KR20050002290A - authentication system in wireless local area network and method thereof - Google Patents

Abstract

PURPOSE: An authentication system for wireless local area network and an authenticating method thereof are provided to use the same ID to access a public wireless LAN and a private wireless LAN by determining a connection region on the ground of IP of network access control device. CONSTITUTION: A network access control device(200) provides authentication information received from a user terminal(100) and an authentication request message including an identification address of the network access control device. A user ID is detected from the authentication information and the kind of the detected user ID is discriminated. An access region of the user terminal is detected. An authentication process for an access request of the user terminal is selectively performed by using the kind of the user ID and the access region of the user terminal.

Description

Authentication system in wireless local area network and method

The present invention relates to an authentication system, and more particularly, to an authentication system and a method in a wireless local area network (WLAN).

Recently, as the wireless communication service for the ISM band is licensed, wireless Internet service using a wireless LAN has been enabled. In general, a wireless LAN means a wireless LAN that transmits and receives data between a computer and a computer or between a computer and other communication devices by using radio frequency (RF) or light. The WLAN has been developed in recent years due to the rapid development of Internet service and wireless communication technology, which is mainly installed in places where wired network is not easy to build, such as large offices and distribution centers, and its use is rapidly increasing due to the ease of maintenance. Doing.

In the WLAN, that is, IEEE 802.11, WEP is used as an authentication and security method. WEP is a wireless LAN security method that encrypts terminal authentication and wireless section data using a shared secret key called a WEP key between a wireless terminal equipped with a LAN card and an access point (hereinafter, referred to as an "AP"). In addition, the LAN card's MAC (media access control) address is registered in advance in the AP, and the AP access is also allowed only to the wireless terminal having the registered MAC address.

However, such authentication methods are suitable in a private WLAN environment, which is the original use of a WLAN, but are not suitable in a public WLAN. That is, in the private WLAN environment, since the number of users is limited and the AP MAC address list management or WEP key setting is easy, the above method may be used. However, in case of an unspecified user, the public WLAN is used in a public place. In this case, when users use the same WEP, the meaning of authentication and security is lost, and even when authentication is performed through MAC address list management, there is a difficulty in registering MAC addresses of all users for each AP.

Therefore, in the public WLAN service, in order to authenticate a user accessing an AP, an authentication method through a central authentication server storing authentication information of all users should be used. IEEE 802.1x, a standard for port-specific authentication and security in IEEE 802 LANs, enables centralized user authentication on a RADIUS authentication server that stores all user authentication information using the Extensible Authentication Protocol (EAP) authentication protocol. Therefore, this can be said to be suitable for the authentication method of the public wireless LAN service. IEEE 802.1x can be used not only for public WLAN services but also for enterprises requiring private WLANs with enhanced security.

The public wireless LAN service using this authentication method can be a main customer for those who want to access the Internet not only at home or at work but also in public places. Users must register a specific ID to identify themselves in order to use the WLAN service. Generally, users use the ID that they previously used when subscribing to a service that requires logon such as Internet access service or e-commerce service for convenience. There is a high tendency to continue to use.

Therefore, even in the WLAN service, there may be users who want to use the ID used at the time of the private WLAN connection even when the public WLAN connection. However, since the number of employees used in a private WLAN is limited, most users can use their own desired ID. However, in a public WLAN, an unspecified number of users often use IDs between users. Therefore, if someone is using the same ID first when subscribing to the service, there is no choice but to select another ID.

As a result, users have to use the second ID when accessing the public WLAN from a public place outside the company while using the first ID when accessing the private WLAN. There is a problem falling.

Therefore, the technical problem to be achieved by the present invention is to solve the conventional problems, to be able to use the same ID used at the time of a private WLAN connection when using a public WLAN.

1 is a network structure diagram of a wireless local area network according to an embodiment of the present invention.

2 is a detailed structural diagram of an authentication system according to an embodiment of the present invention.

3 is a diagram illustrating a field structure of the database illustrated in FIG. 2.

4 is a flowchart illustrating an Internet access and authentication process according to an embodiment of the present invention.

5 is a flowchart illustrating the authentication process illustrated in FIG. 4 in more detail.

