WO2016117211A1

WO2016117211A1 - Wireless communication device, wireless communication method and program

Info

Publication number: WO2016117211A1
Application number: PCT/JP2015/081540
Authority: WO
Inventors: 大介川上; 鈴木　英之; 伊東　克俊
Original assignee: ソニー株式会社
Priority date: 2015-01-19
Filing date: 2015-11-10
Publication date: 2016-07-28

Abstract

[Problem] To provide a wireless communication device, a wireless communication method and a program which enable securer connection to a network. [Solution] A wireless communication device is provided with: a first wireless communication unit which performs wireless communication with a wireless terminal that connects with a first network and performs wireless communication; a second wireless communication unit which connects with a second network and performs wireless communication; and a control unit which receives, from the wireless terminal via the first wireless communication unit, authentication information generated by an authentication server using network information of the second network, and performs authentication of the second network using the authentication information via the second wireless communication unit.

Description

Wireless communication apparatus, wireless communication method and program

The present disclosure relates to a wireless communication device, a wireless communication method, and a program.

In recent years, various services using the Internet have appeared, and there is a demand for means for easily accessing the Internet even when away from home. For example, a terminal having a WWAN (Wireless Wide Area Network) communication function, such as a smartphone and a mobile phone, can access the Internet via a mobile communication network even when the user is away from home. On the other hand, a terminal that does not have a WWAN communication function is required to access the Internet by using another communication method such as a wireless LAN (WLAN). When connecting to a network such as a WLAN, processing such as searching for an access point, inputting an ID (identifier) and a password may be required, and a technique for making such processing easier is required. Yes.

For example, in Patent Document 1 below, a communication terminal that indirectly communicates with a service providing apparatus that provides a service via another communication terminal seamlessly receives a service provided by the service providing apparatus. Techniques for enabling are disclosed.

JP 2009-253752 A

However, further performance improvement is desired in this technical field. For example, in a network constructed by WLAN, there may be a network with a high security risk such as the risk of eavesdropping, so it is desirable to be able to connect to a safer network. Therefore, the present disclosure proposes a new and improved wireless communication apparatus, wireless communication method, and program that can be more securely connected to a network.

According to the present disclosure, the first wireless communication unit that performs wireless communication with a wireless terminal that performs wireless communication by connecting to the first network, and the second wireless that performs wireless communication by connecting to the second network. Authentication information generated by an authentication server using network information of the communication unit and the second network is received from the wireless terminal via the first wireless communication unit, and is transmitted via the second wireless communication unit. And a control unit that performs authentication to the second network using the authentication information.

In addition, according to the present disclosure, the fourth wireless communication unit performs wireless communication with the third wireless communication unit that performs wireless communication by connecting to the first network and the wireless terminal that performs wireless communication by connecting to the second network. The network information of the second network and the network information of the second network are transmitted to the authentication server via the third wireless communication unit, and to the second network generated using the network information in the authentication server And a control unit that transmits authentication information for authentication to the wireless terminal via the fourth wireless communication unit.

According to the present disclosure, a third wireless communication unit that performs wireless communication by connecting to the first network, a fifth wireless communication unit that performs wireless communication by connecting to the second network, and the first Network information of the second network is transmitted to the authentication server via the third wireless communication unit, and the authentication to the second network using the authentication information generated in the authentication server is performed to the fifth wireless communication And a control unit that is provided via the unit.

Further, according to the present disclosure, the first wireless communication unit performs wireless communication with a wireless terminal that performs wireless communication by connecting to the first network, and the second wireless communication unit enters the second network. Connecting and performing wireless communication; receiving authentication information generated by an authentication server using network information of the second network from the wireless terminal via the first wireless communication unit; and And performing authentication to the second network using the authentication information via the wireless communication unit of the wireless communication unit.

Further, according to the present disclosure, the third wireless communication unit connects to the first network to perform wireless communication, and the fourth wireless communication unit connects to the second network to perform wireless communication. Performing wireless communication with a terminal, transmitting network information of the second network to an authentication server via the third wireless communication unit, and generating the first information generated using the network information in the authentication server And transmitting authentication information for authentication to the second network to the wireless terminal via the fourth wireless communication unit.

According to the present disclosure, the third wireless communication unit connects to the first network to perform wireless communication, and the fifth wireless communication unit connects to the second network to perform wireless communication. And transmitting network information of the second network to the authentication server via the third wireless communication unit, and authenticating the second network using the authentication information generated in the authentication server. 5 via a wireless communication unit, a wireless communication method is provided.

According to the present disclosure, the computer is connected to the first network to perform wireless communication with the wireless terminal that performs wireless communication, and the computer is connected to the second network to perform wireless communication. A second wireless communication unit that performs authentication information generated by an authentication server using network information of the second network, and receives the second wireless communication unit from the wireless terminal via the first wireless communication unit; A program is provided for functioning as a control unit that performs authentication to the second network using the authentication information via a wireless communication unit.

In addition, according to the present disclosure, wireless communication between a third wireless communication unit that performs wireless communication by connecting a computer to the first network and a wireless terminal that performs wireless communication by connecting to the second network is performed. The fourth wireless communication unit to be performed and the network information of the second network are transmitted to the authentication server via the third wireless communication unit, and the second information generated using the network information in the authentication server There is provided a program for functioning as a control unit that transmits authentication information for authentication to the network to the wireless terminal via the fourth wireless communication unit.

According to the present disclosure, the third wireless communication unit that connects the computer to the first network and performs wireless communication, and the fifth wireless communication unit that connects to the second network and performs wireless communication; , Transmitting network information of the second network to the authentication server via the third wireless communication unit, and authenticating the second network using the authentication information generated in the authentication server. And a program for functioning as a control unit performed via the wireless communication unit.

As described above, according to the present disclosure, it is possible to connect to a network more safely. Note that the above effects are not necessarily limited, and any of the effects shown in the present specification, or other effects that can be grasped from the present specification, together with or in place of the above effects. May be played.

1 is a diagram for describing an overview of a wireless communication system according to an embodiment of the present disclosure. FIG. 1 is a diagram for describing an overview of a wireless communication system according to an embodiment of the present disclosure. FIG. It is a block diagram which shows an example of a structure of the radio | wireless communications system which concerns on this embodiment. It is a block diagram which shows an example of a logical structure of the WLAN terminal which concerns on this embodiment. It is a block diagram which shows an example of a logical structure of the WWAN terminal which concerns on this embodiment. It is a block diagram which shows an example of a logical structure of the authentication server which concerns on this embodiment. It is a sequence diagram which shows an example of the flow of the connection process performed in the radio | wireless communications system which concerns on this embodiment. It is a sequence diagram which shows an example of the flow of the connection process performed in the radio | wireless communications system which concerns on this embodiment. It is a sequence diagram which shows an example of the flow of the EAP authentication process performed in the radio | wireless communications system which concerns on this embodiment. It is a sequence diagram which shows an example of the flow of the EAP authentication process performed in the radio | wireless communications system which concerns on this embodiment. It is a sequence diagram which shows an example of the flow of the connection process performed in the radio | wireless communications system which concerns on this embodiment. It is a figure for demonstrating the outline | summary of the radio | wireless communications system which concerns on this embodiment. It is a sequence diagram which shows an example of the flow of the connection process performed in the radio | wireless communications system which concerns on this embodiment. It is a figure for demonstrating the outline | summary of the radio | wireless communications system which concerns on this embodiment. It is a sequence diagram which shows an example of the flow of the connection process performed in the radio | wireless communications system which concerns on this embodiment. It is a sequence diagram which shows an example of the flow of the connection process performed in the radio | wireless communications system which concerns on this embodiment. It is a sequence diagram which shows an example of the flow of the connection process performed in the radio | wireless communications system which concerns on this embodiment. It is a sequence diagram which shows an example of the flow of the connection process performed in the radio | wireless communications system which concerns on this embodiment. It is a flowchart which shows an example of the flow of the connection process performed in the WLAN terminal or WWAN terminal which concerns on this embodiment. It is a flowchart which shows an example of the flow of the connection process performed in the WLAN terminal or WWAN terminal which concerns on this embodiment. It is a block diagram which shows an example of a schematic structure of a smart phone. It is a block diagram which shows an example of a schematic structure of a car navigation apparatus.

Hereinafter, preferred embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. In addition, in this specification and drawing, about the component which has the substantially same function structure, duplication description is abbreviate | omitted by attaching | subjecting the same code | symbol.

The description will be made in the following order.
1. Overview 2. First embodiment 2.1. Configuration example of wireless communication system 2.2. Configuration example of WLAN terminal 2.3. Configuration example of WWAN terminal 2.4. Configuration example of authentication server 2.5. 2. Operation processing Second Embodiment 3.1. Overview 3.2. Example of operation processing Third Embodiment 4.1. Outline 4.2. Example of operation processing Fourth embodiment 5.1. Outline 5.2. Example of operation processing 5.3. 5. Relationship between authentication method and public WLAN Fifth embodiment 6.1. Outline 6.2. Example of operation processing Sixth Embodiment 7.1. Outline 7.2. Example of operation processing Application example 9. Summary

<< 1. Overview >>
First, an overview of a wireless communication system 1 according to an embodiment of the present disclosure will be described with reference to FIGS. 1 and 2.

FIG.1 and FIG.2 is a figure for demonstrating the outline | summary of the radio | wireless communications system 1 which concerns on one Embodiment of this indication. In the example illustrated in FIG. 1, the wireless communication system 1 includes a wireless communication device 100. In the example illustrated in FIG. 2, the wireless communication system 1 includes a wireless communication device 100 and a wireless communication device 200.

The wireless communication device 100 is a wireless terminal capable of wireless communication with other devices. In the example of FIG. 1, the wireless communication device 100 is a notebook PC. The wireless communication device 100 is a WLAN terminal that can be connected to a WLAN according to a communication method such as IEEE (Institute of Electrical and Electronics Engineers) 802.11a, 11b, 11g, 11n, 11ac, or 11ad. As shown in FIG. 1, the WLAN terminal 100 can connect to a wireless network 500 via a base station 510 and use a service provided by the service network 400. Further, the WLAN terminal 100 can form a wireless connection with the wireless communication device 200. This wireless connection can be formed according to an arbitrary communication method such as Bluetooth (registered trademark) or NFC (Near field communication). The WLAN terminal 100 can be connected to a WLAN whose network information is known, such as a WLAN that is operated at the user's home, for example, but is difficult to connect to a WLAN whose network information such as whereabouts is unknown. In addition to the notebook PC, the wireless communication device 100 includes a PC, a tablet terminal, a PDA (Personal Digital Assistant), an HMD (Head Mounted Display), a headset, a digital camera, a digital video camera, a smartphone, a mobile phone terminal, a mobile phone, and the like. It may be realized as a music playback device, a portable video processing device, a portable game device, or the like.

The wireless communication device 200 is a wireless terminal capable of wireless communication with other devices. In the example of FIG. 2, the wireless communication device 200 is a smartphone. The wireless communication apparatus 200 can form a wireless connection with the WLAN terminal 100, for example. The wireless communication apparatus 200 is a WWAN terminal that has a WWAN communication function and can be connected to the WWAN. The WWAN terminal 200 has subscriber identification information for connecting to a mobile communication network, performs authentication processing using the subscriber identification information, and establishes wireless connection with a wireless network 300 such as a mobile communication network. Can be formed. The subscriber identification information is, for example, an IMSI (International Mobile Subscriber Identity) stored in a SIM card (Subscriber Identity Module Card). The WWAN terminal 200 can use the service provided by the service network 400 by connecting to the wireless network 300 using the WWAN communication function. The wireless communication device 200 is not only a smartphone but also a notebook PC, PC, tablet terminal, PDA, HMD, headset, digital camera, digital video camera, mobile phone terminal, portable music player, portable video processing device. Alternatively, it may be realized as a portable game device or the like.

The wireless network 300 is a WWAN (first network) such as a mobile communication network. For example, the WWAN 300 is operated according to an arbitrary wireless communication system such as LTE (Long Term Evolution), LTE-A (LTE-Advanced), GSM (registered trademark), UMTS, W-CDMA, or CDMA2000. For example, the WWAN 300 is connected from the wireless communication device 200 located within the range of the cell operated by the base station 310.

The service network 400 is a public network such as the Internet. The WWAN terminal 200 can access the service network 400 via the WWAN 300.

Here, it is difficult for a terminal having no WWAN communication function to access the Internet via the WWAN 300. Even in such a case, examples of means for realizing access to the Internet while away from home include tethering by a terminal capable of WWAN communication or use of a public WLAN.

Tethering is a technology for connecting other communication terminals to the WWAN 300 via a terminal having a WWAN communication function such as a smartphone. For example, since the WWAN terminal 200 can be connected to the WWAN 300 and the WLAN terminal 100, the WWAN terminal 200 can function as an access point that relays communication between the WWAN 300 and the WLAN terminal 100, and can realize tethering. As a result, the WLAN terminal 100 can use the service provided by the service network 400.

Tethering can be used wherever the WWAN terminal 200 is located in an area where WWAN communication is possible. However, since it is necessary to perform terminal setting for tethering use in both the WWAN terminal 200 and the WLAN terminal 100, the convenience of the user is impaired. Further, during tethering, the power consumption of the WWAN terminal 200 functioning as an access point is large.

On the other hand, a public WLAN is a service that provides a connection to the Internet using a WLAN. Hereinafter, communication using a public WLAN will be described with reference to FIG. A wireless network 500 shown in FIG. 2 is a public network (second network) operated by a WLAN, for example. The WLAN terminal 100 can connect to the WLAN 500 to access the service network 400 or further access the service network 400 via the WWAN 300. As a result, the WLAN terminal 100 can use the service provided by the service network 400.

Here, a wireless terminal having a WWAN communication function such as a smartphone is an ANDSF (Access Network Discovery and Selection Function) proposed by 3GPP (Third Generation Partnership Project), or Wi-Fi CERTIFIED proposed by Wi-Fi Alliance. Using Passpoint technology, it is possible to connect to the surrounding public WLAN and perform user authentication using the subscriber identification information possessed by itself. However, in a wireless terminal that does not have a WWAN communication function and does not have subscriber identification information like a notebook PC, it may be necessary to select a public WLAN that can be used by the user and perform an authentication procedure. Convenience was impaired.

