JP2005286783A - Wireless lan connection method and wireless lan client software - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology of connecting to a wireless LAN environment that minimizes setting operations to be entered by a user when the user connects with the wireless LAN environment and that ensures the security. <P>SOLUTION: Information required for connection to the wireless LAN environment is set to a wireless LAN access point in advance, and when a user enters an ESS-ID of a connection destination and its own authentication information, wireless LAN client software automatically acquires the information required for connection from the connection destination and automatically sets the acquired information to a wireless LAN card. Further, the wireless LAN client software automatically carries out user authentication by using the IEEE802.1x being the authentication standard in the wireless LAN to establish the connection to the wireless LAN environment. Moreover, the information required for the setting is acquired in an encrypted state on the basis of the authentication information entered from the user and deleted from on the wireless LAN client at interruption. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a technique for automating a setting for connecting to a wireless LAN access point performed by a user in a wireless LAN connection for performing user authentication.

  In order to connect to a wireless LAN access point, based on information specified by the administrator or wireless LAN connection service provider, the ESS-ID, WEP encryption key, authentication method, etc. Various settings need to be made individually by the user. In addition, when the WEP encryption key or the authentication method is changed at the wireless LAN access point, the user needs to set the changed information again. At this time, since the setting method differs depending on the wireless LAN client software used by the user, the user needs to be familiar with the operation / setting method of the wireless LAN client software used by the user. These operations on the user side are difficult for those who have little knowledge of wireless LAN and those who are not familiar with the operation of the OS and terminal, which may cause connection failures and serious security crises due to misconfiguration. It can be.

  FIG. 7 shows an example of a wireless LAN connection form according to a conventional method. The wired LAN environment (Wired Network) 7 includes an authentication server 72, a DHCP server 73, a gateway 74, and a wireless LAN access point 71. A plurality of wireless LAN clients 7-1 to 7-n use the wireless LAN access point 71. Wireless LAN client software 7-1 for setting connection to a wireless LAN card 7-11 and a wireless LAN access point is installed in the wireless LAN client 7-1. The other wireless LAN clients 7-2 to 7-n have the same configuration. The wireless LAN access point 71, the wireless LAN clients 7-1 to 7-n, and the authentication server 72 correspond to, for example, IEEE802.1x, which is a user authentication standard in a wireless LAN.

  Next, a procedure for connecting to a wireless LAN will be described. When the wireless LAN clients 7-1 to 7-n connect to the wireless LAN access point 71, the wireless LAN access point 71 requests the user to present authentication information based on the set authentication method. The sent authentication information is transferred to the authentication server 72. The authentication server 72 confirms whether or not the presented authentication information is correct, and transmits the result to the wireless LAN access point 71. The wireless LAN access point 71 determines whether the user can connect from the result sent from the authentication server 72. The wireless LAN clients 7-1 to 7-n permitted to connect from the wireless LAN access point 71 request the DHCP server 73 to assign an IP address, and when the IP address is assigned, resources on the network and the Internet Be available.

  FIG. 8 is a connection procedure on the user side when connecting to a wireless LAN environment according to a conventional method. The shaded items in the figure are items operated by the user. The user installs a wireless LAN card in the terminal used by the user (step 82), and installs wireless LAN client software (step 83). At the time of installation, ESS-ID, wireless channel, EAP authentication method, own authentication information, etc. presented by the administrator or wireless LAN connection service provider are set in each wireless LAN client software (steps 84 to 88). At this time, the setting location, setting method, setting item name, and the like differ depending on the wireless LAN client software used. After setting, user authentication is started when attempting to connect to the wireless LAN access point. When correct authentication information is presented (step 89), information such as IP address, subnet mask, and DNS server address is assigned to the wireless LAN client from the DHCP server, and services such as network browsing and Internet browsing are available. .

  When using the wireless LAN environment for the second time or later (step 81), if the settings on the wireless LAN environment side have not been changed (step 90), simply presenting your own authentication information (step 89) Services such as browsing the Internet can be used, but if the settings on the wireless LAN environment have been changed (step 90), the user again sets the information presented by the administrator or wireless LAN connection service provider (step 84-88).

  However, not all users of the wireless LAN environment have sufficient knowledge and operation methods for the wireless LAN client software and OS that they use. For this reason, there is a problem that a user cannot connect to the wireless LAN environment due to an erroneous setting and cannot use network resources or services.