In order to achieve the above technical problem, an authentication method according to an aspect of the present invention is connected to a plurality of local authentication devices through a network, and connects a user terminal connected through a wireless communication network to the Internet according to a relay of a network access control device. In the authentication method of the system to be connected, a) If the authentication request message including the authentication information provided from the user terminal connected via the wireless communication network and the identification address of the network access control device is provided from the network access control device, Determining a type of a user ID included in the authentication information; b) determining an area to which the user terminal is connected; And c) selectively performing authentication on an access request of the user terminal based on the type of the determined user ID and the region to which the user terminal is connected.

In the step c), when the user ID is a wide area ID, the access is allowed if the area accessed by the user terminal corresponds to the first area in which the public WLAN service is available and the second area in which the private WLAN is available. Doing; If the user ID is a narrow ID, allowing access if the area accessed by the user terminal corresponds to a second area; And if the user ID is a general ID, allowing access if the area accessed by the user terminal corresponds to the first area.

In addition, if the user ID is an external authentication ID, the method may further include providing authentication information including the user ID to a corresponding local authentication server to perform authentication. In this case, a proxy function of transmitting the authentication result provided from the local authentication server to the network access control device is performed.

An authentication system according to another aspect of the present invention is an authentication system that is connected to a plurality of local authentication devices through a network and connects a user terminal connected through a wireless communication network to the Internet according to a relay of a network access control device. A corporate classification database in which an authentication subject is stored in correspondence with a corporate identifier assigned to each company that has installed a wireless LAN; An authentication database in which a password, a user ID type, and an accessible area are stored corresponding to the user ID; An address database in which location information of the network access device is stored corresponding to the IP address of the network access control device; A user identification unit for determining a type of a user ID included in the authentication information when an authentication request message including authentication information transmitted from the network access control device from the user terminal and an identification address of the network access control device is provided; An access region determination unit searching the address database based on an identification address of the network access control apparatus included in the authentication request message to find a location of the network access control apparatus, and determining an area to which the user terminal accesses based on the address database; And an authentication processing unit for selectively performing an authentication for the access request of the user terminal based on the type of the determined user ID and the region to which the user terminal is connected.

Here, when the user ID is an external authentication ID, the user identification unit provides authentication information including the user ID to a corresponding local authentication device to perform authentication, and when the user ID is an internal authentication ID, Authentication information is provided to the authentication processing unit so that authentication is performed.

When the user ID is a wide area ID, the authentication processing unit may include a first area in which the access area of the user terminal determined by the access area determination unit is capable of performing public WLAN service and a second area in which the service of the corresponding private WLAN is available. If the user ID is a narrow area ID, the access is allowed. If the user ID is a narrow area ID, the access is allowed if the user ID corresponds to the second area.

In the present invention having such a feature, the wide area ID and narrow area ID include a user ID and an enterprise identifier.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention.

1 illustrates a network structure of a public wireless LAN to which the present invention is applied.

As shown in FIG. 1, in the public wireless LAN to which the present invention is applied, a plurality of user terminals 100 are connected to the network access control device 200, and the network access control device 200 includes a connection device ( It is connected to the Internet 400 through 300, and is connected to the central authentication server 500. In addition, the central authentication server 500 is connected to at least one local authentication server 600. Although the central authentication server 500 is connected to the plurality of regional authentication servers 600 through the Internet 400, it may alternatively be directly connected through a separate interface means.

In the embodiment of the present invention, when the access request is input from the user terminal 100, the network access control apparatus 200 provides an authentication request message including the authentication information of the user to the central authentication server 500, the central authentication server The authentication 500 performs authentication based on the user identification information included in the authentication information or provides the user's authentication information to the corresponding local authentication server 600 so that authentication can be performed.

In particular, an embodiment of the present invention provides a wide area ID service that can use an ID used in a private WLAN at a hot spot (a place where a public WLAN service can be used). To this end, when a corporate user (a user having an ID registered in a private WLAN service) subscribes to a public WLAN service, a company ID, that is, a company identifier that identifies a company other than the user ID, is registered. Treat the combined thing as one ID. Therefore, if a user ID is unique within one company, even if a different user uses the same ID in another company, it may be divided into different IDs. For example, the user ID aaa can be used simultaneously in both companies company1 and company2, and the general user can also use the ID aaa. That is, aaa @ company1, aaa @ company2, and aaa are distinguished by different IDs.

