JP2004304710A - Authentication method for wireless connection apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To permit a connection of a user having an account to a legitimate authentication server provided on the side of a backbone network to a small scale network through one authentication processing. <P>SOLUTION: When an access point (AP) 100 connected to the backbone network (intranet) 120 and connected to wireless terminals 111 to 114 through radio communication receives an authentication request from the wireless terminal 114 through radio communication, the access point transfers the received authentication request to the intranet 120, and when the intranet 120 fails to apply authentication processing with respect to the authentication request, an authentication server function section 102 of the access point 100 applies tentative authentication processing to the wireless terminal 114. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an authentication method of a wireless connection device used when a PAN (Personal Area Network), which is a small-scale LAN environment, is securely constructed by a terminal having a wireless communication function such as a wireless LAN or Bluetooth.
[0002]
[Prior art]
Conventionally, in a wireless LAN or Bluetooth, there is a problem that it is difficult to limit a communication destination because radio waves are used as a communication medium. For this reason, in these standards, protection measures are taken to change the encryption key for each communication destination so that even if a packet is peeped, it cannot be decrypted.
[0003]
At present, the most common encryption method for wireless communication is encryption using a WEP key (40 bits, 128 bits) in the case of the IEEE 802.11 (hereinafter, “802.11”) method, and Pin in the case of the Bluetooth method. This is encryption using a 128-bit encryption key automatically generated from the code. However, it has been pointed out that these encryption schemes are also vulnerable. In the 802.11 scheme, 802.1x-based authentication was performed as an encryption scheme for further enhancing the security of wireless communication. More advanced encryption methods such as dynamic WEP key conversion (EAP), TKIP, and AES above, and the Bluetooth method, such as authentication / encryption methods in the upper application layer based on 802.1x, have been studied. It has been implemented. Among them, an authentication / encryption unit called an EAP (Extensible Authentication Protocol) system based on 802.1x is standardly mounted as an authentication / encryption unit for the 802.11 system in some OS environments. I have.
[0004]
In the EAP method in the wireless LAN (802.11), when a client terminal makes a network connection request, it uses an access point, which is a wireless connection device, to use a partial TCP / IP port on an intranet or the Internet. Data communication is performed with the provided authentication server (such as a RADIUS server), and a request for a certificate or a challenge from the authentication server to the client terminal is performed. The client terminal performs proof of possession of the certificate or returns an account name and password in response to the challenge, and if they match the data in the authentication server, the authentication server permits the client terminal to connect to the network and establishes a wireless connection. A 128-bit encryption key or an encryption key generation parameter for encrypting communication is returned to the access point and the client terminal.
[0005]
When the client terminal passes the authentication by the authentication server through such a process, the subsequent wireless communication is encrypted by using the 128-bit encryption key as the WEP key between the client terminal and the access point. You. Further, such a process is periodically performed at regular intervals to update the encryption key.
[0006]
In the Bluetooth system, it is recommended to use 802.1x authentication / encryption means for improving security in a PAN (Personal Area Network) profile which is a small LAN environment constructed by terminals having a wireless communication function. Have been. In the case of Bluetooth, a key for encrypting radio waves as a wireless medium is automatically generated by mutual authentication using a PIN code between devices performing communication in the Bluetooth system, so that the encryption key received from the authentication server is generated. Although the information cannot be used as an encryption key for the radio wave itself such as a WEP key used in a wireless LAN, it can be used as a key for encrypting a packet before generating a radio wave as a wireless medium. , It is possible to improve the security of communication by double encryption.
[0007]
In the above-described 802.1x-based authentication / encryption process, an authentication server for performing authentication exists in a network such as an intranet, and the authentication server centrally manages the account of the client terminal. For this reason, if the 802.1x method is used, no matter where the client terminal is located, if TCP / IP communication with the authentication server can be performed, use the same account and password to connect to a backbone network such as an intranet. Can be.
