JP2004241911A - Wireless station terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform an authentication processing by automatically setting identification information that a wireless access point is using without user's labor hour. <P>SOLUTION: A wireless station terminal recognizes identification information set to the wireless access point by receiving identification information in a notice signal that the wireless access point sends and automatically sets other identification information in the case of a failure in authentication with a high-order application to perform authentication processing again. A user need not always change settings of identification information and is able to easily participate in a network even when the high-order application is present. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a wireless station terminal that performs wireless communication with a wireless access point, and more particularly to wireless station-higher-level application authentication performed after successful wireless access point-wireless station authentication (first authentication). (Second authentication).
[0002]
[Prior art]
An operation method in a conventional wireless LAN using IEEE802.1x will be described.
[0003]
FIG. 2 is a diagram illustrating an example of a conventional wireless LAN system SYS11 using IEEE802.1x.
[0004]
FIG. 5 is a flowchart showing the operation in the above conventional example.
[0005]
As shown in FIG. 2, a RADIUS server 201, a wireless access point 202, and a DHCP server 203 exist on the same network.
[0006]
The wireless station STA11 exists in a wireless area 205 (a range where a wireless signal can reach) of the wireless access point 202. The wireless station STA11 is connected to an information device and is controlled so that various settings can be made from the information device.
[0007]
Here, a procedure will be described in which the wireless station STA11 can participate in the same network as the wireless access point 202 and can perform communication.
[0008]
The wireless station STA11 operates in the infrastructure mode and sets the same ESSID as the wireless access point 202. The wireless station STA11 has a user certificate used in 802.11x.
[0009]
When the wireless station STA11 is started, first, 802.11 authentication is performed with the wireless access point 202 (501). If the authentication is successful, an association is made and the respective associations are made (502).
[0010]
From here, it shifts to the authentication method specified by IEEE802.1x.
[0011]
The wireless station STA11 transmits an EAPOL-wireless station Start message to start authentication (503). The wireless access point 202 transmits an EAP-Request / Identity message requesting the terminal identifier (504). The transmission order of the EAPOL-wireless station Start and the EAP-Request / Identity is not determined.
[0012]
The wireless station STA11 that has received the EAP-Request / Identity message transmits an EAP-Response / Identity message (505). Then, the wireless access point 202 replaces the EAP-Response / Identity message with the RADIUS format and transfers it to the RADIUS server 201.
[0013]
The RADIUS server 201 creates a challenge for authentication and sends it to the wireless access point 202, which sends it to the wireless station STA11. The wireless station STA11 creates the response and sends it to the RADIUS server 201 via the wireless access point 202 (506). If the authentication is successful after performing the repetition several times, an EAP-Success message is sent from the wireless access point 202 to the wireless station STA11 (507).
[0014]
Finally, the key is delivered from the wireless access point 202 to the wireless station STA11 using the EAPOL-Key message (508).
[0015]
This completes the IEEE 802.1x authentication. Finally, an IP address and other parameters are assigned using the DHCP server 203. The wireless station STA11 can participate in the same network as the wireless access point 202 and can execute communication.
[0016]
That is, according to this authentication method, secure communication between the wireless access point 202 and the wireless station STA11 becomes possible.
[0017]
[Problems to be solved by the invention]
However, in the above-described conventional example, when the 802.1x authentication between the wireless station and the RADIUS server fails, the wireless station determines that the user certificate held by the wireless station is incorrect, and gives the user a Prompt for certificate verification.
[0018]
In the above conventional example, there is a problem that wireless communication cannot be performed in this case.
[0019]
SUMMARY OF THE INVENTION It is an object of the present invention to enable an authentication process by automatically setting identification information used by a wireless access point without a user's trouble.
[0020]
[Means for Solving the Problems]
The present invention recognizes the identification information set in the wireless access point by receiving the identification information in the broadcast signal transmitted by the wireless access point, and automatically detects when the authentication with the upper application has failed. This wireless station terminal sets another identification information and performs the authentication process again.
[0021]
That is, in the present invention, even if the user does not necessarily change the setting of the identification information, the user can easily participate in the network even when a higher-level application exists.
[0022]
Embodiments and Examples of the Invention
[First Embodiment]
The first embodiment of the present invention is a wireless LAN system using a RADIUS server as an authentication server as a host application.
[0023]
FIG. 3 is a diagram showing the configuration of the wireless LAN system SYS1 according to the first embodiment of the present invention.
