JP2004297292A - Wireless terminal, authentication server, wireless authentication information management system, and wireless authentication information management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve a problem that the cost of a setting job is increased because it is required to apply a setting job of authentication information onto all terminals for providing different authentication information to each terminal in the case of utilizing the wireless terminals for a job or the like. <P>SOLUTION: When the wireless terminal 100 is first started, an authentication execution means 102 gives a connection request to an authentication server 200 based on the preliminary authentication information installed in advance to authentication information data 101, a wireless terminal authentication means 201 of the authentication server 200 collates the data 101 with preliminary authentication information data 203 to admit a connection permission. When an authentication information acquisition means 103 gives an authentication information request, an authentication information issue means 202 generates authentication information, stores the information to an authentication information database 204, and transmits the information to the wireless terminal 100. An authentication information storage means 104 stores the received authentication information to the authentication information data 101. Thereafter the wireless terminal 100 and the authentication server 200 execute connection by using the authentication information. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a wireless terminal, an authentication server, a wireless authentication information management system, and a wireless authentication information management method, and in particular, reduces the cost of distributing authentication information to a large number of wireless terminals such as business terminals, and efficiently reduces the cost. The present invention relates to a wireless terminal that distributes authentication information, an authentication server, a wireless authentication information management system, and a wireless authentication information management method.
[0002]
[Prior art]
A wireless network such as a wireless LAN (local area network) has a problem that it is susceptible to security attacks represented by unauthorized access. In order to prevent this, various data encryption and user / terminal authentication methods have been considered. For example, in the authentication method in the technology described in Non-Patent Document 1 standardized by IEEE or the technology described in Non-Patent Document 2 standardized by IETF, each wireless user or wireless terminal has a unique authentication method. Authentication information (user / terminal ID and password, or user / terminal ID and electronic certificate, etc.) is given. Each wireless terminal transmits unique authentication information to the wireless access point before joining the wireless network, and can join the wireless network only when the wireless access point confirms the authentication information.
[0003]
In order to perform authentication by the above mechanism, it is necessary to distribute authentication information to each user or wireless terminal in advance. Usually, the distribution of these authentication information is performed through means different from a wireless network that requires the authentication information. For example, in a service for providing an Internet connection using a wireless LAN in a public place, authentication information is sent to a user or a wireless terminal by e-mail or mail before using the wireless LAN.
[0004]
Further, as a prior art for reducing the work cost of setting authentication information, for example, there is a technology described in Patent Document 1. The present invention is a method for easily setting authentication information called “identification code” in a terminal.
[0005]
Further, the technique described in Patent Document 2 is an invention aimed at reducing the work of installing a certificate in a wired or wireless network. In the present invention, instead of installing the certificate in advance on the client computer, when the client computer accesses the authentication server on the network, the public key and the encryption execution module are sent from the authentication server to the client, and this is sent to the client. It is used to perform encryption. In this technique, it is described that the determination whether to send the public key and the encryption execution module to the client computer that has accessed the authentication server is performed using a set of an ID and a password input on the client side. It does not describe how to distribute the pair of the ID and the password to the client computer.
[0006]
[Patent Document 1]
JP-A-11-008625
[Patent Document 2]
JP-A-2002-374239
[Non-patent document 1]
Donald N. Heirman, and 2 others, “Port-Based Network Access Control”, [online], June 14, 2001, IEEE, [February 5, 2003] Search], Internet URL: http://standards.ieee.org/getieee802/download/802.1X-2001.pdf
[Non-patent document 2]
Blank (L. Blunk) and 2 others, “PPP Extensible Authentication Protocol (EAP)”, [online], March 1998, IETF, [February 5, 2003] Search], Internet URL: http: // www. ief. org / rfc / rfc2284. txt
[0007]
[Problems to be solved by the invention]
A first problem of the above-mentioned technique is that distribution of authentication information requires a communication means different from a wireless LAN, such as a postal network or a wired network. This is because the wireless terminal cannot establish a secure communication path with the wireless access point before the authentication information is distributed, and thus cannot securely distribute the authentication information using the wireless LAN. In the case of a public wireless LAN connection service, many users have different communication means (such as an Internet connection using a cable), and a terminal used by the user is a personal computer having a plurality of communication means. Although this is unlikely to be a problem due to the fact that there are many, it is a serious problem when providing communication means other than the wireless LAN to the target wireless terminal is a cost problem.
[0008]
The second problem is that the work cost required for setting authentication information in each wireless terminal is large. In order to give different authentication information to each wireless terminal, it is necessary to set authentication information on all wireless terminals. In the example of the public wireless LAN connection service, the number of wireless terminals managed by one user is usually one to several, so that the setting operation cost did not become a major problem. However, in the case of a commercial wireless terminal or the like, the setting work needs to be performed intensively, so that the setting work cost becomes a major problem. The technique described in Patent Document 1 reduces the work cost of setting authentication information. However, when setting an identification code, it is necessary to use a wired cable or weaken a radio wave. It has not been resolved.
[0009]
In addition, a system in which common authentication information is provided to all wireless terminals in order to simply keep the work cost of setting authentication information low can be considered. However, in this case, a security risk in the case where one wireless terminal is stolen and the authentication information is leaked is very high. Furthermore, since the authentication information of all the other terminals must be changed, the work cost in the case of leakage becomes enormous.
[0010]
SUMMARY OF THE INVENTION It is an object of the present invention to provide a method for transmitting authentication information to a large number of wireless terminals in a manner different from a public wireless LAN service, such as a business wireless terminal, at a low work cost and without a communication means other than a wireless network. It is to realize a system to set.
[0011]
[Means for Solving the Problems]
The wireless terminal of the present invention includes an authentication information data section in which pre-authentication information is stored in advance, and transmits a request for connection to a wireless network to the authentication server using the pre-authentication information, and receives the wireless communication received from the authentication server. Authentication execution means for transmitting a connection request to the wireless network to an authentication server using business authentication information for connecting to a network and performing a normal business or operation, and a connection corresponding to pre-authentication information from the authentication server Authentication information obtaining means for transmitting a request for business authentication information to the authentication server upon receiving permission, and authentication information storing business authentication information in the authentication information data portion upon receiving business authentication information from the authentication server. Storage means.
