JP2003319455A - Communication system, managing server, method for controlling the same and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To simplify the management of a radio terminal registering list for packet filtering while assuring a security. <P>SOLUTION: A managing server (24) for managing the accessing of a radio terminal (11) intending to access to a wired network (13) via a base station (22) stores the registering list which registers identification information of the radio terminal allowing access to the network (13). When the identification information of the terminal (11) included in a connection request packet (502) received from the station (22) is included in the list, connection allowing packets (503, 504) are transmitted to the radio terminal (11) of an originator via the station (22). <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a communication system, and more particularly to an access control technique when a wireless communication terminal joins a wired network via the wireless network.

2. Description of the Related Art Conventionally, a wireless LAN system has been used as a highly portable network system which is not restricted by a communication cable. In recent years, in particular, the transmission speed in a wireless communication section has been improved and a notebook personal computer has been popularized. It is rapidly gaining popularity due to the emergence of applications suitable for mobile communications. However, the wireless LAN system is generally a wireless communication system using radio waves,
It has been pointed out that the confidentiality and low reliability of communications are low.

[0002] For example, by its nature, radio waves can be intercepted by a third party other than the destination terminal once transmitted from the transmitter into the space, and communication data as information can be transmitted to external third parties. May be leaked to other persons. Further, the wireless LAN system is not logically physically connected by a cable like a wired LAN, but is generally logically connected by a wireless communication procedure to a base station that manages communication of wireless terminals. Therefore, there is a possibility that a wireless terminal outside the self-organization may be mistakenly or intentionally connected to the network.

In order to prevent such problems, wireless LAN
In the system, from the upper application layer to the lower M
Measures are taken by various methods in each layer up to the AC (Media Access Control) layer or the physical layer. In particular, it is common to avoid such problems by dealing with information leakage due to interception of wireless signals by using data encryption, etc. and adopting an authentication method for unauthorized connections from the outside. Is.

There are several possible authentication methods for unauthorized connection, but especially the authentication method using the MAC address uniquely held by each terminal is widely used in wired networks and also in wireless LAN systems. This is an effective method. Such an authentication method in a wireless LAN system has been disclosed in, for example, Japanese Patent Laid-Open No. 06-261043, in which a base station transmits a connection request using a MAC address uniquely held by each wireless terminal. A method has been taken to determine whether a wireless terminal is included in its own organization.

FIG. 8 is a diagram showing the configuration of a conventional wireless LAN system. In the figure, 71 is a wireless terminal (mobile terminal), 72 is a base station, and 73 is a wired network.
Now, when the wireless terminal 71 attempts to perform communication with the network 73, a connection request and authentication procedure is performed prior to the start of communication. First, the wireless terminal 71 is the base station 7
A connection request packet is sent to the packet No. 2. At this time, the connection request packet includes the MAC address of the wireless terminal 71. In general, the MAC address is a unique address given to each wireless terminal, which identifies the wireless terminal.

The base station 72 receives the connection request packet and analyzes the MAC address contained therein to determine whether the wireless terminal can connect to the network 73. This technique is also called packet filtering.

FIG. 9 is a block diagram showing the internal configuration of the base station 72. The base station 72 includes a processor 106 that controls the operation of the entire base station and the following configurations.
Reference numeral 101 is a transceiver for performing communication with the wired network 73, and 102 is a wireless module 102 for performing wireless communication with a wireless terminal via the antenna 103.
Reference numeral 104 denotes a wireless terminal registration list for packet filtering, in which the MAC address of a wireless terminal that is permitted to access the network 73 is registered.
Conversely, wireless terminals not registered in the wireless terminal registration list 104 are not permitted to access the network 73. Reference numeral 105 is a wireless terminal management table in which the MAC address of a wireless terminal currently establishing a connection to the network 73 is described. Reference numeral 107 is an input device for rewriting the contents of the wireless terminal registration list 104, for example.

The base station 72 receives the connection request packet from the wireless terminal 71 through the antenna 103 and the wireless module 1
02, the processor 106 analyzes this received packet and acquires the MAC address of the wireless terminal 71. The processor 106 then obtains the acquired wireless terminal 71.
Is searched for in the wireless terminal registration list 104. As a result of the search, the MAC
When the address is found in the wireless terminal registration list 104, the base station 72 recognizes that the wireless terminal 71 is allowed to connect to the network 73, and the wireless terminal 71 is recognized.
The MAC address is registered in the wireless terminal management table 105 in order to retain the information that the connection has started. After that, communication control is performed in response to a communication request from the wireless terminal 71.