Furthermore, if the WLAN terminal 100 is not compatible with Wi-Fi CERTIFIED Passpoint, it will connect without confirming the safety of the WLAN 500, which may lead to the risk of connecting to the WLAN 500 with a high security risk and damage such as eavesdropping. There was a risk of encounter.

Accordingly, the wireless communication apparatus according to an embodiment of the present disclosure has been created with the above circumstances in mind. A wireless communication apparatus according to an embodiment of the present disclosure can easily and safely connect to a public WLAN and use the Internet. Hereinafter, a wireless communication system including the wireless communication apparatus according to an embodiment of the present disclosure will be described in detail with reference to FIGS.

<< 2. First Embodiment >>
<2.1. Configuration example of wireless communication system>
FIG. 3 is a block diagram illustrating an example of a configuration of the wireless communication system 1 according to the present embodiment. As shown in FIG. 3, the wireless communication system 1 includes a WLAN terminal 100 and a WWAN terminal 200, and provides wireless connection to the WWAN 300, the WLAN 500, and the service network 400.

(1) WWAN300
As shown in FIG. 3, the WWAN 300 is operated by a base station 310, a gateway 320, a subscriber information server 330, an authentication server 340, and a network information providing server 350.

(1-1) Base station 310
The base station 310 is a device that serves as a contact point when a wireless terminal having a WWAN communication function is connected to the WWAN 300. For example, the base station 310 accepts a connection from the WWAN terminal 200. In LTE, the base station 310 corresponds to an eNB.

(1-2) Gateway 320
The gateway 320 is a device that relays communication between the WWAN 300 and another network. For example, the gateway 320 relays communication between the WWAN 300 and the service network 400 and communication between the WWAN 300 and the WLAN 500. In LTE, the gateway 320 corresponds to a P-GW (Packet Data Network Gateway).

(1-3) Subscriber information server 330
The subscriber information server 330 is a device that holds subscriber information for the WWAN 300. The subscriber information server 330 also holds information used for authentication processing when a wireless terminal connects to the WWAN 300. In LTE, the subscriber information server 330 corresponds to an HSS (Home Subscriber Server).

(1-4) Authentication server 340
The authentication server 340 is a device that authenticates that the connection to the WWAN 300 is a connection by a WWAN 300 subscriber. The authentication server 340 can perform this authentication process with reference to the subscriber information server 330. In LTE, the authentication server 340 corresponds to an AAA (Authentication, Authorization and Accounting) server.

The authentication server 340 has a function of authenticating connection to the WLAN 500. For example, an authentication protocol using a certificate such as EAP (Extensible Authentication Protocol) -TLS or EAP-TTLS can be adopted as an authentication protocol for the WLAN 500. In that case, the authentication server 340 issues an electronic certificate, an ID, a password, and the like, and performs an authentication process related to a terminal that connects to the WLAN 500. Further, as an authentication protocol for the WLAN 500, an authentication protocol using subscriber identification information for the WWAN 300, such as EAP-AKA, EAP-SIM, or EAP-AKA ′, can be adopted. In that case, the authentication server 340 performs authentication processing with reference to the subscriber information server 330. A terminal that has a WWAN communication function and can be connected to the WWAN 300 through authentication processing using subscriber identification information can be connected to the WLAN 500 through authentication processing using subscriber identification information. . In addition, IMS-AKA, Security Token, a digital certificate (Credential, Certificate), a public key, or the like may be used as an authentication protocol for the WLAN 500.

(1-5) Network information providing server 350
The network information providing server 350 is a device that provides information on a connection destination wireless network, which is necessary when the connection destination is switched from the wireless network to which the wireless terminal is currently connected to another wireless network. For example, the network information providing server 350 can provide network information for connecting to the WLAN 500 to the WWAN terminal 200. In LTE, the network information providing server 350 corresponds to an ANDSF server.

(2) WLAN500
As shown in FIG. 3, the WLAN 500 is a public network operated by the base station 510. In the present specification, the communication system of the public network is described as being WLAN, but may be operated according to any other communication system such as Bluetooth.

The base station 510 is a device that serves as a contact point when a wireless terminal having a WLAN communication function connects to the WLAN 500. For example, the base station 510 receives a connection from the WLAN terminal 100. When the communication method of the public network is WLAN, the base station 510 corresponds to an access point. Note that the base station 510 can support one or more authentication protocols.

<2.2. Configuration example of WLAN terminal>
FIG. 4 is a block diagram illustrating an example of a logical configuration of the WLAN terminal 100 according to the present embodiment. As illustrated in FIG. 4, the WLAN terminal 100 includes a wireless communication unit 110, a storage unit 120, and a control unit 130.

(1) Wireless communication unit 110
The wireless communication unit 110 is a communication module that transmits / receives data to / from an external device. The wireless communication unit 110 can perform wireless communication using various communication methods. For example, the wireless communication unit 110 includes a WLAN module 112 and can perform wireless communication using Wi-Fi (registered trademark) or WLAN. The wireless communication unit 110 includes a BT (Bluetooth) module 114 and can perform wireless communication using Bluetooth. The wireless communication unit 110 includes an NFC module 116 and can perform wireless communication using NFC.

For example, the wireless communication unit 110 can function as a first wireless communication unit that performs pairing and wireless communication with the WWAN terminal 200. For example, the wireless communication unit 110 performs pairing and wireless communication with the WWAN terminal 200 using a near field communication method such as NFC, Bluetooth, Bluetooth Low Energy, Wi-Fi Direct (registered trademark), or WLAN. In addition, the wireless communication unit 110 may perform pairing and wireless communication with the WWAN terminal 200 using a short-range wireless communication method such as ZigBee (registered trademark) or IrDA (Infrared Data Association).

For example, the wireless communication unit 110 can function as a second wireless communication unit that performs wireless communication by connecting to a public network. For example, the wireless communication unit 110 connects to the WLAN 500 using a wireless communication method such as WLAN. The public network may support any wireless communication method other than WLAN, and in that case, the wireless communication unit 110 can connect to the public network using a wireless communication method according to the public network. Further, the wireless communication unit 110 may perform measurement processing such as measuring RSSI (Received Signal Strength Indicator) from the strength of the signal received from the WLAN 500.

The wireless communication unit 110 may perform wireless communication using the same communication method for wireless communication with the WWAN terminal 200 and wireless communication with the public network. For example, the wireless communication unit 110 may connect to the WLAN 500 while communicating with the WWAN terminal 200 using WLAN.

(2) Storage unit 120
The storage unit 120 is a part that records and reproduces data on a predetermined recording medium. For example, the storage unit 120 may store information received from the WWAN terminal 200 by the wireless communication unit 110.

(3) Control unit 130
The control unit 130 functions as an arithmetic processing device and a control device, and controls the overall operation in the WLAN terminal 100 according to various programs.

For example, the control unit 130 receives authentication information generated by the authentication server 340 using the network information of the WLAN 500 from the WWAN terminal 200 via the wireless communication unit 110 and uses the authentication information via the wireless communication unit 110. Has a function of authenticating to the existing WLAN 500. That is, the WLAN terminal 100 acquires authentication information generated by the authentication server 340 via the WWAN terminal 200, and performs authentication to the WLAN 500 using the acquired authentication information. Thereby, the WLAN terminal 100 acquires the authentication information via the WWAN terminal 200 even in a situation where it is difficult to acquire the authentication information from the authentication server 340 by itself, such as having no WWAN communication function. It becomes possible. Also, the WLAN terminal 100 can connect to the secure WLAN 500 by using the authentication information generated by the authentication server 340, and avoids connection to a network with a high security risk such as the risk of eavesdropping. Can do. Thereby, even when the WLAN terminal 100 is not compatible with Wi-Fi CERTIFIED Passpoint, it is possible to obtain the same safety and connection convenience as the case where the WLAN terminal 100 is compatible.

The network information may include at least one of information obtained by probe processing, such as SSID of WLAN 500, channel information, RSSI information, and the like. Further, the network information may include information indicating an inquiry result using an ANQP (Access Network Query Protocol) such as a NAI (Network Access Identifier) related to an authentication method and a list of available service providers.

The authentication server 340 uses the network information received from the WWAN terminal 200 to generate authentication information. The network information may be collected by the WLAN terminal 100 or may be collected by the WWAN terminal 200. In any case, the WLAN terminal 100 or the WWAN terminal 200 located near the WLAN terminal 100 actually collects network information. For this reason, the WLAN terminal 100 can receive a connection service with higher accuracy in the usable area and the radio wave intensity as compared with the method using the ANDSF.

When the WLAN terminal 100 collects, for example, the control unit 130 collects network information via the wireless communication unit 110. Specifically, the control unit 130 acquires the network information of the WLAN 500 by transmitting a probe request when a beacon emitted from the base station 510 is received by the wireless communication unit 110. In addition, when the WLAN terminal 100 is compatible with Wi-Fi CERTIFIED Passpoint, the control unit 130 may make an inquiry about ANQP information to the WLAN 500 via the wireless communication unit 110. Then, the control unit 130 transmits the collected network information to the WWAN terminal 200 via the wireless communication unit 110.

When there are one or more connection candidate WLANs 500, the control unit 130 may perform authentication to one WLAN 500 selected from one or more WLANs 500. For example, the control unit 130 may select the connection-destination WLAN 500 based on RSSI information or channel information. In addition, the control unit 130 may select the connection-destination WLAN 500 based on device information of the WLAN terminal 100, capability information, or information indicating the purpose of wireless communication with the WLAN 500. The device information can include, for example, a MAC address, a model name, and the like. The information indicating the use can include, for example, information indicating an application executed in the WLAN terminal 100 and information indicating a service used by the WLAN terminal 100. Based on such information, the control unit 130 can select a more suitable connection destination. This selection may be performed by a device other than the WLAN terminal 100 such as the authentication server 340, the base station 310, or the WWAN terminal 200. In that case, information indicating a selection result such as which WLAN 500 should be a connection destination may be taken as authentication information. The WLAN terminal 100 may transmit information for supporting selection of an appropriate connection destination by another device to the WWAN terminal 200 on the assumption that the WLAN terminal 100 and the WWAN terminal 200 are paired. . For example, the control unit 130 may transmit at least one of the device information of the WLAN terminal 100, capability information, or information indicating the purpose of wireless communication with the WLAN 500 to the WWAN terminal 200 via the wireless communication unit 110. . Other devices can select an appropriate connection destination for the WLAN terminal 100 based on these pieces of information.

The control unit 130 may authenticate the WLAN 500 by an authentication process using an electronic certificate. For example, the control unit 130 authenticates the WLAN 500 by EAP authentication using an electronic certificate issued by the authentication server 340. When EAP-TLS is adopted as the authentication protocol, the authentication information includes an electronic certificate issued by the authentication server 340. When EAP-TTLS is adopted as the authentication protocol, the authentication information includes an ID and password issued by the authentication server 340. By using the authentication information generated by the authentication server 340, the WLAN terminal 100 can easily connect to the WLAN 500 even when it does not have subscriber identification information.

Further, the control unit 130 may authenticate the WLAN 500 by an authentication process using the subscriber identification information. For example, the control unit 130 authenticates the WLAN 500 by EAP authentication using subscriber identification information included in the WWAN terminal 200. Specifically, for example, the control unit 130 receives authentication information based on the subscriber identification information from the WWAN terminal 200 by the wireless communication unit 110, and performs authentication to the WLAN 500 using the authentication information by the wireless communication unit 110. . Specifically, the control unit 130 controls a relay process for relaying a message transmitted / received between the WWAN terminal 200 and the WLAN 500 for the authentication process performed by the WWAN terminal 200. For example, the control unit 130 transmits a message (first message) for authentication to the WLAN 500 received by the wireless communication unit 110 to the WWAN terminal 200 by the wireless communication unit 110. This message is, for example, a message that requests generation of authentication information. In addition, the control unit 130 receives a message (second message) received by the wireless communication unit 110 from the WWAN terminal 200 and containing the authentication information generated by the WWAN terminal 200, as a base for operating the WLAN 500 using the wireless communication unit 110. Transmit to station 510. The WLAN terminal 100 can cause the WWAN terminal 200 to perform the authentication process to the WLAN 500 using EAP by proxy by the message relay process described above. For this reason, the WLAN terminal 100 can be easily connected to the WLAN 500 even when it does not have subscriber identification information.

Note that the message relayed by the WLAN terminal 100 may be a message for authentication processing using EAP. For example, the first message may be EAP-Request / Identity, and the second message may be EAP-Response / Identity. Further, the first message may be EAP-Request / AKA-Challenge and the second message may be EAP-Response / AKA-Challenge. In the following, an example in which EAP-AKA is adopted as an example of an authentication protocol using subscriber identification information will be described, but subscriber information such as EAP-SIM or EAP-AKA 'is used for authentication processing. Other authentication protocols may be employed.

When EAP authentication using an electronic certificate or subscriber identification information is adopted, authentication to the WLAN 500 is performed without requiring a user operation, which improves user convenience. Further, even when the WLAN terminal 100 continues the search after switching to the WLAN 500 and switches the connection destination network, the user's convenience is improved because no user operation is required.

The configuration example of the WLAN terminal 100 according to the present embodiment has been described above. Next, a configuration example of the WWAN terminal 200 according to the present embodiment will be described with reference to FIG.

<2.3. Configuration example of WWAN terminal>
FIG. 5 is a block diagram illustrating an example of a logical configuration of the WWAN terminal 200 according to the present embodiment. As illustrated in FIG. 5, the WWAN terminal 200 includes a wireless communication unit 210, a storage unit 220, a subscriber identification module 230, and a control unit 240.

