/ IP is provided with a protocol for realizing communication, and an IP address is assigned by a communication carrier. further,
The secret key for performing encrypted communication with the authentication function 4 is stored.

Wireless LAN user authentication server connection device 2b
Is a peripheral LS including a CPU and a memory.
The CPU implements the following functions by reading the program recorded in the memory and sequentially executing the program. The wireless LAN user authentication server connection device 2b communicates with the RAS 3 so that the xDSL (Digital Sustain
bscriber Line), ISDN (Integrated Services dig)
It has a communication means such as an ital network) and a protocol for realizing communication by TCP / IP such as PPP. Furthermore, the wireless LAN user authentication server connection device 2b
Is a wireless AP for authenticating a wireless AP in the authentication function 4.
It stores the authentication information. The wireless AP authentication information is composed of: a wireless AP user ID (information for identifying the wireless AP) and a password.

Specifically, the RAS 3 is composed of a peripheral LSI including a CPU and a memory, and realizes the following functions by the CPU reading and sequentially executing a program recorded in the memory. The RAS 3 includes a communication unit such as xDSL or ISDN for communicating with the wireless LAN user authentication server connection device 2b, and further includes a protocol for realizing TCP / IP communication. Further, the RAS 3 manages the function of determining where to transfer the data transmitted from the terminal device 1 and the number of the terminal devices 1 that can be simultaneously connected to the wireless AP 2, in cooperation with the distribution server 5 described later. Realize the function to do.

The authentication function 4 realizes the authentication function of the wireless LAN user and the wireless AP. In this authentication function 4,
Specifically, the network terminating device 4a is composed of a peripheral LSI including a CPU and a memory, and the CPU reads and sequentially executes a program recorded in the memory to realize the following functions. The network terminator 4a is an IP
It has an interconnection function that terminates the network N and realizes connection with the authentication function 4. Further, the network terminating device 4a has a protocol for realizing communication by TCP / IP.

The wireless AP authentication server 4b, specifically,
Consists of a peripheral LSI including a CPU and memory, C
The following functions are realized by the PU reading the program recorded in the memory and sequentially executing it.
The wireless AP authentication server 4b has a protocol for realizing communication by TCP / IP and a function for authenticating the wireless AP 2. In addition, the wireless A for authenticating the wireless AP 2
It stores the P authentication information database. In the present embodiment, the following is stored in the wireless AP authentication information database. Wireless AP user ID password secret key user1@aaa.aaa pass01 user2@bbb.bbb pass02 user3@ccc.ccc pass03 :: However, the secret key is the information used to perform encrypted communication with the wireless AP device 2a. .

The wireless LAN user authentication server 4c is specifically composed of a peripheral LSI including a CPU and a memory, and realizes the following functions by the CPU reading and sequentially executing a program recorded in the memory. Is. The wireless LAN user authentication server 4c uses TCP /
It has a protocol for realizing communication by IP, a function for authenticating the terminal device 1, and a function for determining whether to use the wireless AP 2 accessed by the terminal device 1. It also stores a wireless LAN user authentication information database for authenticating the terminal device 1. The wireless LAN user authentication information database is composed of records including: wireless LAN user ID and digital certificate information. In addition, the above digital certificate information is: -Digital certificate-Expiration date of digital certificate-Algorithm for encryption / decryption of digital certificate-Key length (Use for encryption / decryption of digital certificate Key information length). In the present embodiment, the wireless LAN user authentication information database is: wireless LAN user ID: user01, digital certificate information, wireless LAN user ID: user02, digital certificate information, wireless LAN user ID: user03, digital Stores a set of records such as certificate information.

Specifically, the cascon server 4d is a CP.
CPU composed of peripheral LSI including U and memory
The following functions are realized by reading out the program recorded in the memory and sequentially executing it. The cascon server 4d includes a protocol that realizes communication by TCP / IP, and stores a database in which the users permitted to use the wireless AP 2 are registered. Then, by using this database, the wireless LAN user authentication server 4c
Is provided with a function of notifying the terminal device 1 of information for determining whether or not the terminal device 1 can access the wireless AP 2.