On the other hand, when the MAC address of the wireless terminal 71 is not in the wireless terminal registration list 104, the wireless terminal 71
Recognizes that it should not be connected to the network 73 and discards the communication request from the wireless terminal 71.

By the way, the network 73 can include a plurality of base stations. In order for each base station including the base station 72 to appropriately perform the authentication process for the connection request from the wireless terminal 11, the wireless terminal registration list held by each base station is
By using the input device 107 or the like provided in the base station,
It is necessary to enter the MAC address that should be permitted to connect. Here, the wireless terminal management table 105 indicates the M of the wireless terminal currently communicating under the control of the base station.
Since the AC address is held, the contents are generally different in each base station. On the other hand, the wireless terminal registration list stores the MAC addresses of wireless terminals that should be permitted to connect to this entire network, and all bases are excluded unless the entire network is intentionally divided (segmented). The stations must have the same wireless terminal registration list.

[0011]

However, in the above-mentioned prior art, the wireless terminal registration list held by each base station is configured to be input from the input means 107 provided in each base station. Therefore, the addition of new wireless terminals,
It is necessary to manually update each base station when deleting it. This requires a lot of work when the number of base stations is large.

Further, in the wireless LAN, the wireless terminal can be connected to any base station existing on the network. Therefore, the wireless terminal registration list of all the base stations should be kept the same. I have to go. Otherwise, due to the operation of the wireless LAN system, the wireless terminal that should be connected is not allowed to connect, or the wireless terminal that should be denied connection gets permission to connect. There is a problem that access may occur.

The present invention has been made to solve the above problems, and an object of the present invention is to simplify the management of a wireless terminal registration list for packet filtering while ensuring safety. .

[0014]

To achieve the above object, for example, a communication system of the present invention includes a wireless network and a wired network, and one or more bases for relaying the wireless network and the wired network. And a management server that manages the access of a wireless terminal that attempts to access the wired network via one of the base stations, the management server accessing the wired network. When the registration list in which the identification information of the wireless terminal that can be permitted to perform registration and the identification information of the wireless terminal of the transmission source included in the connection request message received from one of the base stations are included in the registration list Access to send a connection permission message to the source wireless terminal via the base station. And having a control means.

[0015]

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a diagram showing a configuration of a wireless LAN system in the embodiment. In the figure, 11 is a wireless terminal,
Reference numeral 22 is a base station, 13 is a wired network, and 24 is a management server. A wireless network is configured by the wireless terminal 11 and the base station 22, and the base station 22 relays between the wireless network and the wired network 13. In addition,
Other base stations may be connected to the wired network 13.

The arrow lines shown in the figure indicate the message transmission path. In an embodiment, the message is transmitted as a packet. Here, 501 is a first connection request packet transmitted from the wireless terminal 11, and 50
2 is a second connection request packet transmitted from the base station 22, 503 is a first connection permission packet transmitted from the management server 24, and 504 is a second connection permission packet transmitted from the base station 22.
Connection permission packet, and propagates through the routes indicated by arrow lines.

FIG. 2 is a block diagram showing a schematic configuration of the base station 22. The base station 22 includes a processor 406 that controls the entire device and the wired network 13
40 for transmitting and receiving signals to and from
1. Antenna 40 for receiving radio signals from wireless terminals
3, a wireless module 402 including a demodulator that demodulates a radio signal received by the antenna 403, and identification information of a wireless terminal currently establishing a connection to the wired network 13 that is under the control of the base station 22 ( For example, a management table 405 holding a MAC address) is provided.

FIG. 3 is a block diagram showing a schematic configuration of the management server 24. The management server 24 includes a processor 306 that controls the entire device and a wired network 13.
301 for transmitting and receiving signals to and from
Also, a management table 30 that holds identification information (for example, a MAC address) of a terminal currently establishing a connection with the management server 24 via the wired network 13.
It is equipped with 5.

