JP2004207965A - High speed authentication system and method for wireless lan - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a high speed authentication system for avoiding the occurrence of communication interruption due to the processing delay of an authentication server corresponding to the increased demand of Internet connection by a wireless LAN, a method for relieving a load on a server in a wireless LAN system, and also a method for strengthening terminal authentication, AP authentication and encryption so as to enhance the security level. <P>SOLUTION: A terminal 1 generates a challenge value from time information of a secret key, calculates a chap value on the basis of the challenge value and a user password, and transmits the time information, an authentication request, and a network information acquisition request to an AP2. The AP2 checks the time information, transfers the challenge value, the chap value, the time information and the authentication request to a server 3, and transfers the network information acquisition request to a router 4. The server 3 calculates the chap value on the basis of the user password and the challenge value and transmits an authentication result of the comparison and collation of the chap value with the received chap value, a hash value calculated from the time information and the secret key to the AP2. The AP2 receives the authentication result and the hash value, attaches the network information from the router 4 to the hash value and transfers the result to the terminal 1. The terminal 1 receives the network, the authentication result, the hash value, and the network information and makes communication with the Internet when the authentication is successful. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to authentication of wireless LAN Internet access, and more particularly to a high-speed authentication method and a high-speed authentication method for a wireless LAN.
[0002]
[Prior art]
A conventional wireless LAN Internet access authentication technology and its problems will be described below.
[0003]
The first conventional authentication technique is WEP (Wired Equivalency Privacy), which is a name of an encryption communication protocol used in IEEE802.11b. In wireless LAN communication, the confidentiality of data is determined by using an encryption technique. Is a way to increase Normally, encryption is performed using a 40-bit secret key, but a 128-bit key can also be used. Keys are not exchanged directly, but are exchanged in a challenge and response format. However, there are some security holes such as disabling the encryption when the "common encryption key" is detected, and IEEE is working on the specification of WEP2 which replaces the conventional WEP. However, WEP2 is not perfect because it already includes security holes similar to some WEPs. When WEP is actually used, an ESS-ID password method, a MAC address registration method, an encryption protocol developed in-house, and the like are often used together with WEP.
[0004]
The second conventional authentication technology ESS-ID uses an ID for identifying an IEEE 802.11 standard wireless LAN, and in a wireless LAN, only the same ID can communicate with each other, and functions as a kind of password. However, there is a problem that communication can be performed with a wireless LAN to which the same ESS-ID is set by chance, a connection can be established with any AP if the ID of the wireless LAN card is set to ANY, and leakage occurs easily.
[0005]
A third conventional authentication technique is MAC address authentication, in which a MAC address represented by a combination of a unique ID number managed by the IEEE and assigned to each card and a number uniquely assigned to each card by a manufacturer is used. This is an authentication method that is registered in the server in advance and permits only registered users. However, this also has a problem that the MAC is easily leaked by radio wave interception.
[0006]
The fourth conventional authentication technique is IEEE 802.1x, which is strongly recognized as a standard that defines a method of user authentication in a LAN, particularly as a user authentication specification in a wireless LAN such as IEEE 802.11b. In this system, all communications from unauthenticated clients are blocked except for authentication requests, and only authorized users are allowed to communicate. Further, in order to prevent another user from taking over the communication port, it is also possible to perform authentication again periodically. Furthermore, the server used for user authentication is RADIUS or the like, and the same server as for dial-up connection can perform authentication processing. Note that since the communication data is not encrypted by IEEE 802.1x itself, if encryption is necessary, another encryption method must be used. Authentication protocols include EAP-MD5, which is a CHAP authentication method, and EAP-TLS, which is an electronic certificate authentication method. However, the operation of both EAP-MD5 and EAP-TLS is complicated as shown in FIGS. 10 and 11, and the authentication sequence between the terminal and the server is complicated. There is a problem that server processing delay may be feared due to a high server load due to the increase in wireless LAN access.
[0007]
Next, a technique described in a patent publication related to the present invention will be described.
[0008]
In the "mobile data communication apparatus" disclosed in Japanese Patent Application Laid-Open No. 9-130397, an IP address is assigned by passing a request / response message, and a simultaneous authentication method is performed by inputting an ID / password of a terminal. A device and a method having a feature of reducing a load are shown.
[0009]
In the “authentication method and authentication device in wireless LAN system” disclosed in Japanese Patent Application Laid-Open No. 2001-111544, a MAC address authentication method of a wireless LAN system conforming to IEEE802.11 and a challenge text transmitting unit of a server are predetermined. Encryption authentication based on a common key that has an expiration date and an encryption algorithm that is encrypted based on an encryption key that performs MAC address authentication using a unique open system authentication method when the common key expires. Authentication system equipped with an authentication system and a WEP encryption system, a protocol for realizing this system, a MAC address table updating function, and a function of independently performing MAC address authentication when a server fails. A wireless base station device is shown. The problem of this technique is that security is weak because only MAC address authentication is performed.