[0024]
The wireless LAN system SYS1 includes a wireless station STA1, a network NW1, a wireless access point AP1, a RADIUS server 301 as an authentication server, a DHCP server 303, a network NW2, a wireless access point AP2, a RADIUS server 305, And a DHCP server 307.
[0025]
The wireless station STA1 is connected to a personal computer and controlled to make various settings from the personal computer. Further, the wireless station STA1 has a user certificate used in 802.1x.
[0026]
The location of the wireless station STA1 is in the wireless area 308 of the wireless access point AP1 connected to the network NW1, and also in the wireless area 310 of the wireless access point AP2 connected to the network NW2. Further, in the network NW1, in addition to the access point AP1, a RADIUS server 301 as an authentication server and a DHCP server 303 exist.
[0027]
Similarly, a RADIUS server 305 and a DHCP server 307 exist in the network NW2.
[0028]
Next, the operation of the wireless station STA1 when the wireless station STA1 attempts to join the network NW1 and fails in the 802.11x authentication will be described.
[0029]
FIG. 1 is a block diagram showing a wireless station terminal STA according to one embodiment of the present invention.
[0030]
The wireless station terminal STA includes a wireless transmission / reception unit 101, a storage unit 102, an interface processing unit 103, a clock unit 104, a control unit 105, and a display unit 106.
[0031]
6 and 7 are time charts showing the operation in the above embodiment.
[0032]
FIG. 8 is a flowchart showing the operation of the above embodiment.
[0033]
In the wireless station STA1, the user turns on the power (801), and displays "communication is being set" on its own display unit 106 (802). The control unit 105 of the wireless station STA1 controls to receive all Beacon signals that can be received by the wireless transmission / reception unit 101 until the AP search timer started by the timer 104 times out (601, 602, 803). .
[0034]
FIG. 10 is a diagram illustrating an example of the database in the embodiment.
[0035]
Upon receiving the Beacon signal, the wireless station STA1 creates a database 1001 as shown in FIG. 10 in its own storage unit 102, and sorts the created database 1001 in the order of the received electric field strength (804). Here, if the Beacon signal cannot be received, "out of service" indicating that communication is not possible is displayed on the display unit 106 of the wireless station STA1 (805), and the timer 104 starts the out of service timer (806). . When the predetermined time of the out-of-service timer elapses and the time is up (807), the display unit 106 of the wireless station STA1 starts by displaying "communication is being set" (802).
[0036]
When the wireless station STA1 sorts in the order of the received electric field strength, the wireless station STA1 sets the ESSID in the order of the received electric field strength and displays the set ESSID on the display unit 106 (808). Here, it is assumed that the set ESSID is the same as the one set in the access point AP1.
[0037]
The wireless station STA1 transmits a Probe Request message including the ESSID set for itself, and upon reaching the access point AP1 having the same ESSID, starts 802.11 authentication (603). An authentication message is exchanged between the wireless station STA1 and the access point AP1, and when the authentication is successful, the protocol moves to an association having a meaning of association (604, 810).
[0038]
Upon completion of the association, the wireless station STA1 sends an EAPOL-wireless station STA1rt message to start the authentication to the access point AP1 (605). The access point AP1 transmits an EAP-Request / Identity message requesting an identifier of the terminal to the wireless station STA1 (606). The transmission order of the EAPOL-wireless station Start message and the EAP-Request / Identity message is not determined.
[0039]
The wireless station STA1 that has received the EAP-Request / Identity message transmits an EAP-Response / Identity message including the terminal identifier (607). The access point AP1 replaces the EAP-Response / Identity message with the RADIUS format and transfers the message to the RADIUS server 301 (608).
[0040]
The RADIUS server 301 creates a challenge for authentication and sends it to the access point AP1, which sends it to the wireless station STA1. The wireless station STA1 creates the response and sends it to the RADIUS server 301 via the access point AP1.
[0041]
Here, since it is assumed that the authentication has failed, the RADIUS server 301 transmits a RADIUS-Failure message notifying that the authentication has failed to the access point AP1 (610), and the access point AP1 performs message conversion. Then, an EAP-Failure message is transmitted to the wireless station STA1 (611).
[0042]
The control unit 105 of the wireless station STA1 that has received the EAP-Failure message writes the information on the failure of the authentication process into the database stored in the storage unit 102, and searches for the next ESSID candidate (815).