  Further, when the configuration on the wireless LAN access point side is changed, it is necessary to change the settings for all wireless LAN clients, which is a heavy burden on the administrator and the user.

  An object of the present invention is to easily provide a connection to a wireless LAN environment and to ensure security by minimizing the setting work that a user must perform.

  In order to achieve the above object, the present invention defines the setting information assigned to the user in advance by the administrator or the provider of the wireless LAN connection service, and when the user connects to the wireless LAN access point. The information is automatically obtained and set by the client. At this time, communication between the wireless LAN access point and the wireless LAN client is encrypted so that setting information is not wiretapped from the outside.

  In addition, the setting information acquired by the wireless LAN client cannot be referred to by the user at all. The setting information acquired when disconnecting from the wireless LAN environment is deleted and set again from the wireless LAN access point when reconnecting. Acquiring information has the feature of reducing unauthorized access by analyzing the acquired setting information file.

  According to the present invention, a user can connect to a wireless LAN environment by performing minimal operations such as designation of a connection destination wireless LAN access point by ESS-ID and input operation of own authentication information, Even if you are not familiar with the operation and setting method of the wireless LAN client software, you can easily use the wireless LAN environment. In addition, even if the administrator or wireless LAN connection service provider changes the setting of the wireless LAN access point due to a change in the configuration or network configuration in the wireless LAN environment, the administrator or the wireless LAN connection service provider notifies the user and requests the setting change again. It is not necessary to present the setting information, and the setting of the wireless LAN access point can be changed as appropriate for the convenience of the administrator or the wireless LAN connection service provider. Furthermore, by encrypting and obtaining the setting information for connecting to the wireless LAN access point, it is possible to prevent eavesdropping on the setting information and enhance security.

  Hereinafter, an embodiment for carrying out the present invention will be specifically described with reference to the drawings.

  FIG. 1 is a schematic configuration diagram of a wireless LAN connection environment according to an embodiment of the present invention. The wired LAN environment 1 includes an authentication server 12, a certificate server 13, a DHCP server 14, a wireless LAN access point 11, and a gateway 15. A plurality of wireless LAN clients 1-1 to 1-n use the wireless LAN access point 11. The wireless LAN access point 11 is compatible with IEEE802.1x, which is a user authentication standard in a wireless LAN, and is set as, for example, setting information 21 in FIG. The wireless LAN access point 11 stores setting information 31 shown in FIG. 3 as setting information for the wireless LAN clients 1-1 to 1-n. In FIG. 1, the setting information 18 in the wireless LAN access point 11 indicates the information shown in FIGS. In particular, the information in FIG. 3 is information that needs to be set in each client-side terminal used by each user in the case of the conventional method.

  The wireless LAN client 1-1 is connected to the wireless LAN card 1-11 and the hardware token 1-13, and the wireless LAN client software 1-12 for setting the connection to the wireless LAN access point is installed. ing. The hardware token 1-13 stores a client certificate 1-14 issued in advance from the certificate server 13. The hardware token 1-13 is distributed to each user in advance by an administrator who operates the wireless LAN. The wireless LAN card 1-11 and the wireless LAN client software 1-12 both support IEEE802.1x, and are particularly characterized in that they support a setting information automatic acquisition function from a wireless LAN access point. The other wireless LAN clients 1-2 to 1-n have the same configuration.

  The authentication server 12 is compatible with IEEE802.1x, and is set as, for example, setting information 41 in FIG. In addition, a server certificate 17 issued from the certificate server 13 is installed, and “certificate server 13” is set as “trusted certificate authority”.

  In the wireless LAN connection environment of this embodiment shown in FIG. 1, each user of the wireless LAN clients 1-1 to 1-n needs to set in advance setting information for connecting to the wireless LAN access point in those clients. There is no need to install the wireless LAN cards 1-11 to 1-n1 and the wireless LAN client software 1-12 to 1-n2. When the user wants to connect to the wireless LAN, select the access point you want to connect from the list of available wireless LAN access points detected by the wireless LAN card at that time, and insert the hardware token. Information is set automatically. Thereafter, the user can receive a wireless LAN service by simply inputting minimum data for identifying the user such as a user ID and a password.