The distribution server 5 is specifically a CPU
In addition, the CPU is configured by a peripheral LSI including a memory, and the CPU reads and sequentially executes a program recorded in the memory to realize the following functions. The distribution server 5 responds to the inquiry from the RAS 3 by the terminal device 1
Destination network (ISP / general enterprise) received from
It has a function of notifying the network terminating device 6 of the routing destination from the information of 1. and a protocol for realizing communication by TCP / IP. The distribution destination database for determining the routing destination is stored. The distribution destination database is composed of a set of records of a user ID for network connection, an IP address (IP address of the network terminating device 6 at the routing destination), and a distribution destination (identification name of the network terminating device 6). However, the network connection user ID has the same configuration as the network connection user ID stored in the terminal device 1. In the present embodiment, the distribution destination database stores the following. User ID for network connection IP address distribution destination user01@aaa.aaa 10.xxx Provider A network terminating device user01@bbb.bbb 10.xxy Provider B network terminating device user01@ccc.ccc 10.xxz Provider C network terminating device :: :

The network terminating device 6 has the same function as the network terminating device 4a. However, the network terminating device 6 holds the identification name of the network, and passes the communication packet having this identification name to the Internet network M or the corporate network L.
And realize the interconnection function.

Specifically, the authentication server 7 is composed of a peripheral LSI including a CPU and a memory, and realizes the following functions by the CPU reading and sequentially executing a program recorded in the memory. C is TC
A protocol for realizing communication by P / IP is provided, and a user authentication unit for performing authentication to permit the terminal device 1 to connect to the Internet M or the corporate network L is provided.

Next, the terminal device 1 is connected to the Internet network M /
A procedure for connecting to the corporate network L will be described. FIG. 2 shows a connection sequence in which the terminal device 1 connects to the Internet network M / company network L. First, a wireless LAN user operates the terminal device 1,
Request a connection as a wireless LAN user (step S
40). In this case, the terminal device 1 sends the wireless LAN user authentication information (IF41). The wireless LAN user authentication information (IF41) includes the wireless L of the wireless LAN card 1C.
Wireless LAN user ID stored in the AN user key
And set the encrypted digital certificate.

When the wireless AP 2 receives this wireless LAN user authentication information (IF41), if the wireless AP has not been authenticated yet, the wireless AP 2 authenticates the wireless AP authentication server 4b as a wireless AP. By making the request, the wireless AP authentication procedure is executed (step S42).
The wireless AP authentication procedure will be described later.

Then, the wireless AP 2 performs step S described later.
The wireless LAN user authentication information (IF41) received by the encrypted communication established by the wireless AP authentication procedure 42.
As the wireless LAN user authentication information (IF43)
Send to S3. Then, RAS3 will use this wireless LAN.
It is determined whether the connection from the user is within the upper limit of the number of simultaneous connections set by the wireless AP installer (step S).
44). The procedure for determining the number of simultaneous connections will be described later.

When the RAS 3 determines that the connection from the wireless LAN user is within the upper limit of the number of simultaneous connections set by the wireless AP installer, the received wireless LA is received.
The N user authentication information (IF43) is transmitted to the wireless LAN user authentication server 4c as wireless LAN user authentication information (IF45).

The wireless LAN user authentication server 4c searches the wireless LAN user authentication information database by the wireless LAN user ID included in the received wireless LAN user authentication information (IF45), and determines the expiration date of the read digital certificate. Confirm that the received digital certificate is valid, and use the key length and algorithm to decrypt the received digital certificate. And
The digital certificate stored in the wireless LAN user authentication information database is compared with the decrypted digital certificate. Further, the terminal device 1 is authenticated by determining the access authority to use the wireless AP 2 accessed by the wireless LAN user. The procedure for determining whether or not the user has access authority will be described later. Then, the wireless LAN user authentication server 4c is a key used for encrypted communication for protecting wireless data communication between the wireless AP device 2a and the terminal device WEP (Wire Equip).
ment Privacy) key is generated (step S46).

The wireless LAN user authentication server 4c permits the authentication (IF47) and sends the WEP keys for the wireless AP device 2a and the terminal device 1 to the wireless AP 2. The wireless AP 2 that has received the authentication permission (IF47) stores the received WEP key of the wireless AP device 2a in the wireless AP device 2a. Then, the received WEP key for the terminal device 1 is sent to the terminal device 1 (IF48), and the terminal device 1 stores the received WEP key for the terminal device 1, so that the subsequent terminal device 1 and the wireless AP are stored. The encrypted communication in the wireless section of the device 2a becomes possible.