[0008]
[Problems to be solved by the invention]
As described above, the client terminal can realize a secure network connection using wireless communication by using the above-described authentication / encryption process based on the 802.1x method. However, in order to do so, it is necessary that an authentication server is installed in the network, and an account of the client terminal is registered in the authentication server in advance. In other words, the 802.1x system is a system assuming operation on a backbone network such as a relatively large intranet, and client terminals for wireless network connection are limited to members having an account on the authentication server. There was a restriction such as.
[0009]
Therefore, when a meeting in which a visitor who does not have an account on the authentication server participates or a meeting is performed in a conference room outside the company where there is no means for connecting to a backbone network such as an intranet, authentication using the 802.1x method is performed. -There was a problem that a secure network could not be constructed by wireless communication using the encryption process.
[0010]
In this case, wireless communication can be realized without performing authentication / encryption, but there is a major problem in terms of security.
[0011]
If parameters for wireless communication are set manually, wireless communication can be encrypted. However, the client terminal is required to input an account and password of an 802.1x system normally used on a backbone network such as an intranet. Automatic connection requires a completely different means of connection to be made manually. Further, in the manual setting of the wireless communication parameters, it is impossible to automatically change the encryption key at regular intervals, so that the security is impaired.
[0012]
In order to eliminate the above-mentioned problems, a dedicated authentication server compatible with the 802.1x method may be provided for members configuring the PAN, and the PAN constituent may be centrally managed on the authentication server. However, in such a case, even a user who has an account on a legitimate authentication server existing on the backbone network such as an intranet is authenticated by an authentication server dedicated to PAN construction. For the access to the backbone network, there are disadvantages such as the necessity of the authentication work again or the failure of the access to the intranet.
[0013]
The present invention has been made in order to solve the above-mentioned problem, and a user having an account on a legitimate authentication server provided on a backbone network can perform a single authentication process to both a backbone network and a small network. The purpose is to allow the connection.
[0014]
Another object of the present invention is to prohibit a user who has not been authenticated by an authorized authentication server provided on the backbone network from accessing the backbone network.
[0015]
A further object of the present invention is to allow a user who has not been authenticated by an authorized authentication server provided on the backbone network to access only a small network.
[0016]
A further object of the present invention is to provide a method for determining whether or not authentication can be performed by a legitimate authentication server provided on the backbone network.
[0017]
A further object of the present invention is to speed up a client connection process when using an access point in a state where there is no backbone network or when using an access point in an environment where there is no authentication server on the backbone network. It is.
[0018]
A further object of the present invention is to make an account or certificate issued by an access point to a client valid only during a period such as a conference, and thereafter invalidate the certificate or certificate to prevent occurrence of an unauthorized account of a non-conference participant. That is.
[0019]
A further object of the present invention is to prevent a client receiving a temporary account or certificate from an access point from suffering a problem such as a temporary disconnection of a network when performing re-authentication.
[0020]
[Means for Solving the Problems]
To achieve the above object, the present invention provides a method of authenticating a wireless connection device connected to a backbone network and connected to a wireless terminal device by wireless communication, comprising: receiving an authentication request by wireless communication from the wireless terminal device. Transferring the received authentication request to the backbone network, and performing a temporary authentication process for the wireless terminal device when the authentication process for the authentication request fails in the backbone network.
[0021]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0022]
FIG. 1 is a diagram illustrating a configuration of a wireless network system according to the present embodiment. In FIG. 1, reference numeral 100 denotes an access point according to the present embodiment, which constructs a secure network by wireless communication means such as IEEE802.11 or Bluetooth. In the access point 100, a wireless communication circuit unit 101 performs wireless communication with a client terminal described later by wireless communication means. Reference numeral 102 denotes an authentication server function unit, which performs authentication processing of a client terminal in place of an authentication server on an intranet described later. Reference numeral 103 denotes a certificate server function unit, which issues a certificate to the client terminal authenticated by the authentication server function unit 102. A display unit 104 displays a message for temporary authentication from the access point 100.