  The connection procedure in the wireless LAN connection environment of the present embodiment described in FIGS. 1 to 4 will be described with reference to FIGS. 5 and 6. Before that, referring to FIG. A connection procedure will be described. As described above, in the wireless LAN connection environment of this embodiment described with reference to FIGS. 1 to 4, setting information is automatically set in the client. The setting about whether to adopt is also included. Accordingly, the authentication method is not limited to the EAP-TLS method, and any method may be used. However, in order to explain with an example using the EAP-TLS method, a general connection procedure in the EAP-TLS method will be described first.

  In FIG. 9, when a user requests connection from the wireless LAN client 91 (step 9-1), the wireless LAN access point 92 requests a user ID (step 9-2). When a user ID is transmitted from the wireless LAN client 91 (step 9-3), the user ID is transmitted to the authentication server 93 (step 9-4). When the authentication server 93 sends a TLS authentication start notification to the wireless LAN access point 92 (step 9-5), the wireless LAN access point 92 sends a TLS authentication start notification to the wireless LAN client 91 (step 9-6). ). The wireless LAN client 91 notifies the authentication server 93 via the wireless LAN access point 92 of a list of supported encryption algorithms (steps 9-7 and 9-8). The authentication server 93 notifies the used encryption algorithm to the wireless LAN client 91 via the wireless LAN access point 92 (steps 9-9 and 9-10). Further, the server certificate is transmitted from the authentication server 93 to the wireless LAN client 91 via the wireless LAN access point 92 (steps 9-11 and 9-12), and the authentication server 93 is transmitted from the wireless LAN client 91 via the wireless LAN access point 92. The client certificate is sent to (Steps 9-13 and 9-14). Further, a message digest is transmitted from the wireless LAN client 91 to the authentication server 93 via the wireless LAN access point 92 (steps 9-15 and 9-16).

  As described above, the authentication server 93 transmits a server certificate to the wireless LAN client 91 to ensure that the authentication server 93 is connected to the correct wireless LAN access point 92. In addition, by transmitting a client certificate from the wireless LAN client 91 to the authentication server 93, it is ensured that the connected user is a legitimate user.

  If it is confirmed that the user is a legitimate user as a result of the authentication, the authentication server 93 transmits an access permission message to the wireless LAN access point 92 (step 9-17). The wireless LAN access point 92 transmits an access permission message to the wireless LAN client 91 (step 9-18) and transmits a WEP encryption key (step 9-19). Thereafter, communication between the wireless LAN client 91 and the wireless LAN access point 92 is performed by encrypted communication using the WEP encryption key.

  In order to realize the connection procedure of the EAP-TLS method as described above, it is necessary to set the setting information as shown in FIG. 3 in the wireless LAN client. In the prior art, the user needs to set these pieces of information in the client. However, in the wireless LAN connection environment according to the present embodiment, these settings are automatically performed, and thus the user does not need to do them.

  FIG. 5 is a connection procedure on the user side when connecting to the wireless LAN environment in the present embodiment. The shaded items in the figure are items operated by the user.

  The user installs the wireless LAN cards 1-11 to 1-n1 in the terminal used by the user (step 52), and installs the wireless LAN client software 1-12 to 1-n2 (step 53). When a user wants to use a wireless LAN, the wireless LAN clients 1-1 to 1-n first display a list of wireless LAN access points that can be wirelessly connected. -Select an ID (step 54). Thereby, connection with the wireless LAN access point 11 is attempted, and user authentication is started. That is, since the user ID and hardware tokens 1-13 to 1-n3 are requested to be input, the user inputs the user ID and inputs hardware tokens 1-13 to 1-n3 (step 55). . The wireless LAN clients 1-1 to 1-n transmit a connection request to the wireless LAN access point 11 of the selected ESS-ID (step 56), and the setting information shown in FIG. Obtain and automatically set (step 57). Thereafter, user authentication is started by the method specified by the setting information, that is, the EAP-TLS method in this example (step 58). Thereafter, the use of the wireless LAN network is started.

  FIG. 6 is an outline of a procedure when a user connects to the wireless LAN connection environment of the present embodiment shown in FIGS. 1 to 5, and is a flowchart showing steps 54 to 58 in FIG. 5 and subsequent procedures. is there. Below, it demonstrates for every step of FIG.