IDs used in an embodiment of the present invention may be largely divided into a general ID, a wide area ID, and a narrow area ID. The general ID is used only in public WLAN and does not include a corporate identifier. The wide area ID is an ID used in both a public WLAN and a private WLAN, and the narrow area ID is an ID used only in a private WLAN. The wide area and narrow area IDs contain a corporate identifier in addition to the user ID.

Therefore, the central authentication server 500 determines whether the user ID included in the authentication information is a general ID, a wide area ID, or a narrow area ID, and allows wireless LAN access according to the determination result and the region where the user is currently connected. In this case, when the user ID is a wide area ID or a narrow area ID, the central authentication server 500 performs authentication by itself or provides authentication information to a local authentication server in a corresponding company so that user authentication is performed.

According to an embodiment of the present invention, an authentication agent service is provided according to a request of a small company or the like which is difficult to maintain an authentication device by itself. The central authentication server has user information of a company subscribed to an authentication agent service and performs authentication when an authentication request is received from an enterprise network access control device. In the case of the narrow ID, the access is allowed only when the area where the user is connected is inside the enterprise that can use the private WLAN, and the access is blocked when the user accesses the private WLAN of another company. In order to check which area the user is connected to, it is possible to distinguish whether the connection location is internal or hotspot based on the IP address of the network access control device that is connected to the user, that is, the network access control device that transmits authentication information. Method is used. However, the access area discrimination method according to the present invention is not limited to this method.

Figure 2 shows the specific structure of each component of the authentication system according to an embodiment of the present invention for this authentication process.

First, referring to the structure of the user terminal 100, an IEEE 802.11 wireless LAN card 110 is provided. The user terminal 100 may be, for example, a notebook computer, a desktop computer, or a personal digital assistant (PDA) having a communication port such as a PCMCIA port, a USB port, or a PCI slot. Since the structure of the WLAN card is a known technology, a detailed description thereof will be omitted here.

The network access control apparatus 200 for relaying a wireless LAN connection of the user terminal 100 may include an authentication requesting unit requesting user authentication to the central authentication server 500 based on information provided from the accessing user terminal 100. 210, a connection controller 220 relaying a connection of a user terminal 100 to a predetermined site on the Internet based on an authentication result transmitted from the authentication server 500.

In addition, a hub, a router, an xDSL modem, a NAS, or the like may be used as the connection device 300 for connecting the network access control device 200 to the Internet 400.

In accordance with the authentication request transmitted from the network access control device 200 having such a structure, the central authentication server 500 that performs wireless LAN access authentication for the user terminal 100 includes an enterprise classification database 510 and an authentication database 520. ), An address database 530, a user identification unit 540, an access region determination unit 550, and an authentication processing unit 560.

The enterprise classification database 510 stores information on a private WLAN capable of wide area ID service according to an embodiment of the present invention. Specifically, the storage field is divided into a company identifier field, an authentication subject field, an authentication server address field, and a wide area ID number field, respectively, and a company identifier and certificate granted to each company having a private WLAN installed in each field. The principal that indicates whether the server is running on the server or the company's own authentication server, the address of the company's authentication server that performs its own authentication, and the number of global IDs registered by that company if the company's regional authentication server performs its own authentication. Are stored respectively.

The authentication database 520 stores authentication information for each user. Specifically, the storage field is divided into an ID field, a password field, a user type field, and a connection area field, and a user ID optionally including an enterprise identifier corresponding to each field, a password used for authentication, and a user ID are general. Alternatively, a user type indicating whether it is a wide area or a narrow area and an access area indicating an area to which the user can access are stored.

The address database 530 stores address information of the network access control device. That is, the storage field is divided into an address field and an access area field, and corresponding to each field, an IP address of the network access control device and area information where the corresponding network access device is located are respectively stored. Here, as the area information, if the network access control device is installed in an area (first area) where public WLAN service is available, a hotspot and a company when installed in an area (second area) where private WLAN service is available. Each company identifier is stored to indicate whether the network access control device is installed in a public WLAN area or a private WLAN area of a specific company.

An example of the information stored in each of these databases is shown in FIG.

