JP2008048212A - Radio communication system, radio base station device, radio terminal device, radio communication method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To promptly authenticate a radio terminal device during a hand-over of a radio communication system. <P>SOLUTION: A radio base station device of the radio communication system is equipped with: a key storage means for storing a predetermined key; a means for transmitting a log-in request to an authenticating device when receiving the log-in request from some radio terminal device, then receiving an authentication request from the authenticating device; a means for transmitting terminal authentication information generated by ciphering information including identification information of the radio terminal device with a predetermined key to the radio terminal device when authentication by the authenticating device is successful; and a means for, when receiving terminal authentication information from another radio terminal device which has been subordinate to another radio base station device and moves therefrom, deciphering the terminal authentication information with the predetermined key, authenticate the other radio terminal device by using information included in the terminal authentication information, and relaying communication between the other radio terminal device and the other device when the authentication is successful. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a handover technique in a wireless communication system including a plurality of wireless access points.

  In recent years, IP telephones using VoIP (Voice over IP) technology have become widespread in office environments. Currently, there are two types of terminal devices for using IP telephones: fixed terminal devices using wires and portable terminal devices using wireless communication. When considering user convenience, a portable terminal device is more convenient than a wired device that cannot move and has physical restrictions.

  At present, a wireless LAN (IEEE802.11a / b / g) is available as a wireless communication infrastructure for realizing a wireless IP phone using VoIP technology in an office environment. The communication range of the wireless LAN is about 20 to 30 meters, and the transmission speed is about 100 kbps to several Mbps. As a mechanism for authenticating terminal devices, a mechanism for performing terminal authentication with an authentication server existing on the network side using a protocol such as IEEE802.1X is widely used.

As a conventional technique related to handover in a wireless LAN communication system, there is a technique described in Patent Document 1, for example.
Japanese Patent Laid-Open No. 2005-223753

  In order to realize a wireless IP phone using VoIP technology using a conventional wireless LAN as an infrastructure, high mobility must be considered. This is because, like a normal mobile phone, a user moves in a wide range while making a call with a wireless IP phone.

  Generally, the range that can be covered by one wireless access point is 802.11b / 11 Mbps in a room and a radius of about 23 m, although it depends on the environment. In addition, only a narrower range can be covered depending on conditions such as office shape and wall layout.

  That is, in most office environments, it is necessary to install a plurality of wireless access points, and handover occurs when a user moves between wireless access points. For data terminals such as PCs, there is often no particular problem even if it takes 2 to 3 seconds for handover. However, in the case of a voice wireless IP phone, if it takes 1 second or more for handover, sound is completely cut off.

  However, the current normal wireless LAN handover requires access to the back-end authentication server (such as a RADIUS server) when re-authenticating the terminal device when switching the wireless access point to be connected. It takes time and it is difficult to perform handover without interruption of the wireless IP phone.

  Patent Document 1 describes a technique for performing a handover process smoothly by predicting the movement of a mobile terminal by a simple method and transmitting the result of the movement prediction from the network side to the mobile terminal. There is no description about prompt authentication when the terminal is authenticated.

  The present invention has been made in view of the above points, and an object of the present invention is to provide a technique for quickly authenticating a wireless terminal device at the time of handover in a wireless communication system.

  The above-described problem includes a plurality of wireless base station devices that perform wireless communication with a wireless terminal device and relay communication between the wireless terminal device and another device, and further include the plurality of wireless base station devices and a network. A wireless communication system including key management devices connected to each other, wherein the key management device assigns a predetermined key commonly used in the plurality of wireless base station devices to each of the wireless base station devices. Means for transmitting to the base station device, each of the radio base station devices in the plurality of radio base station devices, a key storage means for storing a predetermined key received from the key management device, and a login request from a certain radio terminal device The login request is transmitted to the authentication device, the authentication result is received from the authentication device, and when the authentication of the wireless terminal device by the authentication device is successful, Means for transmitting terminal authentication information, which is information obtained by encrypting information including identification information of a line terminal device with the predetermined key, to the wireless terminal device; and other wireless devices that have moved from under the control of another wireless base station device When terminal authentication information is received from the terminal device, the terminal authentication information is decrypted with the predetermined key, and the other wireless terminal device is authenticated using the information included in the terminal authentication information, and the authentication is successful. In such a case, the problem can be solved by a wireless communication system comprising a means for relaying communication between the other wireless terminal device and the other device.