  (1) Step 6-1: As described in steps 54 to 56 in FIG. 5, the wireless LAN client software 1-12 to 1-n2 sets the ESS-ID of the wireless LAN access point that can communicate when it starts up. Automatically obtains and displays a list of communicable ESS-IDs for users attempting to connect to a wireless LAN environment. When the user selects the ESS-ID to be connected from the displayed list of ESS-IDs, the wireless LAN client software 1-12 to 1-n2 inputs the user ID and the client certificate 1- 1 to the user. Requests the insertion of hardware tokens 1-13 to 1-n3 storing 14 to 1-n4. When the user inputs the user ID and inserts the hardware tokens 1-13 to 1-n3, the wireless LAN client software 1-12 to 1-n2 is connected to the wireless LAN belonging to the selected ESS-ID group. After transmitting a connection request to the access point 11, the user ID and client certificates 1-14 to 1-n4 are transmitted. The above corresponds to step 6-1. At step 6-1, the wireless LAN access point 11 is in a port open state (closed except for authentication-related) (6-11).

  (2) Steps 6-2 and 6-3: Further, the wireless LAN client software 1-12 to 1-n2 transmits a request for setting information to the wireless LAN access point 11. In response, the wireless LAN access point 11 sends the setting information 31 in FIG. 3 (setting information 18 in FIG. 1) to the client certificates 1-14 to 1 notified from the wireless LAN clients 1-1 to 1-n. Encrypt using -n4 public key and send to wireless LAN clients 1-1 to 1-n. The wireless LAN client software 1-12 to 1-n2 decrypts the received setting information using the private key of the client certificate 1-14 to 1-n4, and sets the wireless LAN card 1-11 as the setting information 18-1. Set to ~ 1-n1. The above corresponds to Steps 6-2 and 6-3, whereby the wireless LAN setting is automatically performed in each client.

  (3) Step 6-4: Next, user authentication is performed by the authentication method specified by the automatically set wireless LAN setting information. As described above, since the EAP-TLS scheme is used here, user authentication is performed by the scheme. This is to perform user authentication by the procedure described in FIG. However, in the procedures of FIGS. 5 and 6, since the information input by the user such as the user ID has already been input at this time (step 55 in FIG. 5 and step 6-1 in FIG. 6), the steps in FIG. 9-2 to 9-4 are not required. Further, steps 9-17 to 9-19 in FIG. 9 correspond to steps 6-5 to 6-7 in FIG. 6 described later.

  (4) Steps 6-5 to 6-7: When the user authentication is successful, an access permission message is transmitted from the authentication server 12 to the wireless LAN access point 11 (step 6-5). In addition, an access permission message is transmitted from the wireless LAN access point 11 to the wireless LAN clients 1-1 to 1-n (step 6-6), and a WEP encryption key is transmitted (step 6-7).

  (5) Step 6-8: Thereafter, the wireless LAN client encrypts communication using the received WEP encryption key. The wireless LAN clients 1-1 to 1-n request the DHCP server 14 to assign an IP address by DHCP. The DHCP server 14 assigns information such as an IP address, a subnet mask, a default gateway, and a DNS server IP address to the wireless LAN clients 1-1 to 1-n. As described above, the wireless LAN client can perform Internet reference, mail transmission / reception, and the like. That is, the port is open (all network access permission) for the wireless LAN client (6-12).

  (6) Step 6-9: When a disconnection is transmitted from the wireless LAN client (step 6-9), the wireless LAN access point 11 closes the port and cuts off the communication (6-13). The same applies when polling from the wireless LAN access point 11 is not received for a certain period of time. When disconnected, the wireless LAN client software 1-12 to 1-n2 deletes the acquired setting information 18-1 from the wireless LAN clients 1-1 to 1-n to prevent unauthorized access due to acquired information analysis. (6-14)

  When connecting to the wireless LAN environment again, it is not necessary to install a wireless LAN card and wireless LAN client software as shown in step 51 of FIG. According to the procedure from step 54, a connection to the wireless LAN environment may be established. The wireless LAN client obtains and sets the setting information in FIG. 3 from the wireless LAN access point 11 every time it connects to the wireless LAN environment. Even when the setting of the access point 11 is changed, it is possible to connect to the wireless LAN environment without changing the setting of the wireless LAN client software 1-12 to 1-n2.

