JP2004088148A - Radio lan system, mobile communication system and radio terminal, and terminal authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enhance the security in a radio LAN system by authenticating a radio terminal with high accuracy. <P>SOLUTION: In the case that the radio LAN system 100 authenticates the radio terminal 103 accessible to both a mobile communication system 102 and the radio LAN system 100, the radio terminal 103 makes an access request to the radio LAN system 100 and requests the mobile communication system 102 on the authentication at the same time, the mobile communication system 102 transmits the information used for the authentication processing of the radio terminal 103 by the mobile communication system 102 to the radio LAN system 100 in response to the request on the authentication, and the radio LAN system 100 uses the information used for the authentication processing to carry out the authentication processing of the radio terminal 103 making the access request. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a wireless LAN system, a mobile communication system, a wireless terminal, and a terminal authentication method.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, in a wireless LAN system, a simple authentication between an access point such as an ESS-ID (Extended Service Set Identity) and a user wireless terminal, and an encryption technique for improving security of a wireless LAN, for example, IEEE802.11 As an option, WEP (Wired Equivalent Privacy) standardized as a security specification is used.
[0003]
FIG. 13 shows a configuration of a conventional general wireless LAN system 1300. As shown in the figure, a conventional wireless LAN system 1300 includes a plurality of wireless LAN access devices 1303 to 1305 that monitor access from a wireless terminal 1302 located in a wireless LAN area 1301 allocated to the wireless LAN system 1300, and a wireless terminal The wireless LAN switching device 1307 establishes a session between the Internet 1306 and the wireless terminal 1302 by grasping which wireless LAN access device the wireless LAN access device 1302 is performing. Note that the wireless terminal 1302 establishes a wireless link with a wireless LAN access device (1303 in FIG. 13) within the wireless LAN area (1301 in FIG. 13).
[0004]
In such a wireless LAN system 1300, when the wireless terminal 1302 communicates by connecting to the Internet 1306 via the wireless LAN switching device 1307, the wireless LAN system is configured by the above-described simple authentication and encryption technology such as WEP. The security in 1300 is improved.
[0005]
[Problems to be solved by the invention]
However, in the conventional wireless LAN system 1300, although the encryption technology such as the simple authentication and the WEP is standardized as an option, the secret key data and the MAC (Media Access Control) address are decrypted and intercepted from the intercepted wireless signal. The key is easily broken. For this reason, eavesdropping, spoofing, and the like are possible, and security vulnerabilities have been pointed out. Therefore, in order to construct a large-scale network, it is necessary to further improve security.
[0006]
The present invention has been made in view of the above circumstances, and provides a wireless LAN system, a mobile communication system, a wireless terminal, and a terminal authentication method capable of performing highly accurate authentication for a wireless terminal and improving security. The purpose is to provide.
[0007]
[Means for Solving the Problems]
According to the present invention, when a wireless terminal that can access both the mobile communication system and the wireless LAN system is authenticated by the wireless LAN system, the wireless terminal requests an access to the wireless LAN system at the same time as the authentication request to the mobile communication system, In response to the authentication request, the mobile communication system transmits information used for authentication processing of the wireless terminal in the mobile communication system to the wireless LAN system, and the wireless LAN system requests access using the information used for the authentication processing. The authentication processing of the terminal is executed.
[0008]
Accordingly, the same high-accuracy authentication processing as the authentication processing in the mobile communication system can be realized in the wireless LAN system, so that the security of the weak wireless LAN system can be improved.
[0009]
In a wireless LAN system according to a first aspect of the present invention, when an access request is received from a wireless terminal in a management area, authentication for executing an authentication process using an authentication function of a mobile communication system accessible to the wireless terminal is provided. A configuration including a management unit is adopted.
[0010]
According to this configuration, the same high-accuracy authentication processing as the authentication processing in the mobile communication system can be realized in the wireless LAN system, so that the security of the weak wireless LAN system can be improved. .
[0011]
A second aspect of the present invention is the wireless LAN system according to the first aspect, wherein the authentication management unit is used in the mobile communication system for authentication processing of the wireless terminal when receiving an access request from the wireless terminal. A configuration is employed in which authentication processing of the wireless terminal is executed using information.
[0012]
According to this configuration, the same highly accurate authentication processing as the authentication processing in the mobile communication system can be realized in the wireless LAN system using the information used for the authentication processing of the wireless terminal in the mobile communication system. The security of the vulnerable wireless LAN system can be improved.
[0013]
According to a third aspect of the present invention, in the wireless LAN system according to the second aspect, the authentication management unit uses an encryption key and an authentication key transmitted as information used for an authentication process from the mobile communication system. Use a configuration to execute the authentication process.
[0014]
According to this configuration, it is possible to realize, in the wireless LAN system, the same highly accurate authentication processing as the authentication processing in the mobile communication system using the encryption key and the authentication key used in the authentication processing of the wireless terminal in the mobile communication system. Therefore, the security of the vulnerable wireless LAN system can be improved.
[0015]
According to a fourth aspect of the present invention, in the wireless LAN system according to the third aspect, the authentication management unit transmits the calculation result using the encryption key and the authentication key and the authentication key to the wireless terminal. A configuration is employed in which authentication processing of the wireless terminal is executed by collating the calculation result returned from the wireless terminal.
[0016]
According to this configuration, the operation result using the encryption key and the authentication key is compared with the operation result returned from the wireless terminal after transmitting the authentication key to the wireless terminal. Since the same high-accuracy authentication processing as the authentication processing can be realized in the wireless LAN system, the security of the weak wireless LAN system can be improved.
[0017]
A fifth aspect of the present invention is the wireless LAN system according to the first aspect, wherein the authentication management unit receives an access request from the wireless terminal and responds to an authentication result of the wireless terminal in the mobile communication system. A configuration for establishing a channel with the wireless terminal is adopted.
[0018]
According to this configuration, by establishing a channel with the wireless terminal in the wireless LAN system according to the authentication result of the wireless terminal in the mobile communication system, authentication processing with the same high accuracy as the authentication processing in the mobile communication system can be performed. Since the present invention can be realized by a wireless LAN system, the security of a weak wireless LAN system can be improved.
[0019]
In particular, according to the wireless LAN system of the fifth aspect, the authentication processing is completed only in the mobile communication system, and the wireless LAN system does not require the authentication processing. Therefore, the number of steps involved in the authentication process can be reduced, and the configuration of the wireless LAN system can be simplified.
[0020]
A sixth aspect of the present invention is the wireless LAN system according to the fifth aspect, wherein the authentication management unit includes identification information of the wireless terminal transmitted as an authentication result of the wireless terminal from the mobile communication system, When the identification information of the wireless terminal that has made the access request matches, the channel is established with the wireless terminal.
[0021]
According to this configuration, when the identification information of the wireless terminal transmitted as the authentication result of the wireless terminal from the mobile communication system matches the identification information of the wireless terminal that has made the access request, the identification information of the wireless terminal is determined. By establishing a channel, a highly accurate authentication process similar to the authentication process in the mobile communication system can be realized in the wireless LAN system, so that the security of the weak wireless LAN system can be improved. it can.
[0022]
A seventh aspect of the present invention is the wireless LAN system according to the first aspect, wherein the authentication management unit is generated from information used for authentication processing of the mobile communication system when receiving an access request from the wireless terminal. A configuration is used in which authentication processing of the wireless terminal is executed using dynamic information.