[0012]
The authentication server according to the present invention, upon receiving an authentication information database unit, a pre-authentication information data unit in which pre-authentication information is stored in advance, and a connection request from a wireless terminal to a wireless network using the pre-authentication information, receives the pre-authentication information. Wireless terminal authentication means for comparing the pre-authentication information in the authentication information data section with the pre-authentication information from the wireless terminal, and if they match, transmitting a connection permission corresponding to the pre-authentication information to the wireless terminal; Receiving a request for business authentication information from the wireless terminal, stores the business authentication information in the authentication information data section, and transmits the business authentication information to the wireless terminal.
[0013]
A first wireless authentication information management system of the present invention has one or more wireless terminals and one or more authentication servers, and uses an authentication information data section in which pre-authentication information is stored in advance, and pre-authentication information. A connection request to the wireless network is transmitted to the authentication server, and a connection request to the wireless network is received by using the business authentication information for connecting to the wireless network received from the authentication server and executing a normal business or work. Authentication execution means for transmitting a request for business authentication information to the authentication server upon receiving a connection permission corresponding to the pre-authentication information from the authentication server; and Receiving the business authentication information from the server, the wireless terminal comprising authentication information storage means for storing business authentication information in the authentication information data section; Information database section, a pre-authentication information data section in which pre-authentication information is stored in advance, and a pre-authentication information in the pre-authentication information data section when receiving a connection request from the wireless terminal to the wireless network using the pre-authentication information. And the pre-authentication information from the wireless terminal, and if they match, a connection permission corresponding to the pre-authentication information is transmitted to the wireless terminal, and a connection request from the wireless terminal to a wireless network using business authentication information is sent. When receiving the authentication information, the business authentication information in the authentication information database unit is compared with the business authentication information from the wireless terminal, and if there is a match, the connection permission corresponding to the business authentication information is transmitted to the wireless terminal. Terminal authentication means, and, upon receiving a request for business authentication information from the wireless terminal, issues business authentication information and stores it in the authentication information data section. And having said an authentication server having an authentication information issuance means for transmitting the operational authentication information to the wireless terminal.
[0014]
The second wireless authentication information management system of the present invention is the first wireless authentication information management system, wherein the pre-authentication information is information common to all the wireless terminals, and the business authentication information is the wireless terminal. It is unique information for each.
[0015]
The third wireless authentication information management system of the present invention is the first wireless authentication information management system, wherein the pre-authentication information is information common to all the wireless terminals, and the business authentication information is the same The information is common to the wireless terminals used in a wireless network.
[0016]
A fourth wireless authentication information management system according to the present invention includes one or more wireless terminals, one or more authentication servers, and one or more center servers, and an authentication information data unit in which pre-authentication information is stored in advance. Using a pre-authentication information to send a connection request to the wireless network to the authentication server, using the business authentication information to connect to the wireless network received from the authentication server and perform normal business and work Authentication executing means for transmitting a request for connection to the wireless network to an authentication server, authentication information for transmitting a request for business authentication information to the authentication server upon receiving a connection permission corresponding to pre-authentication information from the authentication server Acquisition means, and authentication information storage means for storing business authentication information in the authentication information data section when business authentication information is received from the authentication server. The pre-authentication information database unit, a pre-authentication information data unit in which pre-authentication information is stored in advance, and when the wireless terminal receives a request to connect to the wireless network using pre-authentication information from the radio terminal, the pre-authentication The pre-authentication information in the information data section is compared with the pre-authentication information from the wireless terminal, and if they match, a connection permission corresponding to the pre-authentication information is transmitted to the wireless terminal, and the business authentication information is used from the wireless terminal. Received the connection request to the wireless network, the business authentication information in the authentication information database unit is compared with the business authentication information from the wireless terminal, and if there is a match, the wireless terminal corresponds to the business authentication information. A wireless terminal authentication unit for transmitting a connection permission to perform, upon receiving a request for business authentication information from the wireless terminal, issues business authentication information and issues the authentication information. Authentication information issuing means for storing business authentication information in the data part and transmitting business authentication information to the wireless terminal; and pre-authentication information obtaining means for obtaining the latest pre-authentication information from the center server and storing the same in the pre-authentication information data part. The authentication server, comprising: a pre-authentication information data unit that stores pre-authentication information; and a pre-authentication information updating unit that updates the pre-authentication information in the pre-authentication information data unit periodically or as required. And a center server.
[0017]
The fifth wireless authentication information management system of the present invention is the fourth wireless authentication information management system, wherein the pre-authentication information is information common to all the wireless terminals, and the business authentication information is the same The information is common to the wireless terminals used in a wireless network.
[0018]
The sixth wireless authentication information management system of the present invention is the fourth wireless authentication information management system, wherein the pre-authentication information is information common to all the wireless terminals, and the business authentication information is the same The information is common to the wireless terminals used in a wireless network.
[0019]
The seventh wireless authentication information management system of the present invention is any one of the first, second, third, fourth, fifth, and sixth wireless authentication information management systems, wherein pre-authentication information is used. It is characterized by having the wireless terminal provided with a pre-authentication information erasing means for erasing the information when it is no longer used.
[0020]
The eighth wireless authentication information management system of the present invention is any one of the first, second, third, fourth, fifth, sixth, and seventh wireless authentication information management systems, and The pre-authentication information data section for storing authentication information, and a plurality of pre-authentication information in the pre-authentication information data section are checked against pre-authentication information from the wireless terminal, and if there is a match, the wireless terminal The authentication server further comprises the wireless terminal authentication means for transmitting a connection permission corresponding to the pre-authentication information.
[0021]
A ninth wireless authentication information management system according to the present invention is any one of the first, second, third, fourth, fifth, sixth, seventh, and eighth wireless authentication information management systems. A plurality of pre-authentication information, the pre-authentication information data section storing expiration date data corresponding to the plurality of pre-authentication information, pre-authentication information not expired, and pre-authentication information from the wireless terminal. It is characterized in that the authentication server is provided with the wireless terminal authentication means for checking and, if there is a match, transmitting a connection permission corresponding to the pre-authentication information to the wireless terminal.