[0010]
In the “wireless communication system, wireless terminal, wireless base station, authentication card, and authentication method” disclosed in JP-A-2001-189722, among wireless communication systems using a wireless LAN, a wireless terminal, a wireless base station, And an authentication card. The method relates to an authentication method for a wireless communication system, and particularly relates to an authentication technique between wireless terminals or between a wireless base station and a wireless terminal. It is a system composed of an authority / authentication card, not a system using an authentication server. The encryption / decryption method is an exchange method between a terminal and a wireless base station, and has features using a pattern P, an authentication algorithm, a challenge text T, and a key.
[0011]
[Patent Document 1]
Japanese Patent Application Laid-Open No. Hei 9-13097 (Claim 1, FIG. 1)
[Patent Document 2]
JP-A-2001-111544 (Claims 1, 7, FIG. 1)
[Patent Document 3]
JP 2001-189722 A (claims, FIG. 1)
[0012]
[Problems to be solved by the invention]
The first problem is that in a wireless LAN system, when a terminal is connected to the Internet, or when a terminal is moved or an AP is reconnected due to a roaming service, it takes too much time to perform authentication. Is concerned. The reason for this is that with regard to wireless LAN systems that will be increasingly used in the future, voice and security improvements have made authentication processing when connecting to the Internet and acquisition of network information more complicated, and the processing and sequence are becoming more complicated. Due to the increase in authentication access accompanying the movement of terminals and terminals, the authentication server in charge of processing is increasingly required to have high specifications. On the other hand, the specifications of the server are conventionally determined and introduced based only on the authentication operation at the time of system connection with the assumed number of clients, and do not take into account the increase in authentication access accompanying roaming or terminal movement. Also, it is not possible to easily improve the specifications of the server once introduced.
[0013]
The second problem is that the terminal authentication security level of the wireless LAN system is weak. The reason is that the current terminal authentication methods ISS-ID and MAC address authentication are each vulnerable, and even with IEEE802.1x authentication, a security hole has been found at present, preventing spoofed wireless terminals. I can't.
[0014]
A third problem is that the AP authentication security level of the wireless LAN system is weak. The reason is that the current terminal AP authentication method relies only on weak WEP encryption technology, and it is easy to find out the “common encryption key”. It cannot prevent false wireless base station entry.
[0015]
The fourth problem is that the radio of the wireless LAN system is easy to eavesdrop, and the MAC address, the authentication IP, and the user password are easily deciphered.
[0016]
SUMMARY OF THE INVENTION It is an object of the present invention to provide a high-speed authentication technology for avoiding a communication disconnection caused by an authentication server processing delay corresponding to an increase in demand for a wireless LAN Internet connection, a server load reduction technology for a wireless LAN system, and a terminal authentication. Another object of the present invention is to provide a technique for strengthening AP authentication and encryption and improving a security level.
[0017]
[Means for Solving the Problems]
A high-speed authentication method for a wireless LAN according to the present invention includes a wireless terminal (terminal), a wireless base station (AP) that transmits a beacon message including time information to the terminal, and an authentication server (server) connected to the AP. A wireless LAN high-speed authentication method including the AP and a router connected to a network, wherein the terminal receives the beacon message, recognizes the AP, and receives a secret key exchanged in advance and the AP from the AP. A challenge value is generated from the generated time information, a chap value is generated from the generated challenge value and the user password, and an authentication request and a network information acquisition request are transmitted to the AP together with the time information. Receiving, from the AP, a hash value generated by the server and netsark information in response to the network information acquisition request; When the authentication result is unsuccessful, the communication is not performed to the network.When the authentication result is successfully authenticated, the communication is performed to the network.The AP checks time information received from the terminal. Transfer the received challenge value, chap value, time information and authentication request to the server, transfer the network information acquisition request received from the terminal to the router, receive the authentication result and the hash value from the server, The server adds the network information received from the router and transfers it to the terminal. The server generates a chap value from the user password and the challenge value received from the AP, and compares the generated chap value with the received chap value. The verified authentication result, the time information, and the secret key exchanged in advance. The generated hash value, characterized in that transmitted to the AP.
[0018]
In the high-speed authentication method for a wireless LAN according to the present invention, the terminal compares and compares a hash value generated from the time information and the secret key with a received hash value, sets a matched hash value as a session key, The authentication header is added to the packet to be transmitted.