(1) Wireless communication unit 210
The wireless communication unit 210 is a communication module that transmits / receives data to / from an external device. The wireless communication unit 210 can perform wireless communication using various communication methods. For example, the wireless communication unit 210 includes a WWAN module 212 and can perform wireless communication using the WWAN 300. The wireless communication unit 210 includes a WLAN module 214 and can perform wireless communication using Wi-Fi or WLAN. The wireless communication unit 210 includes a BT module 216 and can perform wireless communication using Bluetooth. The wireless communication unit 210 includes an NFC module 218 and can perform wireless communication using NFC.

For example, the wireless communication unit 210 can function as a fourth wireless communication unit that performs pairing and wireless communication with the WLAN terminal 100. For example, the wireless communication unit 210 performs pairing and wireless communication with the WLAN terminal 100 using a short-range wireless communication method such as NFC, Bluetooth, Bluetooth Low Energy, Wi-Fi Direct, or WLAN. In addition, the wireless communication unit 210 may perform pairing and wireless communication with the WLAN terminal 100 using a short-range wireless communication method such as ZigBee or IrDA (Infrared Data Association). Further, the wireless communication unit 210 can function as a third wireless communication unit that performs wireless communication by connecting to the WWAN 300 using the WWAN module 212. For example, the wireless communication unit 210 communicates with the authentication server 340 via the WWAN module 212. In addition, the wireless communication unit 210 can function as a fifth wireless communication unit that performs wireless communication by connecting to the WLAN 500 using the WLAN module 214. For example, the wireless communication unit 210 communicates with the base station 510 via the WLAN module 214.

(2) Storage unit 220
The storage unit 220 is a part that records and reproduces data on a predetermined recording medium. For example, the storage unit 220 may store information received from the WWAN 300 by the wireless communication unit 210. For example, the storage unit 220 may store device information of the WLAN terminal 100 with which pairing has been established, capability information, or information indicating the purpose of wireless communication with the WLAN 500.

(3) Subscriber identification module 230
The subscriber identification module 230 has a function as a storage unit that stores subscriber identification information for the WWAN 300. For example, the subscriber identification module 230 is realized by a SIM card.

(4) Control unit 240
The control unit 240 functions as an arithmetic processing unit and a control unit, and controls the overall operation within the WWAN terminal 200 according to various programs.

For example, the control unit 240 has a function of transmitting the network information of the WLAN 500 to the authentication server 340 via the wireless communication unit 210. The control unit 240 has a function of transmitting authentication information for authentication to the WLAN 500 generated using the network information in the authentication server 340 to the WLAN terminal 100 via the wireless communication unit 210. That is, the WWAN terminal 200 relays transmission of authentication information from the authentication server 340 to the WLAN terminal 100. As a result, the WLAN terminal 100 can successfully authenticate to the WLAN 500 even under circumstances where it is difficult for the WLAN terminal 100 to acquire authentication information from the authentication server 340 by itself, such as when the WLAN terminal 100 does not have a WWAN communication function. Is possible.

The network information may be collected by the WLAN terminal 100 or may be collected by the WWAN terminal 200. When collected by the WLAN terminal 100, for example, the wireless communication unit 210 receives network information from the WLAN terminal 100. Further, when the WWAN terminal 200 collects, for example, the control unit 240 collects network information via the wireless communication unit 210. Specifically, the control unit 240 acquires the network information of the WLAN 500 by transmitting a probe request when a beacon emitted from the base station 510 is received by the wireless communication unit 210. In addition, when the WWAN terminal 200 is compatible with Wi-Fi CERTIFIED Passpoint, the control unit 240 may make an inquiry about ANQP information to the WLAN 500 via the wireless communication unit 210.

When there are one or more connection candidate WLANs 500, the control unit 240 may select the WLAN 500 to which the WLAN terminal 100 should connect from one or more WLANs 500. In that case, the control unit 240 may transmit authentication information for authentication to one WLAN 500 selected from one or more WLANs 500 to the WLAN terminal 100 via the wireless communication unit 210. For example, the control unit 240 selects the WLAN 500 to be connected to the WLAN terminal 100 based on RSSI information, channel information, device information of the WLAN terminal 100, capability information, or information indicating the purpose of wireless communication with the WLAN 500. Also good. The control unit 240 controls the wireless communication unit 210 to transfer the device information, capability information of the WLAN terminal 100 received from the WLAN terminal 100, or information indicating the purpose of wireless communication with the WLAN 500 to the authentication server 340. May be.

The control unit 240 may support authentication using an electronic certificate by the WLAN terminal 100. For example, the control unit 240 controls the wireless communication unit 210 to receive the electronic certificate or ID and password issued by the authentication server 340 from the authentication server 340 and transmit them to the WLAN terminal 100.

Also, the control unit 240 may support authentication using the subscriber identification information by the WLAN terminal 100. For example, the control unit 240 generates authentication information based on the subscriber identification information stored in the subscriber identification module 230, and transmits the authentication information to the WLAN terminal 100 by the wireless communication unit 210. Specifically, the control unit 240 performs an authentication process based on a message relayed by the WLAN terminal 100. For example, the control unit 240 performs authentication processing based on a message (first message) for the WLAN terminal 100 to authenticate to the WLAN 500 received from the WLAN terminal 100 by the wireless communication unit 210 and generates authentication information. . This message is, for example, a message that requests generation of authentication information. In addition, the control unit 240 transmits a message (second message) including the generated authentication information to the WLAN terminal 100 by the wireless communication unit 210.

The control unit 240 may perform authentication processing using EAP based on a message relayed by the WLAN terminal 100 to generate authentication information. As described above, the control unit 240 may perform authentication processing using any authentication protocol that uses subscriber information for authentication processing, such as EAP-AKA, EAP-SIM, or EAP-AKA '. The control unit 240 can perform the authentication process for the WLAN 500 using EAP on behalf of the WLAN terminal 100 by receiving the relay of the message by the WLAN terminal 100. For this reason, the WWAN terminal 200 can realize easy connection to the WLAN 500 by the WLAN terminal 100 even when the WLAN terminal 100 does not have subscriber identification information. In addition, since the WWAN terminal 200 does not directly transmit subscriber identification information or the like to the WLAN terminal 100, security can be ensured.

The configuration example of the WWAN terminal 200 according to the present embodiment has been described above. Next, a configuration example of the authentication server 340 according to the present embodiment will be described with reference to FIG.

<2.4. Configuration example of authentication server>
FIG. 6 is a block diagram illustrating an example of a logical configuration of the authentication server 340 according to the present embodiment. As illustrated in FIG. 6, the authentication server 340 includes a communication unit 341, a storage unit 342, and a control unit 343.

(1) Communication unit 341
The communication unit 341 is a communication module that transmits / receives data to / from an external device. The communication unit 341 can perform wireless communication using various wired / wireless communication methods. The communication unit 341 according to the present embodiment communicates with the WWAN terminal 200 that connects to the WWAN 300 and performs wireless communication, and the WLAN terminal 100 that connects to the WLAN 500 and performs wireless communication, either directly or via an arbitrary communication node. Indirectly. The communication unit 341 receives network information from the WWAN terminal 200 and transmits authentication information to the WWAN terminal 200.

(2) Storage unit 342
The storage unit 342 is a part that records and reproduces data on a predetermined recording medium. For example, the storage unit 342 stores information received from the WLAN terminal 100 or the WWAN terminal 200 by the communication unit 341.

(3) Control unit 343
The control unit 343 functions as an arithmetic processing device and a control device, and controls the overall operation in the authentication server 340 according to various programs.

For example, the control unit 343 generates authentication information based on the received network information. For example, when EAP-TLS is included in the NAI included in the network information, the control unit 343 issues an electronic certificate. For example, when EAP-TTLS is included in the NAI included in the network information, the control unit 343 issues an ID and a password. In addition, the control unit 343 selects the WLAN 500 to be connected to the WLAN terminal 100 based on RSSI information, channel information, device information of the WLAN terminal 100, capability information, or information indicating the purpose of wireless communication with the WLAN 500. May be. The control unit 343 generates information indicating the contents issued or selected as authentication information.

In addition, the control unit 343 may issue an electronic certificate for the base station 510. The control unit 343 transmits the generated electronic certificate to the base station 510 via the communication unit 341. Thereby, authentication using the electronic certificate in the base station 510 becomes possible.

The configuration example of the authentication server 340 according to this embodiment has been described above. Subsequently, an operation process performed by the wireless communication system 1 according to the present embodiment will be described with reference to FIGS.

<2.5. Operation processing>
(1) First Connection Processing Example This connection processing example is an example in which the WWAN terminal 200 collects network information and EAP authentication using an electronic certificate as an authentication protocol is employed. FIG. 7 is a sequence diagram showing an example of the flow of connection processing executed in the wireless communication system 1 according to the present embodiment. As shown in FIG. 7, the authentication server 340, the base station 310, the WWAN terminal 200, the WLAN terminal 100, and the base station 510 are involved in this sequence.

As shown in FIG. 7, first, in step S102, the WLAN terminal 100 and the WWAN terminal 200 establish pairing. For example, the WLAN terminal 100 and the WWAN terminal 200 establish a communication path using Bluetooth, Wi-Fi Direct, NFC, or the like. After the pairing is established, the WLAN terminal 100 may transmit device information of the WLAN terminal 100, capability information, or information indicating the purpose of wireless communication with the WLAN 500 to the WWAN terminal 200.

Next, in step S104, the WWAN terminal 200 collects network information of the WLAN 500. For example, the WWAN terminal 200 makes an inquiry about probe processing or ANQP information. Thereby, the WWAN terminal 200 acquires network information from the base station 510 in step S106.

Next, in step S108, the WWAN terminal 200 transmits network information to the authentication server 340 via the base station 310.

Next, in step S110, the authentication server 340 generates authentication information. For example, when EAP-TLS is included in the NAI included in the network information, the authentication server 340 issues an electronic certificate. For example, when EAP-TTLS is included in the NAI included in the network information, the authentication server 340 issues an ID and a password. Further, the authentication server 340 may select the WLAN 500 to which the WLAN terminal 100 is connected based on at least one of channel information and RSSI information. The authentication server 340 generates information indicating these issuance and selected contents as authentication information.

Next, in step S112, the authentication server 340 transmits the generated authentication information to the WWAN terminal 200 via the base station 310.

Next, in step S114, the WWAN terminal 200 transmits the authentication information received from the authentication server 340 to the WLAN terminal 100.

In step S116, the WLAN terminal 100 performs authentication processing with the base station 510 using the authentication information received from the WWAN terminal 200. For example, the WLAN terminal 100 performs an EAP-TLS authentication process using an electronic certificate or an EAP-TTL authentication process using an ID and a password.

Thereby, a connection is established between the WLAN terminal 100 and the base station 510 in step S118. The WLAN terminal 100 uses the service network 400 via the base station 510. Examples of services that can be used include IMS services such as Voice over Wi-Fi and Video over Wi-Fi.

(2) Second Connection Processing Example This connection processing example is an example in which the WWAN terminal 200 collects network information and adopts EAP authentication using subscriber identification information as an authentication protocol. FIG. 8 is a sequence diagram showing an example of the flow of connection processing executed in the wireless communication system 1 according to the present embodiment. As shown in FIG. 8, the authentication server 340, the base station 310, the WWAN terminal 200, the WLAN terminal 100, and the base station 510 are involved in this sequence. This sequence is as described above with reference to FIG. 7 except for steps S110 and S117.

In step S110, the authentication server 340 generates authentication information. For example, when EAP-SIM, EAP-AKA, or EAP-AKA 'is included in the NAI included in the network information, the authentication server 340 may omit issuing an electronic certificate or ID and password. For example, the authentication server 340 selects the WLAN 500 to which the WLAN terminal 100 should be connected based on at least one of channel information and RSSI information. And the authentication server 340 produces | generates the information which shows the selected content as authentication information.

In step S117, the WLAN terminal 100 performs an authentication process to the WLAN 500 using the subscriber identification information of the WWAN terminal 200. Since communication paths such as Bluetooth, Wi-Fi Direct, NFC, etc. have already been established between the WLAN terminal 100 and the WWAN terminal 200 in step S102, messages for EAP authentication processing can be transmitted and received using this communication path. Done. The detailed contents of the EAP authentication process using the subscriber identification information of the WWAN terminal 200 will be described below with reference to FIGS.

9 and 10 are sequence diagrams showing an example of the flow of EAP authentication processing executed in the wireless communication system 1 according to the present embodiment. As shown in FIGS. 9 and 10, the base station 310, the WWAN terminal 200, the WLAN terminal 100, the base station 510, the authentication server 340, and the subscriber information server 330 are involved in this sequence. Note that with regard to the WLAN terminal 100 and the WWAN terminal 200, communication modules used for message exchange are described with the term “module” omitted. For example, a message having a WLAN (Wi-Fi) module 112 as a starting point or an ending point indicates that the WLAN module 112 transmits and receives. The same applies to the BT module 114, the WWAN module 212, and the BT module 216.

Here, as described above, a communication path is established between the WLAN terminal 100 and the WWAN terminal 200, and a message for EAP authentication processing is transmitted / received using this communication path. As an example, in this sequence, it is assumed that a wireless connection using Bluetooth is established between the WLAN terminal 100 and the WWAN terminal 200. Of course, the wireless connection may be established by any communication method other than Bluetooth, such as Wi-Fi Direct.

As shown in FIG. 9, first, in step S <b> 202, the WLAN terminal 100 performs association to the base station 510. The WLAN terminal 100 establishes a logical connection for authentication processing by association. The WLAN terminal 100 cannot perform data communication other than authentication processing, for example.

Next, in step S204, the WLAN terminal 100 transmits EAPoL-Start to the base station 510.

Next, in step S206, the base station 510 transmits EAP-Request / Identity to the WLAN terminal 100.

Next, in step S208, the WLAN terminal 100 transmits the EAP-Request / Identity received in step S206 to the WWAN terminal 200. This message is a message requesting the WWAN terminal 200 to generate an Identity required for EAP-AKA.

Next, in step S210, the WWAN terminal 200 refers to the subscriber identification module 230 that the WWAN terminal 200 has and generates an Identity. For example, the control unit 240 generates Identity based on information recorded on a SIM card that is the subscriber identification module 230. When the authentication protocol is EAP-AKA, Identity is generated based on IMSI.