[0022]
According to a first wireless authentication information management method of the present invention, at least one wireless terminal including an authentication information data unit in which pre-authentication information is stored in advance, an authentication information database unit, and a pre-authentication information in which pre-authentication information is stored in advance. Utilizing one or more authentication servers including an authentication information data unit, causing the wireless terminal to transmit a connection request to a wireless network to the authentication server using pre-authentication information from the authentication information data unit, An authentication execution procedure for transmitting a connection request to the wireless network to the authentication server using business authentication information for connecting to the wireless network received from the authentication server and executing normal business or work, Upon receiving a connection permission corresponding to authentication information, an authentication information acquisition procedure for transmitting a request for business authentication information to the authentication server, and Upon receiving business authentication information from the authentication server, an authentication information storing procedure for storing business authentication information in the authentication information data section, and connecting to the authentication server from the wireless terminal to the wireless network using pre-authentication information. Upon receiving the request, the pre-authentication information in the pre-authentication information data part is compared with the pre-authentication information from the wireless terminal, and if they match, the wireless terminal transmits a connection permission corresponding to the pre-authentication information, When receiving a connection request to the wireless network using business authentication information from the wireless terminal, the business authentication information in the authentication information database unit and business authentication information from the wireless terminal are compared, and if there is a match, the A wireless terminal authentication procedure for causing the wireless terminal to transmit a connection permission corresponding to the business authentication information, and Upon receiving the determined, to issue operational authentication information stored in the authentication information data unit, characterized in that it comprises an authentication information issuance procedure for sending business authentication information to the wireless terminal.
[0023]
According to a second wireless authentication information management method of the present invention, at least one wireless terminal including an authentication information data section in which pre-authentication information is stored in advance, an authentication information database section, and a pre-stored pre-authentication information. Utilizing at least one authentication server having an authentication information data part and at least one center server having a pre-authentication information data part for storing pre-authentication information, the wireless terminal is provided with a pre-authentication from the authentication information data part. Using the information to transmit a connection request to a wireless network to the authentication server, to connect to the wireless network received from the authentication server, and to use the business authentication information for performing normal business and work the wireless network Authentication execution procedure for transmitting a connection request to the authentication server, upon receiving a connection permission corresponding to the pre-authentication information from the authentication server, For the authentication server, an authentication information acquisition procedure for transmitting a request for business authentication information, and, when receiving business authentication information from the authentication server, an authentication information storage procedure for storing business authentication information in the authentication information data portion, Upon receiving a connection request to the wireless network using pre-authentication information from the wireless terminal, the authentication server causes the pre-authentication information in the pre-authentication information data section to be compared with the pre-authentication information from the wireless terminal, If they match, the wireless terminal transmits a connection permission corresponding to the pre-authentication information, and when receiving a connection request to the wireless network using the business authentication information from the wireless terminal, the business authentication information in the authentication information database unit and The business authentication information from the wireless terminal is collated, and if there is a match, the wireless terminal corresponds to the business authentication information. A wireless terminal authentication procedure for transmitting a connection permit, receiving a request for business authentication information from the wireless terminal, issuing business authentication information, storing the business authentication information in the authentication information data section, and transmitting the business authentication information to the wireless terminal. Issuing procedure, and a pre-authentication information acquisition unit that obtains the latest pre-authentication information from the center server and stores the pre-authentication information in the pre-authentication information data unit. And a pre-authentication information updating procedure for updating the target in response to a request or a request.
[0024]
A third wireless authentication information management method according to the present invention is the second wireless authentication information management method, wherein when the latest pre-authentication information is acquired from the center server by the authentication server, the acquired latest The generation date and time of the pre-authentication information, or, the sum of a certain period of time to the current time, the procedure of storing in the pre-authentication information data portion of the authentication server as the expiration date of the pre-authentication information was the latest, The pre-authentication information of the pre-authentication information data part is compared with one or more pre-authentication information within the validity period and the pre-authentication information from the wireless terminal. Transmitting a connection permission corresponding to the information.
[0025]
A fourth wireless authentication information management method according to the present invention is the wireless authentication information management method according to any one of the first, second, and third methods, wherein business identification information is stored in the identification information data section in the wireless terminal. And storing the pre-authentication information in the identification information data section after the stored information is stored in the recognition information data section.
[0026]
A fifth wireless authentication information management method according to the present invention is any one of the first, second, third, and fourth wireless authentication information management methods, wherein the pre-authentication information is common to all the wireless terminals. And the service authentication information is information common to the wireless terminals used in the same wireless network.
[0027]
A sixth wireless authentication information management method according to the present invention is the first, second, third, or fourth wireless authentication information management method, wherein the pre-authentication information is common to all of the wireless terminals. And the service authentication information is information common to the wireless terminals used in the same wireless network.
[0028]
BEST MODE FOR CARRYING OUT THE INVENTION
Next, a first embodiment of the present invention will be described in detail with reference to the drawings.
[0029]
FIG. 1 is a block diagram showing a first embodiment of the present invention.
[0030]
Referring to FIG. 1, the first embodiment of the present invention includes one or more wireless terminals 100 and one or more authentication servers 200. The wireless terminal 100 is a wireless device used in stores, homes, and the like. The authentication server 200 is for configuring a wireless NW (network) in a store, home, and the like, and is generally realized as hardware such as a wireless access point, a store server, and a home server. The authentication server 200 is located in each store, home, or the like, or is centrally located in one place, and is connected to a wireless access point in each home or store via a wired network or the like.
[0031]
The wireless terminal 100 includes authentication information data 101 (stored in a storage device such as a memory or a hard disk), an authentication execution unit 102, an authentication information acquisition unit 103, and an authentication information storage unit 104. The authentication information data 101 is authentication information such as an ID, a password, and a digital certificate used when the wireless terminal 100 participates in a store or home wireless network. Here, the authentication information includes pre-authentication information and (business) authentication information used in the original business. The authentication execution unit 102 communicates with the authentication server 200 using the authentication information data 101 to execute an authentication process. The authentication information acquisition unit 103 acquires authentication information from the authentication server 200 at the time of first authentication. The authentication information storage unit 104 stores the authentication information obtained by the authentication information acquisition unit 103 in the authentication information data 101.
[0032]
The authentication server 200 includes a wireless terminal authentication unit 201, an authentication information issuing unit 202, pre-authentication information data 203, and an authentication information database 204. The wireless terminal authentication unit 201 communicates with the authentication execution unit 102 of the wireless terminal 100, and determines whether the authentication information sent from the wireless terminal 100 is correct with reference to the pre-authentication information data 203 and the authentication information database 204. I do. The authentication information issuing unit 202 issues authentication information to the wireless terminal 100 that has joined the wireless network using the pre-authentication information. The authentication information issued in this manner is stored in the authentication information database 204 (comprising a storage device such as a memory and a hard disk device).