[0019]
A high-speed authentication method for a wireless LAN according to the present invention includes a wireless terminal (terminal), a wireless base station (AP) that transmits a beacon message including time information to the terminal, and an authentication server (server) connected to the AP. A high-speed authentication method for a wireless LAN including the AP and a router connected to a network, wherein the terminal receives the beacon message, recognizes the AP, and uses a secret key exchanged in advance to access the AP. A hash value is generated by a one-way hash function based on the received time information, and the generated hash value, the time information, the authentication request, and the network information acquisition request are sent to the AP, and an authentication result for the authentication request is output. And the network information corresponding to the network information acquisition request, and when the authentication result indicates that the authentication has failed, communication with the network is not performed. When the authentication result is successful, the communication is performed to the network, the AP checks the time information received from the terminal, and transfers the hash value, the time information, and the authentication request received from the terminal to the server. Transferring the network information acquisition request received from the terminal to the router, checking the hash value received from the server, and transferring the authentication result received from the server and the network information received from the router to the terminal. The server generates a hash value from the secret key exchanged in advance with the time information received from the AP, compares the generated hash value with the hash value received from the AP, and compares the authentication result with the hash value. Are sent to the AP.
[0020]
A high-speed authentication method for a wireless LAN according to the present invention is characterized in that the terminal uses the hash value as a session key and adds an authentication header based on the session key to a packet to be transmitted.
[0021]
A high-speed authentication method for a wireless LAN according to the present invention includes a wireless terminal (terminal), a wireless base station (AP) that transmits a beacon message including time information to the terminal, and an authentication server (server) connected to the AP. A high-speed authentication method for a wireless LAN including the AP and a router n connected to a network, wherein the terminal obtains a challenge value, a chap value, and a hash value from a secret key exchanged in advance, the time information, and a user password. A forward message including a generated challenge value, a chap value, and a hash value, an authentication request, and a network information acquisition request is transmitted through the AP, and the server transmits the user password and the received challenge value. The authentication result based on the chap value generated in the above and the received chap value, the received time information and the secret key Authentication result by the hash value and the hash value received, characterized in that the return message including the generated network information from the hash value and the router has sent via the AP.
[0022]
The high-speed authentication method for a wireless LAN according to the present invention is characterized in that the network is the Internet.
[0023]
In the high-speed wireless LAN authentication method of the present invention, a wireless base station (AP) transmits a beacon message including time information to a wireless terminal (terminal), and the terminal receives the beacon message and recognizes the AP. Step, the terminal generates a challenge value based on the time information received from the AP using a secret key exchanged in advance, calculates a chap value from the challenge value and a user password, together with the time information Sending an authentication request to the AP, the AP checking the received time information, and transferring the received challenge value, chap value, time information and authentication request to the server; Calculates the chap value from the user password and the received challenge value, and sends the authentication result compared with the received chap value. And the AP transfers the authentication result to the terminal. The terminal receives the authentication result, and communicates with the network if the authentication result is successful. If not, not communicating with the network.
[0024]
In the high-speed authentication method for a wireless LAN according to the present invention, a wireless base station (AP) transmits a beacon message including time information to a wireless terminal (terminal), and the terminal receives the beacon message and recognizes the AP. Sending the time information to an authentication server (server) via the AP; and the server via the AP calculates a hash value calculated from a secret key exchanged in advance with the received time information. Transmitting to the terminal; and calculating, by the terminal, a hash value from the secret key exchanged in advance with the time information, comparing the received hash value with the received hash value, and setting a session key if the hash value matches. It is characterized by the following.
[0025]
The high-speed authentication method for a wireless LAN according to the present invention is characterized in that the terminal further comprises a step of generating an authentication header based on the session key and adding the authentication header to a packet to be transmitted.
[0026]
In the high-speed wireless LAN authentication method of the present invention, a wireless base station (AP) transmits a beacon message including time information to a wireless terminal (terminal), and the terminal receives the beacon message and recognizes the AP. Step, the terminal generates a challenge value from a secret key exchanged in advance with an authentication server (server) and time information received from the AP, and calculates a chap value from the generated challenge value and a user password. Transmitting an authentication request and a network information acquisition request together with the time information to the AP, wherein the AP checks the received time information, and transmits the received challenge value, chap value, time information and authentication request to the server. Transferring the received network information acquisition request to a router; and A chap value is independently calculated from the password and the received challenge value, and an authentication result compared with the received chap value and a hash value calculated from a secret key exchanged in advance with the time information are transmitted to the AP. Step, the AP receives the authentication result and the hash value, adds the network information obtained from the router, and transfers it to the terminal, the terminal, the terminal, the network information, the authentication result and the Receiving the hash value and the network information and communicating with the network when the authentication result is successful, and not communicating with the network when the authentication result is unsuccessful.
[0027]
In the high-speed authentication method for a wireless LAN according to the present invention, the terminal compares and compares the time information with a hash value calculated from the secret key and a received hash value, sets a matching hash value as a session key, Adding an authentication header to the packet to be transmitted.