Now, this management server 24
A wireless terminal registration list 304 for filtering is stored. In this list 304, the wired network 13
The MAC address as the identification information of the wireless terminal that can be permitted to access is registered in the structure as shown in FIG. 4, for example. Conversely, this wireless terminal registration list 30
Wireless terminals not registered in No. 4 are not permitted to access the network 13. Such a registration list is conventionally held by each base station. Note that, along with this, the base station 22 does not have to maintain the wireless terminal registration list. The contents of the wireless terminal registration list in the management server 24 are the same as those of the input device 3 shown in FIG.
It can be changed by an operation using 07.

FIG. 5 shows the network 13 of the wireless terminal 11.
It is a figure which shows the sequence regarding the access to.

The wireless terminal 11 trying to connect to the network 13 first sends a connection request packet 5 for an authentication request.
01 is transmitted to the base station 22 (FIG. 5A). It is well known that the packet transmitted by each node includes the identification information of the transmission source. In this regard, in the present embodiment, the wireless terminal 11 uses M as the identification information of the transmission source.
Include the AC address in the outgoing packet.

The base station 22 receives the connection request packet 501 and acquires the MAC address information of the wireless terminal 11 included therein. Specifically, the base station 22 is the wireless terminal 1
The connection request packet 501 from 1 is received by the wireless module 402 via the antenna 403. Then, the processor 406 analyzes the received packet and analyzes the received packet.
Get the MAC address of. The base station 22 uses the acquired MAC address of the wireless terminal 11 as a connection request packet 502.
As a transceiver 401 by the wired network 13
Send to.

The connection request packet 502 is received by the management server 24 via the wired network 13 (FIG. 5 (b)). The management server 24 uses the transceiver 30
1 receives the connection request packet 502 from the wired network 13. The management server 24 analyzes the received connection request and acquires the MAC address of the wireless terminal 11.
Further, the management server 24 searches whether or not the acquired MAC address is registered in the wireless terminal registration list 304. Here, when the acquired MAC address is registered in the wireless terminal registration list 304, the MAC address is stored in order to retain the information that the wireless terminal is currently participating in the wired network 13. Record in the management table 305. Then, the management server 24 sends a connection permission packet 503 to the wired network 13 to indicate that the connection of the wireless terminal has been permitted.

Next, the connection permission packet 503 propagates through the wired network 13 and is received by the base station 22 (FIG. 5 (c)). The base station 22 uses the transceiver 401 to send the connection permission packet 50 from the wired network 13.
Receive 3 Based on this connection permission packet 503, the base station 22 recognizes that the wireless terminal 11 may normally pass the authentication process and permit the connection to the network 13. Then, the base station 22 uses the wireless terminal management table 405.
By recording the MAC address of the wireless terminal 11, the information that the wireless terminal 11 is participating in the network 13 is held, and at the same time, the connection permission packet 504 is sent from the wireless module 402 to the wireless terminal 11 by wireless transmission ( FIG. 5D). The wireless terminal 11 receives the connection permission packet 504 and, assuming that the connection to the network 13 is permitted, thereafter communicates with the network 13.

According to the above-described embodiment, the management server 24 stores and manages the wireless terminal registration list in which the identification information (eg, MAC address) of the wireless terminals that are permitted to access the wired network 13 is registered. Based on this, it is determined whether the wireless terminal can access the wired network. Along with this, each base station does not need to hold the wireless terminal registration list independently as in the conventional case. Therefore, it is possible to save the labor of manually updating the wireless terminal registration list for each base station. In addition, there is no need to perform a management operation for maintaining the identity of the contents of the wireless terminal registration list of each base station. Therefore, there is a problem that a wireless terminal that should be connected is not permitted to connect, or a wireless terminal that should be denied connection gets permission to connect, or a risk of unauthorized access occurs. Will be resolved.

Next, the processing of the management server in consideration of the movement of the wireless terminal when a plurality of base stations are connected to the wired network 13 will be described. Here, as shown in FIG. 6, consider a case where the wireless terminal 11 moves from the service area of the base station 25 to the service area of another base station 22.

It is assumed that the wireless terminal 11 is now connected to the network 13 via the base station 25. That is, since the wireless terminal 11 has been authenticated using the MAC address as described above, the wireless terminal management table in the base station 25 (similar to the wireless terminal management table 305 in the base station 22 described above) is wireless. MAC of terminal 11
The address is held.

