JP2004072631A - Authentication system in radio communications, authentication method and terminal - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system in radio communication capable of inexpensively realizing safe communication of terminals as much as possible even while enhancing security. <P>SOLUTION: A network A to be connected with a base station and a network B to be connected with an access point (AP) are mutually connected with the authentication system and the authentication system shares a terminal authentication server to be connected with the network A with the one of the network B. A terminal is provided with a first communication means for communicating with the access point of the network B, a second communication means for communicating with the base station of the network A and a means for transmitting information for authentication by being connected with a radio line by which high security is guaranteed with the base station by the second communication means in the case of performing the communication by being connected with the network B. The authentication server judges the propriety of access to the access point to the terminal based on the transmitted information for authentication and informs the access point of a result. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an authentication system, an authentication method, and a terminal device in wireless communication.
[0002]
[Prior art]
In recent years, businesses (operators) have installed wireless network devices (hereinafter, referred to as access points) in coffee shops, restaurants, airports, train stations, hotels, and the like called "hot spots" to provide Internet use services. . A user's terminal device (a personal computer, a PDA, a mobile phone, etc.) is usually provided with a personal computer or a PDA having a wireless LAN function (for example, IEEE802.11b), and is connected to a network connected to an access point. The Internet can be used within the hot spot area.
[0003]
In such a hot spot system, since communication between a user terminal (hereinafter, referred to as a terminal device) and an access point is performed wirelessly, there is always a danger that communication data may be intercepted by a third party. Such a problem is generally dealt with by WEP (Wired Equivalent Privacy) encryption or ESS (Extended Service Set) ID.
[0004]
In addition, the operation of verifying the validity of a person who intends to use a computer in a hot spot area, that is, "authentication" is also important from a security point of view.
[0005]
FIG. 5 is a diagram illustrating an example of a conventional mutual authentication method between a terminal device and a network. In the figure, (a) below the dotted line represents a hot spot system, and (b) represents another communication system, here, a mobile communication system. The hot spot system (a) includes a terminal device 10 accommodated in the own system, an access point (AP) 20, a communication network 30, and a hot spot authentication server (AAA server) 40. On the other hand, the mobile communication system (b) includes a mobile communication network 50, a cellular authentication server (AAA server) 60 used for authentication of a user of the own system subscriber, and a base station (BS: Base station) 70.
[0006]
The hot spot AAA server 40 is, for example, a server for authenticating the identity of the user who owns the terminal device 10, receives an access request from the terminal device 10, and performs authentication (Authentication), authorization (Authorization), and accounting. (Accounting). The cellular AAA server 60 is a server that receives an access request from a mobile terminal (such as a mobile phone) subscribed to the own system and performs authentication, authorization, and accounting of a user subscribed to the own system.
[0007]
Further, the communication network 30 and the mobile communication network 50 are interconnected, and the user of the hot spot system can use the service provided by the mobile communication system.
[0008]
In the hot spot system, mutual authentication is performed between (a) the access point 20 and the terminal device 10 or (b) between the terminal device 10 and the hot spot AAA server 40. Here, the mutual authentication method performed between the terminal device 10 and the hot spot AAA server 40 in (b) will be described as an example. As the mutual authentication method, a secret key encryption-based mutual authentication method (for example, see Non-Patent Document 1) is used.
[0009]
(Description of Mutual Authentication Between Terminal Device 10 and AAA Server 40 for Hot Spot)
The mutual authentication method is a method in which each other (in this case, the terminal device 10 and the AAA server 40) authenticates each other. Here, both the terminal device 10 and the hot spot AAA server 40 share a secret key K. An example of performing mutual authentication will be described below.
[0010]
First, the terminal device 10 receives a random number r _A Is generated and transmitted to the hot spot AAA server 40 via the access point 20 ((1)). The hotspot AAA server 40 uses a random number r _B Is generated, and information X = E, which is the result of encrypting (rA‖rB) using the key K, _K (B‖A‖r _A ‖R _B ) Is transmitted to the terminal device 10 via the access point 20 ((2)). The terminal device 10 decodes the received information X, and _A Is included, and r _B And information Y = E _K (A‖r _B ) Is calculated and transmitted to the hot spot AAA server 40 via the access point 20 ((3)). The hot spot AAA server 40 decrypts the information Y, and _B Is confirmed, the access point 20 is notified of the completion of the authentication ((4)). When the authentication between the terminal device 10 and the hotspot AAA server 40 is completed in this way, communication between the terminal device 10 and the access point 20 is started ((5)).