  In the wireless LAN connection environment of the present embodiment described above, the wireless LAN clients 1-1 to 1-n can obtain the server certificate 17 from a public institution that is trusted by the wireless LAN client OS as a standard. The authentication server 12 can be trusted without installing the certificate of the certificate server that issued the server certificate 17. In addition, client certificates 1-14 to 1-n4 for wireless LAN clients 1-1 to 1-n are issued and managed by the certificate server 13 to use client certificates issued by public institutions. Compared to the case, the client certificate issuance cost is reduced and management is easy. By storing the client certificates 1-14 to 1-n4 in the hardware tokens 1-13 to 1-n3, unauthorized use of the client certificate is prevented. Furthermore, management of the client tokens 1-14 to 1-n4 is made easier by managing the hardware tokens 1-13 to 1-n3.

  Also, the setting information 18 (FIG. 3) assigned to the wireless LAN clients 1-1 to 1-n from the wireless LAN access point 11 is encrypted with the public key of the client certificate 1-14 to 1-n4, and wirelessly By sending the setting to the LAN client and setting it, wiretapping of setting information in the wireless communication section is prevented. The WEP encryption key used in wireless communication is automatically exchanged in the tunnel generated by EAP-TLS, and the communication in the wireless section is protected from eavesdropping by updating it periodically.

Explanatory drawing for demonstrating the outline of the wireless LAN environment of one embodiment of this invention Explanatory drawing for demonstrating the setting of the wireless LAN access point in one Embodiment of this invention Explanatory drawing for demonstrating the setting of the wireless LAN client in one Embodiment of this invention Explanatory drawing for demonstrating the setting of the authentication server in one Embodiment of this invention The flowchart for demonstrating the connection procedure of the user in one embodiment of this invention Explanatory drawing for demonstrating the outline of the connection in one Embodiment of this invention Explanatory diagram for explaining a conventional wireless LAN environment Flow chart for explaining a user connection procedure in a conventional wireless LAN environment Explanatory diagram for explaining the authentication procedure of the EAP-TLS authentication method in IEEE802.1x, the wireless LAN authentication standard

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1, 8 ... Wired LAN environment 11, 81 ... Wireless LAN access point, 12, 82 ... Authentication server, 14, 83 ... DHCP server, 15, 84 ... Gateway, 1-1 1-n, 8-1 to 8-n, wireless LAN client, 1-11 to 1-n1, 8-11 to 8-n1, wireless LAN card, 1-12 to 1-n2, 8 -12 to 8-n2 ... wireless LAN client software, 1-13 to 1-n3 ... hardware token, 1-14 to 1-n4 ... client certificate, 13 ... certificate server, 16 ... Internet, 17 ... Server certificate, 18, 18-1 ... Setting information.

Claims (5)

A wireless LAN connection method for connecting to a wireless LAN access point from a wireless LAN client,
Requesting wireless LAN connection setting information from the wireless LAN client to the wireless LAN access point;
Transmitting wireless LAN connection setting information from the wireless LAN access point to the wireless LAN client;
Setting the transmitted setting information in the wireless LAN client;
A wireless LAN connection method comprising: performing user authentication between the wireless LAN client and the wireless LAN access point using an authentication method specified by the setting information. The wireless LAN connection method according to claim 1,
Transmission of setting information from the wireless LAN access point to the wireless LAN client is performed by encrypted communication. The wireless LAN connection method according to claim 2,
A wireless LAN connection method, wherein a client certificate is stored in advance in a hardware token distributed to a user of a wireless LAN client, and the encrypted communication is performed using key information included in the client certificate. . In the wireless LAN connection method according to any one of claims 1 to 3,
When communication between the wireless LAN client and the wireless LAN access point is completed, the wireless LAN client further comprises a step of canceling the setting information setting and erasing the setting information in the wireless LAN client. Wireless LAN connection method to do. Wireless LAN client software used when connecting to a wireless LAN access point from a wireless LAN client, by executing the software on the wireless LAN client,
Requesting wireless LAN connection setting information from the wireless LAN client to the wireless LAN access point;
Receiving wireless LAN connection setting information transmitted from the wireless LAN access point in response to the setting information request;
A step of setting the received setting information;
Wireless LAN client software, comprising: performing user authentication between the wireless LAN client and the wireless LAN access point using an authentication method specified by the setting information.

Images