[0023]
Reference numeral 110 denotes a wireless medium, which is a wireless communication unit using radio waves such as 802.11 and Bluetooth. 111 and 112 are PDA (Personal Digital Assistants), which are connected to the access point 100 wirelessly. Reference numerals 113 and 114 denote notebook personal computers (PCs), which are wirelessly connected to the access point 100. Reference numeral 120 denotes a backbone network (hereinafter, referred to as “intranet”) such as an intranet or the Internet connected to the access point 100. Reference numeral 121 denotes an authentication server provided on the intranet 120, and performs an authentication process in response to an authentication request from a client terminal. Reference numeral 122 denotes a certificate server provided on the intranet 120. In this embodiment, the PDAs 111 and 112 and the notebook computers 113 and 114 connected to the access point 100 via the wireless communication unit 110 are referred to as “client terminals”.
[0024]
Here, in order to facilitate the following description, the client terminal 113 has a certificate issued by the certificate server 122 on the intranet 120 or has an account on the authentication server 121 on the intranet 120. Suppose that Similarly, assume that client terminal 114 is a client terminal that does not own the certificate issued by certificate server 122 on intranet 120 and does not have an account with authentication server 121 on intranet 120. .
[0025]
FIG. 2 is a transition diagram showing an authentication process when the client terminal 113 establishes a connection with the access point 100 by wireless communication. As shown in FIG. 2, the client terminal 113 starts an EAP authentication process (201 to 207) after performing a series of exchanges of the 802.11 association (200) with the wireless communication circuit unit 101 of the access point 100. First, the client terminal 113 declares that the EAP authentication is to be performed to the wireless communication circuit unit 101 (201), and in response to this declaration, the wireless communication circuit unit 101 requests the identification (202) for the EAP authentication. Is transmitted to the client terminal 113. In response, the client terminal 113 transmits an EAP-Response (203) with a user ID to the wireless communication circuit unit 101. Then, the wireless communication circuit unit 101 transfers the received packet to the authentication server 121 existing on the intranet 120 (210).
[0026]
As a result, the authentication server 121 responds to the authentication request (210) from the client terminal 113, and a user corresponding to the user ID attached to the authentication request (210) is registered in the database in the authentication server 121. Search for If the corresponding user has been registered, a challenge (211 and 204) for authentication is transmitted to the client terminal 113 via the wireless communication circuit unit 101. Upon receiving the challenge (204), the client terminal 113 returns an answer (generally, the content of a password or a certificate) corresponding to the challenge to the authentication server 121 on the intranet 120 via the wireless communication circuit unit 101 ( 205, 212). Then, the authentication server 121 examines the content of the challenge response (212) returned from the client terminal 113, and if it matches the authentication data recorded in its own database, passes the authentication OK via the wireless communication circuit unit 101. Is transmitted to the client terminal 113 (213, 206). Here, when changing the wireless communication encryption key such as the WEP key, the wireless communication circuit unit 101 transmits the wireless communication encryption key information (207) to the client terminal 113.
[0027]
After the above-described EAP authentication process (201 to 207) is completed, the client terminal 113 is permitted to access the intranet 120 via the access point 100. At this time, for the client terminal 113 authenticated by the authentication server 121 on the intranet 120, not only the intranet 120 but also other client terminals 111, 112, 114 connected via the access point 100 are sent. It goes without saying that PAN access is also permitted. When the WEP key is dynamically changed, the wireless communication circuit unit 101 periodically transmits an identification request (202) for the EAP authentication to the client terminal 113 after the above-described process is completed. . Then, the process of re-authentication and the transmission of the wireless communication encryption key information related to the new WEP key (202 to 207) similar to the above-described process are repeatedly executed, thereby realizing the dynamic change of the WEP key.
