JP2005167580A - Access control method and apparatus in wireless lan system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To maintain the security of an entire wireless LAN system even when various authentication systems are used in an intermingled state in use in the case of connection between an STA (terminal station) and an AP (access point). <P>SOLUTION: In the case of subscription (belonging) of the STA (terminal station) to the system, when an authentication processing section 7 in the AP (access point) 2 normally completes authentication processing of the STA and informs a wireless interface section 6 about it, the authentication processing section 7 informs a filter control section 10 about the systems of the processing by the authentication system in use together with a MAC address of the STA. The filter control section 10 registers filter information corresponding to the notified authentication system and the MAC address to a relay processing section 9. At data communication, the relay processing section 9 filters relay data whose sender source or destination is the registered MAC address, that is, communication data of the STA in response to the authentication system used by the STA when the STA subscribes to the system. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to an access control method using an authentication technique in a wireless LAN system, and an apparatus constituting the system.

  In the wireless LAN system, a STA can access the AP without being restricted by the location of the cable if it is within the reach of radio waves between the AP (access point; ACCESS POINT) and the STA (terminal station: STATION). It has the feature that communication that relays is possible.

  In recent years, wireless LAN systems compliant with the IEEE 802.11 specifications constitute a system as high-speed access to networks such as the Internet using high-speed lines using technologies such as optical fiber and ADSL has become widespread. As the cost of the equipment is reduced, it is rapidly spreading.

  However, on the other hand, it has been pointed out that the access control method and encryption method in the wireless LAN system are flawed. As a result, as a security problem, unauthorized access that an STA that is not permitted to access the AP accesses The problem has surfaced.

  In order to cope with this problem of unauthorized access, not only the IEEE 802.11 specification but also other technologies are used in combination.

First, there is MAC address filtering as a simple countermeasure applied to the problem of unauthorized access. As shown in FIG. 5, by performing the MAC address filtering, only the STA having the MAC address registered in advance with the AP is permitted to connect with the AP. In consideration of the case where there are many STAs to be authenticated or cases where a plurality of APs share the MAC addresses to be authenticated, the MAC addresses to be authenticated are registered in the authentication server for centralized management. When performing authentication, there is a method in which the AP inquires the MAC address of the STA from the authentication server. (For example, refer to Patent Document 1.)
Furthermore, as an advanced authentication technique, the introduction of a wireless LAN system using an authentication technique based on the IEEE802.1x specification is also progressing. After the STA belongs to the AP and before performing data communication with a terminal or server connected to the wired side of the AP, the STA exchanges an authentication message with an authentication server that centrally manages information necessary for authentication via the AP. The main processing of authentication is performed by the authentication server. Only when the processing in the authentication message exchange is successful, the data transmission from the STA is relayed by the AP. FIG. 6 shows the authentication procedure.

  In the authentication procedure of the IEEE802.1x specification, various authentication methods indicated by an EAP (Extensible Authentication Protocol) type are used. Various methods such as a simple authentication method using a password and an advanced authentication method using a digital certificate can be used as this method. The password can be distributed to a wide range of users because the distribution method is flexible in its operation, but since the security strength is low, there is a high risk of unauthorized access. On the other hand, a digital certificate cannot be distributed to a wide range of users because its distribution method is limited. However, since the security strength is high, the risk of unauthorized access is low. As described above, since each authentication method has advantages and disadvantages in terms of operation and security, the authentication method employed in an actual wireless LAN system is determined according to its use.

JP 2001-111544 A (first page, FIG. 3)

  As described above, in the wireless LAN system, various authentication techniques are used to prevent unauthorized access. Therefore, an AP that is one of the devices constituting the system supports a plurality of authentication methods. In terms of security, there are problems as described below.

  (1) Even if the user's STA authentication method is different depending on the purpose to be used, all the STAs that have once joined (belonged to) will be allowed equivalent access. For example, the authentication method is distinguished such that a password is used for a STA that temporarily uses a wireless LAN system and performs Web access, and a digital certificate is used for a STA that regularly uses a wireless LAN system. However, if both STAs join the wireless LAN system, they can be accessed equally.