[0023]
According to this configuration, the wireless LAN system realizes an authentication process with the same or higher accuracy as the authentication process in the mobile communication system using the information generated from the information used for the authentication process of the wireless terminal in the mobile communication system. Therefore, the security of the vulnerable wireless LAN system can be improved.
[0024]
In particular, according to the wireless LAN system of the seventh aspect, the information used for the authentication processing is dynamically assigned each time the authentication is performed, so that the authentication processing with higher accuracy can be realized, so that the security is improved. Improvement can be achieved.
[0025]
According to an eighth aspect of the present invention, in the wireless LAN system according to the seventh aspect, the authentication management unit includes a dynamic encryption key and a dynamic authentication key transmitted as the dynamic information from the mobile communication system. A configuration is used in which the authentication process is executed by using.
[0026]
According to this configuration, it is possible to wirelessly perform an authentication process with the same or higher accuracy as the authentication process in the mobile communication system using the dynamic encryption key and the dynamic authentication key transmitted as the dynamic information from the mobile communication system. Since the present invention can be realized by a LAN system, the security of a weak wireless LAN system can be improved.
[0027]
According to a ninth aspect of the present invention, in the wireless LAN system according to the eighth aspect, the authentication management unit includes a calculation result using the dynamic encryption key and the dynamic authentication key received from the mobile communication system. After the dynamic authentication key is transmitted to the wireless terminal, an authentication process of the wireless terminal is executed by comparing the dynamic authentication key with a calculation result returned from the wireless terminal.
[0028]
According to this configuration, the operation result using the dynamic encryption key and the dynamic authentication key is compared with the operation result returned from the wireless terminal after transmitting the dynamic authentication key to the wireless terminal, so that the mobile terminal can be moved. Since the authentication processing with the same or higher accuracy as the authentication processing in the body communication system can be realized in the wireless LAN system, the security of the weak wireless LAN system can be improved.
[0029]
A mobile communication system according to a tenth aspect of the present invention is a mobile communication system including an authentication management unit that executes an authentication process of the wireless terminal when registering position information accompanying movement of the wireless terminal. The authentication management unit transmits information used for authentication processing of the wireless terminal to the wireless LAN system in response to a request for access to the wireless LAN system by the wireless terminal.
[0030]
According to this configuration, the information used for the authentication processing of the wireless terminal is transmitted to the wireless LAN system in response to the access request to the wireless LAN system by the wireless terminal. By using this method, highly accurate authentication processing similar to authentication processing in a mobile communication system can be realized in a wireless LAN system. As a result, the security of the vulnerable wireless LAN system can be improved.
[0031]
An eleventh aspect of the present invention, in the mobile communication system according to the tenth aspect, employs a configuration in which the authentication management unit transmits an encryption key and an authentication key as information used for authentication processing of the wireless terminal.
[0032]
According to this configuration, the encryption key and the authentication key are transmitted as information used for the authentication processing of the wireless terminal. Therefore, the information is used for the authentication processing of the wireless terminal in the wireless LAN system, thereby achieving the same processing as the authentication processing in the mobile communication system. Authentication processing with high accuracy can be realized by the wireless LAN system. As a result, the security of the vulnerable wireless LAN system can be improved.
[0033]
A mobile communication system according to a twelfth aspect of the present invention is a mobile communication system including an authentication management unit that executes an authentication process of the wireless terminal when registering position information accompanying movement of the wireless terminal. The authentication management unit transmits an authentication result of the wireless terminal to the wireless LAN system in response to an access request from the wireless terminal to the wireless LAN system.
[0034]
According to this configuration, the authentication result of the wireless terminal is transmitted to the wireless LAN system in response to the access request to the wireless LAN system by the wireless terminal. Therefore, the channel of the wireless terminal is established in the wireless LAN system in accordance with the authentication result. By doing so, highly accurate authentication processing similar to the authentication processing in the mobile communication system can be realized in the wireless LAN system. As a result, the security of the vulnerable wireless LAN system can be improved.
[0035]
A thirteenth aspect of the present invention, in the mobile communication system according to the twelfth aspect, employs a configuration in which the authentication management unit transmits identification information of the wireless terminal as an authentication result of the wireless terminal.
[0036]
According to this configuration, the identification information of the wireless terminal is transmitted as the authentication result of the wireless terminal. Therefore, in the wireless LAN system, according to the coincidence between the identification information of the wireless terminal and the identification information of the wireless terminal requesting access. By establishing a channel with the wireless terminal, highly accurate authentication processing similar to authentication processing in a mobile communication system can be realized in a wireless LAN system. As a result, the security of the vulnerable wireless LAN system can be improved.
[0037]
A mobile communication system according to a fourteenth aspect of the present invention is a mobile communication system including an authentication management unit that executes authentication processing of a wireless terminal when registering location information accompanying movement of the wireless terminal. A configuration in which the authentication management unit transmits dynamic information generated from information used for authentication processing of the wireless terminal to the wireless LAN system and the wireless terminal in response to an access request to the wireless LAN system by the wireless terminal. take.
[0038]
According to this configuration, dynamic information generated from information used for authentication processing of the wireless terminal is transmitted to the wireless LAN system and the wireless terminal in response to a request for access to the wireless LAN system by the wireless terminal. By using the authentication processing for the wireless terminal in the LAN system, it is possible to realize the authentication processing with higher accuracy than the authentication processing in the mobile communication system in the wireless LAN system. As a result, the security of the vulnerable wireless LAN system can be improved.
[0039]
According to a fifteenth aspect of the present invention, in the mobile communication system according to the fourteenth aspect, the authentication management unit uses an encryption key and an authentication key as dynamic information generated from information used for authentication processing of the wireless terminal. The dynamic encryption key and the dynamic authentication key generated are transmitted to the wireless LAN system, while the dynamic encryption key is transmitted to the wireless terminal.
[0040]
According to this configuration, since the dynamic encryption key and the dynamic authentication key are transmitted as dynamic information, they are used for the authentication processing of the wireless terminal in the wireless LAN system. The above-described highly accurate authentication processing can be realized by the wireless LAN system. As a result, the security of the vulnerable wireless LAN system can be improved.
[0041]
A wireless terminal according to a sixteenth aspect of the present invention makes an access request to the wireless LAN system of the third aspect, simultaneously makes an authentication request to the mobile communication system of the eleventh aspect, and sends an authentication key transmitted from the wireless LAN system. A configuration in which a calculation result using the password and an encryption key used for authentication processing of the mobile communication system is sent back to the wireless LAN system.
[0042]
According to this configuration, a calculation result using the authentication key transmitted from the wireless LAN system and the encryption key used for the authentication request of the mobile communication system is transmitted to the wireless LAN system. By using the authentication processing in the system, it is possible to realize the authentication processing with high accuracy similar to the authentication processing in the mobile communication system in the wireless LAN system. As a result, the security of the vulnerable wireless LAN system can be improved.
[0043]
A wireless terminal according to a seventeenth aspect of the present invention is a wireless terminal that requests access to the wireless LAN system according to the sixth aspect and requests authentication to the mobile communication system according to the thirteenth aspect. In this case, the terminal transmits the identification information of the terminal to the wireless LAN system at the time of the access request.
[0044]
According to this configuration, the identification information of the terminal is transmitted to the wireless LAN system at the time of an access request to the wireless LAN system, so that a channel with the wireless terminal is established in the wireless LAN system based on the identification information. Thus, a highly accurate authentication process similar to the authentication process in the mobile communication system can be realized in the wireless LAN system. As a result, the security of the vulnerable wireless LAN system can be improved.