[0028]
The above-described authentication process is no different from a general EAP authentication implementation process. That is, in the present embodiment, the same operation as the normal EAP authentication is performed for the client terminal 113 having an account in the authentication server 121 on the intranet 120 side. On the other hand, in the case of the client terminal 114 that does not own the certificate issued by the certificate server 122 on the intranet 120 and does not have an account on the authentication server 121 on the intranet 120, a general EAP Performs an operation different from the authentication process.
[0029]
FIG. 3 is a transition diagram illustrating an authentication process when the client terminal 114 establishes a connection with the access point 100 by wireless communication. As shown in FIG. 3, the client terminal 114 also starts an EAP authentication process (301 to 309) after performing a series of exchanges of the 802.11 association (300) with the wireless communication circuit unit 101 of the access point 100. First, the client terminal 114 declares that EAP authentication is to be performed to the wireless communication circuit unit 101 (301), and in response to this declaration, the wireless communication circuit unit 101 requests an identification certificate for EAP authentication (302). Is transmitted to the client terminal 114. In response, the client terminal 114 transmits an EAP-Response (303) with a user ID to the wireless communication circuit unit 101. Then, the wireless communication circuit unit 101 transfers the received packet to the authentication server 121 existing on the intranet 120 (310). The processing so far is exactly the same as the above-described general EAP authentication process.
[0030]
Here, the above-described authentication server 121 responds to the authentication request (310) from the client terminal 114, and registers a user corresponding to the user ID attached to the authentication request (310) in the database in the authentication server 121. Whether or not the authentication has been performed is searched, but the corresponding user is not registered, and thus an authentication rejection response (311) is transmitted to the wireless communication circuit unit 101. Then, upon receiving the authentication rejection response (311), the wireless communication circuit unit 101 does not transfer the authentication rejection response performed in the general EAP authentication process to the client terminal 114, and the authentication server provided in the access point 100. The function unit 102 and the certificate server function unit 103 create a new temporary certificate or temporary account for the client terminal 114 and transmit the created temporary certificate or information necessary for the authentication process to the client terminal 114 by wireless communication means. Distribute using 110.
[0031]
FIG. 4 is a flowchart showing a process for creating and distributing a temporary certificate or a temporary account. First, in step S401, when the authentication is rejected by the authentication server 121 on the intranet 120, the process proceeds to step S402, and the client terminal 114 may be an unauthorized user who does not have PAN participation qualification. Before issuing a temporary certificate or a temporary account in the authentication server function unit 102 or the certificate server function unit 103, the personal information of the client terminal owner is displayed in a list on the display unit 104 of the access point 100. Then, in step S403, the PAN administrator manually inputs whether or not to participate in PAN. Specifically, the PAN administrator looks at the personal information displayed on the display unit 104 of the access point 100 and updates or deletes the PAN participants, and then the PAN participant list becomes appropriate. Then, approve the list.
[0032]
Next, in step S404, as a result of the approval, it is determined whether or not the client has the PAN participation qualification. If the client has the PAN participation qualification, the process proceeds to step S405. Is issued, the authentication server function unit 102 creates a temporary account in step S406, distributes the certificate, temporary account, and temporary password information to the client in step S407, and uses the EAP based on the temporary authentication information distributed in step S408. Send an identification request to the client for authentication. If it is determined in step S404 that the client is not a legitimate client such as an unauthorized participant, the process proceeds to step S409, where the authentication rejection is transferred to the client terminal 114, and the PAN connection is not permitted.
[0033]
In the issuance and distribution processing of the temporary certificate and the temporary account in the access point 100 (S405 to S408), EAP-MD5 or the like that uses only the temporary account and the temporary password without using the temporary certificate for EAP authentication is used. In this case, it goes without saying that the temporary certificate issuing process (S405) can be omitted.