[0011]
On the other hand, proposals such as a wireless communication basic service system have been made (for example, see Patent Document 1). The proposed system provides a two-way data communication function to perform line connection control, and manages the location registration information of the terminal device on the network (basic wireless communication service provider) side, thereby providing mutual service. You can get in.
[0012]
[Patent Document 1]
JP-A-10-248091
[Non-patent document 1]
Okamoto and Yamamoto, "Contemporary Cryptography", Sangyo Tosho, 1997
[Problems to be solved by the invention]
As described above, the mutual authentication method in the hot spot system requires mutual authentication between the access point 20 and the terminal device 10 or between the hotspot AAA server 40 and the terminal device 10, and an authentication protocol for the mutual authentication. Is not easy. In addition, in order to perform mutual authentication, the authentication server needs to transmit and receive information a plurality of times and perform authentication processing, resulting in a problem of increasing system cost.
[0013]
Further, in the case of the above-described conventional technique (Japanese Patent Laid-Open No. Hei 10-248091), a bidirectional data communication function for performing line connection control and a function for managing location registration information are newly provided, so In addition, the system cost increases. Furthermore, since it is necessary to perform intermittent communication between the terminal device and the base station in order to obtain location registration information, there is a disadvantage that frequency resources are consumed.
[0014]
SUMMARY OF THE INVENTION The present invention has been made in view of the above-described problems, and an object of the present invention is to provide a wireless communication that can realize secure communication of a terminal at the cost of building an authentication system as inexpensive as possible while enhancing security. An object of the present invention is to provide an authentication system, an electronic authentication method, and a terminal device.
[0015]
[Means for Solving the Problems]
In order to solve the above problems, the present invention provides a network connected to a base station (hereinafter referred to as a network A) and a network connected to an access point (AP) (hereinafter referred to as a network). , And a network B) are interconnected, and an authentication server connected to the network A in an authentication system in which an authentication server connected to each network authenticates a terminal device accommodated in each network. Is commonly applied to the network B, the terminal device is a first communication unit that communicates with an access point of the network B, a second communication unit that communicates with a base station of the network A, and is connected to the network B. High security is guaranteed with the base station by the second communication means when performing communication by Authentication information transmitting means for transmitting information for authentication by connecting to the wireless line to be authenticated, wherein the authentication server, based on the information for authentication sent by the authentication information transmitting means, the terminal An authentication unit for determining permission or non-permission of an apparatus to access the access point, and an authentication result notifying unit for notifying the access point of a result of the determination are provided.
[0016]
Further, in the authentication system according to the present invention, in the authentication system, the access point transmits a certificate generated based on information secretly shared between the network B and the network A to the terminal device. The terminal device includes a certificate transmission unit configured to transmit the certificate received by the first communication unit to the authentication server by the second communication unit. An authentication server configured to determine whether or not the received certificate is a correct certificate based on the secret sharing information; and that the certificate received by the formal certificate determination unit is a correct certificate. A first communication permission notifying unit for notifying the access point of communication with the terminal device when the access point is determined.
[0017]
Also, in the authentication system according to the present invention, in the authentication system, the terminal device may include a secret information required by the access point in the certificate received by the first communication means before the access point starts communication with the terminal device. And an authentication request transmitting unit that transmits the authentication information to the authentication server together with the added secret information and the certificate.
[0018]
According to a fourth aspect of the present invention, in the authentication system, the authentication server determines whether or not the terminal device indicated by the secret information transmitted by the second communication means has a communication right with the access point. Communication right determination means for determining
The certificate received by the authorized certificate determination unit is determined to be a correct certificate, and the communication right determination unit determines that the terminal device indicated by the secret information has a communication right with the access point. And a second communication permission notifying unit for notifying the access point of permission to communicate with the terminal device when the access is performed.