[0045]
A wireless terminal according to an eighteenth aspect of the present invention makes an access request to the wireless LAN system of the eighth aspect, simultaneously makes an authentication request to the mobile communication system of the fifteenth aspect, and transmits a request transmitted from the mobile communication system. A configuration is employed in which a calculation result using a dynamic encryption key and a dynamic authentication key transmitted from the wireless LAN system is returned to the wireless LAN system.
[0046]
According to this configuration, the operation result using the dynamic encryption key transmitted from the mobile communication system and the dynamic authentication key transmitted from the wireless LAN system is returned to the wireless LAN system. By using the authentication processing in the LAN system, it is possible to realize the authentication processing with higher accuracy than the authentication processing in the mobile communication system in the wireless LAN system. As a result, the security of the vulnerable wireless LAN system can be improved.
[0047]
A terminal authentication method according to a nineteenth aspect of the present invention is a terminal authentication method for authenticating a wireless terminal that can access both a mobile communication system and a wireless LAN system by the wireless LAN system. At the same time as making an access request to the wireless LAN system, an authentication request is made to the mobile communication system, and in response to the authentication request, information used for authentication processing of the wireless terminal in the mobile communication system is used by the wireless LAN system. And performs authentication processing of the wireless terminal requesting access using the information used for the authentication processing in the wireless LAN system.
[0048]
A terminal authentication method according to a twentieth aspect of the present invention is a terminal authentication method for authenticating a wireless terminal that can access both a mobile communication system and a wireless LAN system with the wireless LAN system. At the same time as making an access request to the wireless LAN system, an authentication request is issued to the mobile communication system. In response to the authentication request, the mobile communication system transmits an authentication result of the wireless terminal in the mobile communication system to the wireless LAN system. According to the authentication result, the wireless LAN system establishes a channel with the wireless terminal.
[0049]
A terminal authentication method according to a twenty-first aspect of the present invention is a terminal authentication method for authenticating a wireless terminal accessible to both a mobile communication system and a wireless LAN system by the wireless LAN system. At the same time as making an access request to the wireless LAN system, it makes an authentication request to the mobile communication system. In response to this authentication request, the mobile communication system generates an operation request generated from information used for authentication processing of the wireless terminal in the mobile communication system. And transmitting authentication information to the wireless LAN system, and performing an authentication process of the wireless terminal requesting access using the dynamic information in the wireless LAN system.
[0050]
A program according to a twenty-second aspect of the present invention is a program for authenticating a wireless terminal that can access both a mobile communication system and a wireless LAN system by the wireless LAN system, wherein the program authenticates a wireless terminal in a management area. A step of receiving an access request, a step of receiving information used for authentication processing of the wireless terminal in the mobile communication system from the mobile communication system, and a step of receiving information used for authentication processing of the wireless terminal. And a program for causing a computer to execute the authentication process.
[0051]
A program according to a twenty-third aspect of the present invention is a program for authenticating a wireless terminal capable of accessing both a mobile communication system and a wireless LAN system by the wireless LAN system, wherein the program authenticates a wireless terminal in a management area. A step of receiving an access request, a step of receiving an authentication result of the wireless terminal in the mobile communication system from the mobile communication system, and a step of communicating with the wireless terminal in the wireless LAN system according to the authentication result of the wireless terminal. And a program for causing a computer to execute a procedure for establishing a channel.
[0052]
A program according to a twenty-fourth aspect of the present invention is a program for authenticating a wireless terminal capable of accessing both a mobile communication system and a wireless LAN system by the wireless LAN system, wherein the program authenticates a wireless terminal in a management area. A step of receiving an access request, a step of receiving dynamic information generated from the information used for the authentication processing of the wireless terminal in the mobile communication system from the mobile communication system, and using the dynamic information. And a procedure for executing the authentication process of the wireless terminal.
[0053]
Hereinafter, embodiments of the present invention will be specifically described with reference to the drawings.
[0054]
(Embodiment 1)
FIG. 1 is a block diagram showing a configuration of a communication network to which wireless LAN system 100 according to Embodiment 1 of the present invention is applied.
[0055]
As shown in FIG. 1, a wireless LAN system 100 according to the present invention is connected to the Internet 101, and is used for authentication (hereinafter referred to as “authentication information”) from a mobile communication system 102 similarly connected to the Internet 101. ), And authenticates the wireless terminal 103 using the authentication information. Note that, in the present embodiment, a cellular system will be described as an example of the mobile communication system 102, but the present invention is not limited to this and can be applied to other mobile communication systems. Hereinafter, the configurations of the wireless LAN system 100 and the cellular system 102 will be described.
[0056]
The wireless LAN system 100 includes a plurality of wireless LAN access devices 105 to 107 for monitoring access from a wireless terminal 103 located in a wireless LAN area 104 assigned to the wireless LAN system 100, and the wireless terminal 103 communicates with any wireless LAN access device. The authentication management of the wireless terminal 103 is performed by using the authentication information received from the wireless LAN switching device 108 and a cellular network authentication management device described later to determine whether communication is being performed and establish a session between the Internet 101 and the wireless terminal 103. A wireless LAN authentication management device 109 that performs
[0057]
On the other hand, the cellular system 102 includes a plurality of cellular network radio base station apparatuses 111 to 113 for monitoring access from a radio terminal 103 located in a cellular area 110 allocated to the cellular system 102, and the radio terminal 103 The cellular network switching device 115 establishes a call or a session between the Internet 101 or the public line 114 and the wireless terminal 103 by grasping whether wireless communication is performed with the station device, and the cellular network authentication that performs authentication management of the wireless terminal 103. The management device 116 is provided.
[0058]
The wireless terminal 103 establishes a wireless link with a cellular network wireless base station device (the cellular network wireless base station device 113 in FIG. 1) and communicates with the cellular system 102, A wireless LAN communication unit 118 that establishes a wireless link with a wireless LAN access device (the wireless LAN access device 105 in FIG. 1) in the wireless LAN area 104 and communicates with the wireless LAN system 100. .
[0059]
The wireless terminal 103 includes an authentication information storage unit 119 that stores authentication information assigned to the wireless terminal 103 used for the authentication processing of the cellular system 102, an authentication information stored in the authentication information storage unit 119, and the cellular system 102. 102 and an authentication processing unit 120 that performs an operation for an authentication process using the authentication information received from the wireless LAN system 100. With such a configuration, the wireless terminal 103 realizes a communication function with both the wireless LAN system 100 and the cellular system 102.
[0060]
In the cellular system 102, every time the cellular area 110 where the wireless terminal 103 is located is changed, registration of the position information of the wireless terminal 103 is performed. When registering the location information, the cellular network authentication management device 116 authenticates the wireless terminal 103. As a result, access from a wireless terminal that has not been registered in advance in the cellular system 102 is restricted, so that security in the cellular system 102 is ensured.
[0061]
Hereinafter, the configuration of the cellular network authentication management device 116 will be described. FIG. 2 is a block diagram showing a configuration of the cellular network authentication management device 116.
[0062]
In the cellular network authentication management device 116 shown in the figure, a signal transmission / reception unit 201 requests registration of location information from the wireless terminal 103 via the cellular network switching device 115 (hereinafter, referred to as a “location registration request signal”). And an authentication request signal (hereinafter, referred to as an “authentication request signal”) and a calculation result performed in the authentication process. The authentication request signal is transmitted from the wireless terminal 103 to the cellular system 102 only when the wireless terminal 103 requests access to the wireless LAN system 100. In addition, the signal transmitting / receiving unit 201 transmits an authentication key used for the authentication processing to the wireless terminal 103 to the wireless terminal 103.