[0033]
The pre-authentication information data 203 (configured by a storage device such as a memory and a hard disk device) stores pre-authentication data used by the wireless terminal 100 for initial authentication. The pre-authentication information data 203 is authentication information common to all wireless terminals 100. The format of the authentication data differs depending on the authentication method. For example, when the authentication information is a set of an ID and a password, all the authentication information stored in the wireless terminal 100 and the authentication server 200 may be the same. Alternatively, the ID and password placed in the authentication server 200 may be converted by a one-way conversion function such as MD5 described in Non-Patent Document 1. When performing authentication using a public key cryptosystem, the pre-authentication information stored in the authentication server 200 and the pre-authentication information stored in the wireless terminal 100 may be different. Authentication information other than initial authentication is stored in the authentication information database 204. While the pre-authentication information is common to all the wireless terminals 100, the authentication information stored in the authentication information database 204 is unique to each wireless terminal 100.
[0034]
Next, the operation of the first exemplary embodiment of the present invention will be described with reference to the drawings.
[0035]
FIG. 2 is a schematic flowchart showing the operation of the first embodiment of the present invention.
[0036]
FIG. 3 is an explanatory diagram showing where the operation shown in FIG. 2 is executed.
[0037]
Referring to FIG. 2, in step S21, installation of pre-authentication information into authentication information data 101 of wireless terminal 100 in an initial state is performed manually at a factory or the like (step S21 in FIG. 2). Here, the same pre-authentication information is provided to all wireless terminals 100. Next, the wireless terminal 100 is distributed to each home / store via hand (step S22 in FIG. 2). In S21, the wireless terminal 100 on which the installation work has been performed in a concentrated place is distributed to homes and shops where the wireless terminal 100 is actually used in S22. Next, the wireless terminal 100 arriving at the store or home is activated manually (step S23 in FIG. 2). The activated wireless terminal 100 accesses the wireless network of the store or home using the pre-authentication information, and then acquires and installs the authentication information unique to the wireless terminal 100 (step S24 in FIG. 2). The wireless terminal 100 whose network settings have been changed by the installation is restarted (step S25 in FIG. 2). This restart is performed manually or automatically. Further, depending on the wireless terminal 100, the network setting may be effective without restarting. At this time, S25 may be omitted. Thereafter, the wireless terminal 100 accesses the wireless network of the store or home using the installed authentication information unique to the wireless terminal 100 (step S26 in FIG. 2).
[0038]
Next, each step shown in FIG. 2 will be described in detail.
[0039]
In step S21, pre-authentication information is installed in authentication information data 101 of wireless terminal 100. The pre-authentication information is common to all the wireless terminals 100, or at most there are only a few types of pre-authentication information, and there is no need to install pre-authentication information unique to the wireless terminal 100. Therefore, the installation can be performed by a simple operation such as inserting a memory card into the wireless terminal 100 and copying the pre-authentication information.
[0040]
In step S22, the wireless terminal 100 on which the pre-authentication information installation work has been completed is distributed to places where the wireless terminal 100 is actually used, such as stores and homes.
[0041]
In step S23, the wireless terminal 10 is activated. At this time, it is necessary that a wireless network is activated in a store or home and is in a usable state. After the activation of the wireless terminal 100, the wireless terminal 100 may be set so that step S24 starts immediately, or step S24 may be explicitly activated by means such as manually selecting a menu.
[0042]
In step S24, authentication information is installed in wireless terminal 100.
[0043]
FIG. 4 is an explanatory diagram showing details of step S24 in FIG.
[0044]
Referring to FIG. 4, in a state where step S24 has started, a connection has not been established between the wireless terminal 100 and a wireless network of a store or a home.
[0045]
Next, the authentication execution unit 102 of the wireless terminal 100 requests the authentication server 200 to connect to the wireless network using the pre-authentication information included in the authentication information data 101 (step S2401 in FIG. 4). Upon receiving the connection request, the wireless terminal authentication unit 201 of the authentication server 200 checks the consistency between the pre-authentication information data 203 and the received pre-authentication information data, and determines whether to allow the wireless terminal 100 to participate in the network. (Step S2402 in FIG. 4). If the matching is established, the wireless terminal authentication means 201 of the authentication server 200 gives the connection permission to the wireless terminal 100, whereby the wireless terminal 100 participates in the wireless network (step S2403 in FIG. 4).
[0046]
The procedure until the wireless terminal 100 connects to the wireless network using the pre-authentication information does not necessarily have to strictly follow the procedures of steps S2401 to S2403, and can be replaced with the steps of the existing wireless network authentication procedure. For example, in the authentication framework called 802.1x described in Non-Patent Document 1, authentication procedures such as EAP-MD5, EAP-TLS, EAP-TTLS, PEAP, and LEAP may be used. In addition, any other authentication means can be used as long as the authentication information is transmitted from the wireless terminal 100 and the authentication server 200 checks the authentication information.
[0047]
Also, the format of the pre-authentication information of the wireless terminal 100 and the format of the pre-authentication information data 203 of the authentication server 200 are a pair of an ID and a password or a digital certificate according to the authentication procedure actually used. It may be a book.
[0048]
Next, when the connection to the wireless network is established, the authentication information acquisition unit 103 of the wireless terminal 100 requests authentication information through the wireless network (step S2404 in FIG. 4). The authentication information issuing means 202 of the authentication server 200 issues authentication information (step S2405 in FIG. 4). At this time, the issued authentication information is unique to the wireless terminal 100. In order to issue authentication information unique to the wireless terminal 100, the authentication information issuing unit 202 issues authentication information in the following manner, for example.
[0049]
If the authentication information is simple information such as a pair of an ID and a password and can be easily generated by the authentication information issuing unit 202 of the store, the authentication information issuing unit 202 uses the unique authentication information unique to the wireless terminal 100. Create
[0050]
FIG. 12 is an explanatory diagram illustrating an example of the authentication information.