Next, the terminal device 1 requests a connection to the network (Internet network M or company network L) (step S51). That is, the terminal device 1
Sends the network authentication information (IF52) in which the network connection user ID and the network identification password are set to the RAS 3 via the wireless AP 2 by PPP.

Upon receiving the network authentication information (IF52), the RAS 3 determines the network terminator 6 to which routing is to be performed based on the user ID for network connection (step S5).
4). That is, the RAS 3 transmits the network connection user ID to the distribution server 5, and the distribution server 5
Acquires the IP address and the distribution destination by searching the distribution destination database with the received network connection user ID, and returns the IP address and the distribution destination to the RAS 3. For example, the user ID for network connection set as the network authentication information (IF52) is "user1 @ aaa.
If it is “aaa”, the IP address “10.xxx” and the distribution destination “provider A network terminating device” are notified to the RAS 3.

RAS3 is network authentication information (IF5
2) to the network terminating device 6 indicated by the distribution destination notified from the distribution server 5 to the network authentication information (IF5
6), the network terminating device 6 transfers the network authentication information (IF56) to the authentication server 7 of the ISP / general enterprise which is further interconnected. The authentication server 7 authenticates the wireless LNA user with the received network connection user ID and network connection password (step S57).

Upon authenticating the wireless LAN user, the authentication server 7 notifies the terminal device 1 of the IP address to be allocated to the terminal device 1 (IF58; IP address allocation). I
The terminal device 1 that has received the P address executes IP communication with the Internet M / company network L using the notified IP address.

When the wireless LAN user wants to end the communication with the network, he or she executes an operation for requesting disconnection with the ISP (step S60). That is, the terminal device 1 sends a disconnection request (IF 61) to the network to the network terminating device 6. Then, the network terminating device 6 sends a disconnection process (IF62) to the RAS3, and the RAS3 sends a release (IF63) to the terminal device 1. Terminal device 1
However, when the release notification (IF63) is received, the wireless section communication is released thereafter (step S64).

Next, the wireless AP authentication procedure executed in step S42 of FIG. 2 will be described. FIG. 3 is a diagram showing a wireless AP authentication sequence. The wireless LAN user authentication server connection device 2b stores the wireless AP user I stored in itself.
Wireless AP authentication information (IF42 with D and password set
-1) is sent to RAS3 by PPP. RAS3
Transfers the received wireless AP authentication information to the network terminating device 4a (IF42-1). The network terminating device 4a uses the wireless A
The P authentication information is further transferred to the wireless AP authentication server 4b (IF42-3).

The wireless AP authentication server 4b searches the wireless AP authentication information database with the wireless AP user ID included in the received wireless AP authentication information (IF42-3), reads the password and the secret key, and reads them. Check the password and the received password to confirm wireless A
Authenticate P2. (Step S42-4). For example, the wireless AP user ID “user1@aaa.aaa” and the password “p stored in the wireless LAN user authentication server connection device 2b are stored.
When the wireless AP authentication server 4b receives "ass01", the wireless AP authentication server 4b determines that the wireless AP user ID "user1 @ aa".
The wireless AP 2 is authenticated by searching the wireless AP database with “a.aaa” and comparing the read password “pass01” with the received password. And wireless AP
The secret key corresponding to the user ID "user1@aaa.aaa" is read.

When the wireless AP 2 is successfully authenticated, the wireless LA
To enable the IP communication of the N user authentication server connection device 2b, the wireless AP authentication server 4b assigns the IP address to the wireless LAN user authentication server connection device 2b, the wireless AP device 2a and the wireless LAN user authentication server connection device. A wireless AP authentication result (IF42-5) including wireless AP connection information composed of a netmask for grouping 2b by IP address is returned to the wireless LAN user authentication server connection device 2b. The wireless LAN user authentication server connection device 2b acquires an IP address and uses the secret key stored in the wireless AP device 2a and the secret key read by the wireless AP authentication server 4b to perform encrypted communication with the authentication function 4. Establish.