The IMSI format is as follows.
<MCC: 3 digits><MNC: 2 or 3 digits><MSIN: Maximum 10 digits>

Here, MCC (Mobile Country Code) is information indicating the country, MNC (Mobile Network Code) is information indicating the operator, and MSIN (Mobile Subscriber Identification Number) is information indicating the subscriber identification code. It is.

Also, the format of Identity is as follows.
0 <IMSI> @wlan. mnc <MNC>. mcc <MCC>. 3gppnetwork. org

For example, it is assumed that the MNC is 3 digits and the IMSI is “1234560125345678”. In this case, Identity is “01234560125345678@wlan.mnc456.mcc123.3gppnetwork.org”. The identity generation processing in step S210 has been described above.

Next, in step S212, the WWAN terminal 200 returns EAP-Response / Identity to the WLAN terminal 100. This message stores the Identity generated in step S210.

Next, in step S214, the WLAN terminal 100 transfers the received EAP-Response / Identity to the base station 510.

Next, in step S216, the base station 510 transmits RADIUS-Access-Request to the authentication server 340. In this message, the Identity generated by the WWAN terminal 200 is stored.

Next, in step S218, the authentication server 340 transmits a Retrieval-Authentication-Vector to the subscriber information server 330, and requests an authentication vector for Identity. In this message, the Identity generated by the WWAN terminal 200 is stored. An authentication vector is a set of information required for authenticating a connected terminal. In the case of EAP-AKA, the authentication vector includes the following information.

RAND: random value. Used as a challenge.
AUTN: A value for the terminal to authenticate the network.
XRES: expected response value for challenge.
IK: Message integrity verification key.
CK: Key for message encryption.

Next, in step S220, the subscriber information server 330 executes the AKA algorithm and generates an authentication vector corresponding to the Identity stored in the received message.

Next, as shown in FIG. 10, in step S222, the subscriber information server 330 transmits the generated authentication vector to the authentication server 340.

Next, in step S224, the authentication server 340 transmits RADIUS-Access-Challenge to the base station 510. In this message, the authentication vector generated by the subscriber information server 330 is stored. Here, the authentication server 340 newly calculates a MAC (Message Authentication Code) and adds it to the message. This MAC is used by the WLAN terminal 100 to verify the integrity of this message.

Next, in step S226, the base station 510 transmits EAP-Request / AKA-Challenge to the WLAN terminal 100. This message includes authentication vectors RAND and AUTN, and MAC. The authentication vectors XRES, IK, and CK are held by the base station 510 and are not transmitted to the WLAN terminal 100.

Next, in step S228, the WLAN terminal 100 transmits EAP-Request / AKA-Challenge to the WWAN terminal 200. This message is a message requesting the WWAN terminal 200 to generate a response value (RES) and a session key (IK, CK).

Next, in step S230, the WWAN terminal 200 executes the AKA algorithm and generates the RES, MAC, and session key (IK, CK) corresponding to the received EAP-Request / AKA-Challenge.

Next, in step S232, the WWAN terminal 200 transmits EAP-Response / AKA-Challenge to the WLAN terminal 100. In this message, the RES, MAC, and session key generated by the WWAN terminal 200 are stored.

Next, in step S234, the WLAN terminal 100 transfers the received EAP-Response / AKA-Challenge to the base station 510.

Next, in step S 236, the base station 510 transmits RADIUS-Access-Request to the authentication server 340. This message stores the RES, MAC, and session keys (IK, CK) generated by the WWAN terminal 200.

Next, in step S238, the authentication server 340 verifies the received RES. Specifically, the authentication server 340 verifies that the RES generated by the WWAN terminal 200 matches the XRES generated by the subscriber information server 330 and the integrity of the message by MAC.

Next, in step S240, the authentication server 340 transmits RADIUS-Access-Accept to the base station 510. This message indicates that the connection is permitted.

Next, in step S242, the base station 510 transmits EAP-Success to the WLAN terminal 100. This message indicates that the authentication process has been successful for the WLAN terminal 100.

Next, in step S244, the base station 510 transmits EAPoL-Key to the WLAN terminal 100. This message is used to send a key for encrypted communication used between the WLAN terminal 100 and the base station 510.

Through the EAP authentication process described above, in step S246, the connection for WLAN communication is completed between the WLAN terminal 100 and the base station 510. Thereby, for example, data communication using Wi-Fi is started between the WLAN terminal 100 and the base station 510.

(3) Third connection processing example In this connection processing example, the WLAN terminal 100 collects network information, and EAP authentication using an electronic certificate as an authentication protocol or EAP authentication using subscriber identification information is adopted. This is an example. FIG. 11 is a sequence diagram showing an example of the flow of connection processing executed in the wireless communication system 1 according to the present embodiment. As shown in FIG. 11, the authentication server 340, the base station 310, the WWAN terminal 200, the WLAN terminal 100, and the base station 510 are involved in this sequence.

As shown in FIG. 11, first, in step S302, the WLAN terminal 100 and the WWAN terminal 200 perform tethering. Specifically, the WWAN terminal 200 functions as a tethering access point. Then, the WLAN terminal 100 connects to the WWAN terminal 200 as a WLAN client and uses the service network 400 via the base station 310. As a premise of tethering, the WLAN terminal 100 and the WWAN terminal 200 have established pairing. After the pairing is established, the WLAN terminal 100 may transmit device information of the WLAN terminal 100, capability information, or information indicating the purpose of wireless communication with the WLAN 500 to the WWAN terminal 200.

Next, in step S304, the WWAN terminal 200 requests the WLAN terminal 100 to collect network information. With this request as a trigger, the WWLAN terminal 100 collects network information of the WLAN 500 in step S306. The process here is the same as in step S104. Thereby, the WLAN terminal 100 acquires network information from the base station 510 in step S308. Next, in step S310, the WLAN terminal 100 transfers the acquired network information to the WWAN terminal 200.

Next, in step S312, the WWAN terminal 200 transmits network information to the authentication server 340 via the base station 310.

Next, in step S314, the authentication server 340 generates authentication information. The processing here is as described above with reference to FIG. 7 or FIG.

Next, in step S316, the authentication server 340 transmits the generated authentication information to the WWAN terminal 200 via the base station 310.

Next, in step S318, the WWAN terminal 200 transmits the authentication information received from the authentication server 340 to the WLAN terminal 100.

In step S320, the WLAN terminal 100 performs authentication processing with the base station 510 using the authentication information received from the WWAN terminal 200. The processing here is as described above with reference to FIG. 7 or FIG.

Thereby, a connection is established between the WLAN terminal 100 and the base station 510 in step S322.

The first embodiment has been described above.

<< 3. Second Embodiment >>
<3.1. Overview>
Hereinafter, an overview of the wireless communication system 1 according to the present embodiment will be described with reference to FIG.

FIG. 12 is a diagram for explaining the outline of the wireless communication system 1 according to the present embodiment. In the example illustrated in FIG. 12, the wireless communication system 1 includes a WWAN terminal 200. In the present embodiment, the WWAN terminal 200 itself connects to the WLAN 500 using the authentication information generated in the authentication server 340. Each device included in the wireless communication system 1 according to the present embodiment has the same function as that of the first embodiment. Further, the WWAN terminal 200 has the function that the WLAN terminal 100 has in the first embodiment. Hereinafter, functions characteristic of the WWAN terminal 200 according to the present embodiment will be described.

For example, the control unit 240 transmits the network information of the WLAN 500 to the authentication server 340 via the wireless communication unit 210, and performs authentication to the WLAN 500 using the authentication information generated in the authentication server 340 via the wireless communication unit 210. Do it. For example, the control unit 240 acquires network information via the wireless communication unit 210. Next, the control unit 240 transmits the acquired network information to the authentication server 340 via the base station 310, and acquires authentication information generated based on the network information by the authentication server 340. Then, the control unit 240 connects to the WLAN 500 using the acquired authentication information. The control unit 240 may perform authentication processing using an electronic certificate, or may perform authentication processing using subscriber identification information that the control unit 240 has. By using the authentication information generated by the authentication server 340, the WWAN terminal 200 can be connected to the secure WLAN 500 and can avoid connection to a network with a high security risk such as the risk of eavesdropping. . Thereby, even when the WWAN terminal 200 does not support the Wi-Fi CERTIFIED Passpoint, it is possible to obtain the same safety and connection convenience as the case where the WWAN terminal 200 is compatible.

For example, the control unit 240 may transmit at least one of device information of the WWAN terminal 200, capability information, or information indicating the purpose of wireless communication with the WLAN 500 to the authentication server 340 via the wireless communication unit 210. . As a result, devices other than the WWAN terminal 200 such as the authentication server 340 can select an appropriate connection destination for the WWAN terminal 200 based on these pieces of information.

The outline of the wireless communication system 1 according to the present embodiment has been described above. Subsequently, an operation process performed by the wireless communication system 1 according to the present embodiment will be described with reference to FIG.

<3.2. Example of operation processing>
FIG. 13 is a sequence diagram illustrating an example of the flow of connection processing executed in the wireless communication system 1 according to the present embodiment. As shown in FIG. 13, the authentication server 340, the base station 310, the WWAN terminal 200, and the base station 510 are involved in this sequence.

As shown in FIG. 13, first, in step S402, the WWAN terminal 200 collects network information of the WLAN 500. For example, the WWAN terminal 200 makes an inquiry about probe processing or ANQP information. Thereby, the WWAN terminal 200 acquires network information from the base station 510 in step S404.

Next, in step S406, the WWAN terminal 200 transmits network information to the authentication server 340 via the base station 310.

Next, in step S408, the authentication server 340 generates authentication information. For example, when EAP-TLS is included in the NAI included in the network information, the authentication server 340 issues an electronic certificate. For example, when EAP-TTLS is included in the NAI included in the network information, the authentication server 340 issues an ID and a password. For example, when EAP-SIM, EAP-AKA, or EAP-AKA 'is included in the NAI included in the network information, the authentication server 340 may omit issuing an electronic certificate or ID and password. Further, the authentication server 340 may select the WLAN 500 to which the WWAN terminal 200 should be connected based on at least one of the channel information and the RSSI information. The authentication server 340 generates information indicating these issuance and selected contents as authentication information.

Next, in step S410, the authentication server 340 transmits the generated authentication information to the WWAN terminal 200 via the base station 310.

In step S412, the WWAN terminal 200 performs an authentication process with the base station 510 using the received authentication information. For example, the WWAN terminal 200 may perform an EAP-TLS authentication process using an electronic certificate or an EAP-TTL authentication process using an ID and a password. Further, the WWAN terminal 200 may perform authentication processing of the EAP-AKA, EAP-SIM, or EAP-AKA ′ method using the subscriber identification information stored in the subscriber identification module 230.

Thereby, a connection is established between the WWAN terminal 200 and the base station 510 in step S118.

The second embodiment has been described above.

<< 4. Third Embodiment >>
<4.1. Overview>
Hereinafter, an overview of the wireless communication system 1 according to the present embodiment will be described with reference to FIG.

FIG. 14 is a diagram for explaining the outline of the wireless communication system 1 according to the present embodiment. In the example illustrated in FIG. 14, the wireless communication system 1 includes a WLAN terminal 100 and a WWAN terminal 200. In the present embodiment, it is assumed that the WWAN terminal 200 is already connected to the WLAN 500 and can use the service provided by the service network 400. The WWAN terminal 200 acquires authentication information for authenticating the WLAN 500 by the WLAN terminal 100 via the base station 510 and transmits it to the WLAN terminal 100. Thereby, the WLAN terminal 100 can be connected to the secure WLAN 500. Each device included in the wireless communication system 1 according to the present embodiment has the same function as that of the first embodiment. Hereinafter, functions characteristic of the present embodiment will be described.

For example, the control unit 240 of the WWAN terminal 200 transmits a message requesting generation of authentication information to the base station 510 via the wireless communication unit 210. This message may include at least one of device information of the WLAN terminal 100, capability information, or information indicating the purpose of wireless communication with the WLAN 500.

For example, the authentication server 340 generates authentication information based on the message received from the base station 510. Here, the WWAN terminal 200 has already been connected to the WLAN 500. Therefore, the authentication server 340 may use network information of the WWAN terminal 200 (authentication method, channel information, RSSI information, connection time, etc.). Of course, the authentication server 340 may use device information of the WLAN terminal 100, capability information, or information indicating the purpose of wireless communication with the WLAN 500 included in the message. As described above, the authentication server 340 can generate authentication information by using that the WWAN terminal 200 has already been connected to the WLAN 500.

The outline of the wireless communication system 1 according to the present embodiment has been described above. Subsequently, with reference to FIG. 15, an operation process performed by the wireless communication system 1 according to the present embodiment will be described.

<4.2. Example of operation processing>
FIG. 15 is a sequence diagram illustrating an example of the flow of connection processing executed in the wireless communication system 1 according to the present embodiment. As shown in FIG. 15, the WWAN terminal 200, the WLAN terminal 100, the base station 510, and the authentication server 340 are involved in this sequence.

As shown in FIG. 15, first, in step S502, the WWAN terminal 200 establishes a connection with the base station 510. For example, the WWAN terminal 200 may establish a connection by the method described above in the second embodiment, or may establish a connection by any other method.

Next, in step S504, the WLAN terminal 100 and the WWAN terminal 200 establish pairing. After the pairing is established, the WLAN terminal 100 may transmit device information of the WLAN terminal 100, capability information, or information indicating the purpose of wireless communication with the WLAN 500 to the WWAN terminal 200.

Next, in step S506, the WWAN terminal 200 transmits a message requesting generation of authentication information to the authentication server 340 via the base station 510.