[0063]
Authentication information corresponding to each wireless terminal 103 registered in advance in the cellular system 102 is registered in the database 202. Here, the authentication information refers to a secret encryption key and an authentication key. In the present embodiment, the encryption key is configured with a unique value for each wireless terminal 103. However, the authentication key is used in a common process for all wireless terminals 103, but need not constitute a unique value.
[0064]
The authentication processing unit 203 extracts an authentication key registered in the database 202 and passes it to the signal transmission / reception unit 201 at the time of authentication processing accompanying registration of position information of the wireless terminal 103. Further, the authentication processing unit 203 calculates the encryption key and the authentication key in the authentication processing of the wireless terminal 103, and also checks the calculation result transmitted from the wireless terminal 103.
[0065]
When the wireless terminal 103 requests access to the wireless LAN system 100, that is, when the wireless terminal 103 receives an authentication request signal from the wireless terminal 103, the authentication information transmitting unit 204 transmits an encryption key corresponding to the wireless terminal 103 from the database 202. Then, the authentication key is extracted and transmitted to the wireless LAN authentication management device 109.
[0066]
On the other hand, as described above, the wireless LAN system 100 receives the authentication information (the encryption key and the authentication key) from the cellular system 102, and performs the authentication processing of the wireless terminal 103 using the authentication information. Authentication processing in the wireless LAN system 100 is performed by the wireless LAN authentication management device 109.
[0067]
Hereinafter, the configuration of the wireless LAN authentication management device 109 will be described. FIG. 3 is a block diagram illustrating a configuration of the wireless LAN authentication management device 109.
[0068]
In the wireless LAN authentication management device 109 shown in the figure, the authentication information receiving unit 301 is transmitted from the authentication information transmission unit 204 of the cellular network authentication management device 116 with the access of the wireless terminal 103 to the wireless LAN system 100. Receive the encryption key and the authentication key.
[0069]
The signal transmission / reception unit 302 receives a signal (hereinafter, referred to as an “access request signal”) for requesting access from the wireless terminal 103 via the wireless LAN switching device 108 and a calculation result performed during authentication processing. Further, signal transmitting / receiving section 302 transmits the authentication key received from cellular system 102 to wireless terminal 103 that has made the access request.
[0070]
The authentication processing unit 303 passes the authentication key received by the authentication information receiving unit 301 to the signal transmitting / receiving unit 201. The authentication processing unit 303 performs a calculation using the encryption key and the authentication key received from the cellular system 102, and checks the calculation result against the calculation result transmitted from the wireless terminal 103.
[0071]
Hereinafter, the flow of the authentication process in the wireless LAN system 100 according to the first embodiment will be described with reference to FIGS.
[0072]
FIG. 4 is a diagram illustrating a flow of an authentication process in wireless LAN system 100 according to the present embodiment. It is assumed that the wireless terminal 103 is used at a position within the cellular area 112 and within the wireless LAN area 105 as shown in FIG.
[0073]
When wireless terminal 103 enters cellular area 110, a location registration request signal is transmitted from cellular network communication section 117 of wireless terminal 103 to cellular network wireless base station apparatus 113 (ST401). This location registration request signal is passed to the cellular network authentication management device 116 via the cellular network switching device 115.
[0074]
In the cellular network authentication management device 116, the location registration request signal is received by the signal transmission / reception unit 201 and passed to the authentication processing unit 203. The authentication processing unit 203 executes an authentication process of the wireless terminal 103 according to the position registration request signal. Specifically, the authentication processing unit 203 extracts the encryption key and the authentication key corresponding to the wireless terminal 103 from the database 202, and instructs the signal transmitting / receiving unit 201 to return only the authentication key to the wireless terminal 103. I do.
[0075]
In response to this instruction, signal transmitting / receiving section 201 transmits an authentication key to wireless terminal 103 via cellular network switching apparatus 115 and cellular network wireless base station apparatus 113 (ST402). In addition to transmitting the authentication key, the authentication processing unit 203 performs an operation for the authentication process using the encryption key and the authentication key extracted from the database 202.
[0076]
The wireless terminal 103 receives the authentication key in the cellular network communication unit 117 and passes it to the authentication processing unit 120. Upon receiving this authentication key, the authentication processing unit 120 extracts its own encryption key registered in advance in the authentication information storage unit 119, and performs an operation for authentication processing using the encryption key and the authentication key. Then, the calculation result is returned to cellular system 102 (ST403). This calculation result is transmitted to the cellular system 102 via the cellular network communication unit 117.
[0077]
In the cellular system 102, the calculation result is passed to the authentication processing unit 203 of the cellular network authentication management device 116. Upon receiving the calculation result, the authentication processing unit 203 checks the calculation result using the previously calculated encryption key and the authentication key. Then, the authentication processing unit 203 determines that the wireless terminal 103 that has accessed is a legitimate wireless terminal 103 that has been registered in advance if the calculation results match, and permits access. Judge as an unauthorized wireless terminal 103 and deny access. Thus, the authentication processing in the cellular system 102 is completed.
[0078]
When the wireless terminal 103, which has completed the authentication processing in the cellular system 102, accesses the wireless LAN system 100, an access request signal is sent from the wireless LAN communication unit 118 to the wireless LAN access device 105 (ST404). Then, an authentication request signal is transmitted from cellular network communication section 117 to cellular network radio base station 113 (ST405). The access request signal is passed to the wireless LAN authentication management device 109 via the wireless LAN switching device 108. On the other hand, the authentication request signal is passed to the cellular network authentication management device 116 via the cellular network switching device 115.
[0079]
In the cellular network authentication management device 116, the authentication request signal is received by the signal transmitting / receiving unit 201. Upon receiving the authentication request signal, the signal transmission / reception unit 201 instructs the authentication information transmission unit 204 to transmit the encryption key and the authentication key corresponding to the wireless terminal 103 to the wireless LAN authentication management device 109.
[0080]
Upon receiving this instruction, authentication information transmitting section 204 searches and retrieves the corresponding encryption key and authentication key from database 202, and transmits them to wireless LAN authentication management apparatus 109 (ST406). In the wireless LAN authentication management device 109, the authentication information receiving unit 301 receives the encryption key and the authentication key and passes them to the authentication processing unit 303.
[0081]
The transmission of the encryption key and the authentication key is performed via the Internet 101 or a dedicated line established between the wireless LAN system 100 and the cellular system 102.
[0082]
In wireless LAN authentication management apparatus 109, access request signal transmitted in ST 404 is received by signal transmitting / receiving section 302 and passed to authentication processing section 303. The authentication processing unit 303 executes authentication processing of the wireless terminal 103 according to the access request signal. Specifically, it instructs signal transmission / reception section 302 to return only the authentication key among the encryption key and the authentication key received from cellular system 102 in ST 406 to wireless terminal 103.
[0083]
In response to this instruction, signal transmitting / receiving section 302 transmits an authentication key to wireless terminal 103 via wireless LAN switching apparatus 108 and wireless LAN access apparatus 105 (ST 407). At the same time as transmitting the authentication key, the authentication processing unit 303 performs an operation for an authentication process using the encryption key and the authentication key received from the cellular system 102.