  (2) Since each authentication method has different security strength, if the authentication method with the lowest security strength is broken, the countermeasure against unauthorized access as a wireless LAN system is broken. For example, even if a digital certificate with a high security strength that only a STA of a legitimate user uses is not obtained, a MAC address with a low security strength registered for authentication by MAC address filtering is obtained by some method. If accessed, the user can join the AP and communicate freely.

  (3) In a wireless LAN system, a temporary IP address is often assigned uniformly to STAs permitted to communicate by authentication. In this case, since the combination of the IP address and the STA is not fixed, it is difficult to restrict access to the data communication of the STA, that is, to perform a filtering process.

  The present invention has been made in view of the above problems. In a wireless LAN system in which a plurality of authentication techniques for preventing unauthorized access exist, STAs using various authentication methods can be simultaneously used while maintaining security. As a result, it is possible to capture a wider range of user STAs while maintaining security, so that the convenience of the system can be improved.

  The access control method of the present invention is an access control method in a wireless LAN system, wherein a terminal station (STA) belongs to an access point (AP) by radio, and the AP is registered in advance corresponding to the STA. The STA authenticates the STA using an authentication method, and when the authentication is successful, the AP relays data communication with the STA with access restriction according to the authentication method used. It is characterized by.

  Also, the wireless LAN system of the present invention is a wireless LAN system having a terminal station (STA) and an access point (AP), and the AP corresponds to the STA in advance after the STA is assigned by radio. The authentication of the STA is performed by a registered authentication method, and when the authentication is successful, data communication with the STA is relayed with an access restriction according to the authentication method used. And

  The access point (AP) of the present invention is an access point (AP) in a wireless LAN system, and is based on an authentication method registered in advance corresponding to the STA after the terminal station (STA) has belonged by radio. The authentication of the STA is performed, and when the authentication is successful, the data communication with the STA is relayed with an access restriction according to the authentication method used.

  In the present invention, filter conditions for STA data communication relayed by the AP can be set according to the type of authentication method, so that data communication can be performed according to the authentication method used by the user STA of the wireless LAN system. There is an effect that the above restriction can be changed.

  Further, in the present invention, filter conditions for data communication of STA relayed by the AP can be set according to the strength of the authentication method. For example, when an authentication method with a low security strength of the authentication method is used. Has an effect that the range of use of accessible data communication can be narrowly limited.

  Further, in the present invention, since a combination of authentication method and filter condition is set for each AP, even when authentication information is centrally managed and one authentication server is used by a plurality of APs, the installation conditions of each AP -The filter condition for the authentication method can be changed according to the environment.

  Next, a preferred embodiment of the present invention will be described with reference to the drawings.

  Referring to FIG. 1, the overall configuration of a wireless LAN system according to a first embodiment of the present invention is shown. In FIG. 1, a STA (terminal station) 1 is a terminal station that subscribes to an AP (access point) 2. For example, the STA 1 includes a data terminal such as a notebook personal computer (PC) and a wireless LAN card inserted into the data terminal. A wireless LAN card is generally used by installing hardware and software for performing transmission / reception control of wireless signals in conformity with the IEEE 802.11 specification and inserting it into a card slot of a data terminal. It is not necessary to limit to such a form. That is, the STA1 may be a data terminal capable of data communication in conformity with the IEEE802.11 specification. For example, the STA1 itself may incorporate the above-described wireless LAN card function.

  AP2 is equipped with hardware and software for performing transmission / reception control of wireless signals in accordance with the IEEE802.11 specification, and has an interface function between a wireless LAN and a wired LAN, and is located on the side of the subscribed STA1 and wired LAN3. Relay data communication with the server and the terminal PC. This data communication is filtered according to the filter rule associated with the authentication method registered in the AP 2 from the maintenance management terminal 5, and only permitted data is relayed.