[0034]
Here, returning to FIG. 3, after the distribution is completed, the wireless communication circuit unit 101 retransmits an identification request (304) for EAP authentication to the client terminal 114. In response, the client terminal 114 generates an EAP-Response (305) with a user ID using a temporary certificate or a temporary account newly distributed to the authentication server function unit 102 via the wireless communication circuit unit 101. Send. In response, the wireless communication circuit unit 101 transfers the received packet to the authentication server function unit 102 built in the access point 100 instead of the authentication server 121 existing on the intranet 120 (312).
[0035]
As a result, the authentication server function unit 102 in the access point 100 responds to the authentication request (312) from the client terminal 114, and sends the user attached to the database in the authentication server function unit 102 to the authentication request (312). A search is performed to determine whether a user corresponding to the ID has been registered. Since this user ID is registered in the database in the authentication server function unit 102 when the above-mentioned temporary certificate or temporary account is created, the authentication server function unit 102 in the access point 100 passes through the wireless communication circuit unit 101 Then, a challenge (313, 306) for authentication is transmitted to the client terminal 114. Upon receiving the challenge (306), the client terminal 114 sends the response (the content of the temporary password and the temporary certificate distributed in advance and the processed one) corresponding to the challenge via the wireless communication circuit unit 101. To the authentication server function unit 102 in the access point 100 (307, 314). Then, the authentication server function unit 102 examines the content of the challenge response (314) returned from the client terminal 114.
[0036]
Since this challenge response is derived from the information registered in the database in the authentication server function unit 102 when the temporary certificate or the temporary account is created, the authentication server function unit 102 in the access point 100 determines that the authentication is OK (315 ) Is transmitted to the client terminal 114 via the wireless communication circuit unit 101. Here, when changing the wireless communication encryption key such as the WEP key, the wireless communication circuit unit 101 transmits wireless communication encryption key information (309) to the client terminal 114.
[0037]
After the above-described EAP authentication process (301 to 309) is completed, the client terminal 114 is also permitted to make a PAN connection to other client terminals 111, 112, and 113 connected via the access point 100 excluding the intranet 120. You. When the WEP key is dynamically changed, the wireless communication circuit unit 101 periodically transmits an identification request (304) for EAP authentication to the client terminal 114 after the above process is once completed. . Then, the process of re-authentication and the transmission of the wireless communication encryption key information relating to the new WEP key (304 to 309), which are the same as the above-described processes, are repeatedly executed to realize the dynamic change of the WEP key.
[0038]
The determination of whether or not the authentication is possible by the authentication server 121 on the intranet 120 in the flowchart shown in FIG. 4 (S401) is based on the timeout or the presence or absence of the authentication rejection packet. In the timeout determination, the client terminal 114 transmits an EAP-Response (303) with a user ID to the authentication server 121 via the wireless communication circuit unit 101 of the access point 100, and receives the EAP-Response (303) with the user ID. After forwarding the received packet to the authentication server 121 existing on the intranet 120, if no response to the packet is made within the timeout period set in the access point 100 in advance, it is determined that a timeout has occurred, and the subsequent processing is performed. (S402 and subsequent steps). This is effective determination processing when the authentication server 121 does not exist on the intranet 120.
[0039]
The determination based on the presence or absence of the authentication rejection packet is performed by monitoring the authentication rejection response (311) illustrated in FIG. 3 by the wireless communication circuit unit 101, and determining whether the authentication is possible by the authentication server 121 on the intranet 120 based on the presence or absence of the packet. This is because when the client terminal 114 transmits the EAP-Response (303) with the user ID to the intranet 120 in which the authentication server 121 having no account exists, there is no needless waiting time due to timeout or the like. This is an effective determination process in terms of making
[0040]
Therefore, in order for the wireless communication circuit unit 101 of the access point 100 to efficiently and automatically determine whether or not the authentication is possible by the authentication server 121 on the intranet 120, the above-described determination method is combined and the “authentication reject packet is issued. Or, if there is no response within the timeout period, it is determined that authentication is not possible. "
[0041]
Further, since the access point 100 in the present embodiment may be used by carrying it, it is assumed that the installation status of the access point 100 changes frequently. That is, it is conceivable that the access point 100 is used by being connected to the intranet 120 or is used without the intranet 120.