  Each of the wireless terminal device and the wireless base station device in the wireless communication system may include a UWB communication interface, and UWB communication may be performed between the wireless terminal device and the wireless base station device.

  The identification information of the wireless terminal device is a MAC address of the wireless terminal device, and the wireless base station device is included in the MAC address of the wireless terminal device that is the transmission source of the terminal authentication information and the terminal authentication information. The wireless terminal device that is the transmission source of the terminal authentication information may be authenticated by comparing with a MAC address that is received.

  The key management device periodically transmits counter information to each radio base station device, and each radio base station device includes the counter information in the terminal authentication information and includes the terminal authentication information received from the radio terminal device. The validity of the terminal authentication information may be determined by comparing the counter information included with the latest counter information held.

  Further, the present invention is a radio base station apparatus that performs radio communication with a radio terminal apparatus and relays communication between the radio terminal apparatus and another apparatus, and is used in common with other radio base station apparatuses. A key storage means for storing a predetermined key; and a means for transmitting a login request to an authentication apparatus when receiving a login request from a certain wireless terminal apparatus, and receiving an authentication result of the wireless terminal apparatus from the authentication apparatus; Means for transmitting, to the wireless terminal device, terminal authentication information that is information obtained by encrypting information including identification information of the wireless terminal device with the predetermined key when the authentication by the authentication device is successful; When terminal authentication information is received from another wireless terminal device that has moved from under the control of the wireless base station device, the terminal authentication information is decrypted with the predetermined key, and the information included in the terminal authentication information is used to other A wireless base station device comprising: a means for performing authentication of a line terminal device, and relaying communication between the other wireless terminal device and the other device when the authentication is successful May be.

The present invention also relates to a wireless terminal device used in a wireless communication system including a plurality of wireless base station devices that perform wireless communication with a wireless terminal device and relay communication between the wireless terminal device and another device. Means for transmitting a login request including user authentication information to establish a connection with a certain radio base station apparatus, and when the authentication result based on the user authentication information by the authentication apparatus is successful, the radio base station Means for receiving terminal authentication information, which is information obtained by encrypting information including identification information of the wireless terminal device with a predetermined key from a station device;
When the radio terminal apparatus moves under the control of another radio base station apparatus different from the radio base station apparatus, the other radio base station apparatus is connected to connect to the other radio base station apparatus. And a means for transmitting the terminal authentication information and receiving an authentication result based on the terminal authentication information from the other radio base station apparatus.

  ADVANTAGE OF THE INVENTION According to this invention, it becomes possible to perform the authentication of the radio | wireless terminal apparatus at the time of the hand-over in a radio | wireless communications system quickly, and can speed up a hand-over.

  Embodiments of the present invention will be described below with reference to the drawings.

(System overview)
FIG. 1 shows a radio communication system according to an embodiment of the present invention. As shown in FIG. 1, a configuration is adopted in which a plurality of wireless access points (AP) and a key server 4 are connected by a network 6. In addition, in the area under the wireless access point 1, there is a wireless terminal device 5 that performs wireless communication with the wireless access point 1, and the wireless terminal device 5 moves between the areas as appropriate.

  The key server 4 has a function of distributing key information and counter information to each wireless access point. In this embodiment, the key server 4 is also provided with a user authentication function, but an authentication device other than the key server 4 may be used as a device for performing user authentication.

  Each wireless access point generates a cookie (Cookie) encrypted using the key information distributed from the key server 4 in addition to a general function as a wireless LAN access point, and succeeds in user authentication. A function of distributing the encrypted cookie to the device, and a function of authenticating the wireless terminal device based on the encrypted cookie received from the wireless terminal device at the time of handover. In the following description, the wireless access point is called a host server.

  In addition, the handover method according to the present invention can be applied regardless of the type of the wireless communication method, and any wireless communication method of the wireless terminal device can be used. In this embodiment, the wireless terminal A UWB (Ultra Wide Band) terminal is used as the device. The host server also has a UWB interface function.

  In UWB, it is possible to secure a communication speed exceeding several tens of Mbps by transmitting and receiving data by spreading data in an extremely wide frequency band of 1 GHz or higher. Further, the signal intensity in each frequency band is only as strong as noise, and the power consumption of the device is small. The effect of using UWB will be described later.