Next, in step S508, the authentication server 340 generates authentication information. For example, when EAP-TLS is included in the authentication method used by the WWAN terminal 200, the authentication server 340 issues an electronic certificate. For example, when EAP-TTLS is included in the authentication method used by the WWAN terminal 200, the authentication server 340 issues an ID and a password. Here, the authentication server 340 may issue an electronic certificate or an ID and password that can identify the WLAN terminal 100 using the device information of the WLAN terminal 100 or the like. For example, when the authentication method used by the WWAN terminal 200 includes EAP-SIM, EAP-AKA, or EAP-AKA ', the authentication server 340 may omit issuing an electronic certificate or ID and password. Further, the authentication server 340 may select the WLAN 500 to which the WLAN terminal 100 should be connected based on at least one of the channel information or RSSI information of the WWAN terminal 200. The authentication server 340 generates information indicating these issuance and selected contents as authentication information.

Next, in step S510, the authentication server 340 transmits the generated authentication information to the WWAN terminal 200 via the base station 510.

Next, in step S512, the WWAN terminal 200 transmits the authentication information received from the authentication server 340 to the WLAN terminal 100.

In step S514, the WLAN terminal 100 performs authentication processing with the base station 510 using the authentication information received from the WWAN terminal 200. The processing here is as described above with reference to FIG. 7 or FIG.

Thereby, a connection is established between the WLAN terminal 100 and the base station 510 in step S516.

The third embodiment has been described above.

<< 5. Fourth Embodiment >>
<5.1. Overview>
In the present embodiment, authentication information using device information is generated in the authentication server 340. In the present embodiment, authentication information is acquired in stages. Each device included in the wireless communication system 1 according to the present embodiment has the same function as that of the first embodiment. Hereinafter, assuming the wireless communication system 1 shown in FIG. 2 as an example, functions characteristic of the present embodiment will be described.

For example, the control unit 130 of the WLAN terminal 100 performs authentication to the WLAN 500 using the authentication information generated by the authentication server 340 using the device information of at least one of the WLAN terminal 100 or the WWAN terminal 200. The device information includes, for example, the MAC address and BD address of the WLAN terminal 100, the MSISDN (Mobile Subscriber Integrated Services Digital Network Number) of the WWAN terminal 200, and the like. The authentication server 340 can generate authentication information for a specific terminal based on the device information.

For example, the control unit 130 of the WLAN terminal 100 authenticates to the WLAN 500 using another part of the authentication information acquired using the communication path formed after the authentication using a part of the authentication information. The WLAN terminal 100 can increase the confidentiality of another part of the authentication information by using a communication path formed after authentication using a part of the authentication information. It is desirable that a part of the authentication information is information with a small amount of data such as a one-time password. This is to reduce the amount of data transmitted from the WWAN terminal 200 to the WLAN terminal 100 by Bluetooth or NFC.

The outline of the wireless communication system 1 according to the present embodiment has been described above. Then, with reference to FIG. 16, the operation process by the radio | wireless communications system 1 which concerns on this embodiment is demonstrated.

<5.2. Example of operation processing>
FIG. 16 is a sequence diagram illustrating an example of the flow of connection processing executed in the wireless communication system 1 according to the present embodiment. As shown in FIG. 16, the base station 310, the WWAN terminal 200, the WLAN terminal 100, the base station 510, and the authentication server 340 are involved in this sequence. In this sequence, the “authentication process” in each of the above embodiments is expressed in more detail by dividing it into a “connection authentication process” and a “service authentication process”.

As shown in FIG. 16, first, in step S602, the WLAN terminal 100 and the WWAN terminal 200 establish pairing. After the pairing is established, the WLAN terminal 100 may transmit the device information of the WLAN terminal 100 to the WWAN terminal 200.

Next, in step S604, the WWAN terminal 200 transmits an authentication information request message for requesting authentication information to the authentication server 340. For example, the WWAN terminal 200 authenticates with the authentication server 340 using EAP-AKA or the like, establishes an IP connection with the base station 510, and transmits an authentication information request message to the authentication server 340. This authentication information request message may include at least one of the MAC address of the WLAN terminal 100, the BD address, or the MSISDN of the WWAN terminal 200. Further, the authentication information request message may include network information. The authentication information request message may be transmitted to the authentication server 340 via the base station 510, or may be transmitted to the authentication server 340 via the base station 310.

Next, in step S606, the authentication server 340 generates authentication information using the device information received in step S604. For example, the authentication server 340 may generate an IMPI (IP Multimedia Private Identity), an IMPU (IP Multimedia Public Identity), and a password as authentication information for an IMS (IP Multimedia Subsystem) service. In addition, the authentication server 340 generates a terminal identifier, a certificate, a one-time password used to access the authentication server 340, and the like as authentication information for connection authentication with an ePDG (Evolved Packet Data Gateway). May be. The authentication server 340 may generate a certificate for encryption such as IPsec (Security Architecture for Internet Protocol) in addition to a certificate for EAP authentication such as EAP-TLS as a certificate. However, the certificate for encryption such as IPsec may be originally included in the wireless terminal (WLAN terminal 100 or WWAN terminal 200). The ePDG is a gateway to which a wireless terminal connects when a non-3GPP wireless access (Untrusted Non-3GPP IP Access) with low security such as a public WLAN is accommodated.

Next, in step S608, the authentication server 340 transmits authentication information to the WWAN terminal 200. The authentication information transmitted at this time is a part of the authentication information generated in step S606. For example, the authentication server 340 transmits a one-time password and a certificate. The authentication information may be transmitted to the WWAN terminal 200 via the base station 510, or may be transmitted to the WWAN terminal 200 via the base station 310.

Next, in step S610, the WWAN terminal 200 transmits the authentication information received from the authentication server 340 in the above step S608 to the WLAN terminal 100.

Next, in step S612, the WLAN terminal 100 transmits an additional authentication information request message for requesting additional authentication information to the authentication server 340 using the authentication information received from the WWAN terminal 200 in step S610. For example, the WLAN terminal 100 connects to the authentication server 340 using a one-time password. Thereafter, the WLAN terminal 100 establishes a secure communication path such as a certificate-based TLS with the authentication server 340. Then, the WLAN terminal 100 requests the authentication server 340 to transmit additional authentication information using the established communication path.

Next, in step S614, the authentication server 340 transmits additional authentication information to the WLAN terminal 100. The authentication information transmitted at this time is information that has not been transmitted in step S608 among the authentication information generated in step S606. For example, the authentication server 340 transmits authentication information for the IMS service and authentication information for connection authentication with the ePDG or the like to the WLAN terminal 100 as additional authentication information.

Next, in step S616, the WLAN terminal 100 performs connection authentication processing using the additional authentication information received from the authentication server 340 in step S614. For example, the WLAN terminal 100 performs authentication processing with the authentication server 340 using a terminal identifier and a certificate included in the additional authentication information received from the authentication server 340, and establishes a communication path using TLS or the like. To do. Further, the WLAN terminal 100 may establish a secure communication path using IPsec or the like. Further, the WLAN terminal 100 may employ an authentication protocol such as EAP-AKA, EAP-SIM, or EAP-AKA ′ using the subscriber identification information of the WWAN terminal 200 at the time of authentication. Further, when IPsec is used, the WLAN terminal 100 may use IKEv2 (Internet Key Exchange) as a key management method.

Next, in step S618, the WLAN terminal 100 performs service authentication processing using the additional authentication information received from the authentication server 340 in step S614. For example, the WLAN terminal 100 performs authentication processing such as IMS-AKA using authentication information for the IMS service, and establishes an IMS session. The WLAN terminal 100 may use information such as IMPI or IMPU for authentication, and may establish a secure communication path using IPsec or the like as in step S616. Note that the WLAN terminal 100 may perform IMS authentication processing using the subscriber identification information of the WWAN terminal 200. Note that the authentication processing in steps S616 and S618 may be performed by a device other than the authentication server 340.

Thereby, the service for the WLAN terminal 100 is started in step S620. Examples of services include IMS services such as Voice over Wi-Fi and Video over Wi-Fi.

<5.3. Relationship between authentication method and public WLAN>
Table 1 below shows the relationship between each EAP authentication method and the public WLAN access point in the Wi-Fi CERTIFIED Passpoint. Hereinafter, the Wi-Fi CERTIFIED Passpoint is also simply referred to as Passpoint, and the public WLAN access point is also simply referred to as AP.

“OSU AP” in Table 1 indicates Online Sign up AP. In L2 Auth (Layer 2 Authentication), authentication between a wireless terminal and a public WLAN is performed by Open Authentication or Anonymous EAP-TLS. In TLS Session, a TLS Session for using HTTPS is constructed by using a Passpoint Root Certificate held by a wireless terminal in advance. In Registration, the wireless terminal registers the user's contact information, fee plan, billing information, and the like. In the provisioning, the user name, password, or certificate information of the production AP used for using the public WLAN service is exchanged.

OSU AP is an AP specialized for sign-up. After completing the registration and provisioning, the wireless terminal temporarily disconnects and reconnects to the production AP. The authentication information used when the wireless terminal reconnects is information received in provisioning. When the ePDG is used as a gateway, the wireless terminal establishes an IPsec session between the wireless terminal and the ePDG based on information received in provisioning, certificate information that the wireless terminal has in advance, and the like. . When this session is established, the wireless terminal uses IKEv2 key management. Furthermore, when using multimedia services such as Voice over Wi-Fi and Video over Wi-Fi, the wireless terminal performs IMS-AKA authentication and starts using IMS.

As explained above, the use of EAP-TLS / TTLS is assumed in OSU (Online Sign up) in Passpoint, and authentication protocols such as EAP-AKA using subscriber identification information are out of scope. . However, in the OSU, the technique described above with reference to FIG. 16 can be applied.

For example, the processing in steps S602 to S614 in FIG. 16 may be performed in the provisioning from the L2 Auth in the OSU AP. Further, the processing in steps S616 to S620 in FIG. 16 may be performed in the IMS from the L2 Auth of the Production AP. In addition to EAP-AKA shown in Table 1, EAK-AKA ′ or the like may be employed.

The fourth embodiment has been described above. In addition, this embodiment and each embodiment mentioned above can be combined suitably.

<< 6. Fifth embodiment >>
<6.1. Overview>
In the present embodiment, terminal authentication using a one-time password is performed after a communication path between the WLAN terminal 100 and the authentication server 340 is formed. In the present embodiment, authentication information is acquired in stages. Each device included in the wireless communication system 1 according to the present embodiment has the same function as that of the first embodiment. Hereinafter, assuming the wireless communication system 1 shown in FIG. 2 as an example, functions characteristic of the present embodiment will be described.

For example, the control unit 130 of the WLAN terminal 100 transmits a part of the authentication information to the authentication server 340 using a communication path (IP communication path) formed by authentication using the WWAN terminal 200. Since a part of the authentication information is transmitted using the already formed secure communication path, it is possible to improve the confidentiality of the authentication information. It is desirable that a part of the authentication information is information with a small amount of data such as a one-time password. This is to reduce the amount of data when the WLAN terminal 100 receives a part of the authentication information from the WWAN terminal 200 via Bluetooth or NFC. It is desirable that the one-time password has an expiration date. The expiration date can be provided in various units such as 30 minutes, 1 hour, and the like. Thereby, attacks such as replay attack and spoofing can be prevented. Examples of authentication methods using the WWAN terminal 200 include EAP-SIM, EAP-AKA, and EAP-AKA ′. In addition, the control unit 130 may form a communication path by an authentication method using a certificate such as EAP-TLS or EAP-TTLS.

And the control part 130 authenticates to WLAN500 using the other part of the authentication information received from the authentication server 340 through the authentication using the part of the authentication information by the authentication server 340. The other part of the authentication information may be information for authentication to services such as Voice over Wi-Fi and Video over Wi-Fi. Hereinafter, such information for authentication to the service is also referred to as service authentication information.

The outline of the wireless communication system 1 according to the present embodiment has been described above. Next, with reference to FIG. 17, an operation process performed by the wireless communication system 1 according to the present embodiment will be described.

<6.2. Example of operation processing>
FIG. 17 is a sequence diagram showing an example of the flow of connection processing executed in the wireless communication system 1 according to the present embodiment. As shown in FIG. 17, the base station 310, the WWAN terminal 200, the WLAN terminal 100, the base station 510, and the authentication server 340 are involved in this sequence. In this sequence, the “service authentication process (step S618)” in the fourth embodiment is replaced with “terminal authentication / terminal registration (step S716)” “transmission of service authentication information (step S718)” and “service authentication process”. (Step S720) ”is expressed in more detail.

As shown in FIG. 17, first, in step S702, the WLAN terminal 100 and the WWAN terminal 200 establish pairing.

Next, in step S704, the WWAN terminal 200 transmits an authentication information request message for requesting authentication information (that is, a one-time password) to the authentication server 340. For example, after the WWAN terminal 200 authenticates with the authentication server 340 by EAP-AKA using its own subscriber identification information, the WWAN terminal 200 establishes an IP connection with the base station 510 and the WWAN terminal 200 has Log in to the authentication server 340 using the current user account. Thereafter, the WWAN terminal 200 requests the authentication server 340 for a one-time password for the WLAN terminal 100. The authentication information request message may be transmitted to the authentication server 340 via the base station 510, or may be transmitted to the authentication server 340 via the base station 310. However, when passing through the base station 310, the WWAN terminal 200 can connect to the authentication server 340 by performing predetermined authentication required for 3G / LTE wireless access instead of EAP-AKA or the like.

Next, in step S706, the authentication server 340 generates a one-time password as the authentication information requested in step S704. The authentication server 340 may generate service authentication information such as an ID necessary for the service in addition to the one-time password. For example, the authentication server 340 may generate an IMPI (IP Multimedia Private Identity), an IMPU (IP Multimedia Public Identity), and a password as service authentication information for an IMS (IP Multimedia Subsystem) service.

Next, in step S708, the authentication server 340 transmits authentication information to the WWAN terminal 200. The authentication information transmitted at this time may be a part of the authentication information generated in step S706. For example, the authentication server 340 transmits a one-time password. The authentication information may be transmitted to the WWAN terminal 200 via the base station 510, or may be transmitted to the WWAN terminal 200 via the base station 310. However, when passing through the base station 310, the authentication server 340 may use, for example, SMS (Short Message Service).