On the other hand, the user identification unit 540 determines whether the user ID included in the authentication information of the user transmitted through the network access control device 200 includes the corporate identifier, and if the ID includes the corporate identifier, the ID is The authentication information is provided to the authentication processing unit 560 according to whether it is an authentication agent ID (an ID for requesting an authentication agent service to perform authentication at the central authentication server) or an external authentication ID (ID that performs authentication by the company itself). Provided to the local authentication server 600 of the company. At this time, if the user ID does not include a company identifier, it is determined that the ID is a general ID and the authentication information is provided to the authentication processing unit 560. On the other hand, when the authentication information is transmitted to the local authentication server 600, it performs a relay function (proxy function) for transmitting the authentication result provided from the local authentication server 600 to the network access control device 200.

The access area determination unit 550 searches the address database 530 based on the IP address of the network access control device included in the message transmitted from the network access control device 200 to determine the location of the network access control device. Accordingly, it determines where the user is connected to, and provides the result to the authentication processing unit 560.

The authentication processing unit 560 authenticates the authentication information provided from the user identification unit 540. Specifically, it is determined whether the user ID is a general ID, a wide area ID, or a narrow area ID, selectively performs authentication according to the user's ID type and the access area of the user provided from the access area determining unit 550, and performs the authentication result. Transmission to the network access control device 200.

The central authentication server 500 according to the embodiment of the present invention having such a structure may use EAP authentication as a user authentication method. EAP authentication is an authentication protocol supported by IEEE 802.1x, which is a standard for port-specific authentication and security in IEEE 802 LAN. It is a pure authentication protocol based on user ID and password, and an authentication that generates a secret key that can be used for link encryption during authentication. And keying protocols. Since this authentication method is a known technology, a detailed description thereof will be omitted.

The network access control device installed in the private WLAN of the enterprise requesting the authentication agent requests the authentication agent by passing authentication information provided from the user terminal to the central authentication server, but the network installed in the private WLAN of the company that performs the authentication itself. The access control device may provide authentication information to a local authentication server installed in an enterprise to allow authentication.

Next will be described the operation of the authentication system via a wireless LAN according to an embodiment of the present invention having such a structure.

4 schematically illustrates an authentication and a connection process according to an embodiment of the present invention.

When the user terminal 100 enters a basic service set (BBS) where a service is provided, a connection is made between the WLAN card 100 of the user terminal 100 and the network access control device 200. At this time, the network access control apparatus 200 performs a wireless LAN relay function (S100 to S110).

Then, when the user logs on using the access program, the user terminal 100 sends an authentication start message to the network. Upon receiving the authentication start message, the network access control device 200 sends an ID request message to the user terminal 100. In response, the user terminal 100 transmits authentication information including an ID and a password input by the user. The ID response message is transmitted to the network (S120 to S140). In this case, the ID response message including the user ID and password may be automatically transmitted by the access program on the user terminal 100 even if the user does not input the ID and password separately.

The network access control device 200 transmits the ID response message to the central authentication server 500 through the connection device 300. The central authentication server 500 extracts the user ID from the authentication information included in the ID response message, and then determines whether the user ID is a general or authentication agency ID or an external authentication ID (S150 to S160). According to the determination result, if the user ID is a general or authentication agent ID, self authentication is performed (S170). However, in the case of an external authentication ID, a proxy operation is performed to transmit the ID response message to the local authentication server 600 of the corresponding company. In this case, the authentication process is performed between the user terminal 100 and the local authentication server 600, the central authentication server 500 serves as a message relay (S18o to S190).

On the other hand, after the authentication is completed, the network access control device 200 does not establish a session (S200 ~ S220) if the authentication result is failed (S200 ~ S220), and if the authentication is successful, establish a session for the user terminal 100 (S230), The accounting start message is sent to the central authentication server 500 (S240). The central authentication server 500 sets up a session for the corresponding user ID (S250), and if the user ID is an external authentication ID, transmits an accounting start message to the corresponding local authentication server 600 (S260).