Then, in step S44 of FIG.
However, a procedure for determining whether the connection from the wireless LAN user is within the upper limit of the number of simultaneous connections set by the wireless AP installer will be described. FIG. 4 is a diagram showing a procedure of registering the number of simultaneous connections to the RAS 3 and determining the number of simultaneous connections of the RAS 3. First, the wireless AP installer requests the number of wireless LAN users who can simultaneously use the wireless AP installed by itself from the communication carrier (step S44-1).
The number of wireless LAN users applied by the wireless AP installer is registered in RAS3 (step S44-2). That is, in the figure, when the wireless AP installer applies to the communication carrier, for example, the number of wireless LNA users "2" as the upper limit value of simultaneous connection to the wireless AP 2 (step S44-1), the wireless LAN user is added to the RAS 3. The upper limit value "2" of simultaneous connection is registered for the physical line connected to the authentication server connection device 2b (step S44-2), and the simultaneous connection of the wireless LAN users is permitted within this upper limit value of simultaneous connection. To do. RAS3
Recognizes that the number of simultaneous connections of the wireless AP installer apparatus 2 has increased by 1 when the wireless LAN user authentication information (IF43) is received (FIG. 2) and the session is established, and the disconnection process (IF
When 62) is received (FIG. 2) and the session is released, it is recognized that the number of simultaneous connections has decreased by 1.

RAS3 is the first and second wireless L
Wireless LAN user authentication information (I
For F43) (FIG. 2), since the registered maximum number of simultaneous connections is “2 people” or less, use of the wireless AP 2 is permitted, and the number of simultaneous connections is updated to “2 people”. However, the wireless LAN user authentication information (I
If F43) is received, the connection is not permitted because the number of the terminal devices 1 that are already simultaneously connected is “two” (step S44-3).

Next, in step S46 of FIG.
A procedure for the user authentication server 4c to determine whether or not the wireless LAN user has wireless AP access authority will be described. FIG. 5 is a diagram showing a procedure of registration and determination of presence / absence of wireless AP access authority for a wireless LAN user in the wireless LAN user authentication server 4c. First, a user who can use the wireless AP 2 is registered in the cascon server 4d (step S46-1). That is, the wireless LAN user IDs of the wireless LAN user A and the wireless LAN user B that can be used are stored in the database with respect to the IP address of the wireless AP device 2a that is assigned in advance.

The wireless LAN user authentication server 4c
Receives the wireless LAN user authentication information (IF45) from the wireless LAN user A / wireless LAN user B, the wireless L
In the AN user authentication process (step S46) (FIG. 2), the wireless LAN user IDs of the wireless LAN user A / wireless LAN user B and the wireless LAN user authentication information (IF
45) The IP address of the wireless AP device 2a which is the transmission source of 45) is transmitted to the cascon server 4d. Then, the cascon server 4d searches the database by the received IP address, reads out the wireless LAN user ID that can use the wireless AP 2, and compares the wireless LAN user ID with the received wireless LAN user ID. Wireless LAN user A / Wireless LAN user B
Is registered as an available wireless LAN user, the available information is sent to the wireless LAN user authentication server 4c.
Return to. On the other hand, the wireless LA from the wireless LAN user C
When the N user authentication key (IF45) is received (FIG. 2), the wireless LAN user C is not registered as a usable wireless LAN user in the cascon server 4d.
The unusable information is returned to the wireless LAN user authentication server 4c.

According to the above procedure, the wireless LAN user authentication server 4c permits the wireless LAN user A and the wireless LAN user B to connect, and disables the wireless LAN user C to connect (step S46-2). In addition, individual wireless LAN
Instead of registering the user ID, the wireless LAN users may be classified into user groups and the class of the wireless LAN users may be used to determine whether the connection is possible.

The terminal device 1, the wireless access point device 2a, the wireless LAN user authentication server connection device 2b, the RAS 3, the network terminating device 4a, the wireless AP authentication server 4b, the wireless LAN user authentication server 4c, the cascon server 4d, The distribution server 5, the network terminating device 6, and the authentication server 7 have a computer system inside. The above-described process of operation is stored in a computer-readable recording medium in the form of a program, and the computer system reads and executes the program to perform the above-described processing. The computer system mentioned here includes an OS and hardware such as peripheral devices.

The term "computer-readable recording medium" means, in addition to a ROM, a portable medium such as a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a hard disk incorporated in a computer system, or the like. A memory device. Further, the "computer-readable recording medium" is a volatile memory (RAM) inside a computer system which is a system or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those that hold the program for a certain period of time are also included.