Next, in step S710, the WWAN terminal 200 transmits the authentication information received from the authentication server 340 in the above step S708 to the WLAN terminal 100. For example, the WWAN terminal 200 transmits a one-time password using an information code such as WLAN, Bluetooth, NFC, or a barcode.

Next, in step S712, the WLAN terminal 100 performs a connection authentication process. For example, the WLAN terminal 100 performs connection authentication processing by EAP-SIM, EAP-AKA, EAP-AKA ′, or the like using the subscriber identification information of the WWAN terminal 200 to establish an IP connection. The processing here is as described above with reference to FIGS. In addition, the WLAN terminal 100 may perform connection authentication processing by an authentication method using a certificate such as EAP-TLS or EAP-TTLS to establish an IP connection.

Next, in step S714, the WLAN terminal 100 transmits authentication information to the authentication server 340. For example, the WLAN terminal 100 transmits the one-time password received in step S710. This procedure may be performed automatically by the WLAN terminal 100, or may be performed manually by the user on the Web page of the authentication server 340 or the like.

Next, in step S716, the authentication server 340 performs terminal authentication and terminal registration. For example, the authentication server 340 authenticates whether the one-time password received from the WLAN terminal 100 in step S714 is correct. Then, the authentication server 340 performs terminal registration when the one-time password is correct. For example, the authentication server 340 generates service authentication information. If service authentication information has already been generated in step S706, the generation is omitted. The authentication server 340 may associate information such as the MAC address of the WLAN terminal 100 obtained from the base station 510 or the like with registration information (for example, service authentication information).

Next, in step S718, the authentication server 340 transmits service authentication information to the WLAN terminal 100.

Next, in step S720, the WLAN terminal 100 performs service authentication processing using the service authentication information received from the authentication server 340 in step S718. For example, regarding the IMS service, the WLAN terminal 100 establishes a service session using information such as IMPI and IPMU, and establishes a secure communication path using IPsec when necessary. In addition, the WLAN terminal 100 may perform authentication such as IMS-AKA using the subscriber identification information of the WWAN terminal 200.

Thereby, the service for the WLAN terminal 100 is started in step S722. Examples of services include IMS services such as Voice over Wi-Fi and Video over Wi-Fi.

The fifth embodiment has been described above. In addition, this embodiment and each embodiment mentioned above can be combined suitably.

<< 7. Sixth Embodiment >>
<7.1. Overview>
In the present embodiment, the WLAN terminal 100 selects an appropriate authentication method according to the situation. Each device included in the wireless communication system 1 according to the present embodiment has the same function as that of the first embodiment. Hereinafter, assuming the wireless communication system 1 shown in FIG. 2 as an example, functions characteristic of the present embodiment will be described.

(1) WLAN terminal 100
For example, the control unit 130 of the WLAN terminal 100 selects an authentication method for the WLAN 500 based on whether or not the wireless communication unit 110 (first wireless communication unit) can communicate with a wireless terminal having subscriber identification information. . Specifically, when the WLAN terminal 100 can communicate with a wireless terminal having subscriber identification information (for example, the WWAN terminal 200), the control unit 130 uses EAP-SIM, EAP-AKA, or EAP as an authentication method. -Select an authentication protocol using subscriber identification information such as AKA '. On the other hand, when the WLAN terminal 100 cannot communicate with a wireless terminal having subscriber identification information, the control unit 130 uses an authentication protocol that does not use subscriber identification information such as EAP-TLS or EAP-TTLS as an authentication method. select. By selecting such an authentication method, the WLAN terminal 100 can select an appropriate authentication method according to the situation. Whether or not communication with a wireless terminal having subscriber identification information is possible refers to a wireless having subscriber identification information at a distance that can be communicated from the WLAN terminal 100 using a short-range wireless communication method such as NFC or Bluetooth. It can also be understood as whether or not a terminal exists. Hereinafter, a wireless terminal having subscriber identification information is also simply referred to as a SIM terminal.

For example, the storage unit 120 of the WLAN terminal 100 may store authentication information, and the control unit 130 may authenticate to the WLAN 500 using the authentication information stored in the storage unit 120. For example, the WLAN terminal 100 stores the authentication information used when authenticating to the WLAN 500 in the past in the storage unit 120. Then, the control unit 130 performs authentication by using the stored authentication information again. As a result, the authentication information generation process and the notification process to the WLAN terminal 100 in the authentication server 340 are omitted, so that the authentication process becomes simpler and faster.

(2) WWAN terminal 200
For example, the storage unit 220 of the WWAN terminal 200 may store authentication information, and the control unit 240 transmits the authentication information stored in the storage unit 220 via the wireless communication unit 210 (fourth wireless communication unit). You may transmit to the WLAN terminal 100. For example, the WWAN terminal 200 receives from the authentication server 340 in the past and receives the authentication information used when the authentication to the WLAN 500 in the past or authentication by the WLAN terminal 100 to the W500 terminal. The authentication information transmitted to 200 is stored in the storage unit 220. Then, when the WLAN terminal 100 authenticates to the WLAN 500 again, the WWAN terminal 200 transmits the authentication information stored in the storage unit 220. As a result, the authentication information generation process in the authentication server 340 and the authentication information acquisition process from the authentication server 340 are omitted, so that the authentication process becomes simpler and faster.

The outline of the wireless communication system 1 according to the present embodiment has been described above. Subsequently, an operation process performed by the wireless communication system 1 according to the present embodiment will be described with reference to FIGS.

<7.2. Example of operation processing>
FIG. 18 is a sequence diagram illustrating an example of a flow of connection processing executed in the wireless communication system 1 according to the present embodiment. As shown in FIG. 18, the base station 310, the WWAN terminal 200, the WLAN terminal 100, the base station 510, and the authentication server 340 are involved in this sequence. In this sequence, a basic processing flow will be described. Detailed conditional branching will be described later in detail with reference to FIGS. 19 and 20.

As shown in FIG. 18, first, in step S802, the WLAN terminal 100 and the WWAN terminal 200 establish pairing.

Next, in step S804, the WLAN terminal 100 acquires network information from the base station 510. For example, the WLAN terminal 100 acquires network information by receiving a beacon signal, performing a probe process, or inquiring ANQP information. The acquired network information includes, for example, information indicating the SSID of the base station 510 and the authentication method supported by the base station 510.

Next, in step S806, the WLAN terminal 100 confirms network information. Specifically, the WLAN terminal 100 confirms whether authentication information for authenticating to the base station 510 is stored in the storage unit 120 based on the network information acquired in step S804. Here, the authentication information for authenticating to the base station 510 includes a certificate for EAP-TLS or EAP-TTLS, or an ID and a password. Of course, the authentication information is not limited to these.

If it is determined that it is not stored, the WLAN terminal 100 inquires of the WWAN terminal 200 about authentication information in step S808. If it is determined that the information is stored, the WLAN terminal 100 performs a connection authentication process (step S820) using the stored authentication information.

The WWAN terminal 200 that has received the inquiry confirms the authentication information in step S810. Specifically, the WWAN terminal 200 confirms whether authentication information for the WLAN terminal 100 to authenticate to the base station 510 is stored in the storage unit 220.

If it is determined that it is not stored, in step S812, the WWAN terminal 200 transmits an authentication information request message for requesting authentication information (for example, certificate or ID and password) to the authentication server 340. Since the communication path between the WWAN terminal 200 and the authentication server 340 is the same as that described for step S704, a detailed description thereof will be omitted here. If it is determined that it is stored, the WWAN terminal 200 returns the stored authentication information to the WLAN terminal 100 (step S818), and the WLAN terminal 100 uses the returned authentication information to perform connection authentication processing ( Step S820) is performed.

Next, in step S814, the authentication server 340 generates authentication information. For example, the authentication server 340 generates a certificate or ID and password.

Next, authentication information is transmitted to the WWAN terminal 200 in step S816. Since the communication path between the WWAN terminal 200 and the authentication server 340 is the same as that described with respect to step S708, detailed description thereof is omitted here.

Next, in step S818, the authentication server 340 causes the WWAN terminal 200 to transmit the authentication information received from the authentication server 340 in step S816 to the WLAN terminal 100. For example, the WWAN terminal 200 transmits authentication information using an information code such as WLAN, Bluetooth, NFC, or barcode.

Next, in step S820, the WLAN terminal 100 performs connection authentication processing. For example, the WLAN terminal 100 performs connection authentication processing by EAP-SIM, EAP-AKA, EAP-AKA ′, or the like using the subscriber identification information of the WWAN terminal 200 to establish an IP connection. The processing here is as described above with reference to FIGS. In addition, the WLAN terminal 100 may perform connection authentication processing by EAP-TLS using the electronic certificate received in step S818 or EAP-TTLS using an ID and a password to establish an IP connection. .

The basic process flow has been described above. Next, detailed conditional branching will be described with reference to FIGS. 19 and 20.

FIG. 19 is a flowchart illustrating an example of a flow of connection processing executed in the WLAN terminal 100 or the WWAN terminal 200 according to the present embodiment.

As shown in FIG. 19, first, in step S902, the WLAN terminal 100 acquires network information. This step corresponds to step S804 in FIG.

Next, in step S904, the WLAN terminal 100 determines whether or not the connection destination base station 510 supports SIM authentication. SIM authentication means an authentication method using subscriber identification information, and corresponds to, for example, EAP-AKA. For example, the WLAN terminal 100 makes a determination based on the network information acquired in step S902. In this step, the WLAN terminal 100 may determine whether or not the connection destination SSID indicates a desired network.

If it is determined that SIM authentication is supported (step S904 / YES), in step S906, the WLAN terminal 100 performs an authentication process using EAP-AKA. The processing here is as described above with reference to FIGS. When the SIM of the WWAN terminal 200 is a GSM SIM, EAP-SIM may be selected as the authentication method, and in the case of USIM, EAP-AKA ′ with enhanced security may be selected as the authentication method. When this step is executed, the processing related to steps S806 to S818 shown in FIG. 18 is omitted. Thereby, the process ends.

On the other hand, if it is determined that SIM authentication is not supported (step S904 / NO), in step S908, the WLAN terminal 100 determines that the connected base station 510 supports EAP-TLS or EAP-TTLS authentication. It is determined whether or not. In this step, the WLAN terminal 100 may determine whether or not the connection destination SSID indicates a desired network.

If it is determined that EAP-TLS or EAP-TTLS authentication is not supported (step S908 / NO), the process ends.

On the other hand, if it is determined that EAP-TLS or EAP-TTLS authentication is supported (YES in step S908), the WLAN terminal 100 stores authentication information for authenticating to the base station 510 in step S910. Whether it is stored in 120 or not is confirmed. In this step, the WLAN terminal 100 may determine whether or not the connection destination SSID indicates a desired network. This step corresponds to step S806 in FIG.

If it is determined that it is stored (S910 / YES), in step S912, the WLAN terminal 100 uses the stored authentication information (for example, an electronic certificate or an ID and password) to perform EAP-TLS or EAP. -Perform authentication using TLS. This step corresponds to step S820 in FIG. In this case, the processing related to steps S808 to S818 shown in FIG. 18 is omitted.

On the other hand, if it is determined that it is not stored (S910 / NO), the WLAN terminal 100 inquires of the WWAN terminal 200 for authentication information in step S914. This step corresponds to step S808 in FIG.

Next, in step S916, the WWAN terminal 200 determines whether authentication information (for example, an electronic certificate or an ID and a password) for the WLAN terminal 100 to authenticate to the base station 510 is stored in the storage unit 220. judge. This step corresponds to step S810 in FIG.

If it is determined that it is stored (S916 / YES), the WWAN terminal 200 transmits the stored authentication information to the WLAN terminal 100 in step S918. This step corresponds to step S818 in FIG. In this case, the processing related to steps S812 to S816 shown in FIG. 18 is omitted.

On the other hand, if it is determined that it is not stored (S916 / NO), the WWAN terminal 200 acquires authentication information from the authentication server 340 in step S920. This step corresponds to steps S812 to S816 in FIG. In step S918, the WWAN terminal 200 transmits the acquired authentication information to the WLAN terminal 100. This step corresponds to step S818 in FIG.

In step S912, the WLAN terminal 100 performs authentication processing using EAP-TLS or EAP-TTLS using authentication information (for example, an electronic certificate or ID and password) received from the WWAN terminal 200. This step corresponds to step S820 in FIG. Thereby, the process ends.

FIG. 20 is a flowchart showing an example of the flow of connection processing executed in the WLAN terminal 100 or the WWAN terminal 200 according to this embodiment.

First, in step S1002, the WLAN terminal 100 determines whether there is a SIM terminal in the vicinity. For example, the WLAN terminal 100 determines whether there is a wireless terminal having subscriber identification information within a communicable distance using a short-range wireless communication method such as NFC or Bluetooth. More specifically, the WLAN terminal 100 determines whether or not the paired WWAN terminal 200 can be found by NFC or Bluetooth.

If it is determined that there is a SIM terminal in the vicinity (S1002 / YES), in step S1010, the WLAN terminal 100 and the WWAN terminal 200 use an authentication method (that is, an authentication method using subscriber identification information or not) corresponding to the network. An authentication process using the authentication method is performed, and the process ends. The processing here is as described above with reference to FIG.

When it is determined that there is no SIM terminal in the vicinity (S1002 / NO), in step S1004, the WLAN terminal 100 acquires network information. This step corresponds to step S804 in FIG. 18 and S902 in FIG.

Next, in step S1006, the WLAN terminal 100 determines whether there is authentication information in the WLAN terminal 100. This step corresponds to step S806 in FIG. 18 and S910 in FIG.

If it is determined that it is stored (step S1006 / YES), in step S1008, the WLAN terminal 100 performs authentication processing using EAP-TLS or EAP-TTLS using the stored authentication information, and processing Ends. This step corresponds to step S820 in FIG. 18 and S912 in FIG.

On the other hand, if it is determined that it is not stored (step S1006 / NO), the process ends. This is because the SIM terminal is not present in the surroundings, and even if it exists, it is a wireless terminal that does not have subscriber identification information. Therefore, the wireless terminal is not expected to acquire authentication information from the authentication server 340.