[0042]
In this way, a switch is provided on the access point 100 and the switch transmits a message from the client terminal to the authentication server 121 via the wireless communication circuit unit 101 in case the presence or absence of the intranet 120 is known in advance. It may be possible to set whether to transfer the EAP-Response (210, 310) with the user ID to the intranet 120.
[0043]
This switch may be either a physical switch or a soft switch. By providing such a switch, when the access point 100 is used in an environment where it is known in advance that the intranet 120 does not exist, if this switch is set to be unnecessary to transfer to the intranet 120, the configuration shown in FIG. Since the processes 310 and 311 can be omitted, it is possible to promptly shift to the process of issuing a temporary certificate or a temporary account, thereby improving user convenience.
[0044]
In the authentication process when the client terminal 114 having no account in the authentication server 121 on the intranet 120 shown in FIG. 3 tries to establish a connection with the access point 100 by wireless communication, the client terminal 114 EAP-Response with ID occurs multiple times (303, 305). Therefore, it is necessary to transfer the first EAP-Response (303) to the authentication server 121 on the intranet 120 and transfer the subsequent EAP-Response (305) to the authentication server function unit 102 in the access point 100 without fail. is there. In order to correctly realize this transfer, the wireless communication circuit unit 101 uses a history of whether or not authentication is possible by the authentication server 121 on the intranet 120 of a certain client terminal, or a history of whether a temporary certificate or a temporary account is issued to a certain client terminal. What is necessary is just to determine a transfer destination.
[0045]
In other words, when a determination is made based on the history of whether or not a certain client terminal can be authenticated by the authentication server 121 on the intranet 120, if there is no authentication history by the authentication server 121 on the intranet 120 or the client terminal that has been successfully authenticated, The EAP-Response is transferred to the authentication server 121 on the intranet 120, and the client terminal that has failed the authentication by the authentication server 121 on the intranet 120 always sends the EAP-Response to the authentication server function unit 102 in the access point 100. Perform a transfer.
[0046]
The transfer destination determination based on the history of whether a temporary certificate or a temporary account has been issued to any client terminal is determined by the authentication server function unit 102 and the certificate server function unit 103 in the access point 100 for the arbitrary client terminal. If there is no temporary certificate or temporary account issuance history, the EAP-Response is transferred to the authentication server 121 on the intranet 120. If there is a temporary certificate or temporary account issuance history, the authentication server function in the access point 100 is performed. The EAP-Response is transferred to the unit 102.
[0047]
In this way, by determining the transfer destination of the EAP-Response with the user ID transmitted from the client terminal, the EAP-Response with the user ID that is repeated when dynamically changing the WEP key can be transmitted to the client. The terminal can be reliably transferred to the authentication server that has authenticated the terminal (the authentication server 102 on the intranet 120 or the authentication server function unit 121 in the access point 100), and problems such as temporary disconnection of the network connection can be prevented. .
[0048]
In addition, the PAN constructed around the access point 100 described in the present embodiment does not exist permanently, but is constructed temporarily. Therefore, the temporary certificate and the temporary account issued by the authentication server function unit 102 and the certificate server function unit 103 in the access point 100 must not be permanently valid. Therefore, these temporary certificates and temporary accounts need to be invalidated immediately after the PAN construction period ends. The following can be considered as a method for this invalidation.
[0049]
According to the first method, when a notification such as a conference end notification or a switch operation is given to the access point 100, the temporary certificate and the temporary account that have been valid up to that point are discarded on the access point 100 side. Is the way.
[0050]
The second method is a method in which, when the scheduled PAN construction time input by the user to the access point 100 at the time of constructing the PAN expires, the temporary certificate and the temporary account that have been valid up to that time are destroyed on the access point 100 side. is there.