[0051]
The created unique authentication information is an ID and a password unique to the wireless terminal 100, as shown in FIG. The ID may be information obtained by combining a store number assigned to each store, a unique issue number managed in the store, and random number information for making it difficult to guess the ID. In addition, random number information or the like can be used as a password paired with the ID.
[0052]
If the authentication information is information that cannot be easily issued, such as a digital certificate, a sufficient number of digital certificates are stored in advance in the authentication server 200 from a digital certificate issuing organization, and the authentication information is issued. Means 202 may use a method of sequentially passing the stored certificates to wireless terminal 100.
[0053]
Further, the authentication information may not be authentication information unique to the wireless terminal 100 but may be common to the wireless terminal 100 belonging to a certain store or home.
[0054]
The authentication information issuing means 202 of the authentication server 200 stores the authentication information issued in S2404 in the authentication information database 204 (Step S2406 in FIG. 4). After that, the authentication information issuing unit 202 of the authentication server 200 transmits the authentication information generated in S2405 to the wireless terminal 100 (Step S2407 in FIG. 4). At this time, since the communication path of the wireless network connection between the authentication server 200 and the wireless terminal 100 is encrypted by the connection using the pre-authentication information, the transmitted authentication information is externally accessed by eavesdropping or the like. Never be known to. At this time, an encryption method including WEP, WEP2, TKIP, AES or the like, which is an encryption method generally used widely in a wireless network, can be used.
[0055]
Next, the authentication information storage unit 104 of the wireless terminal 100 stores the received authentication information in the authentication information data 101 (Step S2408 in FIG. 4). Through the above steps S2401 to S2408, the authentication information unique to the wireless terminal 100 is installed in the wireless terminal 100 without any fear of being known from others by eavesdropping or the like.
[0056]
Next, the wireless terminal 100 restarts itself (step S25 in FIG. 2). The term “restart” here means that all functions including the operating system of the wireless terminal 100 may be restarted, or a means of temporarily disconnecting the wireless network and then retrying the wireless network connection. good. In any case, the wireless terminal 100 temporarily disconnects the wireless network established using the pre-authentication information and establishes a new wireless network connection in step S25.
[0057]
FIG. 5 is an explanatory diagram showing the details of step S26 in FIG.
[0058]
Referring to FIG. 5, the authentication execution unit 102 of the wireless terminal 100 requests connection to the wireless network using the authentication information acquired in step S24 (step S2601 in FIG. 5). Next, the wireless terminal authentication unit 201 of the authentication server 200 that has received the connection request checks the matching between the received authentication information and the authentication information database 204, and determines whether to allow the wireless terminal 100 to participate in the network. (Step S2602 in FIG. 5). When the wireless terminal authentication unit 201 matches, the authentication server 200 gives the connection permission to the wireless terminal 100 (step S2603), whereby the wireless terminal 100 participates in the wireless network.
[0059]
Similarly to step S24, the procedure until the wireless terminal 100 connects to the wireless network using the authentication information does not necessarily have to strictly follow the procedure of steps S2601 to S2603. Can be replaced. For example, an authentication procedure such as EAP-MD5, EAP-TLS, EAP-TTLS, PEAP, LEAP, etc. may be used in the authentication framework called 802.1x of Non-Patent Document 1. In addition, any other authentication means can be used as long as the authentication information is transmitted from the wireless terminal 100 and the authentication server 200 checks it.
[0060]
Also, the format of the authentication information of the wireless terminal 100 and the format of the authentication information database 204 of the authentication server 200 are a pair of an ID and a password or a digital certificate according to the authentication procedure actually used. It may be.
[0061]
Next, a second embodiment of the present invention will be described in detail with reference to the drawings.
[0062]
The difference between the second embodiment and the first embodiment of the present invention lies in the handling of pre-authentication information. Since the pre-authentication information is common to all stores, all homes, and all terminals, if the wireless terminal 100 is stolen and the pre-authentication information is leaked, the center server 300 or the authentication server 200 receives unauthorized access and receives the pre-authentication information. Security risk is high when leaked. The second embodiment of the present invention addresses a security risk caused by using pre-authentication information.
[0063]
FIG. 6 is a block diagram showing a configuration of the second exemplary embodiment of the present invention.
[0064]
Referring to FIG. 6, the difference from the first embodiment of the present invention is that the pre-authentication information erasing unit 105 is added in the wireless terminal 100 and the pre-authentication information acquiring unit 205 is included in the authentication server 200. And that a center server 300 placed in a center or a factory that ships and manages the wireless terminal 100 is added.
[0065]
The pre-authentication information deleting unit 105 is a unit that deletes the pre-authentication information from the wireless terminal 100 as soon as the pre-authentication information becomes unnecessary. The pre-authentication information acquisition unit 205 is a unit that acquires pre-authentication information from the center server 300 periodically or as needed. The center server 300 includes pre-authentication information data 301 and pre-authentication information updating means 302. The pre-authentication information updating unit 302 is a unit that periodically updates the pre-authentication information data 301.
[0066]
Among the differences between the first embodiment and the second embodiment of the present invention, the pre-authentication information erasing means 105 will be described first.
[0067]
FIG. 7 is an explanatory diagram illustrating an operation of installing authentication information according to the second embodiment of this invention.
[0068]
The difference from the operation shown in FIG. 4 is that the pre-authentication information is deleted in step S2709. Once the wireless terminal 100 acquires the unique authentication information, the pre-authentication information is not used. For this reason, the pre-authentication information is erased to reduce security risks.
[0069]
Next, a function of periodically updating the pre-authentication information will be described.
[0070]
The pre-authentication information updating unit 302 of the center server 300 is a unit for updating the pre-authentication information data 301 regularly or irregularly. The update may be performed manually or by a program that is activated at regular intervals.
[0071]
The pre-authentication information data 301 updated in this manner is reflected on the pre-authentication information data 203 as needed by the pre-authentication information acquisition unit 205 in the authentication server 200.
[0072]
FIG. 8 is a flowchart showing the operation of the pre-authentication information acquisition unit 205.
[0073]
FIG. 9 is an explanatory diagram showing the stored contents of the pre-authentication information data 203.
[0074]
Before the step in FIG. 8 is executed, the pre-authentication information stored in the authentication server 200 is in a state before updating described in the upper part of FIG. At this time, the pre-authentication information yyyyy is the latest, and the expiration date of the pre-authentication information yyyyy is not limited.