The sixth embodiment has been described above. In addition, this embodiment and each embodiment mentioned above can be combined suitably.

<< 8. Application example >>
The technology according to the present disclosure can be applied to various products. For example, the wireless communication device 100 and the wireless communication device 200 include a smartphone, a tablet PC (Personal Computer), a notebook PC, a mobile terminal such as a portable game terminal or a digital camera, a television receiver, a printer, a digital scanner, a network storage, or the like. It may be realized as an in-vehicle terminal such as a fixed terminal or a car navigation device. The wireless communication device 100 and the wireless communication device 200 are terminals (MTC (Machine Type Communication) such as smart meters, vending machines, remote monitoring devices, or point-of-sale (POS) terminals that perform M2M (Machine To Machine) communication. ) (Also referred to as a terminal). Further, the wireless communication device 100 and the wireless communication device 200 may be wireless communication modules (for example, integrated circuit modules configured by one die) mounted on these terminals.

<8.1. First application example>
FIG. 21 is a block diagram illustrating an example of a schematic configuration of a smartphone 900 to which the technology according to the present disclosure can be applied. The smartphone 900 includes a processor 901, a memory 902, a storage 903, an external connection interface 904, a camera 906, a sensor 907, a microphone 908, an input device 909, a display device 910, a speaker 911, a wireless communication interface 913, an antenna switch 914, an antenna 915, A bus 917, a battery 918, and an auxiliary controller 919 are provided.

The processor 901 may be, for example, a CPU (Central Processing Unit) or a SoC (System on Chip), and controls the functions of the application layer and other layers of the smartphone 900. The memory 902 includes a RAM (Random Access Memory) and a ROM (Read Only Memory), and stores programs and data executed by the processor 901. The storage 903 can include a storage medium such as a semiconductor memory or a hard disk. The external connection interface 904 is an interface for connecting an external device such as a memory card or a USB (Universal Serial Bus) device to the smartphone 900.

The camera 906 includes, for example, an image sensor such as a CCD (Charge Coupled Device) or a CMOS (Complementary Metal Oxide Semiconductor), and generates a captured image. The sensor 907 may include a sensor group such as a positioning sensor, a gyro sensor, a geomagnetic sensor, and an acceleration sensor. The microphone 908 converts sound input to the smartphone 900 into an audio signal. The input device 909 includes, for example, a touch sensor that detects a touch on the screen of the display device 910, a keypad, a keyboard, a button, or a switch, and receives an operation or information input from a user. The display device 910 has a screen such as a liquid crystal display (LCD) or an organic light emitting diode (OLED) display, and displays an output image of the smartphone 900. The speaker 911 converts an audio signal output from the smartphone 900 into audio.

The wireless communication interface 913 supports one or more wireless LAN standards such as IEEE802.11a, 11b, 11g, 11n, 11ac, and 11ad, and performs wireless communication. The wireless communication interface 913 can communicate with other devices via a wireless LAN access point in the infrastructure mode. In addition, the wireless communication interface 913 can directly communicate with other devices in an ad hoc mode or a direct communication mode such as Wi-Fi Direct (registered trademark). In Wi-Fi Direct, unlike the ad hoc mode, one of two terminals operates as an access point, but communication is performed directly between the terminals. The wireless communication interface 913 can typically include a baseband processor, an RF (Radio Frequency) circuit, a power amplifier, and the like. The wireless communication interface 913 may be a one-chip module in which a memory that stores a communication control program, a processor that executes the program, and related circuits are integrated. The wireless communication interface 913 may support other types of wireless communication methods such as a short-range wireless communication method, a proximity wireless communication method, or a cellular communication method in addition to the wireless LAN method. The antenna switch 914 switches the connection destination of the antenna 915 among a plurality of circuits (for example, circuits for different wireless communication schemes) included in the wireless communication interface 913. The antenna 915 includes a single antenna element or a plurality of antenna elements (for example, a plurality of antenna elements constituting a MIMO antenna), and is used for transmission and reception of radio signals by the radio communication interface 913.

Note that the smartphone 900 is not limited to the example in FIG. 21 and may include a plurality of antennas (for example, an antenna for a wireless LAN and an antenna for a proximity wireless communication method). In that case, the antenna switch 914 may be omitted from the configuration of the smartphone 900.

The bus 917 connects the processor 901, memory 902, storage 903, external connection interface 904, camera 906, sensor 907, microphone 908, input device 909, display device 910, speaker 911, wireless communication interface 913, and auxiliary controller 919 to each other. . The battery 918 supplies electric power to each block of the smartphone 900 shown in FIG. 21 through a power supply line partially shown by a broken line in the drawing. For example, the auxiliary controller 919 operates the minimum necessary functions of the smartphone 900 in the sleep mode.

In the smartphone 900 illustrated in FIG. 21, one or more components (for example, at least one of the storage unit 120 and the control unit 130) included in the WLAN terminal 100 described with reference to FIG. 4 are implemented in the wireless communication interface 913. May be. In addition, at least some of these components may be implemented in the processor 901 or the auxiliary controller 919. As an example, the smartphone 900 may include a module including the wireless communication interface 913, the processor 901, and / or the auxiliary controller 919, and the one or more components may be mounted on the module. In this case, the module stores a program for causing the processor to function as the one or more components (in other words, a program for causing the processor to execute the operation of the one or more components), and stores the program. May be executed. As another example, a program for causing a processor to function as one or more components may be installed in the smartphone 900, and the wireless communication interface 913, the processor 901, and / or the auxiliary controller 919 may execute the program. As described above, the smartphone 900 or the module may be provided as a device including the one or more components, and a program for causing a processor to function as the one or more components may be provided. In addition, a readable recording medium in which the program is recorded may be provided.

In the smartphone 900 illustrated in FIG. 21, one or more components (for example, at least one of the storage unit 220, the subscriber identification module 230, or the control unit 240) included in the WWAN terminal 200 described with reference to FIG. The wireless communication interface 913 may be implemented. In addition, at least some of these components may be implemented in the processor 901 or the auxiliary controller 919. As an example, the smartphone 900 may include a module including the wireless communication interface 913, the processor 901, and / or the auxiliary controller 919, and the one or more components may be mounted on the module. In this case, the module stores a program for causing the processor to function as the one or more components (in other words, a program for causing the processor to execute the operation of the one or more components), and stores the program. May be executed. As another example, a program for causing a processor to function as one or more components may be installed in the smartphone 900, and the wireless communication interface 913, the processor 901, and / or the auxiliary controller 919 may execute the program. As described above, the smartphone 900 or the module may be provided as a device including the one or more components, and a program for causing a processor to function as the one or more components may be provided. In addition, a readable recording medium in which the program is recorded may be provided.

Note that the smartphone 900 may operate as a wireless access point (software AP) when the processor 901 executes the access point function at the application level. Further, the wireless communication interface 913 may have a wireless access point function.

<8.2. Second application example>
FIG. 22 is a block diagram illustrating an example of a schematic configuration of a car navigation device 920 to which the technology according to the present disclosure can be applied. The car navigation device 920 includes a processor 921, a memory 922, a GPS (Global Positioning System) module 924, a sensor 925, a data interface 926, a content player 927, a storage medium interface 928, an input device 929, a display device 930, a speaker 931, and wireless communication. An interface 933, an antenna switch 934, an antenna 935, and a battery 938 are provided.

The processor 921 may be a CPU or SoC, for example, and controls the navigation function and other functions of the car navigation device 920. The memory 922 includes RAM and ROM, and stores programs and data executed by the processor 921.

The GPS module 924 measures the position (for example, latitude, longitude, and altitude) of the car navigation device 920 using GPS signals received from GPS satellites. The sensor 925 may include a sensor group such as a gyro sensor, a geomagnetic sensor, and an atmospheric pressure sensor. The data interface 926 is connected to the in-vehicle network 941 through a terminal (not shown), for example, and acquires data generated on the vehicle side such as vehicle speed data.

The content player 927 reproduces content stored in a storage medium (for example, CD or DVD) inserted into the storage medium interface 928. The input device 929 includes, for example, a touch sensor, a button, or a switch that detects a touch on the screen of the display device 930, and receives an operation or information input from the user. The display device 930 has a screen such as an LCD or an OLED display, and displays a navigation function or an image of content to be reproduced. The speaker 931 outputs the navigation function or the audio of the content to be played back.

The wireless communication interface 933 supports one or more wireless LAN standards such as IEEE802.11a, 11b, 11g, 11n, 11ac, and 11ad, and executes wireless communication. The wireless communication interface 933 can communicate with other devices via a wireless LAN access point in the infrastructure mode. In addition, the wireless communication interface 933 can directly communicate with other devices in an ad hoc mode or a direct communication mode such as Wi-Fi Direct. The wireless communication interface 933 may typically include a baseband processor, an RF circuit, a power amplifier, and the like. The wireless communication interface 933 may be a one-chip module in which a memory that stores a communication control program, a processor that executes the program, and related circuits are integrated. In addition to the wireless LAN system, the wireless communication interface 933 may support other types of wireless communication systems such as a short-range wireless communication system, a proximity wireless communication system, or a cellular communication system. The antenna switch 934 switches the connection destination of the antenna 935 among a plurality of circuits included in the wireless communication interface 933. The antenna 935 includes a single antenna element or a plurality of antenna elements, and is used for transmission and reception of a radio signal by the radio communication interface 933.

Note that the car navigation device 920 may include a plurality of antennas without being limited to the example of FIG. In that case, the antenna switch 934 may be omitted from the configuration of the car navigation device 920.

The battery 938 supplies power to each block of the car navigation device 920 shown in FIG. 22 through a power supply line partially shown by a broken line in the drawing. Further, the battery 938 stores electric power supplied from the vehicle side.

In the car navigation device 920 shown in FIG. 22, one or more components (for example, at least one of the storage unit 120 and the control unit 130) included in the WLAN terminal 100 described with reference to FIG. May be implemented. Further, at least a part of these functions may be implemented in the processor 921. As an example, the car navigation device 920 may include a module including the wireless communication interface 933 and / or the processor 921, and the one or more components may be mounted on the module. In this case, the module stores a program for causing the processor to function as the one or more components (in other words, a program for causing the processor to execute the operation of the one or more components), and stores the program. May be executed. As another example, a program for causing a processor to function as one or more components may be installed in the car navigation device 920, and the wireless communication interface 933 and / or the processor 921 may execute the program. As described above, the car navigation apparatus 920 or the module may be provided as an apparatus including the one or more components, and a program for causing a processor to function as the one or more components may be provided. In addition, a readable recording medium in which the program is recorded may be provided.

In the car navigation device 920 shown in FIG. 22, one or more components included in the WWAN terminal 200 described with reference to FIG. 5 (for example, at least one of the storage unit 220, the subscriber identification module 230, or the control unit 240). May be implemented in the wireless communication interface 933. Further, at least a part of these functions may be implemented in the processor 921. As an example, the car navigation device 920 may include a module including the wireless communication interface 933 and / or the processor 921, and the one or more components may be mounted on the module. In this case, the module stores a program for causing the processor to function as the one or more components (in other words, a program for causing the processor to execute the operation of the one or more components), and stores the program. May be executed. As another example, a program for causing a processor to function as one or more components may be installed in the car navigation device 920, and the wireless communication interface 933 and / or the processor 921 may execute the program. As described above, the car navigation apparatus 920 or the module may be provided as an apparatus including the one or more components, and a program for causing a processor to function as the one or more components may be provided. In addition, a readable recording medium in which the program is recorded may be provided.

Also, the technology according to the present disclosure may be realized as an in-vehicle system (or vehicle) 940 including one or more blocks of the car navigation device 920 described above, an in-vehicle network 941, and a vehicle side module 942. The vehicle-side module 942 generates vehicle-side data such as vehicle speed, engine speed, or failure information, and outputs the generated data to the in-vehicle network 941.

<< 9. Summary >>
The embodiment of the present disclosure has been described in detail above with reference to FIGS. According to the above-described embodiment, the authentication information generated by the authentication server 340 in the wireless communication with the WWAN terminal 200 that connects to the WWAN 300 and performs wireless communication and the WLAN terminal 100 that connects to the WLAN 500 and performs wireless communication. Authentication from the WWAN terminal 200 to the WLAN 500 using the authentication information is performed. Thereby, the WLAN terminal 100 acquires the authentication information via the WWAN terminal 200 even in a situation where it is difficult to acquire the authentication information from the authentication server 340 by itself, such as having no WWAN communication function. It becomes possible. Also, the WLAN terminal 100 can connect to the secure WLAN 500 by using the authentication information generated by the authentication server 340, and avoids connection to a network with a high security risk such as the risk of eavesdropping. Can do. Thereby, even when the WLAN terminal 100 does not support the Wi-Fi CERTIFIED Passpoint, it is possible to obtain the same safety and connection convenience as when the WLAN terminal 100 is compatible.

Also, the WLAN terminal 100 transmits the collected network information to the WWAN terminal 200 in order to obtain authentication information from the authentication server 340. Since the network information is collected at the current location of the WLAN terminal 100, the WLAN terminal 100 can receive a connection service with higher accuracy in the available area and the radio wave intensity as compared with the method using the ANDSF.

The preferred embodiments of the present disclosure have been described in detail above with reference to the accompanying drawings, but the technical scope of the present disclosure is not limited to such examples. It is obvious that a person having ordinary knowledge in the technical field of the present disclosure can come up with various changes or modifications within the scope of the technical idea described in the claims. Of course, it is understood that it belongs to the technical scope of the present disclosure.

In addition, the processes described using the flowcharts and sequence diagrams in this specification do not necessarily have to be executed in the order shown. Some processing steps may be performed in parallel. Further, additional processing steps may be employed, and some processing steps may be omitted.

In addition, the effects described in this specification are merely illustrative or illustrative, and are not limited. That is, the technology according to the present disclosure can exhibit other effects that are apparent to those skilled in the art from the description of the present specification in addition to or instead of the above effects.