[0043]
If all of the ESSID candidates on the database 1001 are candidates holding information on the failure of the authentication process, “out of service” indicating that communication is not possible is displayed on the display unit 106 of the wireless station STA1 (805). ), The timer 104 starts the out-of-service timer (806). When the predetermined time of the out-of-service timer elapses and the time is up (807), the display unit 106 of the wireless station STA1 starts by displaying "communication is being set" (802).
[0044]
If the next ESSID candidate exists, the control unit 105 of the wireless station STA1 sets the ESSID and displays the set ESSID on the display unit 106 (808). Here, it is assumed that the set ESSID is the same as the one set in the access point AP2.
[0045]
The wireless station STA1 transmits a Probe Request message including the ESSID set for itself, and upon reaching the access point AP2 having the same ESSID, starts the 802.11 authentication (612). An authentication message is exchanged between the wireless station STA1 and the access point AP2, and when the authentication is successful, the protocol moves to an association having a meaning of association (613, 810).
[0046]
When the association is completed, the wireless station STA1 sends an EAPOL-wireless station Start message to start the authentication to the access point AP2 (614). The access point AP2 transmits an EAP-Request / Identity message requesting the terminal identifier to the wireless station STA1 (615).
[0047]
The wireless station STA1 that has received the EAP-Request / Identity message transmits an EAP-Response / Identity message including the terminal identifier (616). The access point AP2 replaces the EAP-Response / Identity message with the RADIUS format and transfers it to the RADIUS server 305 (617).
[0048]
The RADIUS server 305 creates a challenge for authentication and sends it to the access point AP2, which sends it to the wireless station STA1. The wireless station STA1 creates the response and sends it to the RADIUS server 305 via the access point AP2. This time, assuming that the authentication has succeeded, the RADIUS server 305 transmits a RADIUS-Access-Accept message notifying that the authentication has succeeded to the access point AP2 (619), and the access point AP2 sends the message The conversion is performed, and an EAP-Success message is transmitted to the wireless station STA1 (620). Then, the key is delivered from the access point AP2 to the wireless station STA1 using the EAPOL-Key message (621).
[0049]
Finally, by using the DHCP server 307 to assign an IP address and other parameters (622, 813), the wireless station STA1 can participate in the same network as the access point AP2, and secure communication can be performed. Can be performed.
[0050]
Although the first embodiment relates to participation in a wireless LAN system, the same can be considered for various systems using a wireless LAN system.
[0051]
Also, it is considered that the wireless station STA1 having no timer or display unit or the wireless station STA1 that can be connected to the outside is effective.
[0052]
[Second embodiment]
The second embodiment of the present invention is an example of a simple authentication system as an upper application.
[0053]
Next, a system configuration of the second embodiment will be described.
[0054]
FIG. 4 is a diagram illustrating a configuration of a wireless LAN system SYS2 according to a second embodiment of the present invention.
[0055]
The wireless LAN system SYS2 includes a wireless station STA2, a network NW3, a wireless access point AP3, a DHCP server 401, a personal computer 403, a network NW4, a wireless access point AP4, a DHCP server 405, and a personal computer 407. Having.
[0056]
The configuration of the wireless station STA2 is the same as that of the wireless station terminal STA shown in FIG.
[0057]
The wireless station STA2 is connected to a printer, receives data from a network as a wireless printer, and prints the data.
[0058]
The location of the wireless station STA2 is in the wireless area 408 of the wireless access point AP3 connected to the network NW3, and also in the wireless area 410 of the wireless access point AP4 connected to the network NW4. Further, a DHCP server 401 and a personal computer 403 exist in the network NW3 in addition to the access point AP3. As described above, a DHCP server 405 and a personal computer 407 exist in the network NW4.
[0059]
Next, an operation when the wireless station STA2 attempts to join the network NW3 and fails in simple authentication of the printer will be described.
[0060]
FIG. 9 is a flowchart showing an operation in the wireless LAN system SYS2 when the wireless station STA2 attempts to join the network NW3 and fails in simple authentication of the printer.
[0061]
First, the user turns on the power of the wireless station STA2 (901), and displays "communication is being set" on its own display unit 106 (902). The control unit 105 of the wireless station STA2 controls to receive all Beacon signals that can be received by the wireless transmission / reception unit 101 until the AP search timer started by the timer 104 times out (701, 702, 903).