[0019]
Also, in the authentication system according to the fifth aspect of the present invention, in the authentication system, the authentication server includes an authentication information transmitting unit that transmits the certificate and the secret information transmitted by the authentication request transmitting unit to the access point, The access point includes an AP regular certificate determining unit that determines whether the certificate is a correct certificate based on the secret sharing information, and a terminal device designated by the secret information has a communication right with the access point. AP communication right judgment means for judging whether or not the certificate has been received. The certificate received by the regular certificate judgment means is judged as a correct certificate, and the communication right judgment means instructs with the secret information. Start communication with the terminal device to the access point when it is determined that the terminal device to be operated has the right to communicate with the access point. Communication start determining means for determining whether to start communication.
[0020]
According to a sixth aspect of the present invention, in the authentication system, the communication network used in the network A is a mobile communication network, and the communication network used in the network B is a wireless LAN that communicates via an access point. It is characterized by.
[0021]
According to a seventh aspect of the present invention, in the authentication system, the terminal device accesses a wireless LAN wireless communication unit capable of accessing a wireless LAN as the first communication unit and a mobile communication network as the second communication unit. A mobile communication network wireless communication means, and inter-system information transmission / reception means for exchanging information by connecting the first communication means and the second communication means by wire or wirelessly.
[0022]
8. The wireless line connection control program according to claim 8, wherein the terminal device downloads a software program corresponding to the wireless LAN wireless communication unit and the mobile communication network wireless communication unit from outside in the authentication system. It is characterized by having storage means.
[0023]
According to the configuration of the present invention as described above, mobile communication in which information (authentication information such as a certificate) for authentication of a terminal device accommodated in a network B (eg, a wireless LAN) is guaranteed with high security. Since the information is transmitted to the authentication server using a wireless section between the base station of the network (network A) and the terminal device, theft and falsification of the authentication information by a third party can be more accurately prevented, and compared with the conventional case. Secure communication can be realized. Further, since the authentication of the terminal device using the wireless LAN is performed using the authentication server used in the mobile communication network, the number of authentication servers required for each different system can be reduced. As a result, even when a new system is constructed in the wireless LAN system, it is possible to construct an extremely inexpensive security system while increasing the security level of the terminal device using the wireless LAN.
[0024]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0025]
(Embodiment 1)
FIG. 1 is a schematic diagram of an authentication system according to Embodiment 1 of the present invention.
[0026]
In FIG. 1, this authentication system includes a terminal device 10 connected to a communication line capable of bidirectional communication, a communication network (NW: Network) system A (left side in the figure), a communication network system B (right side in the figure), The communication network system A and the communication network system B include a common authentication server (hereinafter, referred to as a common AAA server) 100. The communication network system A is, for example, a PDC (Personal Digital Cellular) system or an IMT-2000 system (hereinafter abbreviated as a mobile communication system), and the communication network system B is, for example, a specific area (hot spot). This is a wireless LAN system used for acquiring specific information and accessing the Internet.
[0027]
The mobile communication system includes a network A (for example, a mobile communication network) 50 and a base station 70 that performs wireless communication with the terminal device 10, and the wireless LAN system includes a network B30 (a wireless LAN network). And an access point 20. In the present embodiment, the terminal device 10 includes a wireless communication interface capable of accessing the communication line of the network A50 and the network B30, and may be a computer, a portable information terminal, a mobile phone, or the like connectable to the communication line. In this example, as shown in FIG. 2, a wireless communication interface A3 that can access the network A50 and a wireless communication interface B4 that can access the network B30 are provided in the housing of the terminal device 10, and transfer of the information is performed. This is performed on the information transfer bus line 6. The CPU 5 controls the wireless communication interface A3 and the wireless communication interface B4. In this example, to facilitate the description, the wireless communication interface A3 is defined as the terminal device A (= reference numeral 3), and the wireless communication interface B4 is defined as the terminal device B (= reference numeral 4). The radio signal generated by the terminal device A3 is radiated to the base station 70 via the antenna 1, and the radio signal generated by the terminal device B4 is radiated to the access point 20 via the antenna 2.