The following configurations also belong to the technical scope of the present disclosure.
(1)
A first wireless communication unit that performs wireless communication with a wireless terminal that performs wireless communication by connecting to the first network;
A second wireless communication unit connected to the second network for wireless communication;
Authentication information generated by an authentication server using network information of the second network is received from the wireless terminal via the first wireless communication unit, and the authentication information is received via the second wireless communication unit. A control unit for performing authentication to the second network using
A wireless communication device comprising:
(2)
The control unit collects the network information via the second wireless communication unit, and transmits the collected network information to the wireless terminal via the first wireless communication unit. The wireless communication device described.
(3)
The wireless communication apparatus according to (1) or (2), wherein the network information includes at least one of SSID, channel information, RSSI (Received Signal Strength Indicator) information, and an inquiry result using ANQP.
(4)
The control unit transmits at least one of device information of the wireless communication device, capability information, or information indicating a purpose of wireless communication with the second network to the wireless terminal via the first wireless communication unit. The wireless communication device according to any one of (1) to (3), wherein the wireless communication device transmits.
(5)
The wireless communication device according to any one of (1) to (4), wherein the control unit performs authentication to one second network selected from one or more second networks.
(6)
The control unit performs authentication to the second network using the authentication information generated by the authentication server using device information of at least one of the wireless communication device or the wireless terminal. The wireless communication device according to any one of (5) to (5).
(7)
The control unit performs authentication to the second network using another part of the authentication information acquired using a communication path formed after authentication using a part of the authentication information. The radio communication device according to any one of 1) to (6).
(8)
The control unit transmits a part of the authentication information to the authentication server using a communication path formed by authentication using the wireless terminal, and performs authentication using the part of the authentication information by the authentication server. The wireless communication apparatus according to any one of (1) to (7), wherein authentication to the second network is performed using another part of the authentication information received via the authentication information.
(9)
The wireless communication apparatus according to (7) or (8), wherein a part of the authentication information is a one-time password provided with an expiration date.
(10)
The control unit selects an authentication method for the second network based on whether or not the first wireless communication unit can communicate with the wireless terminal having subscriber identification information. The wireless communication device according to any one of (9).
(11)
The wireless communication device further includes a storage unit that stores the authentication information,
The wireless communication apparatus according to any one of (1) to (10), wherein the control unit authenticates to the second network using the authentication information stored in the storage unit.
(12)
The wireless communication apparatus according to any one of (1) to (11), wherein the control unit authenticates to the second network by EAP (Extensible Authentication Protocol) authentication using an electronic certificate. .
(13)
The wireless communication device according to (12), wherein the authentication information includes an electronic certificate issued by the authentication server.
(14)
The wireless communication device according to (12), wherein the authentication information includes an ID and a password issued by the authentication server.
(15)
The wireless communication according to any one of (1) to (11), wherein the control unit performs authentication to the second network by EAP authentication using subscriber identification information included in the wireless terminal. apparatus.
(16)
The wireless communication apparatus according to any one of (1) to (15), wherein the first network is a mobile communication network.
(17)
The wireless communication apparatus according to any one of (1) to (16), wherein the second network is a public wireless LAN.
(18)
A third wireless communication unit that connects to the first network and performs wireless communication;
A fourth wireless communication unit that performs wireless communication with a wireless terminal that performs wireless communication by connecting to the second network;
Authentication for authentication to the second network generated by transmitting the network information of the second network to the authentication server via the third wireless communication unit and using the network information in the authentication server A control unit for transmitting information to the wireless terminal via the fourth wireless communication unit;
A wireless communication device comprising:
(19)
The wireless communication device according to (18), wherein the fourth wireless communication unit receives the network information from the wireless terminal.
(20)
The wireless communication device further includes a fifth wireless communication unit that performs wireless communication by connecting to the second network,
The wireless communication device according to (18), wherein the control unit collects the network information via the fifth wireless communication unit.
(21)
The control unit transmits the authentication information for authentication to one second network selected from one or more second networks to the wireless terminal via the fourth wireless communication unit. The wireless communication device according to any one of (18) to (20).
(22)
The wireless communication device further includes a storage unit that stores the authentication information,
The wireless communication unit according to any one of (18) to (21), wherein the control unit transmits the authentication information stored in the storage unit to the wireless terminal via the fourth wireless communication unit. Communication device.
(23)
A third wireless communication unit that connects to the first network and performs wireless communication;
A fifth wireless communication unit for connecting to the second network and performing wireless communication;
The network information of the second network is transmitted to the authentication server via the third wireless communication unit, and the authentication to the second network using the authentication information generated in the authentication server is performed in the fifth network. A control unit that performs via a wireless communication unit;
A wireless communication device comprising:
(24)
Performing wireless communication with a wireless terminal that performs wireless communication by connecting to the first network by the first wireless communication unit;
Connecting to the second network by the second wireless communication unit to perform wireless communication;
Authentication information generated by an authentication server using network information of the second network is received from the wireless terminal via the first wireless communication unit, and the authentication information is received via the second wireless communication unit. Authenticating to the second network using
A wireless communication method including:
(25)
Connecting to the first network by the third wireless communication unit to perform wireless communication;
Performing wireless communication with a wireless terminal that performs wireless communication by connecting to the second network by a fourth wireless communication unit;
Authentication for authentication to the second network generated by transmitting the network information of the second network to the authentication server via the third wireless communication unit and using the network information in the authentication server Transmitting information to the wireless terminal via the fourth wireless communication unit;
A wireless communication device comprising:
(26)
Connecting to the first network by the third wireless communication unit to perform wireless communication;
Connecting to the second network by the fifth wireless communication unit to perform wireless communication;
The network information of the second network is transmitted to the authentication server via the third wireless communication unit, and the authentication to the second network using the authentication information generated in the authentication server is performed in the fifth network. Doing via the wireless communication part,
A wireless communication method including:
(27)
Computer
A first wireless communication unit that performs wireless communication with a wireless terminal that performs wireless communication by connecting to the first network;
A second wireless communication unit connected to the second network for wireless communication;
Authentication information generated by an authentication server using network information of the second network is received from the wireless terminal via the first wireless communication unit, and the authentication information is received via the second wireless communication unit. A control unit for performing authentication to the second network using
Program to function as.
(28)
Computer
A third wireless communication unit that connects to the first network and performs wireless communication;
A fourth wireless communication unit that performs wireless communication with a wireless terminal that performs wireless communication by connecting to the second network;
Authentication for authentication to the second network generated by transmitting the network information of the second network to the authentication server via the third wireless communication unit and using the network information in the authentication server A control unit for transmitting information to the wireless terminal via the fourth wireless communication unit;
Program to function as.
(29)
Computer
A third wireless communication unit that connects to the first network and performs wireless communication;
A fifth wireless communication unit for connecting to the second network and performing wireless communication;
The network information of the second network is transmitted to the authentication server via the third wireless communication unit, and the authentication to the second network using the authentication information generated in the authentication server is performed in the fifth network. A control unit that performs via a wireless communication unit;
Program to function as.

DESCRIPTION OF SYMBOLS 1 Wireless communication system 100 WLAN terminal 110 Wireless communication part 112 WLAN module 114 BT module 116 NFC module 120 Storage part 130 Control part 200 WWAN terminal 210 Wireless communication part 212 WWAN module 214 WLAN module 216 BT module 218 NFC module 220 Storage part 230 Subscription Identification module 240 Control unit 300 WWAN
310 Base station 320 Gateway 330 Subscriber information server 340 Authentication server 341 Communication unit 342 Storage unit 343 Control unit 350 Network information providing server 400 Service network 500 WLAN
510 base station

Claims

A first wireless communication unit that performs wireless communication with a wireless terminal that performs wireless communication by connecting to the first network;
A second wireless communication unit connected to the second network for wireless communication;
Authentication information generated by an authentication server using network information of the second network is received from the wireless terminal via the first wireless communication unit, and the authentication information is received via the second wireless communication unit. A control unit for performing authentication to the second network using
A wireless communication device comprising:
2. The control unit according to claim 1, wherein the control unit collects the network information via the second wireless communication unit, and transmits the collected network information to the wireless terminal via the first wireless communication unit. Wireless communication device.
The wireless communication apparatus according to claim 1, wherein the network information includes at least one of an SSID, channel information, RSSI (Received Signal Strength Indicator) information, or an inquiry result using ANQP.
The control unit transmits at least one of device information of the wireless communication device, capability information, or information indicating a purpose of wireless communication with the second network to the wireless terminal via the first wireless communication unit. The wireless communication apparatus according to claim 1, which transmits the wireless communication apparatus.
The wireless communication device according to claim 1, wherein the control unit performs authentication to one second network selected from one or more second networks.
The said control part authenticates to the said 2nd network using the said authentication information produced | generated by the said authentication server using the apparatus information of at least any one of the said radio | wireless communication apparatus or the said radio | wireless terminal. A wireless communication device according to 1.
The control unit performs authentication to the second network using another part of the authentication information acquired using a communication path formed after authentication using a part of the authentication information. The wireless communication device according to 1.
The control unit transmits a part of the authentication information to the authentication server using a communication path formed by authentication using the wireless terminal, and performs authentication using the part of the authentication information by the authentication server. The wireless communication apparatus according to claim 1, wherein authentication to the second network is performed using another part of the authentication information received via the authentication information.
The wireless communication device according to claim 8, wherein a part of the authentication information is a one-time password provided with an expiration date.
2. The control unit according to claim 1, wherein the control unit selects an authentication method for the second network based on whether the first wireless communication unit can communicate with the wireless terminal having subscriber identification information. Wireless communication device.
The wireless communication device further includes a storage unit that stores the authentication information,
The wireless communication apparatus according to claim 1, wherein the control unit performs authentication to the second network using the authentication information stored in the storage unit.
The wireless communication apparatus according to claim 1, wherein the control unit authenticates to the second network by EAP (Extensible Authentication Protocol) authentication using an electronic certificate.
The wireless communication device according to claim 12, wherein the authentication information includes an electronic certificate issued by the authentication server.
The wireless communication device according to claim 12, wherein the authentication information includes an ID and a password issued by the authentication server.
The wireless communication apparatus according to claim 1, wherein the control unit authenticates to the second network by EAP authentication using subscriber identification information included in the wireless terminal.
The wireless communication device according to claim 1, wherein the first network is a mobile communication network.
The wireless communication apparatus according to claim 1, wherein the second network is a public wireless LAN.
A third wireless communication unit that connects to the first network and performs wireless communication;
A fourth wireless communication unit that performs wireless communication with a wireless terminal that performs wireless communication by connecting to the second network;
Authentication for authentication to the second network generated by transmitting the network information of the second network to the authentication server via the third wireless communication unit and using the network information in the authentication server A control unit for transmitting information to the wireless terminal via the fourth wireless communication unit;
A wireless communication device comprising:
The wireless communication device according to claim 18, wherein the fourth wireless communication unit receives the network information from the wireless terminal.
The wireless communication device further includes a fifth wireless communication unit that performs wireless communication by connecting to the second network,
The wireless communication device according to claim 18, wherein the control unit collects the network information via the fifth wireless communication unit.
The control unit transmits the authentication information for authentication to one second network selected from one or more second networks to the wireless terminal via the fourth wireless communication unit. The wireless communication apparatus according to claim 18.
The wireless communication device further includes a storage unit that stores the authentication information,
The wireless communication apparatus according to claim 18, wherein the control unit transmits the authentication information stored in the storage unit to the wireless terminal via the fourth wireless communication unit.
A third wireless communication unit that connects to the first network and performs wireless communication;
A fifth wireless communication unit for connecting to the second network and performing wireless communication;
The network information of the second network is transmitted to the authentication server via the third wireless communication unit, and the authentication to the second network using the authentication information generated in the authentication server is performed in the fifth network. A control unit that performs via a wireless communication unit;
A wireless communication device comprising:
Performing wireless communication with a wireless terminal that performs wireless communication by connecting to the first network by the first wireless communication unit;
Connecting to the second network by the second wireless communication unit to perform wireless communication;
Authentication information generated by an authentication server using network information of the second network is received from the wireless terminal via the first wireless communication unit, and the authentication information is received via the second wireless communication unit. Authenticating to the second network using
A wireless communication method including:
Connecting to the first network by the third wireless communication unit to perform wireless communication;
Performing wireless communication with a wireless terminal that performs wireless communication by connecting to the second network by a fourth wireless communication unit;
Authentication for authentication to the second network generated by transmitting the network information of the second network to the authentication server via the third wireless communication unit and using the network information in the authentication server Transmitting information to the wireless terminal via the fourth wireless communication unit;
A wireless communication device comprising:
Connecting to the first network by the third wireless communication unit to perform wireless communication;
Connecting to the second network by the fifth wireless communication unit to perform wireless communication;
The network information of the second network is transmitted to the authentication server via the third wireless communication unit, and the authentication to the second network using the authentication information generated in the authentication server is performed in the fifth network. Doing via the wireless communication part,
A wireless communication method including:
Computer
A first wireless communication unit that performs wireless communication with a wireless terminal that performs wireless communication by connecting to the first network;
A second wireless communication unit connected to the second network for wireless communication;
Authentication information generated by an authentication server using network information of the second network is received from the wireless terminal via the first wireless communication unit, and the authentication information is received via the second wireless communication unit. A control unit for performing authentication to the second network using
Program to function as.
Computer
A third wireless communication unit that connects to the first network and performs wireless communication;
A fourth wireless communication unit that performs wireless communication with a wireless terminal that performs wireless communication by connecting to the second network;
Authentication for authentication to the second network generated by transmitting the network information of the second network to the authentication server via the third wireless communication unit and using the network information in the authentication server A control unit for transmitting information to the wireless terminal via the fourth wireless communication unit;
Program to function as.
Computer
A third wireless communication unit that connects to the first network and performs wireless communication;
A fifth wireless communication unit for connecting to the second network and performing wireless communication;
The network information of the second network is transmitted to the authentication server via the third wireless communication unit, and the authentication to the second network using the authentication information generated in the authentication server is performed in the fifth network. A control unit that performs via a wireless communication unit;
Program to function as.