JP2008042658A - Connection control apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a controller which smoothly performing communications without distributing authentication information even in the case where re-authentication is required. <P>SOLUTION: A controller C05 of the present invention comprises: a move detecting unit 101 which detects that a mobile terminal MS enters a second authentication zone S2 from a first authentication zone S1; an authentication confirmation unit 102 which judges whether the mobile terminal MS is completely authenticated in the second authentication zone S2; and a communication instruction unit 103 which outputs instruction information instructing an access point AP05 belonging to the second authentication zone S2 to communicate with the mobile terminal MS without essentially requiring authentication in the case where the mobile terminal MS is not completely authenticated in the second authentication zone S2 as a result of the confirmation by the authentication confirmation unit 102. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a connection control apparatus used in a mobile communication system that authenticates a mobile terminal and permits connection.

As a mobile communication system that authenticates a mobile terminal and permits connection, there is a wireless LAN (wireless local area network) based on a method such as IEEE 802.11a / b / g. The wireless LAN authenticates the mobile terminal to ensure communication confidentiality and permits connection. On the other hand, users using a wireless LAN often communicate using a mobile terminal while moving. Therefore, various studies have been made on authentication methods in order to ensure a smooth communication state at the time of handover (see Patent Document 1 below).
JP 2004-266331 A

  The technique described in Patent Document 1 is intended to reduce the authentication time when a mobile terminal performs communication while moving between different wireless networks. As specific means, the location information of the mobile terminal is acquired and the authentication information is notified to the wireless network around the current location.

  However, it may be undesirable to distribute authentication information unnecessarily from the viewpoint of ensuring security of authentication information. On the other hand, if the authentication information is simply centrally managed, if re-authentication is required due to handover or the like, the re-authentication sequence may take time, and smooth handover may not be possible.

  Therefore, in the present invention, a connection control apparatus used in a mobile communication system that authenticates a mobile terminal and permits connection, and smoothly distributes even when re-authentication is necessary without distributing authentication information. An object of the present invention is to provide a connection control apparatus capable of performing communication.

  A connection control apparatus according to the present invention is used in a mobile communication system that authenticates a mobile terminal and permits a connection. The mobile communication system includes a first authentication zone, a first authentication zone, Has a second authentication zone that requires authentication independently, and has a plurality of radio base stations belonging to each, and this connection control device allows the mobile terminal to perform second authentication from the first authentication zone. A mobile detection means for detecting that the mobile terminal has entered, an authentication confirmation means for judging whether or not authentication in the second authentication zone has been completed for the mobile terminal; If authentication in the authentication zone has not been completed, instruction information for instructing the wireless base station belonging to the second authentication zone to perform communication that does not substantially require authentication with the mobile terminal is output. Comprising a communication instruction means for, the.

  According to the present invention, when a mobile terminal enters a second authentication zone that requires authentication independently of the first authentication zone, and authentication is not completed in the second authentication zone, authentication is required. Since the instruction information for performing communication is not output to the radio base station, the communication connection sequence that substantially does not require authentication for the mobile terminal is executed to the radio base station prior to executing the authentication sequence for the mobile terminal. It becomes possible to make it.

  In the connection control device according to the present invention, if the authentication in the second authentication zone is not completed for the mobile terminal as a result of the confirmation by the authentication confirmation unit, the authentication request unit that requests the authentication device to authenticate the mobile terminal; When the authentication of the mobile terminal is completed as a result of the request, the mobile terminal authenticates with the radio base station performing the communication that does not substantially require authentication by the instruction information output from the communication instruction means. It is also preferable to include switching instruction means for outputting switching instruction information for instructing to switch to communication that requires.

  According to this preferable aspect, while the authentication apparatus is requested to authenticate a mobile terminal that requires authentication in the second authentication zone, communication that does not substantially require authentication is possible, and authentication is not performed. When completed, the communication can be switched to require authentication.

  According to the present invention, it is possible to cause the radio base station to execute a communication connection sequence that does not substantially require authentication for the mobile terminal prior to executing the authentication sequence for the mobile terminal. Even if re-authentication is required, communication can be performed smoothly without distributing the.

  DESCRIPTION OF EXEMPLARY EMBODIMENTS Hereinafter, preferred embodiments of the invention will be described with reference to the accompanying drawings. In order to facilitate the understanding of the description, the same constituent elements in the drawings will be denoted by the same reference numerals as much as possible, and redundant description will be omitted.

  First, a configuration of a mobile communication system using a controller (communication control device) according to the present embodiment will be described. FIG. 1 is a diagram showing a configuration of a mobile communication system S including controllers C01, C02, C03, C04, C05, and C06.

  The mobile communication system S includes a first authentication zone S1 and a second authentication zone S2. The second authentication zone S2 is an area where authentication is required independently of the first authentication zone S1. Therefore, conversely, the first authentication zone S1 is an area where authentication is required independently of the second authentication zone S2.

  An authentication server RS1 is provided in the first authentication zone S1. The authentication server RS1 is a device for performing communication terminal authentication in the first authentication zone S1. Routers R01 and R02 are provided under the authentication server RS1.