[0028]
Next, the outline of the present invention will be described with reference to FIG. In the mobile communication system on the left side of the figure, it is assumed that the mutual authentication between the network A50 and the terminal device A3 has already been completed, and in the wireless LAN system on the right side of the diagram, the mutual authentication between the network B30 and the terminal device B4 has not been completed. State. The most significant feature of the present invention is that in such a state, authentication of the terminal device B4 accommodated in the wireless LAN system is performed using a mobile communication system which is another system.
[0029]
In FIG. 1, first, a certificate is transmitted from the access point 20 of the wireless LAN system to the terminal device B4 ((1) dotted line). The certificate includes a) information indicating that the access point 20 has transmitted, and b) information secretly shared between the mobile communication system and the wireless LAN system (secret shared information). The certificate may be generated on the wireless LAN system side, or may be generated by a trusted third party.
[0030]
After receiving the certificate transmitted from the access point 20, the terminal device B4 adds secret ID information (described later) to the certificate and transmits the certificate to the terminal device A3. In this embodiment, since it is assumed that the terminal device A3 and the terminal device B4 are housed in the same housing (see FIG. 2), the certificate and the secret ID information are transmitted via the information transfer bus line 6. Is transferred from the terminal device B4 to the terminal device A3. After receiving the certificate and the secret ID information transferred from the terminal device B4, the terminal device A3 transmits 100 of the information to the common AAA server connected to the network A50 via the base station 70 ((2)). ). After receiving the certificate and the secret ID information sent from the terminal device A3, the common AAA server 100 notifies the access point 20 of the completion of the authentication (communication permission) if the authentication is OK ([3]). When the communication permission is notified to the access point 20 in this manner, communication between the terminal device B4 and the access point 20 is started ((4)).
[0031]
Here, the secret ID information will be described. The secret ID information is used in the case where the access point 20 authenticates the terminal device B4 prior to the communication between the terminal device B4 and the access point 20, or in the communication between the terminal device B4 and the access point 20. It may be an encryption key.
[0032]
Next, the authentication processing of the terminal device B performed by the common AAA server 100 will be described with reference to the flowchart of FIG. In describing this flowchart, it is assumed that mutual authentication between the network A50 and the terminal device A3 in the mobile communication system has already been completed, and high-security communication can be realized between the terminal device A3 and the network A50.
[0033]
3, when the common AAA server 100 receives (acquires) the certificate and the secret ID information transmitted from the terminal device A3 (S1), it checks which access point the received certificate is for. In addition, it is determined whether or not the certificate of the access point is registered properly, and whether or not the information stored in the received certificate is correct (S2). When it is determined in this determination (S2) that the certificate is valid (YES in S2), the terminal device B4 indicated by the secret ID information further refers to the secret ID information, and It is determined whether or not the terminal device B4 has the communication right with the access point 20 (YES in S3). ), And transmits a message permitting communication with the terminal device B4 to the access point 20 as authentication OK (S4). On the other hand, if the determination in any of the above (S2) and (S3) is negative (NO in S2 or NO in S3), authentication NG is notified to the access point 20 as an access from an unauthorized user.
[0034]
In the above embodiment, the certificate is transmitted from the access point 20. However, the certificate is transmitted from an access point of another third party other than the access point 20 (an access point of an access point other than its own). The certificate may be fraudulent). The present invention can invalidate such unauthorized participation in a network by a third-party access point in the following manner.
[0035]
When the third-party access point transmits the certificate for malicious purposes, etc., the common AAA server 100 does not inform only the authorized access point of the secret ID information of the terminal device B4. It cannot communicate with B4. Thereby, it is possible to prevent a malicious third party from illegally joining the network from an access point.
[0036]
As described above, according to the first embodiment, high security is assured for the information (authentication information such as a certificate) for authentication of the terminal device B4 accommodated in the network B30 (wireless LAN). Is transmitted to the common authentication server 100 using a wireless section between the base station 70 and the terminal device A3 in the network A50 (mobile communication network), so that theft or falsification of the authentication information by a third party can be prevented more appropriately. As a result, secure communication can be realized as compared with the related art.