[0062]
Upon receiving the Beacon signal, the wireless station STA2 creates the database 1001 shown in FIG. 10 in its own storage unit 102, and sorts the created database 1001 in the order of the applicable communication speed included in the Beacon signal ( 904). Also, the display unit 106 of the wireless station STA2 displays "Registering" indicating that the printer is being registered (905). Here, when the Beacon signal cannot be received, "out of service" indicating that communication cannot be performed is displayed on the display unit 106 of the wireless station STA2 (906), and the timer 104 starts the out of service timer (907).
[0063]
When the predetermined time of the out-of-service timer elapses and the time is up (908), the process starts from displaying "communication being set" on the display unit 106 of the wireless station STA2 (902).
[0064]
The wireless station STA2 that has finished sorting in the order of the applicable communication speed sets the ESSID in the order of the applicable communication speed, and displays the set ESSID on the display unit 106 (909). Here, it is assumed that the set ESSID is the same as the one set in the access point AP3.
[0065]
The wireless station STA2 transmits a Probe Request message including the ESSID set for itself, and upon reaching the access point AP3 having the same ESSID, starts 802.11 authentication (703). An authentication message is exchanged between the wireless station STA2 and the access point AP3. If the authentication is successful, the protocol is shifted to an association having a meaning of association (704, 910).
[0066]
The wireless station STA2 retrieves a utility software search message including information such as a Printer name, a serial number, and a model name in order to search for a PC having utility software among various terminals connected on the network NW3. Is transmitted to the access point AP3 (706, 912), and its own timer 104 starts a search waiting timer (913).
[0067]
The access point AP3 that has received the utility software search message transmits the utility software search message via broadband (707). Here, it is assumed that the wireless station STA2 cannot receive (914) a utility software search response message that is a response to the utility software search message.
[0068]
The control unit 105 of the wireless station STA2 that has not received the network printer registration completion message (914), has passed the predetermined time of the search waiting timer, and has timed up (915), stores the message in the database stored in the storage unit 102 as Information indicating that the authentication processing has failed is written, and the next ESSID candidate is searched (916).
[0069]
If all of the ESSID candidates on the database 1001 are candidates holding information on the failure of the authentication process, the display unit 106 of the wireless station STA2 displays “out of service” indicating that communication is not possible (906), and counts the time. The unit 104 starts the out-of-service timer (907). When the predetermined time of the out-of-service timer elapses and the time is up (908), the display unit 106 of the wireless station STA2 starts by displaying "communication is being set" (902).
[0070]
If the next ESSID candidate exists, the control unit 105 of the wireless station STA2 sets the ESSID and displays the ESSID set on the display unit 106 (909). Here, it is assumed that the set ESSID is the same as the one set in the access point AP4.
[0071]
The wireless station STA2 transmits a Probe Request message including the ESSID set for itself, and upon reaching the access point AP4 having the same ESSID, starts 802.11 authentication (708). An authentication message is exchanged between the wireless station STA2 and the access point AP4, and when the authentication is successful, the protocol shifts to an association having a meaning of association (709, 910).
[0072]
Upon completion of the association, the wireless station STA2 accesses the DHCP server 405, and the DHCP server 405 assigns an IP address and other parameters (710, 911).
[0073]
The wireless station STA2 retrieves a utility software search message including information such as a Printer name, a serial number, and a model name in order to search for a PC having utility software among various terminals connected on the network NW4. Is transmitted to the access point AP4 (711, 912), and its own timer 104 starts a search waiting timer (913).
[0074]
The access point AP4 that has received the utility software search message transmits the utility software search message via broadband (712). Here, it is assumed that the wireless station STA2 can receive (914) a network printer registration completion message which is a response to the utility software search message, and the description will be continued.
[0075]
The personal computer 407 having the utility software receiving the utility software search message confirms that the information such as the Printer name, serial number, and model name included in the utility software search message matches the utility software, When it is confirmed that they match, the utility software is activated (713).
[0076]
Thereafter, the personal computer 407 transmits a utility software search response message to the wireless station STA2 via the access point AP4 (714). Upon receiving the utility software search response message, the wireless station STA2 stops the search waiting timer (917).
[0077]
Registration work such as port assignment is performed between the wireless station STA2 and the personal computer 407 (715). After completion, the personal computer 407 notifies the wireless station STA2 of the registration completion via the access point AP4 (716, 717). The wireless station STA2 that has received the registration completion notification displays “registration completed” on its own display unit 106 (918).
[0078]
By executing the above procedure, the wireless printer can be easily authenticated.