  Under the router R01, access points AP01 and AP02 (wireless base stations) are provided. The access point AP01 is an access point that performs communication with a communication terminal existing in the communication area Z01. Similarly, the access point AP02 is an access point that performs communication with a communication terminal existing in the communication area Z02.

  A controller C01 is connected to the access point AP01. The controller C01 is a communication control device for controlling communication of the access point AP01. A controller C02 is connected to the access point AP02. The controller C02 is a communication control device for controlling communication of the access point AP02.

  Under the router R02, access points AP03 and AP04 (wireless base stations) are provided. The access point AP03 is an access point that performs communication with a communication terminal existing in the communication area Z03. Similarly, the access point AP04 is an access point that performs communication with a communication terminal existing in the communication area Z04.

  A controller C03 is connected to the access point AP03. The controller C03 is a communication control device for controlling communication of the access point AP03. A controller C04 is connected to the access point AP04. The controller C04 is a communication control device for controlling communication of the access point AP04.

  An authentication server RS2 is provided in the second authentication zone S2. The authentication server RS2 is a device for performing communication terminal authentication in the second authentication zone S2. A router R03 is provided under the authentication server RS2.

  Under the router R03, access points AP05 and AP06 (wireless base stations) are provided. The access point AP05 is an access point that performs communication with a communication terminal existing in the communication area Z05. Similarly, the access point AP06 is an access point that performs communication with a communication terminal existing in the communication area Z06.

  A controller C05 is connected to the access point AP05. The controller C05 is a communication control device for controlling communication of the access point AP05. A controller C06 is connected to the access point AP06. The controller C06 is a communication control device for controlling communication of the access point AP06.

  Subsequently, the controllers C01 to C06 will be described. Since the configurations of the controllers C01 to C06 are the same, the description will be given taking the controller C05 as an example. In this description, it is assumed that the mobile terminal MS moves from the communication area Z04 to the communication area Z05.

  As shown in FIG. 2, the controller C05 includes a CPU (Central Processing Unit) 10a, a RAM (Random Access Memory) 10b and a ROM (Read Only Memory) 10c, an auxiliary storage device 10d such as a hard disk, and a communication. A computer (or computer system) including hardware such as the interface 10e is configured. By operating these constituent elements, the functions described later of the controller C05 are exhibited.

  Next, functional components of the controller C05 will be described with reference to FIG. The controller C05 includes, as functional components, a movement detection unit 101 (movement detection unit), an authentication confirmation unit 102 (authentication confirmation unit), a communication instruction unit 103 (communication instruction unit), and an authentication request unit 104 (authentication). Requesting means), an authentication result receiving unit 105 (authentication result receiving means), and a switching instruction unit 106 (switching instruction means). Subsequently, each functional component will be described.

  The movement detection unit 101 is a part that detects that the mobile terminal MS has entered the second authentication zone S2 from the first authentication zone S1. More specifically, when the mobile terminal MS is in the communication area Z05 of the access point AP05 to which the controller C05 is connected, information about the mobile terminal MS is output from the access point AP05 to the controller C05.

  The movement detection unit 101 receives the information about the output mobile terminal MS. If the movement detection unit 101 detects that the mobile terminal MS has moved from the communication area Z04 based on the output information, the movement terminal MS moves from the first authentication zone S1 to the second authentication zone S2. We recognize that we entered. On the other hand, when it can be detected that the mobile terminal MS has moved from the communication area Z06, it is recognized that the mobile terminal MS has moved within the second authentication zone S2.

  When the movement detection unit 101 detects that the mobile terminal MS has moved from the communication area Z04, the movement detection unit 101 recognizes that the mobile terminal MS has entered the second authentication zone S2 from the first authentication zone S1, and determines the result. Output to the authentication confirmation unit 102.

  The authentication confirmation unit 102 is a part that determines whether or not the authentication in the second authentication zone S2 has been completed for the mobile terminal MS. More specifically, the authentication confirmation unit 102 determines whether or not authentication has been completed for the mobile terminal MS based on the information output from the access point AP05 and received by the movement detection unit 101. The authentication confirmation unit 102 outputs the confirmation result to the communication instruction unit 103.

  If the authentication in the second authentication zone S2 is not completed for the mobile terminal MS as a result of the confirmation by the authentication confirmation unit 102, the communication instruction unit 103 communicates with the mobile terminal MS for the access point AP05 belonging to the second authentication zone S2. This is a part that outputs instruction information for instructing to perform communication that does not require authentication.

  In response to the output of the instruction information, the access point AP05 communicates with the mobile terminal MS using a predetermined perch channel. This perch channel is a channel that can be immediately communicated without substantially requiring authentication. Note that the communication connection that does not substantially require authentication is a communication connection that does not perform authentication at all or performs relatively loose authentication even if authentication is performed.

  The authentication request unit 104 is a part that requests the authentication server RS2 to authenticate the mobile terminal MS when the mobile terminal MS has not been authenticated in the second authentication zone S2 as a result of the confirmation by the authentication confirmation unit 102. . More specifically, the authentication request unit 104 transmits authentication request information for requesting authentication of the mobile terminal MS to the authentication server RS2. This transmission may be via the access point AP05 or directly from the controller C05.