Further, the above program may be transmitted from a computer system having the program stored in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the "transmission medium" for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the program may be a program for realizing some of the functions described above. further,
It may be a so-called difference file (difference program) that can realize the above-mentioned functions in combination with a program already recorded in the computer system.

[0057]

According to the present invention, a wireless LAN user can use a wireless LAN to make an arbitrary I-location when he / she is out, without being aware of the installation environment of the wireless AP installed by the wireless AP installer.
It becomes possible to connect to the SP's Internet and corporate network. Further, the wireless AP installer can provide a connection to the ISP / intracorporate network or the like for each individual wireless LAN user who shares one broadband access line with a plurality of people. The wireless AP installer can centrally manage the wireless AP authentication by using the authentication function of the network. In addition, communication carriers can authenticate individual wireless LAN users who are using a broadband access line, and wireless LAN users arbitrarily specify the connection from wireless LAN users. Since the network can be routed, a wireless network connection service menu can be set for each individual user of the wireless LAN.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of a wireless communication system according to an embodiment of the present invention.

FIG. 2 is a diagram showing a connection sequence in which the terminal device 1 according to the embodiment connects to the Internet network M / intra-company network L.

FIG. 3 is a diagram showing a sequence of wireless AP authentication according to the same embodiment.

FIG. 4 shows a procedure of registering the number of simultaneous connections to RAS3 and determining the number of simultaneous connections of RAS3 according to the same embodiment.

FIG. 5 is a diagram showing a procedure of registration and determination of presence / absence of wireless AP access authority for a wireless LAN user in the wireless LAN user authentication server 4c according to the same embodiment.

[Explanation of symbols]

1 ... Terminal device 1C ... Wireless LAN card 2 ... Wireless AP 2a ... Wireless AP device 2b ... Wireless LAN user authentication server connection device 3 ... RAS 4 ... Authentication function 4a, 6, 6-1, 6-2 ... Network terminating device 4b ... Wireless AP authentication server 4c ... Wireless user authentication server 4d ... Cascon server 5 ... distribution server 7, 7-1, 7-2 ... Authentication server

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Tadashi Hioki             3-19-2 Nishishinjuku, Shinjuku-ku, Tokyo Tohnichi             Inside Telegraph and Telephone Corporation F term (reference) 5J104 AA07 AA16 EA15 KA01 KA02                       MA01 PA07                 5K030 GA15 HC14 HD06 HD09 JL01                       KA01 KA07 LB15                 5K033 AA08 DA17 DB12 DB16 DB18                       EC03

Claims (11)