Thereafter, when the user uses the Internet access service and logs off to terminate the network access (S270), the network access control apparatus 200 terminates the session and transmits an accounting end message to the central authentication server 500 (S280 ˜S). S290). Upon receiving this, the central authentication server 500 deletes the session information and stores the charging information included in the accounting end message (S300). On the other hand, if the user ID is an external authentication ID, the central authentication server 500 transmits the accounting end message to the local authentication server 600 of the corresponding company, so that the local authentication server 600 stores the charging information (S310). S320).

Next, in the operation process of the authentication system according to the embodiment of the present invention described above, a user identification made in the central authentication server and the corresponding authentication process will be described in more detail.

5 illustrates a user identification and authentication process according to an exemplary embodiment of the present invention.

As described above, when the ID response message is transmitted from the network access control apparatus 200 according to the network connection request of the user terminal 100, the user identification unit 540 of the central authentication server 500 is attached to the ID response message. The user ID is extracted from the included authentication information to determine which service the user ID is for requesting (S400 to S410).

First, it is determined whether the user ID includes the company separator, and if there is no company separator, it is determined as a general ID (S420). If the user ID includes a corporate identifier, the corporate identifier database 510 is searched based on the corporate identifier to determine where the authentication subject for the corresponding user ID is located (S430). As shown in (a) of FIG. 3, if the authentication subject field of the company identifier of the company classification database 510 is internal, it is determined that authentication is performed directly by the central authentication server. However, if the authentication subject field is external, it is determined as an external authentication ID and the user authentication information is transmitted to the local authentication server having the corresponding enterprise identifier, so that authentication is performed (S440).

If it is determined in step S430 that the user ID is a general ID or an internal authentication ID that is directly authenticated by the central authentication server, the user identification unit 540 provides the authentication information to the authentication processing unit 560, and the authentication processing unit 560. Performs authentication for the authentication information according to a user's access region determination result provided from the access region determination unit 550.

First, the access area determination unit 550 extracts the IP address of the network access control device from the ID response message, and searches the address database 530 based on the extracted IP address to determine where the network access control device is located. The determination result is then provided to the authentication processing unit 560 (S450).

The authentication processing unit 560 searches the authentication database 520 based on the user ID included in the authentication information provided from the user identification unit 540 to determine whether the corresponding ID is a general ID, a wide area ID, or a narrow area ID, Authentication is performed based on the ID determination result and the region determination result provided from the access region determination unit 550 as follows.

Specifically, if the user ID is a general ID that does not include an enterprise identifier, the user can be accessed only when the network access control device connected to the user terminal is installed in the public WLAN area, that is, when the user requests access from the public WLAN area. Allows wireless LAN access (S460 to S470).

In addition, if the user ID is an ID including an enterprise identifier but is a narrow ID that can be used only in a specific private WLAN, the WLAN connection is allowed only when the user terminal accesses the network access control device of the corresponding private WLAN (S480). .

In addition, if the user ID is a wide area ID including an enterprise identifier, the wireless LAN connection is allowed only when the user terminal is connected through the network access control device of the corresponding private WLAN or through the network access control device of the public WLAN. (S490).

For example, as shown in (c) of FIG. 3, since the user whose ID is aaa @ company1 is a wide area ID user, the IP address of the network access control apparatus is 200.100.100.21 (access area is cpmpany1, that is, inside the corresponding company). If you try to connect from or 100.100.200.91 (where the hotspot is), the connection is allowed. However, if the IP address of the network access control device to which the user is connected is 200.100.100.61 (the access area is company2), the connection is impossible.

When the user requests a connection in a region where the user is allowed to access the authentication processing unit 560, the authentication processing unit 560 finally receives a password included in the authentication information that matches the password corresponding to the corresponding ID of the authentication database 520. Allow the connection, and transmits the access permission message to the network access control device 200 so that the user's WLAN connection is made.

However, if the user ID is a general ID and the user requests access through a private WLAN instead of a public WLAN, access is not possible. Also, while the user ID is a narrow-band ID, the user accesses through a public WLAN or another private WLAN. If a connection is requested, the connection is not possible. In addition, if the user ID is a wide area ID and a connection request is made through another private WLAN, the connection is impossible. In this case, the authentication processing unit 560 transmits a connection disable message to the network access control device 200 so that the user's wireless LAN connection is blocked.