[0028]
In the high-speed authentication method for a wireless LAN according to the present invention, a wireless base station (AP) transmits a beacon message including time information to a wireless terminal (terminal), and the terminal receives the beacon message and recognizes the AP. Sending the time information to an authentication server (server) via the AP; and receiving the time information from the AP using a secret key exchanged in advance with the authentication server (server). Calculating a hash value hashed by a one-way hash function based on the received time information, sending an authentication request and a network information acquisition request together with the time information to the AP, and checking the time information received by the AP. Transferring the received hash value, time information, and authentication request to the server, and transferring the received network information acquisition request to the router. A step in which the server independently calculates a hash value from a secret key exchanged in advance with the received time information, and sends to the AP the authentication result and the hash value that are compared with the received hash value, and The AP confirms the received hash value, and transfers the received authentication result and the network information acquired from the router to the terminal; and the terminal transmits the network information and the authentication result from the AP to the terminal. And communicating to the network when the authentication result is successful, and not communicating to the network when the authentication result is unsuccessful.
[0029]
The high-speed authentication method for a wireless LAN according to the present invention is characterized by further comprising the step of the terminal using the hash value as a session key and adding an authentication header based on the session key to a packet to be transmitted.
[0030]
The high-speed authentication method for a wireless LAN according to the present invention is characterized in that the network is the Internet.
[0031]
BEST MODE FOR CARRYING OUT THE INVENTION
<First Embodiment> FIG. 1 shows an example of the configuration of an authentication system for a wireless LAN (Local Area Network). A wireless terminal 1 having wireless access means to the wireless base station 2 and a portable means; a wireless access means to the wireless terminal 1; an Internet access router (router) 4 having a function of connecting to the Internet (network) 5; A wireless base station 2 provided with means for connecting to an authentication server 3 for realizing an authentication function; an authentication server 3 connected to the wireless base station 2 for determining an authentication result according to a predetermined authentication procedure; and a closed authentication system And an Internet access router 4 provided with a means for connecting to the Internet 5.
[0032]
The wireless terminal 1 is, for example, an information processing device such as a personal computer, and operates according to a program stored in a storage unit, and is used only by a user having a password, for example. The wireless base station 2, the authentication server 3, and the Internet access router 4 also have a computer and operate according to a program stored in the storage unit.
[0033]
It should be noted that each device shown in this drawing represents an image, and does not specify its shape. Hereinafter, the wireless terminal 1 will be described as the terminal 1, the wireless base station 2 as the AP 2, the authentication server 3 as the server 3, and the Internet access router 4 as the router 4.
[0034]
FIG. 2 is a configuration (logical configuration) diagram of the element blocks of the wireless LAN high-speed authentication system of the present invention. When the AP 2 is recognized, an AP recognition block 11 which is a means of the terminal 1 for obtaining the time information (t), and a terminal authentication (CHAP) block 12 which is a terminal authentication means using a challenge value and a chap value (CHAP). A terminal authentication (authentication header) block 13 as terminal authentication means for adding an authentication header using a session key as a temporary key to a packet to be transmitted, and an AP authentication (authentication header) block 14 as the same AP authentication means. And a network information acquisition block 15 which is network information acquisition means. Further details will be described. When the terminal 1 recognizes the AP 2, the AP recognition block 11, which is a means for receiving a beacon message including time information transmitted periodically from the AP 2, calculates a challenge value and a chap value from the secret key, the time information, and the password. A terminal authentication (CHAP) block 12, which is a terminal authentication means for comparing and collating between the terminal 1 and the server 3, and calculating a hash value from the secret key and the time information. A terminal authentication (authentication header) block 13 which is a terminal authentication means for generating an authentication header from a temporary key called and adding it to a packet to be transmitted, and a session key for every packet transmitted from the AP 2 for each packet. An AP authentication (authentication header) block 14, which is an AP authentication means that is always added as an authentication header, and the terminal 1 4 has become the high-speed authentication unit and a network information acquisition block 15. is a means of obtaining network information such as IP address and default gateway from.
[0035]
Next, an operation procedure from the authentication request to the authentication result after the LINK of the wireless LAN system is established will be described.