  The authentication result receiving unit 105 is a part that receives the authentication result of the mobile terminal MS transmitted from the authentication server RS2 in response to the authentication request from the authentication request unit 104. The authentication result receiving unit 105 outputs the received authentication result to the switching instruction unit 106.

  When the authentication of the mobile terminal MS is completed as a result of the authentication request of the authentication request unit 104, the switching instruction unit 106 performs communication that does not substantially require authentication based on the instruction information output from the communication instruction unit 103. This is a part for outputting switching instruction information for instructing the access point AP05 to switch to communication that requires authentication with the mobile terminal MS.

  In response to the output of the switching instruction information, the access point AP05 performs communication with the mobile terminal MS, which has been performed using a predetermined perch channel, using a channel that requires normal authentication. Switch to.

  Next, the operation of the controller C05 (C01 to C04, C06) will be described with reference to FIG.

  The movement detection unit 101 detects that the mobile terminal MS has entered the second authentication zone S2 from the first authentication zone S1 (step S01). The authentication confirmation unit 102 determines whether or not authentication in the second authentication zone S2 has been completed for the mobile terminal MS (step S02).

  If it is determined in step S02 that the mobile terminal MS has been authenticated in the second authentication zone S2, the communication instruction unit 103 instructs the access point AP05 to perform communication using a normal channel ( Step S03).

  If it is determined in step S02 that the mobile terminal MS has not been authenticated in the second authentication zone S2, the communication instruction unit 103 instructs the access point AP05 to perform communication using the perch channel. (Step S04).

  After step S04, the authentication request unit 103 requests the authentication server RS2 to authenticate the mobile terminal MS (step S05). When the authentication in the authentication server RS2 is completed, the result is transmitted and received by the authentication result receiving unit 105 (step S06). When the reception in step S06 is completed, the switching instruction unit 106 authenticates with the mobile terminal MS with respect to the access point AP05 performing communication that does not substantially require authentication based on the instruction information output from the communication instruction unit 103. The switching instruction information for instructing to switch to the communication that requires is output (step S07).

  As described above, according to the present embodiment, the mobile terminal MS enters the second authentication zone S2, which requires authentication independently of the first authentication zone S1, and the authentication is completed in the second authentication zone S2. If not, instruction information for performing communication that does not substantially require authentication is output to the access point AP05 or the like, so that the authentication for the mobile terminal MS is performed prior to executing the authentication sequence for the mobile terminal MS. It is possible to cause the access point AP05 or the like to execute a communication connection sequence that does not substantially require the access point AP05.

  Further, by the operations of the communication instruction unit 103, the authentication request unit 104, the authentication result receiving unit 105, and the switching instruction unit 106 described above, authentication for the mobile terminal MS that requires authentication in the second authentication zone S2 is performed by the authentication server RS2. While the request is made, communication that substantially does not require authentication is possible, and when authentication is completed, the communication can be switched to communication that requires authentication.

It is a figure which shows the structure of the mobile communication system where the controller of this embodiment is used. It is a hardware block diagram of the controller shown in FIG. It is a functional block diagram of the controller shown in FIG. It is a flowchart which shows operation | movement of the controller shown in FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS S ... Mobile communication system, S1 ... 1st authentication zone, S2 ... 2nd authentication zone, RS1, RS2 ... Authentication server, R01, R02, R03 ... Router, AP01, AP02, AP03, AP04, AP05, AP06 ... Access point, C01, C02, C03, C04, C05, C06 ... Controller, Z01, Z02, Z03, Z04, Z05, Z06 ... Communication area, MS ... Mobile terminal, 101 ... Movement detection unit, 102 ... Authentication confirmation unit, 103 ... Communication instruction 104, an authentication request unit, 105, an authentication result receiving unit, 106, a switching instruction unit.

Claims (2)

A connection control apparatus used in a mobile communication system that authenticates a mobile terminal and permits a connection, wherein the mobile communication system performs authentication independently of a first authentication zone and the first authentication zone. Having a required second authentication zone, and having a plurality of radio base stations belonging to each,
Movement detection means for detecting that the mobile terminal has entered the second authentication zone from the first authentication zone;
Authentication confirmation means for judging whether or not authentication in the second authentication zone is completed for the mobile terminal;
When the authentication in the second authentication zone is not completed for the mobile terminal as a result of the confirmation by the authentication confirmation means, the mobile terminal and the wireless base station belonging to the second authentication zone need to be substantially authenticated. Communication instruction means for outputting instruction information for instructing communication to be performed, and
A connection control device comprising: As a result of confirmation by the authentication confirmation means, if authentication in the second authentication zone is not completed for the mobile terminal, an authentication request means for requesting the authentication device to authenticate the mobile terminal;
When the mobile terminal authentication is completed as a result of the request, the mobile terminal performs the communication with the radio base station performing communication that does not substantially require authentication based on the instruction information output from the communication instruction means. Switching instruction means for outputting switching instruction information for instructing to switch to communication that requires authentication with the terminal;
The connection control device according to claim 1, comprising:

Images