[0084]
The wireless terminal 103 receives the authentication key through the wireless LAN communication unit 118 and passes it to the authentication processing unit 120. Upon receiving the authentication key, the authentication processing unit 120 performs an operation for the authentication process using the authentication key and an encryption key registered in advance in the authentication information storage unit 119 for the authentication process of the cellular system 102. Then, the calculation result is returned to wireless LAN system 100 (ST408). This calculation result is transmitted to the wireless LAN system 100 via the wireless LAN communication unit 118.
[0085]
In the wireless LAN system 100, the calculation result is passed to the authentication processing unit 303 of the wireless LAN authentication management device 109. Upon receiving this calculation result, the authentication processing unit 303 checks the calculation result using the previously calculated encryption key and authentication key.
[0086]
Then, the authentication processing unit 303 determines that the accessing wireless terminal 103 is a legitimate wireless terminal 103 when both the calculation results match, and permits the access. Judge and deny access. Then, when permitting access from wireless terminal 103, wireless LAN switching apparatus 108 sets a channel between wireless terminal 103 and Internet 101 (ST409).
[0087]
As described above, according to the wireless LAN system 100 of the present embodiment, when performing the authentication processing of the wireless terminal 103 in the wireless LAN system 100, the encryption key and the authentication key used in the authentication processing of the cellular system 102 are used. Since the authentication is performed, authentication processing with high accuracy similar to the authentication processing in the cellular system 102 can be realized in the wireless LAN system 100. Thereby, the security of the vulnerable wireless LAN system 100 can be improved.
[0088]
Note that, in the present embodiment, when the wireless terminal 103 requests access to the wireless LAN system 100, the encryption key and the authentication key are used without taking into account whether there is a prior contract between the wireless terminal 103 and the wireless LAN system 100. Is transmitted to the wireless LAN authentication management device 109. However, the present invention is not limited to this. The presence or absence of a prior contract with the wireless LAN system 100 is registered in the database 202 of the cellular network authentication management device 116, and the encryption key and the authentication key are exchanged only when there is a prior contract. You may change so that it may transmit to the authentication management apparatus 109. In the case of such a change, access of the wireless terminal 103 that does not have a prior contract with the wireless LAN system 100 is restricted, so that a more accurate authentication process can be realized.
[0089]
(Embodiment 2)
The wireless LAN system 100 according to the first embodiment receives authentication information used for authentication processing of the cellular system 102 from the cellular system 102, performs authentication processing of the wireless terminal 103 independently, and then establishes a channel with the wireless terminal 103. On the other hand, the wireless LAN system 500 according to the second embodiment is different in that a channel with the wireless terminal 103 is established according to the authentication result of the wireless terminal 103 in the cellular system 102.
[0090]
FIG. 5 is a block diagram showing a configuration of a communication network to which wireless LAN system 500 according to Embodiment 2 of the present invention is applied. 5, components having the same reference numerals as those in FIG. 1 have the same functions and will not be described.
[0091]
In the communication network shown in FIG. 5, the cellular network authentication management device 501 responds to an authentication request signal from the wireless terminal 103 to identify the wireless terminal 103 that has completed the authentication process (hereinafter, referred to as “wireless terminal ID”). ) Is transmitted to the wireless LAN authentication management device 502. On the other hand, when receiving the wireless terminal ID, the wireless LAN authentication management device 502 checks the received wireless terminal ID against the ID of the wireless terminal 103 that has made the access request.
[0092]
Hereinafter, the configurations of the cellular network authentication management device 501 and the wireless LAN authentication management device 502 according to the second embodiment will be described.
[0093]
FIG. 6 is a block diagram showing a configuration of the cellular network authentication management device 501 according to the second embodiment. Note that, in FIG. 6, the components denoted by the same reference numerals as those in FIG. 2 have the same functions and will not be described.
[0094]
In the cellular network authentication management device 501 shown in FIG. 6, the database 601 includes, in addition to the authentication information corresponding to each wireless terminal 103 registered in the database 202 according to the first embodiment, the wireless information corresponding to each wireless terminal 103. The terminal ID is registered.
[0095]
When the wireless terminal 103 requests access to the wireless LAN system 500, that is, when the wireless terminal 103 receives an authentication request signal from the wireless terminal 103, the terminal ID transmitting unit 602 transmits the wireless terminal corresponding to the wireless terminal 103 from the database 601. The ID is extracted and transmitted to the wireless LAN authentication management device 502.
[0096]
FIG. 7 is a block diagram illustrating a configuration of the wireless LAN authentication management device 502.
[0097]
In the wireless LAN authentication management device 502 shown in FIG. 5, the terminal ID receiving unit 701 receives the wireless terminal ID transmitted from the terminal ID transmitting unit 602 in response to the access of the wireless terminal 103 to the wireless LAN system 500.
[0098]
The signal transmitting / receiving unit 702 receives an access request signal from the wireless terminal 103 via the wireless LAN switching device 108. The access request signal includes the wireless terminal ID corresponding to the wireless terminal 103. In addition, signal transmitting / receiving section 702 transmits a signal indicating that the authentication processing has been completed (hereinafter, referred to as an “authentication completion signal”) to wireless terminal 103 that has requested access.
[0099]
The authentication processing unit 703 compares the wireless terminal ID received by the terminal ID receiving unit 701 with the wireless terminal ID included in the access request signal. If the two wireless terminal IDs match, the signal transmission / reception unit 702 is instructed to transmit an authentication completion signal to the wireless terminal 103.
[0100]
Hereinafter, the flow of the authentication process in the wireless LAN system 500 according to the second embodiment will be described with reference to FIGS.
[0101]
FIG. 8 is a diagram for explaining a flow of an authentication process in the wireless LAN system 500 according to the second embodiment. Note that, in FIG. 8, the processes denoted by the same reference numerals as those in FIG. 4 indicate the same processes, and description thereof will be omitted.
[0102]
As shown in FIG. 8, in cellular system 102, authentication processing is performed in response to a position information registration request from wireless terminal 103, as in Embodiment 1 (ST401 to ST403). Also, when the wireless terminal 103 accesses the wireless LAN system 100, an access request signal is sent to the wireless LAN system 100 and an authentication request signal is sent to the cellular system 102 in the same manner (ST404, ST405). .
[0103]
In the second embodiment, when an authentication request signal is transmitted from the wireless terminal 103 that has completed the authentication processing in the cellular system 102, the signal transmitting / receiving unit 201 of the cellular network authentication management device 501 receives this authentication request signal. . Upon receiving the authentication request signal, the signal transmission / reception unit 201 instructs the terminal ID transmission unit 602 to transmit the wireless terminal ID corresponding to the wireless terminal 103 to the wireless LAN authentication management device 502.
[0104]
Upon receiving this instruction, terminal ID transmitting section 602 searches for and retrieves the corresponding wireless terminal ID from database 601 and transmits it to wireless LAN authentication management apparatus 502 (ST801). In the wireless LAN authentication management device 502, the wireless terminal ID is received by the terminal ID receiving unit 701 and passed to the authentication processing unit 703.
[0105]
The wireless terminal ID is transmitted via the Internet 101 or via a dedicated line established between the wireless LAN system 500 and the cellular system 102.
[0106]
The access request signal transmitted from wireless terminal 103 in ST 404 is passed to wireless LAN authentication management device 502 via wireless LAN access device 105 and wireless LAN switching device 108. In the wireless LAN authentication management device 502, the access request signal is received by the signal transmission / reception unit 702 and passed to the authentication processing unit 703.
[0107]
Upon receiving the access request signal, authentication processing section 703 collates the wireless terminal ID included in the access request signal with the wireless terminal ID received from cellular system 102 by terminal ID receiving section 701.