[0075]
The pre-authentication information acquisition means 205 communicates with the center server 300, and acquires pre-authentication information from the pre-authentication information data 301 (step S81 in FIG. 8). This pre-authentication information is assumed to be xxxxxx. The actual pre-authentication information may be a set of an ID and a password or a digital certificate, but here, it is assumed to be xxxxxx for simplicity of explanation. Next, the pre-authentication information xxxxxx thus obtained is compared with the latest pre-authentication information yyyy stored in the pre-authentication information data 203 in the authentication server 200 (step S82 in FIG. 8), and both pre-authentication information are different. If the change has been made (step S83 in FIG. 8), the pre-authentication information is fixed to the date when xxxxxx was updated in the center server 300 in the expiration date column of the latest pre-authentication information yyyyyy. The one with the added period is written (step S84 in FIG. 8). In the example of FIG. 9, February 20 that is obtained by adding five days of a fixed period to February 15, which is the date on which xxxxxx was updated, is written in the validity period of yyyy. Next, the pre-authentication information xxxxxx acquired earlier is written to the pre-authentication information data 203 as the latest one (step S85 in FIG. 8).
[0076]
In principle, only the latest pre-authentication information is valid. However, in the case of the wireless terminal 100 as the object of the present invention, the pre-authentication information is written in a center such as a factory before the store or home. Since it is delivered by mail or other means, a renewal period of about several days may be required. Therefore, it is necessary to perform steps as shown in FIG.
[0077]
In the second embodiment of the present invention, as in the first embodiment of the present invention (see FIG. 4), installation of authentication information using pre-authentication information is performed. The difference from the first embodiment of the present invention is that the pre-authentication information sent from the wireless terminal 100 is compared with the pre-authentication information data 203 stored in the authentication server 200 in step S2702 in FIG. That is, it is checked not only with the latest one but also with all the pre-authentication information data 203 whose expiration date has not expired.
[0078]
Next, a first embodiment of the present invention will be described in detail with reference to the drawings.
[0079]
The first embodiment of the present invention is a management system for authentication information of business terminals such as convenience stores. In convenience stores and the like, thousands to tens of thousands of business wireless terminals 100 are used, and the cost of installing authentication information in those wireless terminals 100 is enormous.
[0080]
FIG. 10 is a configuration diagram showing a first embodiment of the present invention.
[0081]
Referring to FIG. 10, in the first embodiment of the present invention, there is a shipping center 400 that installs pre-authentication information in the wireless terminal 100 and delivers the information to each store. One or at most several shipping centers 400 exist. The data center 410 has a center server 300 that manages pre-authentication information. The center server 300 also exists at one place or at most several places. Further, a sales store 430 exists. The authentication server 200 and the wireless LAN access point 431 are installed in each sales store 430. There are hundreds to tens of thousands of sales stores 430.
[0082]
The latest pre-authentication information existing in the center server 300 is delivered to the shipping center 400 using a means such as a network. In the shipping center 400, the latest pre-authentication information is installed in the wireless terminal 100. The installation is performed by copying the pre-authentication information stored in a PC card or the like, or by storing the pre-authentication information stored in the PC card or the like in the wireless terminal 100 by an installation program. The wireless terminal 100 on which the pre-authentication information is installed is distributed to each sales store 430 by mail or the like.
[0083]
The sales store 430 includes a wireless LAN access point 431 and an authentication server 200. The authentication server 200, the wireless LAN access point 431, and the center server 300 are connected by a wired network 420, respectively. Therefore, the authentication server 200 can automatically acquire the latest pre-authentication information stored in the center server 300 once to several times a day.
[0084]
Upon receiving a network participation request from the wireless terminal 100, the wireless LAN access point 431 transfers the authentication information sent from the wireless terminal 100 to the authentication server 200, and enters the network according to permission / non-permission of the authentication server 200. Control participation. The exchange of authentication information between the wireless LAN access point 431 and the wireless terminal 100 uses a standard authentication means in a wireless LAN such as 802.1x (EAP-TLS) described in Non-Patent Document 1. The exchange between the wireless LAN access point 431 and the authentication server 200 uses an authentication protocol called RADIUS.
[0085]
The authentication server 200 includes pre-authentication information data 203 storing pre-authentication information and an authentication information database 204 storing business authentication information unique to each wireless terminal 100. The pre-authentication information is used only when the wireless terminal 100 is delivered to the sales store 430, activated for the first time by a clerk or the like of the sales store 430, and executes the authentication information installation procedure.
[0086]
It may take several weeks from when the pre-authentication information is installed in the wireless terminal 100 at the shipping center 400 to when the installation procedure of the authentication information is executed at the sales store 430 in some cases. For this reason, a plurality of pre-authentication information is stored in the authentication server 200 of the sales store 430, and the authentication information of the wireless terminal 100 having the out-of-date pre-authentication information can be installed.
[0087]
Next, a second embodiment of the present invention will be described in detail with reference to the drawings.
[0088]
FIG. 11 is a configuration diagram showing a second embodiment of the present invention.
[0089]
Referring to FIG. 11, a second embodiment of the present invention is a management system for authentication information of a business terminal such as a convenience store. The difference from the first embodiment of the present invention is that the authentication server 200 is not installed in each store but is integrated in the data center 410 and installed as a center server and authentication server 310.
[0090]
Even in this case, since the wireless LAN access point 431 is located at each sales store 430 and the wireless LAN access point 431 is connected to the center server and authentication server 310 via the wired network 420, the present invention can be applied. It is possible.
[0091]
In addition, in such a configuration, the wireless terminal 100 can participate in the wireless network of any sales store 430. In order to prevent this, it is necessary to store the IP address of the wireless LAN access point 431 that has issued the authentication request and the business authentication information of the wireless terminal 100 as a set, and use those information at the time of authentication.
[0092]
Next, a third embodiment of the present invention will be described in detail with reference to the drawings.
[0093]
The third embodiment of the present invention is different from the third embodiment of the present invention or each step of the operation of the second embodiment of the present invention (see FIG. 4, FIG. 5, FIG. 7, FIG. 8). Shown).
[0094]
【The invention's effect】
A first effect of the present invention is that the installation cost of authentication information can be significantly reduced as compared with a case where different authentication information is installed in each wireless terminal.