[Claims] 1. A terminal device, a wireless access point accessed by the terminal device, an authentication server for authenticating the wireless access point and the terminal device, and a remote access server for routing to a network designated by the terminal. A wireless network connection system comprising: a wireless communication means for wirelessly communicating with the wireless access point; and terminal authentication information of the terminal device to an authentication server installed in an internet protocol network. The terminal authentication information transmitting means for transmitting, the encryption wireless communication means for receiving the encryption key information from the authentication server and encrypting the communication of the wireless communication means, and the network user authentication information including network identification information User authentication sent to the user authentication function of A multicast transmission unit, the allocated from the network user authentication function I
Network communication means for communicating with the network by a P address, the wireless access point, wireless communication means for wirelessly communicating with the plurality of terminal devices, communication means for communicating with a remote access server, and The wireless communication means and the interface conversion means for mutually converting the interface of the communication means; and an encryption wireless communication means for receiving encryption key information from the authentication server and encrypting communication of the wireless communication means, The remote access server includes an interface for communicating with a wireless access point, an interface converting unit for mutually converting an interface for communicating with an internet protocol network, and the network user authentication information received from the terminal device. Based on network identification information A routing unit that determines a destination of the network user authentication information by determining a communication device that accommodates the connection destination network, the authentication server stores a terminal authentication information of the terminal device, and a terminal authentication database, Terminal authentication means that receives terminal authentication information from a terminal and authenticates it with the terminal authentication database; and if the terminal authentication means authenticates the terminal, the terminal and the wireless access point encrypt. A wireless network connection system, comprising: encryption key information transmitting means for generating encryption key information for communication and notifying the wireless access point and the terminal device. 2. The wireless access point comprises authentication information transmitting means for transmitting the wireless access point authentication information of the wireless access point to the authentication server, and the communication means is I assigned by the authentication server.
The communication by the Internet protocol is established using the P address, the authentication server receives a wireless access point authentication information and a wireless access point authentication database that stores wireless access point authentication information of a wireless access point, And a wireless access point authenticating unit that authenticates with the access point authentication database; and an address notifying unit that transmits an IP address to be assigned to the wireless access point when the wireless access point authenticating unit authenticates the wireless access point. The wireless network connection system according to claim 1, wherein: 3. The remote access server, the wireless access point storage means for storing the number of simultaneous connection of the terminal device to which the wireless access point is allowed to connect, and the number of connected terminals counting the number of terminal devices connected to the wireless access point. And a number of simultaneous connections control means for rejecting the connection of the terminal device when the number of the terminal devices connected to the wireless access point accessed by the terminal device as the transmission source of the terminal authentication information is equal to or more than the number of the simultaneous connections. The wireless network connection system according to claim 1 or 2, further comprising: 4. The authentication server can use a list of terminal devices to which the wireless access point permits connection, and a wireless access point accessed by a terminal device that is a sender of the terminal authentication information. It is determined by the list based on the list, and includes a usage permission confirmation means for notifying the terminal device authentication means, wherein the terminal device authentication means authenticates the terminal device based on the connection availability information notified from the usage permission confirmation means. The wireless network connection system according to claim 1, wherein the wireless network connection system is performed. 5. A wireless communication unit that wirelessly communicates with a wireless access point, a terminal authentication information transmission unit that transmits the terminal authentication information of the terminal device to an authentication server installed in an Internet protocol network, and the authentication server Encrypted wireless communication means for receiving encryption key information and encrypting communication of the wireless communication means, and network user authentication information transmission means for transmitting network user authentication information including network identification information to a network user authentication function And the I assigned from the network user authentication function.
A network communication unit that communicates with the network by using a P address, and a terminal device. 6. A wireless communication unit that wirelessly communicates with a plurality of terminal devices, a communication unit that communicates with a remote access server, an interface conversion unit that mutually converts the interfaces of the wireless communication unit and the communication unit, and authentication. A wireless access point, comprising: encryption wireless communication means for receiving encryption key information from a server and encrypting communication of the wireless communication means. 7. An authentication information transmitting unit for transmitting wireless access point authentication information of the wireless access point to the authentication server, wherein the communication unit is an I assigned from the authentication server.
The wireless access point according to claim 6, wherein the P address is used to establish communication according to the Internet protocol. 8. An interface conversion means for mutually converting an interface for communicating with a wireless access point and an interface for communicating with an Internet protocol network, and the number of simultaneous connections of terminal devices to which the wireless access point permits connection. Storage means for storing, connection terminal number counting means for counting the number of terminal devices connected to the wireless access point, and the terminal device connected to the wireless access point accessed by the terminal device that transmitted the terminal authentication information Number,
A remote access server comprising: a simultaneous connection number control means for rejecting the connection of the terminal device when the number of simultaneous connections is equal to or more than the above. 9. A terminal authentication database that stores terminal authentication information of a terminal device, a terminal device authentication unit that receives the terminal authentication information from the terminal device, and authenticates with the terminal authentication database; When the terminal device is authenticated, it generates encryption key information for the terminal device and the wireless access point to perform encrypted communication, and the wireless access point accessed by the terminal device and the encryption key information to notify the terminal device. An authentication server comprising: a transmission unit. 10. A wireless access point authentication database that stores wireless access point authentication information of a wireless access point, and a wireless access point that receives wireless access point authentication information from the wireless access point and performs authentication by the wireless access point authentication database. 10. An authentication unit, and an address notification unit for transmitting an IP address to be assigned to the wireless access point when the wireless access point authentication unit authenticates the wireless access point. The listed authentication server. 11. A list of terminal devices to which a wireless access point permits connection, and whether the wireless access point accessed by the terminal device that is the source of the terminal authentication information is available is determined from the list, and the terminal is determined. It is provided with a use permission confirmation means for notifying a device authentication means, and the terminal device authentication means authenticates the terminal device according to the connection availability information notified from the use permission confirmation means. 9. The authentication server according to claim 9 or 10.