[0079]
In the second embodiment, the wireless station STA2 having a timer and a display unit is used. However, a wireless station without a timer and a display unit or an externally connectable wireless station is considered to be effective.
[0080]
【The invention's effect】
According to the present invention, the identification information used by the wireless access point is automatically set and authentication with the upper application is performed. Therefore, even if the authentication with the upper application fails, another identification information is reset. Thus, there is an effect that authentication can be performed again, that is, even if the user does not necessarily change the setting of the identification information, even if a higher-level application exists, the user can easily participate in the network.
[Brief description of the drawings]
FIG. 1 is a block diagram of a wireless station terminal STA according to one embodiment of the present invention.
FIG. 2 is a diagram showing an example of a conventional wireless LAN system SYS11 using IEEE802.1x.
FIG. 3 is a diagram illustrating a configuration of a wireless LAN system SYS1 according to a first embodiment of the present invention.
FIG. 4 is a diagram illustrating a configuration of a wireless LAN system SYS2 according to a second embodiment of the present invention.
FIG. 5 is a flowchart showing an operation in the above conventional example.
FIG. 6 is a time chart showing an operation in the embodiment.
FIG. 7 is a time chart showing an operation in the embodiment.
FIG. 8 is a flowchart showing the operation of the embodiment.
FIG. 9 is a flowchart showing an operation in a case where the wireless station STA2 attempts to join the network NW3 and fails in simple authentication of a printer in the wireless LAN system SYS2.
FIG. 10 is a diagram showing an example of a database in the embodiment.
[Explanation of symbols]
STA, STA1 ... wireless station terminal,
101: wireless transmission / reception unit
102: storage unit,
103 ... Interface processing unit,
104: timing unit,
105 ... control unit,
106 ... display unit,
SYS1: Wireless LAN system,
AP1, AP2 ... wireless access point,
301, 305: RADIUS server which is an authentication server,
303, 307... DHCP servers.

Claims (10)

In a wireless station terminal capable of performing digital wireless communication with a wireless access point,
Interface processing means for connecting to various devices;
Broadcast signal receiving means for receiving the broadcast information transmitted from the wireless access point;
Storage means for storing system identification information included in the broadcast information;
System identification information setting means for setting the system identification information stored in the storage means in the wireless station terminal;
Authentication means for performing a first authentication process with the wireless access point;
An authentication unit for performing a second authentication process with a higher-level application;
If the authentication fails in the second authentication process with the higher-level application, the new system identification information extracted from the storage means is transmitted to the wireless station terminal by a system identification information setting for changing the setting. Means;
A wireless station terminal, wherein the first authentication is performed using system identification information set by the identification information setting means. In claim 1,
The wireless station terminal, wherein the first authentication process is an authentication method defined in IEEE 802.11. In claim 1,
A wireless station terminal comprising status display means for displaying a status of the wireless station. In claim 1,
The wireless station terminal, wherein the upper application is an authentication server, and the second authentication process is an authentication method defined by IEEE 802.1x. In claim 1,
The wireless station terminal, wherein the upper application is an information device, and the second authentication process is a simple authentication process of a network printer. In claim 1,
A clock means for clocking for a fixed time when the reception of the broadcast information is started;
Control means for notifying that the predetermined time has elapsed and stopping reception of the notification information;
A wireless station terminal comprising: In claim 1,
Timer means for counting a certain time when any one of the first and second authentication processes using the system identification information fails in any of the authentication processes;
Control means for notifying that the certain time has elapsed and performing an authentication process;
A wireless station terminal comprising: In claim 1,
The storage means, when receiving the broadcast information from the wireless access point, is a means for simultaneously storing a received electric field strength value,
When selecting the system identification information to be set in the wireless station from the storage means, the wireless station terminal selects in the order of applicable communication speed. In claim 1,
The storage means, when receiving the broadcast information from the wireless access point, is a means for simultaneously storing the applicable communication speed included in the broadcast information,
When selecting the system identification information to be set in the wireless station from the storage means, the wireless station terminal selects in the order of applicable communication speed. In claim 1,
The storage means is means for storing system identification information set in the wireless station terminal before receiving the broadcast information transmitted from the wireless access point that failed in the first or second authentication. ,
When the system identification information stored in the storage unit is included in the system identification information notified by the notification information, the authentication processing using the system identification information that failed in authentication is not performed. Wireless station terminal.

Images