[0095]
The reason is that authentication information must be installed and distributed intensively, such as business wireless terminals, so in environments where installation and distribution costs are not negligible, pre-authentication information is shared by all wireless terminals. This is because the authentication information is installed.
[0096]
The second effect is that the cost is low and the security risk due to continuing to use the common authentication information in all terminals is reduced.
[0097]
The reason is that the wireless terminal on which the pre-authentication information is installed is distributed to a place where the wireless terminal is actually used, such as each store or home, and the authentication information is automatically installed at that place by a program or the like.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a first exemplary embodiment of the present invention.
FIG. 2 is a schematic flowchart showing an operation of the first exemplary embodiment of the present invention.
FIG. 3 is an explanatory diagram showing where the operation shown in FIG. 2 is executed;
FIG. 4 is an explanatory diagram showing details of FIG. 2;
FIG. 5 is an explanatory diagram showing details of FIG. 2;
FIG. 6 is a block diagram showing a configuration of a second exemplary embodiment of the present invention.
FIG. 7 is an explanatory diagram showing an operation of the second exemplary embodiment of the present invention.
FIG. 8 is a flowchart showing an operation of the second exemplary embodiment of the present invention.
FIG. 9 is an explanatory diagram showing the contents of pre-authentication information data of the authentication server.
FIG. 10 is a configuration diagram showing a first embodiment of the present invention.
FIG. 11 is a configuration diagram showing a second embodiment of the present invention.
FIG. 12 is an explanatory diagram illustrating an example of authentication information created by an authentication server.
[Explanation of symbols]
100 wireless terminal
101 Authentication information data
102 Authentication execution means
103 Authentication information acquisition means
104 authentication information storage means
105 Pre-authentication information erasing means
200 authentication server
201 Wireless terminal authentication means
202 Authentication information issuing means
203 Pre-authentication information data
204 authentication information database
205 Pre-authentication information acquisition means
300 center server
301 Pre-authentication information data
302 Pre-authentication information updating means
310 Center server and authentication server
400 Shipping Center
410 Data Center
420 wired network
430 sales store
431 Wireless LAN Access Point

Claims (17)

An authentication information data section in which pre-authentication information is stored in advance, and a request for connection to a wireless network is transmitted to the authentication server using the pre-authentication information, and connection to the wireless network received from the authentication server is performed to perform normal operations. Authentication executing means for transmitting a request for connection to the wireless network to an authentication server using business authentication information for executing a task or the like, and receiving a connection permission corresponding to pre-authentication information from the authentication server, An authentication information acquisition unit that transmits a request for business authentication information to the server, and an authentication information storage unit that stores business authentication information in the authentication information data unit when receiving business authentication information from the authentication server.
A wireless terminal comprising: An authentication information database section, a pre-authentication information data section in which pre-authentication information is stored in advance, and a pre-authentication information in the pre-authentication information data section when a connection request to a wireless network using the pre-authentication information is received from the wireless terminal. Information and pre-authentication information from the wireless terminal, and if they match, a wireless terminal authentication unit that transmits a connection permission corresponding to the pre-authentication information to the wireless terminal, and a request for business authentication information from the wireless terminal. Upon receipt, authentication information issuing means for issuing business authentication information and storing it in the authentication information database unit, and transmitting business authentication information to the wireless terminal,
An authentication server comprising: Comprising one or more wireless terminals and one or more authentication servers,
An authentication information data portion in which pre-authentication information is stored in advance, a connection request for a wireless network is transmitted to the authentication server using the pre-authentication information, and connection to the wireless network received from the authentication server is performed to perform normal business Authentication execution means for transmitting a connection request to the wireless network to an authentication server using business authentication information for executing a task or operation, upon receiving a connection permission corresponding to pre-authentication information from the authentication server, the authentication server An authentication information acquisition unit that transmits a request for business authentication information, and an authentication information storage unit that stores business authentication information in the authentication information data unit when receiving business authentication information from the authentication server. When,
An authentication information database section, a pre-authentication information data section in which pre-authentication information is stored in advance, and a pre-authentication in the pre-authentication information data section when receiving a connection request to the wireless network using the pre-authentication information from the wireless terminal. The information is compared with the pre-authentication information from the wireless terminal, and if they match, a connection permission corresponding to the pre-authentication information is transmitted to the wireless terminal, and the wireless terminal connects to the wireless network using the business authentication information. Upon receiving the request, the business authentication information in the authentication information database unit is compared with the business authentication information from the wireless terminal, and if there is a match, the connection permission corresponding to the business authentication information is transmitted to the wireless terminal. Upon receiving a request for business authentication information from the wireless terminal authentication means and the wireless terminal, the mobile terminal issues business authentication information and stores the business authentication information in the authentication information data section. And, said authentication server comprising an authentication information issuance means for transmitting the operational authentication information to the wireless terminal,
A wireless authentication information management system comprising: The wireless authentication information management system according to claim 3, wherein the pre-authentication information is information common to all the wireless terminals, and the business authentication information is information unique to each of the wireless terminals. The wireless authentication according to claim 3, wherein the pre-authentication information is information common to all the wireless terminals, and the business authentication information is information common to the wireless terminals used in the same wireless network. Information management system. It has one or more wireless terminals, one or more authentication servers, and one or more center servers,
An authentication information data portion in which pre-authentication information is stored in advance, a connection request for a wireless network is transmitted to the authentication server using the pre-authentication information, and connection to the wireless network received from the authentication server is performed to perform normal business Authentication execution means for transmitting a connection request to the wireless network to an authentication server using business authentication information for executing a task or operation, upon receiving a connection permission corresponding to pre-authentication information from the authentication server, the authentication server An authentication information acquisition unit that transmits a request for business authentication information, and an authentication information storage unit that stores business authentication information in the authentication information data unit when receiving business authentication information from the authentication server. When,
An authentication information database section, a pre-authentication information data section in which pre-authentication information is stored in advance, and a pre-authentication in the pre-authentication information data section when receiving a connection request to the wireless network using the pre-authentication information from the wireless terminal. The information is compared with the pre-authentication information from the wireless terminal, and if they match, a connection permission corresponding to the pre-authentication information is transmitted to the wireless terminal, and the wireless terminal connects to the wireless network using the business authentication information. Upon receiving the request, the business authentication information in the authentication information database unit is compared with the business authentication information from the wireless terminal, and if there is a match, the connection permission corresponding to the business authentication information is transmitted to the wireless terminal. Wireless terminal authentication means, upon receiving a request for business authentication information from the wireless terminal, issues business authentication information and stores it in the authentication information data section, Authentication information issuing means for transmitting the operational authentication information to the wireless terminal, and, with the authentication server acquires the newest pre-authentication information from the center server includes a pre-authentication information acquiring means for storing the pre-authentication information data section,