[0108]
If the two wireless terminal IDs match, the authentication processing unit 703 determines that the accessing wireless terminal 103 is a legitimate wireless terminal 103 and permits the access, while if the calculation result is different, the unauthorized wireless terminal 103 And deny access. Then, when permitting access from wireless terminal 103, wireless LAN switching apparatus 108 establishes a channel between wireless terminal 103 and Internet 101 (ST802).
[0109]
As described above, according to the wireless LAN system 500 of the second embodiment, the channel with the wireless terminal 103 is established according to the authentication result obtained by the authentication processing in the cellular system 102. Thereby, the authentication process using the encryption key and the authentication key used for the authentication process in the cellular system 102 can be indirectly performed in the wireless LAN system 500, so that the authentication with the same high accuracy as the authentication process in the cellular system 102 can be performed. The processing can be realized by the wireless LAN system 500. As a result, the security of the vulnerable wireless LAN system 500 can be improved.
[0110]
In particular, according to the wireless LAN system 500 of the second embodiment, the authentication processing is completed only by the cellular system 102, and the wireless LAN system 500 does not require the authentication processing. Therefore, compared to the wireless LAN system 100 of the first embodiment, the number of steps involved in the authentication process can be reduced, and the circuit of the wireless LAN authentication management device 502 can be simplified.
[0111]
Note that, in the present embodiment, when the wireless terminal 103 requests access to the wireless LAN system 500, the wireless terminal ID is assigned to the wireless terminal ID without considering whether or not there is a prior contract between the wireless terminal 103 and the wireless LAN system 500. The form of transmission to the LAN authentication management device 502 has been described. However, the present invention is not limited to this. In the database 601 of the cellular network authentication management device 501, the presence or absence of a prior contract with the wireless LAN system 500 is registered, and the wireless terminal ID is transmitted only when there is a prior contract. May be changed. In the case of such a change, access of the wireless terminal 103 not previously contracted with the wireless LAN system 500 is restricted, so that more accurate authentication processing can be realized.
[0112]
(Embodiment 3)
While the wireless LAN system 100 according to the first embodiment receives fixed authentication information used for authentication processing of the cellular system 102 and performs authentication processing of the wireless terminal 103, the wireless LAN system according to the third embodiment 900 is different in that authentication processing of the wireless terminal 103 is performed using dynamic authentication information generated from fixed authentication information used for authentication processing of the cellular system 102.
[0113]
FIG. 9 is a block diagram showing a configuration of a communication network to which wireless LAN system 900 according to Embodiment 3 of the present invention is applied. In FIG. 9, the components denoted by the same reference numerals as those in FIG. 1 have the same functions and will not be described.
[0114]
In the communication network illustrated in FIG. 9, the cellular network authentication management device 901 dynamically responds to an authentication request signal from the wireless terminal 103 from an encryption key and an authentication key corresponding to the wireless terminal 103 that has completed authentication processing. An encryption key and a dynamic authentication key are generated and transmitted to the wireless LAN authentication management device 902. On the other hand, upon receiving the dynamic encryption key or the like, the wireless LAN authentication management device 902 performs authentication processing of the wireless terminal 103 using the dynamic encryption key or the like.
[0115]
Hereinafter, configurations of the cellular network authentication management device 901 and the wireless LAN authentication management device 902 according to Embodiment 3 will be described.
[0116]
FIG. 10 is a block diagram showing a configuration of a cellular network authentication management device 901 according to Embodiment 3. Note that, in FIG. 10, the components denoted by the same reference numerals as those in FIG. 2 have the same functions and will not be described.
[0117]
In the cellular network authentication management device 901 shown in FIG. 10, the signal transmission / reception unit 1001 transmits a position registration request signal or an authentication request signal from the wireless terminal 103 via the cellular network switching device 115 and a calculation result performed in the authentication process. On the other hand, while receiving the authentication information, the authentication information necessary for the authentication processing of the wireless terminal 103 that has requested the authentication is transmitted. In the third embodiment, a dynamic encryption key and an authentication key are transmitted as authentication information.
[0118]
The authentication information generation unit 1002 extracts the encryption key and the authentication key corresponding to the wireless terminal 103 from the database 202, and generates a dynamic encryption key and a dynamic authentication key by multiplying by an arbitrary numerical value. The generated dynamic encryption key and the like are stored in the database 202 again. When generating the dynamic encryption key and the dynamic authentication key, any method may be used.
[0119]
When the wireless terminal 103 requests access to the wireless LAN system 900, that is, when the wireless terminal 103 receives an authentication request signal from the wireless terminal 103, the authentication information transmitting unit 1003 transmits the dynamic information corresponding to the wireless terminal 103 from the database 202. The encryption key and the dynamic authentication key are extracted, and the dynamic encryption key and the dynamic authentication key are transmitted to the wireless LAN authentication management device 902.
[0120]
FIG. 11 is a block diagram illustrating a configuration of the wireless LAN authentication management device 902.
[0121]
In the wireless LAN authentication management device 902 shown in the figure, the authentication information receiving unit 1101 includes a dynamic encryption key and a dynamic encryption key transmitted from the authentication information transmitting unit 1002 when the wireless terminal 103 accesses the wireless LAN system 900. Receive an authentication key.
[0122]
The signal transmission / reception unit 1102 receives an access request signal from the wireless terminal 103 and a calculation result performed at the time of authentication processing via the wireless LAN switching device 108. Further, signal transmitting / receiving section 1102 transmits the dynamic authentication key received from cellular system 102 to wireless terminal 103 that has made an access request.
[0123]
The authentication processing unit 1103 passes the dynamic authentication key received from the cellular system 102 to the signal transmitting / receiving unit 1102. In addition, the authentication processing unit 1103 calculates the dynamic authentication key and the dynamic encryption key, and checks the calculation result against the calculation result transmitted from the wireless terminal 103.
[0124]
Hereinafter, the flow of the authentication process in the wireless LAN system 900 according to the third embodiment will be described with reference to FIGS.
[0125]
FIG. 12 is a diagram illustrating a flow of an authentication process in wireless LAN system 900 according to the third embodiment. In FIG. 12, the processes denoted by the same reference numerals as those in FIG. 4 indicate the same processes, and the description will be omitted.
[0126]
As shown in FIG. 12, in cellular system 102, authentication processing is performed in response to a position information registration request from wireless terminal 103, as in Embodiment 1 (ST401 to ST403).
[0127]
In the third embodiment, when the authentication processing of the wireless terminal 103 is completed in the cellular system 102, the authentication information generation unit 1002 in the cellular network authentication management device 901 uses the encryption key corresponding to the wireless terminal 103 to perform dynamic encryption. Generate a key. Signal transmitting / receiving section 1001 transmits this dynamic encryption key to wireless terminal 103 via cellular network switching apparatus 115 and cellular network radio base station apparatus 113 (ST1201).
[0128]
In the wireless terminal 103, the dynamic encryption key is received by the cellular network communication unit 117 and registered in the authentication information storage unit 119.
[0129]
When the wireless terminal 103, which has completed the authentication process in the cellular system 102, accesses the wireless LAN system 900, an access request signal is sent from the wireless terminal 103 to the wireless LAN system 900, and the cellular system 102 is authenticated. Similarly, the request signal is transmitted (ST404, ST405).
[0130]
The access request signal is passed to the wireless LAN authentication management device 902 via the wireless LAN switching device 108. On the other hand, the authentication request signal is passed to the cellular network authentication management device 901 via the cellular network switching device 115.