[0037]
In addition, since the authentication of the terminal device B4 using the wireless LAN is performed using the authentication server used in the network A50, that is, the common authentication server 100, the number of authentication servers required for each different system can be reduced. .
[0038]
In addition, in the authentication of the terminal device 10 conventionally performed by the access point 20 and the hot spot authentication server 40, information exchange for authentication is performed a plurality of times (conventionally, at least four times are required; (See ▼ to ▲ 4). However, there was a drawback that the authentication protocol became complicated. However, in the present embodiment, since the number of communication times of the common AAA server 100 for mutual authentication of the terminal device B4 is only two, the authentication protocol is simplified, and the devices of the common AAA server 100 and the access point 20 are complicated. Can be prevented.
[0039]
Therefore, according to the present invention, even when a new system is constructed in a wireless LAN system, it is possible to construct an extremely inexpensive security system while increasing the security level of the terminal device B4 using the wireless LAN. .
[0040]
Further, according to the present embodiment, since the incoming call function of the terminal device B4 is not used (only the outgoing call function is used), location registration (registration of the position of the terminal device in the mobile communication network for the incoming call) is unnecessary. Become. That is, there is no need to manage the position registration information of the terminal device B4 on the network side, and the processing load on the network side can be reduced.
[0041]
(Embodiment 2)
In the first embodiment, the common AAA server 100 authenticates the terminal device B4 and notifies the access point 20 of the authentication result. However, as shown in FIG. 4, the authentication is performed by the common AAA server 100. The authentication may be performed at the access point 20 without performing the authentication. In this case, the certificate for authentication and the secret ID information are sent from the common AAA server 100 to the access point 20, and the authentication processing in the common AAA server 100 shown in FIG. This makes it possible to reduce the load on the common AAA server 100 as compared with the case of the first embodiment.
[0042]
In the first and second embodiments, the mutual authentication method using a certificate has been described as an authentication method performed between the common AAA server 100 and the terminal device B4. However, the present invention is not limited to this. is not. For example, an authentication protocol of IEEE802.1x, which is a security standard used for a wireless LAN or the like, may be mounted on the AAA server 100 and the terminal device B4 to perform authentication.
[0043]
Furthermore, in the first and second embodiments, the terminal device A3 and the terminal device B4 are housed in the same housing, and information is exchanged between them using the information transfer bus line 6. In addition to the above, the terminal device A3 and the terminal device B4 are separately prepared, and both of them are chips compatible with the short-range wireless communication standard "Bluetooth" or wireless communication standard "IEEE 802. 15.1 "(also known as WPAN standard) compliant chip may be built in, and information may be transmitted and received by short-range wireless communication. In this case, information exchanged between the terminal device A3 and the terminal device B4 is subjected to an encryption process.
[0044]
Alternatively, the functions of one terminal device may be changed by rewriting software, and the terminal devices A3 and B4 may be constructed using software defined radio technology that can support various wireless systems.
[0045]
Further, according to the present embodiment, even when the terminal device 10 moves (handover) from the area of the network A to the area of the network B30, the personal authentication on the network A with high security has already been completed. Therefore, new authentication on the network B side becomes unnecessary. Therefore, authentication protocol processing in the common authentication server 100 can be reduced.
[0046]
In the above example, the common authentication server 100 corresponds to an authentication unit, an authentication result notification unit, a regular certificate determination unit, a first communication permission notification unit, a second communication permission notification unit, and an authentication information transmission unit. In addition, the terminal device B4 corresponds to a first communication unit, a secret information adding unit, and a wireless LAN wireless communication unit, and the terminal device A3 corresponds to a second communication unit, an authentication request transmitting unit, an authentication information transmitting unit, a mobile communication network wireless unit. The access point 20 corresponds to a certificate transmitting unit, an AP regular certificate determining unit, an AP communication right determining unit, and a communication start determining unit. Further, the terminal device B4 and the terminal device A3 correspond to inter-system information transmission / reception means, and the terminal device 10 corresponds to a wireless line connection control program storage means.