  In this specification, unless otherwise specified, the term “wireless LAN” is used in a broad sense, and a wireless communication network (so-called PAN (personal area network)) is used between a wireless communication terminal and a host server. All methods that can be configured are included.

  Next, main operations of the wireless communication system according to the present embodiment will be described with reference to the sequence charts of FIGS. As a premise of this operation, it is assumed that each host server holds key information (host key (HK), counter) distributed from the key server. Each flow shows transmission / reception of a message (frame) in the MAC layer of the wireless LAN.

  First, a process when the wireless terminal device 5 first connects to the host server 1 will be described with reference to FIG.

  The wireless terminal device 5 transmits a login request message including a user name, a password, and a terminal identifier (own MAC address) to the host server 1 (step 1). The host server 1 that has received the login request message transmits the login request message to the key server 4 (step 2). The key server 4 performs user authentication using the user name and password included in the login request message (step 3), and when the authentication is successful, sends an ACK message to the host server 1 (step 4). Then, the host server 1 transmits a login confirmation message including the connection key (CK) and the host server identifier (HID) to the wireless terminal device 5 (step 5). The connection key is a key that is used in the next 4-way handshake and is also used for encrypted communication with the host server 1 after connection with the host server 1.

  Then, for example, after performing a 4-way handshake standardized by the WiMedia Alliance (step 6), the host server 1 encrypts the cookie encrypted with the host key (HK) distributed from the key server 4 to the host server 1. Is transmitted to the wireless terminal device 5 (step 7). The cookie includes a terminal identifier, a connection key, and a counter. The wireless terminal device 5 stores the encrypted cookie in a storage unit such as a memory.

  With the above processing, the connection between the wireless terminal device 5 and the host server 1 is established, and the wireless terminal device 5 can communicate with other devices via the host server 1.

  Next, a handover operation when the wireless terminal device 5 moves to the area of the host server 2 will be described with reference to FIG.

  When the wireless terminal device 5 moves under the host server 2, the wireless terminal device 5 confirms that the wireless terminal device 5 holds the encrypted cookie, and sends a message including the encrypted cookie to the host server. 2 (step 11). The host server 2 authenticates the wireless terminal device 5 by verifying whether the cookie is valid (step 12).

  More specifically, the host server 2 decrypts the cookie encrypted using the host key, and takes out the terminal identifier and counter included in the cookie. Then, check whether the terminal identifier extracted from the cookie matches the MAC address of the cookie transmission source wireless terminal device 5 and whether the counter value is not older than the latest counter value. When it is satisfied, it is determined that the wireless terminal device 5 is valid. Note that the operation when the condition is not satisfied will be described later in the detailed operation description of each device.

  Then, the host server 2 transmits an ACK message indicating that the authentication is successful to the wireless terminal device 5 (step 13). As a result, the wireless terminal device 5 is connected to the host server 2 and can continue to communicate with other devices via the host server 2.

  As described above, since the host server performs authentication at the time of handover using the encrypted cookie stored in the wireless terminal device 5, it does not access the authentication server or switch at the time of handover as in the prior art, The time required for authentication can be reduced, and sound interruptions when using an IP phone can be prevented.

(Detailed configuration of the device)
Next, each device constituting the wireless communication system of the present embodiment will be described in more detail. FIG. 4 shows the functional configuration of each device. FIG. 4 mainly shows functional units related to the present invention, and it goes without saying that each apparatus appropriately has functions and information for realizing wireless LAN communication and data communication. Absent.

  As illustrated in FIG. 4, the wireless terminal device 5 includes a data reception unit 51, a data transmission unit 52, a cookie storage DB 53, and a handover processing unit 54.

  The data receiving unit 51 and the data transmitting unit 52 are equipped with a UWB network interface. The data receiving unit 51 has a function of receiving data from the host server 1 by UWB. The data transmission unit 52 has a function of transmitting data to the host server 5 by UWB. The cookie storage DB 53 stores the encrypted cookie transmitted from the host server 5. The handover processing unit 54 has a function of determining a process to be performed next depending on the type of message received from the host server 5.

  The host server 1 includes a data reception unit 11, a data transmission unit 12, a data transfer unit 13, a host key storage DB 14, a data processing unit 15, and a cookie processing unit 16.

  The data receiving unit 11 has a function of receiving data transmitted from the wireless terminal device 5, and the data transmitting unit 12 has a function of transmitting data to the wireless terminal device 5. Both the data receiving unit 11 and the data transmitting unit 12 have a UWB network interface function.