[0051]
The third method is a method in which, after a lapse of a predetermined time (preferably several hours) from the establishment of the PAN, the temporary certificate and the temporary account that have been valid up to that point are unconditionally discarded on the access point 100 side.
[0052]
In the fourth method, when a temporary certificate or a temporary account is issued from the access point 100, the PAN construction time input by the user to the access point 100 or the expiration date information of a certain time (preferably several hours) (Date and time information) is set in a temporary certificate or a temporary account, the expiration date information is checked for each authentication, the expiration date is expired after the expiration date, and the authentication server function unit of the access point 100 This is a method of making network connection impossible unless the new temporary certificate or temporary account is issued by the certificate server 102 or the certificate server function unit 103. These connection time restrictions are effective for security.
[0053]
As described above, according to the present embodiment, a user having a legitimate account on the authentication server on the intranet or a user having a valid certificate on the authentication server can be temporarily constructed with the intranet by a single authentication process. Wireless connection to a PAN (Personal Area Network). In addition, a secure wireless connection to a temporarily constructed PAN can be realized even for an outsider who does not have an account in the authentication server. Such a need for wireless connection construction is optimal when a temporary secure network is to be constructed at a conference or the like.
[0054]
Even if the present invention is applied to a system including a plurality of devices (for example, a host computer, an interface device, a reader, a printer, etc.), the present invention can be applied to an apparatus (for example, a copying machine, a facsimile device, etc.) including one device. May be applied.
[0055]
Further, an object of the present invention is to supply a recording medium in which a program code of software for realizing the functions of the above-described embodiments is recorded to a system or an apparatus, and a computer (CPU or MPU) of the system or apparatus stores the recording medium in the recording medium. Needless to say, this can also be achieved by reading and executing the program code thus read.
[0056]
In this case, the program code itself read from the recording medium realizes the functions of the above-described embodiment, and the recording medium storing the program code constitutes the present invention.
[0057]
As a recording medium for supplying the program code, for example, a floppy (registered trademark) disk, hard disk, optical disk, magneto-optical disk, CD-ROM, CD-R, magnetic tape, nonvolatile memory card, ROM, or the like is used. be able to.
[0058]
When the computer executes the readout program code, not only the functions of the above-described embodiments are realized, but also an OS (Operating System) running on the computer based on the instruction of the program code. It goes without saying that a case where some or all of the actual processing is performed and the functions of the above-described embodiments are realized by the processing is also included.
[0059]
Further, after the program code read from the recording medium is written into a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer, the function expansion is performed based on the instruction of the program code. It goes without saying that a CPU or the like provided in the board or the function expansion unit performs part or all of the actual processing, and the processing realizes the functions of the above-described embodiments.
[0060]
【The invention's effect】
As described above, according to the present invention, a user having an account on a legitimate authentication server provided on the backbone network is permitted to connect to a small-scale network in a single authentication process. Can be improved.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a configuration of a wireless network system according to an embodiment.
FIG. 2 is a transition diagram showing an authentication process when a client terminal 113 establishes a connection with an access point 100 by wireless communication.
FIG. 3 is a transition diagram illustrating an authentication process when the client terminal 114 establishes a connection with the access point 100 by wireless communication.
FIG. 4 is a flowchart illustrating a process for creating and distributing a temporary certificate or a temporary account.
[Explanation of symbols]
100 access points
101 wireless communication circuit
102 Authentication server
103 Certificate Server
104 Display
110 wireless communication means
111 PDA (Personal Digital Assistants)
112 PDA (Personal Digital Assistants)
113 Notebook PC
114 Notebook PC
120 backbone network (intranet)
121 Authentication server
122 Certificate Server

Claims (1)

An authentication method for a wireless connection device connected to a backbone network and connected to a wireless terminal device by wireless communication,
Receiving an authentication request by wireless communication from the wireless terminal device;
Transferring the received authentication request to the backbone network, and performing a temporary authentication process on the wireless terminal device when the authentication process for the authentication request fails in the backbone network. Authentication method.

Images