A pre-authentication information data section for storing pre-authentication information, and the center server including a pre-authentication information updating unit for periodically updating pre-authentication information in the pre-authentication information data section, or upon request;
A wireless authentication information management system comprising: 7. The wireless authentication according to claim 6, wherein the pre-authentication information is information common to all the wireless terminals, and the business authentication information is information common to the wireless terminals used in the same wireless network. Information management system. 7. The wireless authentication according to claim 6, wherein the pre-authentication information is information common to all the wireless terminals, and the business authentication information is information common to the wireless terminals used in the same wireless network. Information management system. The wireless communication device further includes a pre-authentication information erasing unit that erases pre-authentication information after the authentication information acquiring unit in the wireless terminal acquires the business authentication information and the authentication information storage unit stores the business authentication information in the authentication information data unit. The wireless authentication information management system according to any one of claims 3, 4, 5, 6, 7, and 8, further comprising a terminal. The pre-authentication information data section storing a plurality of pre-authentication information, and comparing the plurality of pre-authentication information in the pre-authentication information data section with the pre-authentication information from the wireless terminal, if there is a match, 10. The authentication server according to claim 3, further comprising the authentication server including the wireless terminal authentication unit that transmits a connection permission corresponding to pre-authentication information to the wireless terminal. The wireless authentication information management system according to 1. A plurality of pre-authentication information, the pre-authentication information data section storing the expiration date data corresponding to the plurality of pre-authentication information, and comparing the pre-authentication information that has not expired with the pre-authentication information from the wireless terminal 7. An authentication server comprising said wireless terminal authentication means for transmitting a connection permission corresponding to pre-authentication information to said wireless terminal if there is a match. , 7, 8, 9, or 10. One or more wireless terminals including an authentication information data section in which pre-authentication information is stored in advance, an authentication information database section, and one or more authentication servers including a pre-authentication information data section in which pre-authentication information is stored in advance. Use
Using the pre-authentication information from the authentication information data section, the wireless terminal transmits a request for connection to a wireless network to the authentication server, connects to the wireless network received from the authentication server, and performs a normal operation or work. An authentication execution procedure of transmitting a connection request to the wireless network to an authentication server using business authentication information for executing the authentication processing, upon receiving a connection permission corresponding to pre-authentication information from the authentication server, An authentication information obtaining procedure for transmitting a request for business authentication information, and an authentication information storing procedure for storing business authentication information in the authentication information data section when receiving business authentication information from the authentication server;
Upon receiving a connection request to the wireless network using pre-authentication information from the wireless terminal, the authentication server causes the pre-authentication information in the pre-authentication information data section to be compared with the pre-authentication information from the wireless terminal, If they match, a wireless terminal authentication procedure for causing the wireless terminal to transmit a connection permission corresponding to pre-authentication information, and, upon receiving a request for business authentication information from the wireless terminal, issue business authentication information and cause the authentication information data unit to issue the business authentication information. And an authentication information issuance procedure for causing the wireless terminal to transmit business authentication information,
A wireless authentication information management method, comprising: One or more wireless terminals including an authentication information data unit in which pre-authentication information is stored in advance, an authentication information database unit, and one or more authentication servers including a pre-authentication information data unit in which pre-authentication information is stored in advance; Using one or more center servers having a pre-authentication information data section for storing pre-authentication information,
Using the pre-authentication information from the authentication information data section, the wireless terminal transmits a request for connection to a wireless network to the authentication server, connects to the wireless network received from the authentication server, and performs a normal operation or work. An authentication execution procedure of transmitting a connection request to the wireless network to an authentication server using business authentication information for executing the authentication processing, upon receiving a connection permission corresponding to pre-authentication information from the authentication server, An authentication information obtaining procedure for transmitting a request for business authentication information, and an authentication information storing procedure for storing business authentication information in the authentication information data section when receiving business authentication information from the authentication server;
Upon receiving a connection request to the wireless network using pre-authentication information from the wireless terminal, the authentication server causes the pre-authentication information in the pre-authentication information data section to be compared with the pre-authentication information from the wireless terminal, If they match, the wireless terminal transmits a connection permission corresponding to the pre-authentication information, and when receiving a connection request to the wireless network using the business authentication information from the wireless terminal, the business authentication information in the authentication information database unit. And the business authentication information from the wireless terminal, and if there is a match, the wireless terminal transmits a connection permission corresponding to the business authentication information to the wireless terminal, and a request for the business authentication information from the wireless terminal. Is received, the business authentication information is issued, stored in the authentication information data section, and the authentication information for transmitting the business authentication information to the wireless terminal is received. Issued instructions, and a pre-authentication information acquiring hand that stored in the pre-authentication information data unit to obtain the latest pre-authentication information from the center server,
The center server, a pre-authentication information update procedure for updating the pre-authentication information in the pre-authentication information data section periodically or as required,
A wireless authentication information management method, comprising: When the latest pre-authentication information is acquired from the center server by the authentication server, the date and time of generation of the acquired latest pre-authentication information or the current time plus a certain period of time is the latest Storing the pre-authentication information in the pre-authentication information data portion of the authentication server as an expiration date of the pre-authentication information; And pre-authentication information from the wireless terminal, and if they match, a step of causing the wireless terminal to transmit a connection permission corresponding to the pre-authentication information,
14. The wireless authentication information management method according to claim 13, comprising: 15. The wireless terminal according to claim 12, further comprising a step of deleting pre-authentication information from the recognition information data section after business authentication information is stored in the recognition information data section. The wireless authentication information management method described in Crab. 15. The pre-authentication information is information common to all of the wireless terminals, and the business authentication information is information common to the wireless terminals used in the same wireless network. Or the wireless authentication information management method according to any one of 15. 15. The pre-authentication information is information common to all of the wireless terminals, and the business authentication information is information common to the wireless terminals used in the same wireless network. Or the wireless authentication information management method according to any one of 15.

Images