  The host key storage DB 14 stores host key related information such as host keys and counters received from the key server 4.

  The data transfer unit 13 has a function of transferring a user authentication request (login request) received from the wireless terminal device 5 to the key server 4 and received a host key request from the data processing unit 15 to the key server 4. A function of receiving a user authentication result from the key server 4 and transferring it to the data transmission unit 12 for transmission to the wireless terminal device 5, receiving host key related information from the key server 4, and a data processing unit 15 Has a function to transfer to The data transfer unit 13 also has a function of relaying communication between the wireless terminal device 5 and another device after connection with the wireless terminal device 5.

  The data processing unit 15 requests a host key when the host server 1 is initialized, transmits a host key request to the data transfer unit 13, and sends host key related information from the key server 4 via the data transfer unit 13. Using the host key stored in the host key storage DB 14, the function of receiving and storing in the host key storage DB 14, the encrypted cookie included in the handover request from the wireless terminal device 5 received via the data receiver 11 A function of encrypting the cookie generated by the cookie processing unit 16 using a host key and transferring the cookie processing request (authentication, generation) to the cookie processing unit 16 Etc.

  The cookie processing unit 16 has a function of receiving a cookie processing request (authentication, generation) from the data processing unit 15, performing processing according to the cookie processing request, and notifying the data processing unit 15 of the processing result.

  The key server 4 includes a data reception unit 41, a data transmission unit 42, a host key processing unit 43, a user authentication unit 44, a host data storage DB 45, and a user data storage DB 46.

  The data receiving unit 41 receives data from the host server 1 and transfers the data to the user authentication unit 44 if the data is a user authentication request (login request). If the data is a host key request, the host key processing unit 43 receives the data. It has a function to transfer to. The data transmission unit 42 has a function of transmitting data from the user authentication unit 44 or the host key processing unit 43 to the host server 1.

  The host key processing unit 43 issues host key related information (host key, counter, etc.) in response to a registration request from the host server 1, and simultaneously registers the issued host key related information in the host data storage DB 45. It has a function of updating the counter at regular intervals and transmitting it to the host server 1 via the data transmission unit 42.

  The user authentication unit 44 has a function of performing user authentication with reference to user information in the user data storage DB 46 in response to a user authentication request, and returning an authentication result to the data transmission unit 42.

  Each of the above devices can be realized by mounting a program corresponding to a process to be executed by each device on a device having a configuration as a computer including a CPU, a storage device, a communication device, and the like. Each device can also be configured with dedicated hardware. The internal configuration of each device is not limited to that described in FIG. 4, and any configuration may be used as long as the operation described below can be realized.

(Operation of each device)
The details of the operation of each device in the present embodiment will be described below with reference to flowcharts. In the operation of each device, messages shown in FIGS. 5 and 6 are transmitted and received. The format of these messages is shown in FIGS. 7 to 9 and is referred to as appropriate in the description of the processing flow.

  First, the operation of the host server when authenticating the wireless terminal device will be described with reference to FIG.

  First, in step 21, the host server receives an authentication request message from the wireless terminal device. As the authentication request message, there are a message 1 (login request message) shown in FIG. 7 (a) and a message 4c (handover request message) shown in FIG. 8 (h).

  As shown in FIG. 7A, the message 1 includes a user name (user), a password (pwd), and a wireless terminal device identifier (DID: MAC address of the wireless terminal device). The header includes information indicating the type of message. As shown in FIG. 8 (h), the message 4c includes an encrypted cookie (CKI) and a MIC (Message Integrity Check: CKI MD5 hash value), and the cookie is a wireless terminal device identifier (DID), connection Includes key (CK) and counter (CTR).

  In the flowchart of FIG. 10, when the host server receives message 1 from the wireless terminal device, the host server performs user authentication information transmission / reception processing (step 23). Here, the host server transmits the message 1 to the key server that performs user authentication, and receives the user authentication result from the key server. If the user authentication is successful, the host server transmits a message 2 (login confirmation message) shown in FIG. 7B to the wireless terminal device. As shown in FIG. 7B, the message 2 includes a status, a connection key (CK), and a host identifier (HID). The connection key is a key for establishing a connection between the wireless terminal device and the host server, and is generated by the host server. The connection key is also used in a 4-way handshake.