  When STA1 joins AP2, authentication is performed by any one of the authentication methods registered in AP2 from maintenance management terminal 5. When using an IEEE 802.1x specification authentication method, AP and STA1 are set to use the IEEE 802.1x specification authentication method, and a finer authentication method, that is, an EAP type is set. The authentication server 4 performs the main processing of authentication by an authentication method according to the EAP type. The authentication server 4 operates as a RADIUS (Remote Authentication Dial In User Service) server based on the RADIUS protocol defined in RFC2138 of IETF (Internet Engineering Task Force) or the like. The maintenance management terminal 5 communicates with each AP 2 via the wired LAN 3 to monitor and control a plurality of APs 2 and STAs subscribing to each AP 2, as well as an authentication method allowed for each AP 2, It is used to register a filter rule for an authentication method, and generally communicates using AP2 and SNMP (Simple Network Management Protocol).

  FIG. 3 is an example of combinations of authentication methods and filter rules (filter rule sets) registered in the AP. Each rule can define a rule based on information at the layer 2 level or higher, and each authentication method is registered in association with a filter rule set. As a filter rule, there may be a setting that there is no filter rule, that is, all data is relayed. For each filter rule, the application condition of the filtering process, that is, the relay data to be subjected to the filtering process is whether the data destination is the MAC address of the STA, the data transmission source is the MAC address of the STA, or This indicates whether or not both, and when starting to use the filter after authenticating the STA in the AP, the MAC address of the authenticated STA is embedded as part of each filter rule according to the application conditions of the filtering process. It is.

  FIG. 2 is a diagram showing the configuration of AP2. The AP maintenance management unit 8 processes a monitoring control command from the maintenance management terminal 5, registers a corresponding authentication method in the authentication processing unit 7, and sets a filter rule in the filter control unit 10. Prepare. The wired interface unit 11 has a function of transmitting / receiving data to / from the wired LAN 3 and performing a layer 2 protocol process of the wired LAN.

  The wireless interface unit 6 has functions of transmitting and receiving wireless signals to and from the STA 1 and performing protocol processing of IEEE 802.11 specifications. Further, when the STA1 receives an association request to the AP2 from the STA1 in the course of the protocol processing, it transmits an attribution response to the STA1 and sends an authentication request for the STA1 to the authentication processing unit 7. If the authentication result is successful, the data communication of the corresponding STA1 is permitted, and if the authentication result is unsuccessful, the authentication cancellation process is immediately performed. It has a function.

  Upon receiving an authentication request from the wireless interface unit 6, the authentication processing unit 7 determines and executes an authentication method for the corresponding STA 1, and has a function of performing processing in cooperation with the authentication server 4 depending on the determined authentication method. When an authentication method conforming to the .1x specification is selected, a function for performing protocol processing of the IEEE 802.1x specification together with the corresponding STA1 and the authentication server 4 is provided. Furthermore, when the authentication is finally successful, the wireless interface unit 6 is notified to that effect, and a filter setting request is transmitted to the filter control unit 10, and the MAC address of the authentication target STA1 and the authentication used A function for notifying the system is provided. As for the method for determining the authentication method, for example, among the authentication methods permitted by AP2, an attempt is made from an authentication method with high security strength, and it is determined that STA1 does not correspond to the selected authentication method. In the case of detection by a negotiation response or in the case of authentication failure, it is possible to sequentially apply an authentication method with weak security strength.

  The filter control unit 10 has a function of selecting a filter rule set according to a filter setting request from the authentication processing unit 7 and registering it in the filter information storage unit 12. That is, when this filter setting request is received, the filter rule set associated with each authentication method, which is registered and held in advance by the maintenance management terminal 5, is selected, and the filter information together with the MAC address of the target STA Register in the storage unit 12.

  The relay processing unit 9 receives data received from each of the wired interface unit 11, the wireless interface unit 6, and the AP maintenance management unit 8 according to the header information added to the data, the wired interface unit 11, the wireless interface unit 6, and the AP. It has a data relay function that is allocated and sent to the maintenance management unit 8 and checks whether the data to be relayed matches the filter rule stored in the filter information storage unit 12, and if there is a corresponding filter rule It has a function to discard data or relay data according to the rules.

  Next, the operation of the wireless LAN system according to the first embodiment will be described in detail with reference to FIG.

  FIG. 4 shows a flow from when the AP receives a join request from STA1, that is, an association request, until the STA1 is successfully authenticated and the filter rule is registered in the AP2, and the STA1 de-association A flow from the detection of the factor occurrence to the deletion of the filter rule for the corresponding STA1 in the AP2 is shown.