[0047]
【The invention's effect】
As described above, according to the present invention, according to the present invention, information (authentication information such as a certificate) for authentication of a terminal device accommodated in a network B (eg, a wireless LAN) is transferred with high security. Since the information is transmitted to the authentication server using the wireless section between the base station of the communication network (network A) and the terminal device, theft and falsification of the authentication information by a third party can be more accurately prevented, and compared with the conventional case. And secure communication can be realized. Further, since the authentication of the terminal device using the wireless LAN is performed using the authentication server used in the mobile communication network, the number of authentication servers required for each different system can be reduced. As a result, even when a new system is constructed in the wireless LAN system, it is possible to construct an extremely inexpensive security system while increasing the security level of the terminal device using the wireless LAN.
[Brief description of the drawings]
FIG. 1 is a schematic diagram of an authentication system according to Embodiment 1 of the present invention.
FIG. 2 is a diagram illustrating a configuration example of a terminal device illustrated in FIG. 1;
FIG. 3 is a flowchart illustrating an authentication process of a terminal device B performed by a common authentication server.
FIG. 4 is a schematic diagram of an authentication system according to Embodiment 2 of the present invention.
FIG. 5 is a diagram showing an example of a conventional mutual authentication method between a terminal device and a network.
[Explanation of symbols]
1 Antenna for wireless interface A (terminal device A)
2 Antenna for wireless interface B (terminal device B)
3 Wireless interface A (terminal device A)
4 Wireless interface B (terminal device B)
5 CPU (control unit)
6 Information transfer bus line
10 Terminal device
20 access points
30 Network B (wireless LAN network)
40 Authentication server for hot spot (AAA server)
50 Network A (Mobile Communication Network)
60 Cellular Authentication Server (AAA Server)
70 base stations
100 Common Authentication Server

Claims (14)

A terminal device that is interconnected with a network (hereinafter, referred to as a network A) connected to a base station and a network (hereinafter, referred to as a network B) connected to an access point (AP) and accommodated in each network In an authentication system for performing authentication of the authentication server by an authentication server connected to the respective networks,
Applying an authentication server connected to the network A in common with the network B;
The terminal device,
First communication means for communicating with the access point of the network B;
Second communication means for communicating with a base station of the network A;
When performing communication by connecting to the network B, the second communication unit connects to a wireless line that guarantees high security with the base station and transmits authentication information to transmit information for authentication. With means,
The authentication server, based on the information for the authentication sent by the authentication information transmission means, an authentication unit that determines permission or non-permission of access to the access point to the terminal device,
An authentication result notifying unit for notifying the access point of the result of the determination. The authentication system according to claim 1,
The access point includes a certificate transmitting unit that transmits a certificate generated based on information that is secretly shared between the network B and the network A to a first communication unit of the terminal device,
The terminal device includes an authentication request transmission unit that transmits the certificate received by the first communication unit to the authentication server by the second communication unit,
The authentication server, a formal certificate determination unit that determines whether the received certificate is a correct certificate based on the secret sharing information,
A first communication permission notifying unit for notifying the access point of communication with the terminal device when the certificate received by the regular certificate determining unit is determined to be a correct certificate; An authentication system, characterized in that: The authentication system according to claim 2,
The terminal device includes secret information adding means for adding secret information required before the access point starts communication with the terminal device to the certificate received by the first communication means,
The authentication system, wherein the authentication request transmitting unit transmits the added secret information and the certificate together to the authentication server. The authentication system according to claim 2 or 3,
The authentication server includes a communication right determination unit that determines whether the terminal device indicated by the secret information sent by the second communication unit has a communication right with the access point,
The certificate received by the authorized certificate determination unit is determined to be a correct certificate, and the communication right determination unit determines that the terminal device indicated by the secret information has a communication right with the access point. An authentication system, comprising: a second communication permission notifying unit for notifying the access point of communication with the terminal device when the access is performed. The authentication system according to claim 4,
The authentication server includes an authentication information transmitting unit that transmits the certificate and the secret information transmitted by the authentication request transmitting unit to the access point,
The access point, AP regular certificate determination means for determining whether the certificate is a correct certificate based on the secret sharing information,
AP communication right determination means for determining whether the terminal device indicated by the secret information has a communication right with the access point,