[0036]
In the first operation (see the beacon transmission operation of the wireless base station in FIG. 3), the AP 2 periodically broadcasts a beacon message including time information (t) at the time of transmission (step A1), and the terminal 1 transmits a beacon message. That is, AP2 is recognized when the message is received (step A2). (End of Fig. 3)
The second operation (see the CHAP value authentication operation sequence of the wireless terminal in FIG. 4) is one of the terminal authentication means, in which the terminal 1 and the server 3 and the AP 2 and the server 3 exchange a secret key (k) in advance. In advance, the terminal 1 broadcasts the transmission of the beacon message including the time information (t) from the AP 2 and recognizes the AP 2 (step B1). Next, the terminal 1 generates a challenge value (Chg) based on the time information (t) received from the AP 2 using the secret key (k), and generates a chap from the challenge value (Chg) and the password (user password). The value (CHAP) is calculated, and transmitted to the target AP2 together with the time information (t) as an authentication request message (step B2). The AP 2 checks the time information (t), and transfers only the packet within a specified time as being transmitted from the authorized terminal 1 to the server 3. Packets other than the prescribed time are discarded (step B3). The server 3 independently calculates a chap value (CHAP) from the user password stored in the server 3 and the received challenge value (Chg), compares the chap value (CHAP) with the received chap value (CHAP), and if the password matches, it matches the AP2. An authentication success message (authentication result message) is sent. If not, an authentication failure (Failure) message (authentication result message) is transmitted (step B4). AP2 transfers the authentication result message to terminal 1 to terminal 1 (step B5). Terminal 1 receives the authentication result message. If the authentication result message indicates that the authentication is successful (Success), communication to the Internet 5 is enabled thereafter, and if the authentication fails (Failure), communication to the Internet 5 is disabled (step B6). (End of Fig. 4)
The third operation is (see the operation sequence for creating a session key used in the authentication header in FIG. 5). The terminal 1 and the server 3 and the AP 2 and the server 3 exchange a secret key (k) in advance so that the secret key is not known.
[0037]
The terminal 1 receives the transmission of the beacon message including the time information (t) from the AP 2 by broadcast, recognizes the AP 2, and sends the time information (t) to the server 3 (step C1). The server 3 calculates a hash value Hk (t) by hash calculation from the time information (t) and the secret key (k), and transmits the hash value Hk (t) to the terminal 1 (step C2). Next, the terminal 1 independently calculates the hash value Hk (t) by the hash value calculation from the time information (t) and the secret key (k), compares the hash value Hk (t) with the received hash value Hk (t), (Terminal authentication) A temporary key called a session key is used (step C3). Based on this, an authentication header is generated, and a different authentication header is added to all packets transmitted for each user (step C4). (End of Fig. 5)
Next, the authentication header format will be described. FIG. 6 shows an authentication header format of the wireless terminal and the wireless base station. The authentication header format is based on a 1-byte next header 21, a 1-byte payload length 22, a 2-byte reserved space 23, a 4-byte Security Parameters Index (SPI) 24, a 4-byte serial number 25, and an 8-byte authentication data 26. Be composed. Authentication data 26 includes session key information.
[0038]
The fourth operation is the authentication means of AP2, and is realized by always adding the session key created by the second terminal authentication means as an authentication header to every packet transmitted from AP2 for each packet. . Since only the correct AP2 can have a common session key with the terminal 1 or the server 3, both the terminal 1 and the server 3 can check whether the AP2 is the correct base station by checking the authentication header of the packet transmitted from the AP2. When transferring the authentication result message sent from the server 3 or the network information returned from the router 4 to the terminal 1, the AP 2 adds an authentication header using a session key and transmits the authentication result message to the terminal 1. The terminal 1 can confirm whether the message is transmitted from the correct AP2, and prevents the terminal 1 from being connected to a fake base station.
[0039]
In the fifth operation (see the network information acquisition operation sequence of the wireless terminal in FIG. 7), the terminal 1 acquires network information after recognizing the AP2. First, the terminal 1 transmits network information such as an IP address and a default gateway obtained from a DHCP (Dynamic Host Configuration Protocol) or a PPP (Point to Point Protocol) to the AP 2 as an information acquisition request message (step D1). Upon receiving the information acquisition message, the AP 2 transfers the information acquisition message to the router 4 and requests information (step D2). Upon receiving the information acquisition message request from AP2, router 4 returns its own network information to AP2 (step D3). Upon receiving the network information from the router 4, the AP 2 transfers the network information to the terminal 1 (step D4). By doing so, the terminal 1 acquires network information (step D4). (The above is FIG. 7)
The sixth operation (the wireless LAN high-speed authentication operation sequence in FIG. 8, see FIGS. 5 to 7) integrates the above-described authentication means and network information acquisition means to realize the high-speed authentication method by the following procedure. .
[0040]
AP2 broadcasts a beacon message including time information (t) (step E1). Terminal 1 recognizes AP2 by receiving the beacon message. The terminal 1 generates a challenge value (Chg) based on the time information (t) received from the AP 2 using a secret key (k) exchanged in advance with the server 3, and generates a challenge value (Chg). A chap value (CHAP) is calculated from the password of the user (user), and an authentication request message and a network information acquisition request message (collectively referred to as outward messages) are transmitted to the target AP 2 together with time information (t) (step E2). The AP 2 checks the time information (t), regards only packets within a specified time as being transmitted from the authorized terminal 1 (step E3), and issues a challenge value (Chg), a chap value (CHAP), and time information (t). ) And the authentication request message is transferred to the server 3 (step E4). At the same time, a network information acquisition request message is transferred to the router 4 (step E5). All packets other than the prescribed time are discarded (step E3).