Here, the wireless terminal 11 moves and the base station 2
It is assumed that the user has left the service area of No. 5 and entered the service area of the base station 22. Hereinafter, description will be given with reference to both the network diagram of FIG. 6 and the signaling diagram of FIG. 7.

At this time, the wireless terminal 11 detects that communication with the network 13 via the base station 25 has become impossible, and searches for a new connectable base station. As a result of the search, the wireless terminal 11 that has detected the base station 22 as the next connectable base station sends the connection request packet 501 to the base station 22 as described above (FIG. 7A). The base station 22 receives the connection request packet 501, acquires the MAC address information of the wireless terminal 11 included therein, and transmits the connection request packet 502 including this to the management server 24 via the wired network 13. (Fig. 7
(B)). After that, the management server 24 performs the authentication process in the same manner as described above.

As described above, when the management server 24 finds the MAC address of the wireless terminal 11 from the wireless terminal registration list 304, it determines that the wireless terminal 11 should be permitted to connect. After that, the wireless terminal management table 305 is also searched. Since the wireless terminal 11 has been connected to the network 13 via the base station 25 until then, the wireless terminal 11 is stored in the wireless terminal management table 305.
The MAC address of is registered. This allows the address management server 24 to know the fact that the wireless terminal 11 has moved from the base station 25 to the base station 22.

After that, the management server 24 transmits a connection release packet 505 to the base station 25 (FIG. 7).
(C)). The base station 25 having received the connection release packet 505 deletes the MAC address from its own wireless terminal management table and releases the connection with the wireless terminal 11.

After that, the management server 24 sends out the connection permission packet 503 as described above (FIG. 7 (d)), and the base station 22 receiving this transmits the connection permission packet 504 to the wireless terminal 11 (FIG. 7 (d)). 7 (e)).

As described above, when the wireless terminal moves between the base stations, the management server sends a connection release packet to the base station that has managed the wireless terminal until then. Since the base station that does not need to communicate with the wireless terminal can release the connection, the base station can efficiently manage the wireless terminal.

[0035]

Other Embodiments The embodiments of the present invention have been described in detail above.
Although the base station and the management server are described as separate devices in the above-described embodiment, the present invention is not limited to sharing the functions of both.
It may be applied to one device.

The present invention supplies a software program for realizing the functions of the above-described embodiments to a system or apparatus directly or remotely, and a computer of the system or apparatus reads and executes the supplied program. Including the case where it is achieved by

Therefore, the program code itself installed in a computer to implement the functional processing of the present invention by the computer also implements the present invention. That is, the claims of the present invention include the computer program itself for realizing the functional processing of the present invention.

In this case, the program may take any form such as an object code, a program executed by an interpreter, or script data supplied to an OS as long as it has the function of the program.

As a storage medium for supplying the program, for example, a flexible disk or an optical disk (CD
-ROM, CD-R, CD-RW, DVD, etc.), magneto-optical disk, magnetic tape, memory card, etc.

As another method of supplying the program,
A mode in which the program of the present invention is acquired by file transfer via the Internet is also included.

The program of the present invention is encrypted to be a CD.
-Stored in a storage medium such as a ROM and distributed to users, users who have met prescribed conditions are allowed to acquire key information for decryption via the Internet, and the key information is used for encryption. It is also possible to execute the program and install the program on a computer to realize it.

The computer executes the read program to realize the functions of the above-described embodiments, and the OS or the like running on the computer executes the actual processing based on the instructions of the program. The functions of the above-described embodiments may be realized by performing a part or all of the processing.

Further, after the program read from the storage medium is written in the memory provided in the function expansion board inserted in the computer or the function expansion unit connected to the computer, based on the instruction of the program,
CPU provided on the function expansion board or function expansion unit
Etc. perform a part or all of the actual processing, and the functions of the above-described embodiments are also realized by the processing.

[0044]

According to the present invention, management of a wireless terminal registration list for packet filtering can be simplified while ensuring safety.

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of a wireless LAN system according to an embodiment.

FIG. 2 is a block diagram showing a schematic configuration of a base station in the embodiment.

FIG. 3 is a block diagram showing a schematic configuration of a management server in the embodiment.

FIG. 4 is a diagram showing a structural example of a wireless terminal registration list in the embodiment.