  First, a flow until registering a filter rule will be described. When the STA1 is activated and an attribution request is transmitted to the AP2, the wireless interface unit 6 returns an attribution response to the STA1 and sends an authentication request together with the MAC address of the STA1 to the authentication processing unit 7. Receiving this, the authentication processing unit 7 determines an authentication method and executes an authentication process. If the authentication process is successful, the filter setting request including the MAC address of the STA1 authenticated and used for the filter control unit 10 is sent to the filter control unit 10 by permitting the data communication of the STA1. Receiving this, the filter control unit 10 selects a filter rule set corresponding to the authentication method, and registers it in the filter information storage unit 12 together with the MAC address of the STA1.

  Next, a flow until the filter rule is deleted will be described. When the wireless interface unit 6 in the AP 2 recognizes the STA1 belonging cancellation by issuing the STA1 belonging releasing command from the maintenance management terminal 5, the wireless interface unit 6 sends the filter releasing request together with the MAC address of the corresponding STA1 to the filter control unit 10 Send to. Receiving this, the filter control unit 10 deletes the filter rule relating to the requested MAC address from the filter information storage unit 12.

  As described above, in the wireless LAN system of the present invention, it is possible to select and register or cancel the filter rule set for STA data communication relayed by the AP according to the authentication method.

1 is a diagram illustrating an overall configuration of a wireless LAN system according to a first embodiment of this invention. It is a figure which shows the structure of AP (access point) of 1st embodiment of this invention. It is a figure which shows the example of the combination (filter rule set) of the authentication system and filter rule registered into AP (access point) of 1st embodiment of this invention. It is a flowchart which shows operation | movement of the wireless LAN system of 1st embodiment of this invention. It is a figure explaining MAC address filtering. It is a figure explaining the authentication by the IEEE802.1x specification.

Explanation of symbols

1 STA (terminal station)
2 AP (access point)
3 Wired LAN
4 Authentication Server 5 Maintenance Management Terminal 6 Wireless Interface Unit 7 Authentication Processing Unit 8 AP Maintenance Management Unit 9 Relay Processing Unit 10 Filter Control Unit 11 Wired Interface Unit 12 Filter Information Storage Unit

Claims (12)

An access control method in a wireless LAN system,
The terminal station (STA) belongs to the access point (AP) by radio,
The AP authenticates the STA by an authentication method registered in advance corresponding to the STA,
When the authentication is successful, the AP relays data communication with the STA by adding an access restriction according to the authentication method used.   The access control method according to claim 1, wherein a filter rule set that is a collection of filter rules for performing the access restriction is registered in the AP.   The access control method according to claim 1, wherein the filter rule set is registered in advance by a maintenance management terminal.   The access control method according to claim 1, further comprising an authentication server that performs the authentication. A wireless LAN system having a terminal station (STA) and an access point (AP),
The AP performs authentication of the STA by an authentication method registered in advance corresponding to the STA after the STA belongs by radio, and performs data communication with the STA when the authentication is successful. A wireless LAN system that relays data by adding an access restriction according to the authentication method used.   6. The wireless LAN system according to claim 5, wherein the AP has a filter information storage unit that registers a filter rule set that is a collection of filter rules for performing the access restriction.   7. The wireless LAN system according to claim 5, further comprising a maintenance management terminal used by a network operation manager to register the filter rule set in advance with respect to the AP.   8. The wireless LAN system according to claim 5, further comprising an authentication server that performs the authentication process in cooperation with the AP. An access point (AP) in a wireless LAN system,
After the terminal station (STA) belongs by radio, the STA is authenticated by an authentication method registered in advance corresponding to the STA, and when the authentication is successful, data communication with the STA is used. An access point (AP) that relays by adding an access restriction according to the authentication method.   The access point (AP) according to claim 9, further comprising a filter information storage unit that registers a filter rule set that is a collection of filter rules for performing the access restriction.   The access point (AP) according to any one of claims 9 to 10, wherein the filter rule set is registered in advance by a maintenance management terminal.   The access point (AP) according to any one of claims 9 to 11, wherein the authentication is performed by an authentication server.

Images