[0041]
The server 3 independently calculates a chap value (CHAP) from the user password stored in the server 3 and the received challenge value (Chg), compares the chap value (CHAP) with the received chap value (CHAP), A hash value Hk (t), which is a value hashed from the information (t) and the secret key (k), is attached, and an authentication success (Success) message (authentication result message) is sent to the AP 2. If not, an authentication failure (Failure) message (authentication result message) is sent (step E6). Upon receiving the authentication result message, the AP 2 adds the network information acquired from the router 4 and transfers the authentication result message (collectively referred to as a return message) to the terminal 1 (steps E7 to E10). Upon receiving the authentication success message, all packets from the terminal 1 are connected to the Internet 5 via the router 4.
[0042]
The terminal 1 receives the network information and an authentication result (Success or Failure) message. When the authentication success message is received, connection to the Internet 5 is enabled (step E11). At this time, the hash value Hk (t) calculated from the time information (t) and the secret key (k) is compared with the hash value Hk (t) sent from the server 3, and the hash value Hk (t) matches (terminal authentication). Hk (t) is set as a session key that is a temporary secret key (step E12). The terminal 1 and the AP 2 add an authentication header using a session key to all packets transmitted thereafter. The format is the same as that of FIG. 6 (step E13). (The above is FIGS. 5 to 8)
As described above, in the first embodiment described above, the server 3 or the router 4 receives the message (outgoing message) transmitted from the terminal 1 via the AP2, and sends the message (return message) via the AP2. In this manner, authentication of the terminal 1, authentication of the AP 2, and acquisition of network information can be performed by one round trip message exchange.
[0043]
<Second Embodiment> A second embodiment to which the present invention is applied will be described. The feature of the embodiment described here is that the value Hk (t) value hashed by the one-way hash function is shared with the terminal authentication and the temporary secret key (session key), thereby being further simplified. . Other points (such as the configuration of the wireless LAN authentication system) are the same as those of the first embodiment.
[0044]
FIG. 9 is an example of a high-speed authentication operation sequence of the wireless LAN according to the second embodiment.
[0045]
AP2 broadcasts a beacon message including time information (t) (step F1). Terminal 1 recognizes AP2 by receiving the beacon message. The terminal 1 uses a secret key (k) exchanged in advance with the server 3 and a hash value Hk which is a value hashed by a one-way hash function based on the time information (t) received from the AP 2. (T) is calculated, and an authentication request message and a network information acquisition request message (collectively referred to as outward messages) are transmitted to the target AP 2 together with the time information (t) (step F2). The AP 2 checks the time information (t), regards only the packet within a specified time as being transmitted from the authorized terminal 1, and transmits the hash value Hk (t), the time information (t), and the authentication request message to the server 3. (Steps F3 and F4). At the same time, the network information acquisition information is transferred to the router 4 (steps F4 and F5). All packets other than the specified time are discarded.
[0046]
The server 3 independently calculates the hash value Hk (t) from the received time information (t) and the secret key (k), compares the hash value Hk (t) with the received hash value Hk (t) (terminal authentication), and An authentication success message is sent to AP2 together with the hash value Hk (t). If not, an authentication failure message is sent (step F6). The AP 2 confirms the hash value Hk (t) and, upon receiving the authentication result message, transfers the authentication result message (collectively referred to as a return message) to the terminal 1 with the network information obtained from the router 4 added (step F7). To F10). Upon receiving the authentication success message, all packets from the terminal 1 are connected to the Internet 5 via the router 4. The terminal 1 receives the network information and an authentication result (Success or Failure) message. When an authentication success message is received, connection to the Internet 5 is enabled (step F11). Further, the hash value Hk (t) of the terminal 1 is set as a session key which is a temporary secret key (step F12). The terminal 1 and the AP 2 add an authentication header using a session key to all packets transmitted thereafter. The format is the same as that of FIG. 6 (step F13). (FIGS. 6, 7, and 9)
As described above, also in the second embodiment described above, the server 3 or the router 4 receives the message (outgoing message) transmitted from the terminal 1 via the AP2, and sends the message (return message) via the AP2. In this manner, authentication of the terminal 1, authentication of the AP 2, and acquisition of network information can be performed by one round trip message exchange.
[0047]
【The invention's effect】
The first effect is that authentication of the terminal, authentication of the AP, and acquisition of network information are all performed by one access (one round-trip message exchange), so that authentication between the terminal and the server can be performed at high speed.
[0048]
The second effect is that individual information such as an ID, a password, a MAC address, and an IP address is not stolen even in wireless communication. The reason is that the secret key itself does not flow in the wireless section, so that the secret key between the terminal and the server cannot be seen. That is, since a primary key (session key) calculated based on the secret key cannot be detected, data of a packet to be transmitted is not decrypted.