  Subsequently, in step 24 of FIG. 10, a 4-way handshake is performed. Here, the message 3a shown in FIG. 7 is transmitted from the wireless terminal device to the host server, the message 3b is transmitted from the host server to the wireless terminal device, and the message 3c is transmitted from the wireless terminal device to the host server. Is transmitted from the host server to the wireless terminal device.

  After the 4-way handshake, the host server sends a message 4b to the wireless terminal device (step 25). As shown in FIG. 8 (g), the message 4b includes a cookie encrypted with a host key and a MIC. As a result, the encrypted cookie is stored in the wireless terminal device. Note that the cookie transmitted by the message 4b is encrypted by the host server before transmission using HK distributed in advance from the key server.

  In Step 21 of FIG. 10, when the host server receives the message 4c (roaming request message) (No in Step 22), the host server determines the validity of the cookie (Step 26). Here, the cookie (CKI) is first decrypted using the host key (HK). If the cookie (CKI) can be decrypted normally, the wireless terminal device identifier (DID) and counter (CTR) contained in the cookie (CKI) are extracted, and the wireless terminal device identifier (DID) is the MAC of the wireless terminal device Check if it matches the address. If they match, it is determined that the cookie is valid.

  If the cookie (CKI) cannot be decrypted using the host key (HK), or if the wireless terminal device identifier (DID) does not match the MAC address of the sending wireless terminal device, the cookie is determined to be invalid (step No) 26), a message 4d is returned to the wireless terminal device with status as NACK (step 27). Thereafter, the processing of steps 23 to 25 is performed. Note that the message 4d is as shown in FIG. 8 (i), and notifies the wireless terminal device whether or not the cookie authentication is successful by status (ACK or NACK).

  If it is determined in step 26 of FIG. 10 that the cookie is valid, the host server next determines whether the counter (CTR) value is normal. Here, the counter (CTR) value extracted from the cookie (CKI) is compared with the latest counter value notified from the key server. For example, the counter (CTR) value extracted from the cookie (CKI) If it is 2 or more away from the counter value, it is determined that the cookie is old, invalidated, and a 4-way handshake message 3a is transmitted to the wireless terminal device. When the 4-way handshake is completed, the host server issues a new cookie and transmits it to the wireless terminal device with the message 4b (No in Step 28, Steps 24 and 25).

  If the counter (CTR) value retrieved from the cookie (CKI) and the latest counter value notified from the key server are the same or different from each other (Yes in step 28), the cookie is sufficiently new. The message 4d with status set to ACK is transmitted to the wireless terminal device (step 29).

  Next, the operation of the wireless terminal device will be described with reference to the flowchart of FIG. When the wireless terminal device connects to the host server for communication, it is first determined whether the wireless terminal device itself holds a cookie (CKI). If it does not hold a cookie (CKI), it is the first connection, and if it holds a cookie (CKI), the connection is a connection for handover.

  If it is determined in step 31 that a cookie (CKI) is not held (in the case of No), user authentication using a key server, a 4-way handshake, and reception of a cookie (steps 32 to 34) are performed. That is, an authentication request is made by transmitting message 1 (login request message), and if the authentication is successful, a 4-way handshake is performed with the host server. Then, the encrypted cookie (CKI) is received from the host server and stored in the storage means.

  If the cookie (CKI) is held in step 31 (Yes), a message 4c (roaming request message) including the held cookie (CKI) is transmitted to the host server (step 35). Thereafter, as described with reference to FIG. 10, the validity of the cookie is determined in the host server, and a response to the message 4c is received from the host server (step 36). As described with reference to FIG. 10, the reply may be the message 4d or the message 3a.

  When the message 3a is received as a reply (No in step 37), a 4-way handshake is started from there and a new cookie (CKI) is received (steps 33 and 34). When a new cookie (CKI) is received, the existing cookie (CKI) is deleted and the new cookie (CKI) is stored as valid.

  When the message 4d is received as a reply (Yes in step 37), the status (ACK or NACK) of the message 4d is confirmed. In the case of ACK (Yes in step 38), the host server determines that the cookie (CKI) is valid, the handover succeeds, and re-authentication using the authentication server (key server) is not necessary. Communication with other devices can be continued through the host server after switching.