Meanwhile, in step S440, the local authentication server 600 provided with the authentication information from the central authentication server 500 performs authentication on the user based on the information stored in its database and returns the result to the central authentication server 500. The central authentication server 500 transmits the result to the network access control device 200 so that the user can make a wireless LAN connection.

As such, when the local authentication server 600 of the corresponding company performs authentication, the central authentication server 500 does not manage the authentication information for each ID, and registers the number of wide area IDs only for the enterprise identifier. It checks whether the number of hotspot accesses as many as the number of registered IDs is made through accounting information (use history) for each setting period (for example, monthly). If you connect more than the number of registered IDs, you can charge the excess details.

Although the preferred embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of right.

According to this embodiment of the present invention, even if the users use the same ID, it is easy to identify that can be used only in public WLAN, available in public WLAN and private WLAN, only available in private WLAN Thus, the users can use the same ID used for the private WLAN connection even for the public WLAN connection.

Therefore, users do not need to memorize each of a plurality of IDs, and thus can use the WLAN more conveniently.

In addition, by providing an authentication agent service, a user ID / password-based user authentication can be used even in a small company that cannot maintain its own authentication device.

Claims (11)

In the authentication method of the system that is connected to a plurality of local authentication devices through a network, the user terminal connected through a wireless communication network to the Internet according to the relay of the network access control device a) a user ID included in the authentication information when the authentication request message including the authentication information provided from the user terminal connecting through the wireless communication network and the identification address of the network access control device is provided from the network access control device; Determining the type of; b) determining an area to which the user terminal is connected; And c) selectively performing authentication on an access request of the user terminal based on the type of the determined user ID and the region to which the user terminal is connected; Authentication method comprising a. The method of claim 1 Step c) If the user ID is a wide area ID, allowing access if the area accessed by the user terminal corresponds to a first area in which a public WLAN service is available and a second area in which a service of the corresponding private WLAN is available; If the user ID is a narrow area ID, allowing access if the area accessed by the user terminal corresponds to a second area; And If the user ID is a general ID, allowing access if the area accessed by the user terminal corresponds to the first area; Authentication method comprising a. The method of claim 2 And the wide area ID and narrow area ID include a user ID and a company identifier. The method of claim 1 Step b) is an authentication method for determining the area connected to the user terminal based on the IP address of the network access control device that transmitted the authentication information. The method of claim 1 d) if the user ID is an external authentication ID, providing authentication information including the user ID to a corresponding local authentication server to perform authentication. The method of claim 5 In step d), an authentication method of performing a proxy function of transmitting the authentication result provided from the local authentication server to the network access control device. In an authentication system that is connected to a plurality of local authentication devices through a network, the user terminal connected through a wireless communication network to the Internet according to the relay of the network access control device A corporate classification database in which authentication subjects are stored in correspondence with a corporate identifier assigned to each company that has set up a private WLAN; An authentication database in which a password, a user ID type, and an accessible area are stored corresponding to the user ID; An address database in which location information of the network access device is stored corresponding to the IP address of the network access control device; A user identification unit for determining a type of a user ID included in the authentication information when an authentication request message including authentication information transmitted from the network access control device from the user terminal and an identification address of the network access control device is provided; An access region determination unit searching the address database based on an identification address of the network access control apparatus included in the authentication request message to find a location of the network access control apparatus, and determining an area to which the user terminal accesses based on the address database; And An authentication processing unit for selectively performing an authentication for the access request of the user terminal based on the type of the determined user ID and the region connected to the user terminal. Authentication system comprising a. The method of claim 7, When the user ID is an external authentication ID, the user identification unit provides authentication information including the user ID to a corresponding local authentication device to perform authentication. When the user ID is an internal authentication ID, the authentication information is provided. An authentication system for providing authentication to the authentication processing unit. The method of claim 7, When the user ID is a wide area ID, the authentication processing unit may include a first area in which the access area of the user terminal determined by the access area determination unit is capable of serving a public WLAN service and a second service in which the corresponding private WLAN is available. If the user ID is a narrow ID, and if the user ID corresponds to a second area, the authentication system allows access. The method of claim 9 And the authentication processing unit permits access when the area accessed by the user terminal corresponds to the first area when the user ID is a general ID. The method of claim 9 And the wide area ID and narrow area ID include a user ID and a company identifier.