[0049]
The third effect is that the authentication of the wireless terminal is strong. The reason is that the current time information from the wireless terminal is checked by the AP to confirm whether it is within the specified time, and the chap value is calculated from the time information, the password and the secret key that does not leak, so that the calculated value is imitated. This is because it is impossible to determine whether the terminal is an impersonating terminal by always attaching an authentication header created from a secret key that does not leak to a packet transmitted from the wireless terminal.
[0050]
The fourth effect is that the authentication of the wireless base station is strong. The reason is that a false wireless base station can be eliminated by always attaching an authentication header made from a secret key that does not leak to a packet transmitted from the wireless base station.
[Brief description of the drawings]
FIG. 1 is a configuration example of a wireless LAN authentication system according to the present invention.
FIG. 2 is a configuration diagram of an element block of the wireless LAN high-speed authentication system of the present invention.
FIG. 3 shows a beacon transmission operation of the wireless base station.
FIG. 4 is a CHAP value authentication operation sequence of the wireless terminal.
FIG. 5 shows an operation sequence for creating a session key used in an authentication header.
FIG. 6 shows an authentication header format of a wireless terminal and a wireless base station.
FIG. 7 is a network information acquisition operation sequence of the wireless terminal.
FIG. 8 is a high-speed authentication operation sequence of a wireless LAN.
FIG. 9 is an example of a high-speed authentication operation sequence of a wireless LAN according to the second embodiment.
FIG. 10 is an EAP-MD5 protocol operation sequence of IEEE 802.1x among conventional authentication methods.
FIG. 11 is an EAP-TLS protocol operation sequence of IEEE 802.1x among conventional authentication methods.
[Explanation of symbols]
1 wireless terminal
2 wireless base stations
3 Authentication server
4 Internet access router
5 Internet
11 AP recognition block
12 Terminal authentication (CHAP) block
13 Terminal authentication (authentication header) block
14 AP authentication (authentication header) block
15 Network information acquisition block
21st header
22 Payload length
23 reserved space
24 Security Parameters Index (SPI)
25 serial number
26 Authentication data

Claims (14)

A wireless terminal (terminal), a wireless base station (AP) that transmits a beacon message including time information to the terminal, an authentication server (server) connected to the AP, and a router connected to the AP and a network A high-speed authentication method for a wireless LAN,
The terminal receives the beacon message, recognizes the AP, generates a challenge value from a secret key exchanged in advance and time information received from the AP, and generates a chap value from the generated challenge value and the user password. Generating an authentication request and a network information acquisition request together with the time information to the AP, and transmitting the authentication result for the authentication request, the hash value generated by the server, and the netsark information for the network information acquisition request to the AP. When the authentication result is authentication failure, the communication is not performed to the network, and when the authentication result is authentication successful, the communication is performed to the network.
The AP checks the time information received from the terminal, transfers the challenge value, the chap value, the time information and the authentication request received from the terminal to the server, and transmits the network information acquisition request received from the terminal to the router. Transfer to the terminal by adding the network information received from the router receiving the authentication result and the hash value from the server,
The server generates a chap value from the user password and a challenge value received from the AP, compares the generated chap value and the received chap value with the authentication result, the time information, and a secret key exchanged in advance. And sending the generated hash value to the AP. The terminal compares and compares a hash value generated from the time information and the secret key with a received hash value, sets a matched hash value as a session key, and adds the authentication value to the packet to be transmitted with an authentication header based on the session key. The wireless LAN high-speed authentication method according to claim 1, wherein: A wireless terminal (terminal), a wireless base station (AP) that transmits a beacon message including time information to the terminal, an authentication server (server) connected to the AP, and a router connected to the AP and a network A high-speed authentication method for a wireless LAN,
The terminal receives the beacon message, recognizes the AP, generates a hash value with a one-way hash function based on time information received from the AP using a secret key exchanged in advance, and generates a hash value. Sends the obtained hash value, the time information, the authentication request, and the network information acquisition request to the AP, receives the authentication result for the authentication request and the network information for the network information acquisition request, and when the authentication result indicates that the authentication has failed. Communicates with the network when the authentication result is successful without communicating with the network,
The AP checks the time information received from the terminal, transfers the hash value, the time information, and the authentication request received from the terminal to the server, and transfers the network information acquisition request received from the terminal to the router. Confirming the hash value received from the server, transferring the authentication result received from the server and the network information received from the router to the terminal,
The server generates a hash value from a secret key exchanged in advance with the time information received from the AP, and compares the hash value with an authentication result obtained by comparing and matching the generated hash value and the hash value received from the AP. A high-speed wireless LAN authentication method, wherein the high-speed authentication is transmitted to the AP. The wireless LAN high-speed authentication method according to claim 3, wherein the terminal uses the hash value as a session key and adds an authentication header based on the session key to a packet to be transmitted. A wireless terminal (terminal), a wireless base station (AP) that transmits a beacon message including time information to the terminal, an authentication server (server) connected to the AP, and a router n connected to the AP and a network. Wireless LAN high-speed authentication method,