FIG. 5 is a diagram showing a sequence relating to access of a wireless terminal to a network in the embodiment.

FIG. 6 is a diagram for explaining processing of the management server in consideration of movement of a wireless terminal.

FIG. 7 is a diagram showing a sequence relating to access to a network by a wireless terminal that has moved between base stations.

FIG. 8 is a diagram showing a configuration of a conventional wireless LAN system.

FIG. 9 is a block diagram showing an internal configuration of a conventional base station.

Claims (8)

[Claims] 1. A wireless network and a wired network, and one or more base stations for relaying the wireless network and the wired network, and an attempt to access the wired network via any one of these base stations. And a management server that manages the access of the wireless terminal, the registration server registering identification information of the wireless terminal that allows the management server to access the wired network, When the identification information of the transmission source wireless terminal included in the connection request message received from the base station is included in the registration list, a connection permission message is sent to the transmission source wireless terminal via the base station. A communication system comprising: an access control unit for transmitting. 2. The management server further comprises holding means for holding identification information of the wireless terminal while the wireless terminal establishes a connection to the wired network, and a connection request message from the first base station. When you receive
When the identification information of the wireless terminal of the transmission source included in the connection request message is held by the holding means,
The wireless terminal determines that it has moved from the service area of the second base station to the service area of the first base station, and transmits a disconnection message to the second base station. The communication system according to claim 1, wherein: 3. A communication system including a wireless network and a wired network, comprising one or more base stations for relaying the wireless network and the wired network, and the wired network via any one of the base stations. A management server that manages the access of the wireless terminal that is trying to access the wireless network, the registration list registering the identification information of the wireless terminal that is allowed to access the wired network, and the registration list received from any one of the base stations. Access control means for transmitting a connection permission message to the wireless terminal of the transmission source via the base station when the identification information of the wireless terminal of the transmission source included in the connection request message is included in the registration list; A management server comprising: 4. A holding means for holding identification information of the wireless terminal while the wireless terminal is establishing a connection to the wired network, and a connection request message from the first base station,
When the identification information of the wireless terminal of the transmission source included in the connection request message is held by the holding means,
The wireless terminal determines that it has moved from the service area of the second base station to the service area of the first base station, and transmits a disconnection message to the second base station. The management server according to claim 3, wherein: 5. A communication system including a wireless network and a wired network, comprising one or more base stations for relaying the wireless network and the wired network, and the wired network via any one of the base stations. A method of controlling a management server that manages the access of a wireless terminal attempting to access a wireless terminal, wherein a registration list in which identification information of wireless terminals that are permitted to access the wired network is registered is stored in advance. Receiving a connection permission message from any one of the base stations, detecting the identification information of the wireless terminal of the transmission source included in the received connection request message from the registration list, and when the detection is successful, A connection permission message is sent to the source wireless terminal via the base station. The method of the management server, characterized by comprising the steps of: transmitting a. 6. A holding step of holding identification information of the wireless terminal while the wireless terminal establishes a connection to the wired network, and when a connection request message is received from the first base station,
When the identification information of the wireless terminal of the transmission source included in the connection request message is held by the holding step, the wireless terminal moves from the service area of the second base station to the service area of the first base station. The control method of the management server according to claim 5, further comprising: a transmission step of determining that the mobile terminal has moved and transmitting a connection release message to the second base station. 7. A communication system including a wireless network and a wired network, comprising one or more base stations for relaying the wireless network and the wired network, and the wired network via any one of the base stations. A program for controlling a management server that manages the access of a wireless terminal that is trying to access a wireless terminal, which stores in advance a registration list in which identification information of wireless terminals that are permitted to access the wired network is registered. Receiving a connection permission message from the base station, detecting the identification information of the wireless terminal of the transmission source included in the received connection request message from the registration list, the base station when the detection is successful Connection permission message to the wireless terminal of the transmission source via The step of sending, the program to perform. 8. A holding step of holding identification information of the wireless terminal while the wireless terminal establishes a connection to the wired network, when a connection request message is received from the first base station,
When the identification information of the wireless terminal of the transmission source included in the connection request message is held by the holding step, the wireless terminal moves from the service area of the second base station to the service area of the first base station. The program according to claim 7, further comprising: a transmission step of transmitting a disconnection message to the second base station upon determining that the mobile terminal has moved.