[0131]
In the cellular network authentication management device 902, the signal transmitting / receiving unit 1001 receives this authentication request signal. Upon receiving the authentication request signal, the signal transmission / reception unit 1001 uses the encryption key and the authentication key corresponding to the wireless terminal 103 to generate a dynamic encryption key and a dynamic authentication key. To instruct. In addition, the signal transmission / reception unit 1001 instructs the authentication information transmission unit 1003 to transmit the dynamic encryption key and the dynamic authentication key generated by the authentication information generation unit 1002 to the wireless LAN authentication management device 902.
[0132]
In response to this instruction, the authentication information generation unit 1002 extracts the encryption key and the authentication key corresponding to the wireless terminal 103 from the database 202, and generates a dynamic encryption key and a dynamic authentication key. Then, these dynamic encryption keys are stored in the database 202 again.
[0133]
In response to an instruction from signal transmitting / receiving section 1001, authentication information transmitting section 1003 searches and retrieves the corresponding dynamic encryption key and dynamic authentication key from database 202, and transmits them to wireless LAN authentication management apparatus 902 (ST1202). . In the wireless LAN authentication management device 902, the dynamic encryption key and the dynamic authentication key are received by the authentication information receiving unit 1101 and passed to the authentication processing unit 1103.
[0134]
The transmission of these dynamic encryption keys and the like is performed via the Internet 101 or via a dedicated line established between the wireless LAN system 900 and the cellular system 102.
[0135]
On the other hand, in wireless LAN authentication management apparatus 902, access request signal transmitted from wireless terminal 103 in ST 404 is received by signal transmitting / receiving section 1102 and passed to authentication processing section 1103. The authentication processing unit 1103 executes an authentication process of the wireless terminal 103 according to the access request signal. Specifically, in ST 1202, of dynamic encryption key and dynamic authentication key received from cellular system 102, only dynamic authentication key is instructed to signal transmitting / receiving section 1102 to return to wireless terminal 103.
[0136]
In response to this instruction, signal transmitting / receiving section 1102 transmits a dynamic authentication key to wireless terminal 103 via wireless LAN switching apparatus 108 (ST1203). At the same time as transmitting the dynamic authentication key, the authentication processing unit 1103 performs an operation for an authentication process using the dynamic encryption key and the dynamic authentication key received from the cellular system 102.
[0137]
The wireless terminal 103 receives the dynamic authentication key through the wireless LAN communication unit 118 and passes it to the authentication processing unit 120. Upon receiving the dynamic authentication key, wireless terminal 103 performs an operation for an authentication process using the dynamic authentication key and the dynamic encryption key received in ST 1201. Then, the calculation result is returned to wireless LAN system 900 (ST1204). This calculation result is transmitted to the wireless LAN system 100 via the wireless LAN communication unit 118.
[0138]
In the wireless LAN system 900, the calculation result is passed to the authentication processing unit 1103 of the wireless LAN authentication management device 902. Upon receiving the calculation result, the authentication processing unit 1103 checks the calculation result using the previously calculated dynamic encryption key and dynamic authentication key.
[0139]
Then, the authentication processing unit 1103 determines that the accessing wireless terminal 103 is a legitimate wireless terminal 103 when both of the calculation results match, and permits the access. Judge and deny access. Then, when permitting access from wireless terminal 103, wireless LAN switching apparatus 108 establishes a channel between wireless terminal 103 and Internet 101 (ST1205).
[0140]
As described above, according to the wireless LAN system 900 of the third embodiment, the dynamic encryption key is transmitted to the wireless terminal 103 that has completed the authentication processing in the cellular system 102, while the dynamic encryption key and the A dynamic authentication key is transmitted, and an authentication process in the wireless LAN system 900 is performed using the dynamic encryption key and the dynamic authentication key. Thus, authentication processing with higher accuracy than the authentication processing in cellular system 102 can be realized in wireless LAN system 900. As a result, the security of the vulnerable wireless LAN system 900 can be improved.
[0141]
In particular, according to the wireless LAN system 900 of the third embodiment, the encryption key and the authentication key used for the authentication process are dynamically allocated each time authentication is performed. Improvement can be achieved.
[0142]
Note that, in the present embodiment, when the wireless terminal 103 requests access to the wireless LAN system 900, the dynamic encryption key and the dynamic encryption key are used without considering whether there is a prior contract between the wireless terminal 103 and the wireless LAN system 900. A mode of transmitting a dynamic authentication key to the wireless LAN authentication management device 902 has been described. However, the present invention is not limited to this. In the database 202 of the cellular network authentication management device 901, the presence or absence of a prior contract with the wireless LAN system 900 is registered, and only when there is a prior contract, the dynamic encryption key and the dynamic authentication are registered. The key may be changed to be transmitted. In the case of such a change, access of the wireless terminal 103 not previously contracted with the wireless LAN system 900 is restricted, so that a more accurate authentication process can be realized.
[0143]
Note that as will be apparent to those skilled in the art, the present invention can be implemented using a general commercially available digital computer and microprocessor programmed according to the technology described in the above embodiment. Further, as will be apparent to those skilled in the art, the present invention includes a computer program created by those skilled in the art based on the technology described in the above embodiment.
[0144]
Also, a computer program product that is a storage medium including instructions that can be used to program a computer implementing the present invention is included in the scope of the present invention. The storage medium is a disk such as a floppy (R) disk, an optical disk, a CDROM and a magnetic disk, a ROM, a RAM, an EPROM, an EEPROM, a magnetic optical card, a memory card or a DVD, but is not particularly limited to these. Absent.
[0145]
【The invention's effect】
As described above, according to the present invention, the authentication processing of the wireless terminal in the wireless LAN system is performed by using the authentication function of the wireless terminal in the cellular system. Therefore, the same accuracy as the authentication processing in the cellular system is performed. Authentication processing can be realized by the wireless LAN system, and the security of the weak wireless LAN system can be improved.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a communication network to which a wireless LAN system according to a first embodiment of the present invention is applied;
FIG. 2 is a block diagram showing a configuration of a cellular network authentication management device according to Embodiment 1.
FIG. 3 is a block diagram showing a configuration of a wireless LAN authentication management device according to the first embodiment.
FIG. 4 is a diagram for explaining a flow of an authentication process in the wireless LAN system according to the first embodiment.
FIG. 5 is a block diagram showing a configuration of a communication network to which a wireless LAN system according to Embodiment 2 of the present invention is applied;
FIG. 6 is a block diagram showing a configuration of a cellular network authentication management device according to a second embodiment.
FIG. 7 is a block diagram showing a configuration of a wireless LAN authentication management device according to a second embodiment.
FIG. 8 is a diagram for explaining a flow of an authentication process in the wireless LAN system according to the second embodiment.
FIG. 9 is a block diagram showing a configuration of a communication network to which a wireless LAN system according to a third embodiment of the present invention is applied;
FIG. 10 is a block diagram showing a configuration of a cellular network authentication management device according to a third embodiment.
FIG. 11 is a block diagram showing a configuration of a wireless LAN authentication management device according to a third embodiment.
FIG. 12 is a diagram illustrating a flow of an authentication process in the wireless LAN system according to the third embodiment.
FIG. 13 is a block diagram showing a configuration of a conventional general wireless LAN system.