The terminal generates a challenge value, a chap value, and a hash value from the secret key exchanged in advance, the time information, and the user password, and obtains the generated challenge value, chap value, and hash value, an authentication request, and network information acquisition. A forward message including the request, via the AP,
The server generates an authentication result using the user password and the chap value generated based on the received challenge value and the received chap value, an authentication result based on the received time information and the hash value generated using the secret key, and the received hash value. A high-speed authentication method for a wireless LAN, wherein a return path message including the hash value and network information from the router is transmitted through the AP. 6. The wireless LAN high-speed authentication method according to claim 1, wherein the network is the Internet. A wireless base station (AP) transmitting a beacon message including time information to a wireless terminal (terminal), wherein the terminal receives the beacon message and recognizes the AP;
The terminal generates a challenge value based on time information received from the AP using a secret key exchanged in advance, calculates a chap value from the challenge value and a user password, and issues an authentication request together with the time information. Sending to the AP;
The AP checking the received time information and transferring the received challenge value, chap value, time information and authentication request to the server;
A step in which the server calculates a chap value from the user password and the received challenge value, and sends an authentication result that is compared with the received chap value;
The AP transferring the authentication result to the terminal;
The terminal receiving the authentication result, communicating with the network if the authentication result is successful, and not communicating with the network if the authentication result is unsuccessful;
A high-speed authentication method for a wireless LAN, comprising: A wireless base station (AP) transmits a beacon message including time information to a wireless terminal (terminal), and the terminal receives the beacon message to recognize the AP, and transmits the time information via the AP. Sending to an authentication server (server);
Transmitting the hash value calculated from the secret key exchanged in advance with the received time information to the terminal via the AP,
The terminal calculates a hash value from the secret key that has been exchanged in advance with the time information, compares the hash value with the received hash value, and sets a session key if the hash value matches;
A high-speed authentication method for a wireless LAN, comprising: A step in which the terminal generates an authentication header based on the session key and adds the authentication header to a packet to be transmitted;
The high-speed authentication method for a wireless LAN according to claim 8, further comprising: A wireless base station (AP) transmitting a beacon message including time information to a wireless terminal (terminal), wherein the terminal receives the beacon message and recognizes the AP;
The terminal generates a challenge value from a secret key exchanged in advance with an authentication server (server) and time information received from the AP, calculates a chap value from the generated challenge value and a user password, Transmitting an authentication request and a network information acquisition request to the AP together with time information;
The AP checks the received time information, transfers the received challenge value, chap value, time information and authentication request to the server, and transfers the received network information acquisition request to the router;
The server independently calculates a chap value from the password of the user and the received challenge value, compares the authentication result with the received chap value, and a hash value calculated from a secret key exchanged in advance with the time information. Sending to the AP;
The AP receives the authentication result and the hash value, adds the network information obtained from the router, and transfers it to the terminal;
The terminal receives the network information, the authentication result, the hash value, and the netsark information, communicates with the network when the authentication result is successful, and communicates with the network when the authentication result is unsuccessful. Steps that do not communicate,
A high-speed authentication method for a wireless LAN, comprising: A step in which the terminal compares and matches a hash value calculated from the time information and the secret key with the received hash value, sets a matched hash value as a session key, and attaches the authentication key based on the session key to a packet to be transmitted;
The high-speed authentication method for a wireless LAN according to claim 10, further comprising: A wireless base station (AP) transmits a beacon message including time information to a wireless terminal (terminal), and the terminal receives the beacon message to recognize the AP, and transmits the time information via the AP. Sending to an authentication server (server);
The terminal calculates a hash value hashed by a one-way hash function based on the time information received from the AP using a secret key exchanged in advance with an authentication server (server). Sending an authentication request and a network information acquisition request to the AP together with information;
The AP checking the received time information, transferring the received hash value, the time information and the authentication request to the server, and transferring the received network information acquisition request to the router;
The server calculates a hash value independently from the received time information and a secret key exchanged in advance, and sends to the AP the authentication result and the hash value that have been compared and collated with the received hash value;
The AP confirming the received hash value, and transferring the received authentication result and the network information obtained from the router to the terminal;
The terminal receiving network information and an authentication result from the AP, communicating with the network when the authentication result is successful, and not communicating with the network when the authentication result is unsuccessful;
A high-speed authentication method for a wireless LAN, comprising: A step in which the terminal uses the hash value as a session key and adds an authentication header based on the session key to a packet to be transmitted;
The high-speed authentication method for a wireless LAN according to claim 12, further comprising: 13. The wireless LAN high-speed authentication method according to claim 7, wherein the network is the Internet.

Images