The certificate received by the authorized certificate determination unit is determined to be a correct certificate, and the communication right determination unit determines that the terminal device indicated by the secret information has a communication right with the access point. An authentication system, further comprising: a communication start determining unit configured to start communication with the terminal device in the access point when the authentication is performed. The authentication system according to any one of claims 1 to 5,
An authentication system, wherein the communication network used in the network A is a mobile communication network, and the communication network used in the network B is a wireless LAN communicating via an access point. The authentication system according to any one of claims 1 to 6,
The terminal device includes: a wireless LAN wireless communication unit capable of accessing a wireless LAN as the first communication unit; a mobile communication network wireless communication unit capable of accessing a mobile communication network as the second communication unit;
An authentication system, comprising: inter-system information transmission / reception means for exchanging information by connecting the first communication means and the second communication means by wire or wirelessly. The authentication system according to claim 7,
An authentication system, characterized in that the terminal device comprises a wireless line connection control program storage means for externally downloading a software program corresponding to the wireless LAN wireless communication means and the mobile communication network wireless communication means. A terminal device that is interconnected with a network (hereinafter, referred to as a network A) connected to a base station and a network (hereinafter, referred to as a network B) connected to an access point (AP) and accommodated in each network In an authentication method of performing authentication of the authentication server by an authentication server connected to the respective networks,
Applying an authentication server connected to the network A in common with the network B;
The access point transmits a certificate generated based on information secretly shared between the network B and the network A to a terminal device that is to connect to the network B and perform communication. ,
The terminal device receives the certificate using communication means for communicating with an access point with the network B provided with the certificate in advance,
Using the communication means for communicating with the base station with the network A provided in advance, the received certificate is connected to the wireless line that guarantees high security with the base station and transmitted to the authentication server. And
The authentication server determines whether the certificate is a correct certificate based on information that is secretly shared between the network B and the network A,
An authentication method, comprising: determining whether or not to permit the access point to communicate with the terminal device based on the determination and notifying the access point. The authentication method according to claim 9,
When the terminal device receives the certificate using a communication unit that communicates with an access point with the network B, the access point transmits confidential information required prior to the start of communication with the terminal device. Attached to the certificate,
An authentication method, comprising: using a communication unit that communicates with a base station with the network A, transmitting the combined secret information and the certificate together to the authentication server. In the authentication method according to claim 9 or 10,
The authentication server determines whether the certificate transmitted from the terminal device is a correct certificate based on information that is secretly shared between the network B and the network A, and matches the certificate with the certificate. It is determined whether or not the terminal device indicated by the transmitted secret information has the right to communicate with the access point, and from these determination results, whether to permit the access point to perform communication with the terminal device is determined. An authentication method characterized by determining whether or not to perform the notification. The authentication method according to claim 10,
The authentication server transmits the certificate and the secret information transmitted from the terminal device to the access point,
The access point determines whether the certificate is a correct certificate based on the secret sharing information, and determines whether a terminal device indicated by the secret information has a communication right with the access point. Determine whether the terminal device indicated by the secret information transmitted in conjunction with the certificate has the right to communicate with the access point,
When the certificate is determined to be a correct certificate, and it is determined that the terminal device indicated by the secret information has the right to communicate with the access point, communication with the terminal device is started. Authentication method to use. A terminal device that is interconnected with a network (hereinafter, referred to as a network A) connected to a base station and a network (hereinafter, referred to as a network B) connected to an access point (AP) and accommodated in each network In a terminal device used in an authentication system for performing authentication of an authentication server connected to the respective networks,
First communication means for communicating with an access point of the network B and second communication means for communicating with a base station of the network A;
When performing communication by connecting to the network B, a certificate generated based on information secretly shared between the network B and the network A is transmitted to the base station by the second communication means. A terminal which is connected to a wireless line which ensures high security between the terminal and the authentication server and transmits the request to the authentication server. The terminal device according to claim 13,
The certificate includes secret information adding means for adding secret information required before the access point starts communication with the terminal device,
Connecting the secret information and the certificate added by the secret information adding means to the authentication server by connecting to the wireless line that ensures high security with the base station by the second communication means; An authentication system characterized by the following.

Images