[Explanation of symbols]
100,500,900 Wireless LAN system
102 Cellular System
103 wireless terminal
104 Wireless LAN area
105-107 Wireless LAN access device
108 Wireless LAN switching equipment
109, 502, 902 Wireless LAN authentication management device
110 Cellular Area
111-113 Cellular network radio base station apparatus
115 Cellular network switching equipment
116,501,901 Cellular network authentication management device
203 Authentication processing unit
204, 1003 Authentication information transmission unit
301, 1101 Authentication information receiving unit
303 Authentication processing unit
602 terminal ID transmission unit
701 Terminal ID receiving unit
1002 Authentication information generation unit

Claims (24)

A wireless LAN system, comprising: an authentication management unit that executes an authentication process using an authentication function of a mobile communication system accessible to a wireless terminal when an access request is received from a wireless terminal in a management area. The authentication management unit, when receiving an access request from the wireless terminal, executes authentication processing of the wireless terminal using information used for authentication processing of the wireless terminal in the mobile communication system. 1. The wireless LAN system according to 1. The wireless LAN system according to claim 2, wherein the authentication management unit executes the authentication process using an encryption key and an authentication key transmitted from the mobile communication system as information used for the authentication process. The authentication management unit authenticates the wireless terminal by comparing a calculation result using the encryption key and the authentication key with a calculation result returned from the wireless terminal after transmitting the authentication key to the wireless terminal. 4. The wireless LAN system according to claim 3, wherein the processing is executed. The wireless communication system according to claim 1, wherein the authentication management unit, upon receiving an access request from the wireless terminal, establishes a channel with the wireless terminal according to an authentication result of the wireless terminal in the mobile communication system. LAN system. The authentication management unit, the identification information of the wireless terminal transmitted as an authentication result of the wireless terminal from the mobile communication system, if the identification information of the wireless terminal that has requested access, the wireless terminal and the wireless terminal 6. The wireless LAN system according to claim 5, wherein said channel is established. The authentication management unit, upon receiving an access request from the wireless terminal, executes authentication processing of the wireless terminal using dynamic information generated from information used for authentication processing of the mobile communication system. The wireless LAN system according to claim 1, wherein The wireless LAN according to claim 7, wherein the authentication management unit performs an authentication process using a dynamic encryption key and a dynamic authentication key transmitted as the dynamic information from the mobile communication system. system. The authentication management unit, the operation result using the dynamic encryption key and the dynamic authentication key received from the mobile communication system, and returned from the wireless terminal after transmitting the dynamic authentication key to the wireless terminal 9. The wireless LAN system according to claim 8, wherein the authentication processing of the wireless terminal is executed by comparing the calculation result with the calculation result. A mobile communication system including an authentication management unit that executes an authentication process of the wireless terminal when registering location information accompanying movement of the wireless terminal, wherein the authentication management unit is configured to establish a wireless LAN system by the wireless terminal. A mobile communication system for transmitting information used for authentication processing of said wireless terminal to said wireless LAN system in response to said access request. The mobile communication system according to claim 10, wherein the authentication management unit transmits an encryption key and an authentication key as information used for authentication processing of the wireless terminal. A mobile communication system including an authentication management unit that executes an authentication process of the wireless terminal when registering location information accompanying movement of the wireless terminal, wherein the authentication management unit is configured to establish a wireless LAN system by the wireless terminal. Transmitting a result of authentication of said wireless terminal to said wireless LAN system in response to said access request. The mobile communication system according to claim 12, wherein the authentication management unit transmits identification information of the wireless terminal as an authentication result of the wireless terminal. A mobile communication system including an authentication management unit that executes an authentication process of the wireless terminal when registering location information accompanying movement of the wireless terminal,
The authentication management unit transmits dynamic information generated from information used for authentication processing of the wireless terminal to the wireless LAN system and the wireless terminal in response to a request for access to the wireless LAN system by the wireless terminal. Mobile communication system. The authentication management unit transmits a dynamic encryption key and a dynamic authentication key generated from an encryption key and an authentication key to the wireless LAN system as dynamic information generated from information used for authentication processing of the wireless terminal, The mobile communication system according to claim 14, wherein the dynamic encryption key is transmitted to the wireless terminal. 12. An authentication key transmitted from the wireless LAN system and an authentication key transmitted to the mobile communication system according to claim 11 at the same time as an access request to the wireless LAN system according to claim 3 and an encryption used in authentication processing of the mobile communication system. A wireless terminal that returns an operation result using a key to the wireless LAN system. 14. A wireless terminal that requests access to the wireless LAN system according to claim 6 and requests authentication to the mobile communication system according to claim 13, wherein the identification information of the terminal is transmitted when the access request to the wireless LAN system is made. A wireless terminal for transmitting to a wireless LAN system. An access request to the wireless LAN system according to claim 8, and an authentication request to the mobile communication system according to claim 15, wherein a dynamic encryption key transmitted from the mobile communication system and a dynamic encryption key transmitted from the wireless LAN system are transmitted. A wireless terminal that returns a calculation result using the dynamic authentication key to the wireless LAN system. A terminal authentication method for authenticating a wireless terminal that can access both a mobile communication system and a wireless LAN system by the wireless LAN system, wherein the wireless terminal requests access to the wireless LAN system and simultaneously transmits an access request to the mobile communication system. An authentication request, and in response to the authentication request, information used for authentication processing of the wireless terminal in the mobile communication system is transmitted to the wireless LAN system in the mobile communication system, and used for the authentication processing in the wireless LAN system. A terminal authentication method, comprising executing authentication processing of the wireless terminal requesting access using information. A terminal authentication method for authenticating a wireless terminal that can access both a mobile communication system and a wireless LAN system by the wireless LAN system, wherein the wireless terminal requests access to the wireless LAN system and simultaneously transmits an access request to the mobile communication system. Requesting authentication, transmitting the authentication result of the wireless terminal in the mobile communication system from the mobile communication system to the wireless LAN system in response to the authentication request, and performing wireless communication in the wireless LAN system in accordance with the authentication result. A terminal authentication method comprising establishing a channel with a terminal. A terminal authentication method for authenticating a wireless terminal that can access both a mobile communication system and a wireless LAN system by the wireless LAN system, wherein the wireless terminal requests access to the wireless LAN system and simultaneously transmits an access request to the mobile communication system. Requesting authentication, transmitting dynamic information generated from information used for authentication processing of the wireless terminal in the mobile communication system from the mobile communication system to the wireless LAN system in response to the authentication request, A terminal authentication method, comprising executing authentication processing of the wireless terminal requesting access using the dynamic information in a LAN system. A program for authenticating a wireless terminal that can access both a mobile communication system and a wireless LAN system with the wireless LAN system, the method including receiving an access request from a wireless terminal in a management area, and the mobile communication system A procedure for receiving information used for authentication processing of the wireless terminal in the mobile communication system from the step of executing authentication processing for the wireless terminal using information used for authentication processing for the wireless terminal, The program to be executed. A program for authenticating a wireless terminal that can access both a mobile communication system and a wireless LAN system with the wireless LAN system, the method including receiving an access request from a wireless terminal in a management area, and the mobile communication system Receiving the authentication result of the wireless terminal in the mobile communication system from the mobile communication system, and establishing a channel with the wireless terminal in the wireless LAN system according to the authentication result of the wireless terminal. Program for. A program for authenticating a wireless terminal that can access both a mobile communication system and a wireless LAN system with the wireless LAN system, the method including receiving an access request from a wireless terminal in a management area, and the mobile communication system A procedure for receiving dynamic information generated from information used for the authentication processing of the wireless terminal in the mobile communication system, and a procedure for executing the authentication processing of the wireless terminal using the dynamic information, A program for causing a computer to execute.

Images