  If the status is NACK (No in step 38), the host server determines that the cookie (CKI) is invalid, so the process returns to user authentication using the key server. Process. In other words, when the user authentication and the 4-way handshake are completed, the host server issues a new cookie (CKI) to the wireless terminal device, so the wireless terminal device receives and stores the new cookie (CKI) in message 4b. Will do.

  Next, the operation of the key server will be described with reference to FIG. The key server updates the counter (CTR) at regular intervals (for example, every 30 minutes), and retransmits the updated counter to all the host servers.

  In step 41, it is confirmed whether or not this update interval has elapsed, and if it has elapsed, this retransmission processing is performed (step 42). The message at this time is an update message shown in FIG. 9C, and includes a counter and a MIC. The host server that has received the update message transmits a reception confirmation message (FIG. 9 (d)) to the key server, and receives the key server (step 43).

  The host server requests the key server for a host key for performing encryption / decryption of the cookie as one of initialization operations at the time of activation or the like. When the key server receives the key server request message (initialization request message) from the host server (step 44), the key server returns an initialization response message including the host key and the counter to the host server (step 45). A confirmation message is returned to the key server (step 46). The structure of these messages is as shown in FIGS. 9 (a), 9 (b) and 9 (d).

  When the host server receives the updated counter from the key server, the host server may update the cookie of the connected wireless terminal device and distribute it to the connected wireless terminal device.

  Next, a user authentication operation by the key server will be described with reference to FIG. When the key server receives the message 1 (user authentication request message) transmitted from the wireless terminal device via the host server (step 51), the key server compares the user name and password included in the message 1 with the registration information. Authentication is performed (step 52). If the user name and password match the registration information, a message (ACK) indicating successful authentication is transmitted to the host server (step 53). Then, the host server transmits message 2 to the wireless terminal device, and then a 4-way handshake is performed. In step 52, if the user name and password do not match the registration information, a message indicating authentication failure (NACK) is transmitted to the wireless terminal device via the host server (step 54).

(Effects of using UWB)
According to the present invention, there is an effect that the speed of handover can be increased regardless of the type of wireless communication method between the wireless terminal device and the host server (wireless access point: AP). Since the effect can be obtained, the effect obtained by using the UWB will be described below.

  In order to speed up the handover, it is desirable not only to speed up the network system as described above but also to speed up the processing on the wireless terminal device side. However, speeding up the process means that the wireless terminal device consumes power accordingly, and the duration of the battery is shortened, which may impair user convenience. .

  There is also a need for countermeasures against attacks by unauthorized users, particularly spoofing that is difficult to detect. As countermeasures against spoofing of a wireless terminal device, it has been conventionally performed to encrypt all data between the AP and the terminal, and to authenticate each time connection or handover is performed. However, for example, there remains a problem with unauthorized access by installing a spoofed AP using the same ESSID as a regular AP.

  That is, in a normal wireless LAN client (wireless terminal device) such as IEEE802.11a / b / g, when a plurality of APs having the same ESSID exist, connection with an AP having good reception sensitivity is attempted. Once connected, the wireless LAN client is not aware of which AP it is connected to, so it is difficult to detect impersonation. By this impersonation, there is a risk that user information is leaked from the connected client. It is also desirable to prevent wiretapping in communication between the AP and the wireless terminal device even if the data is encrypted.

  The above problem can be solved by using UWB.

  First, as described above, the power consumption for communication can be significantly reduced by using UWB compared to the case of using a normal wireless LAN such as IEEE802.11a / b / g, and the terminal at the time of handover Even if the power consumption is allocated to the high-speed processing on the side, the problem of a decrease in battery duration can be avoided.

  In addition, in order to perform unauthorized access such as spoofing AP and eavesdropping in the first place, it is necessary to place an unauthorized AP at a physical location that can be reached from the terminal and allow access from the terminal. However, as mentioned above, UWB has a short communication distance and uses a high-frequency band, so it has low transparency to walls, etc., so it is difficult to place unauthorized APs in the office and access them from terminals. is there. In addition, unlike a normal wireless LAN, the UWB does not automatically scan and associate with the AP, so it is possible to prevent information leakage. That is, by using UWB as a wireless communication method, it is possible to protect against impersonation and eavesdropping, thereby improving physical security.

  In addition, since the communication distance is short in UWB, the number of APs must be increased, and as a result, the frequency of handover increases. However, by using the authentication technology at the time of handover according to the present invention, handover can be performed at high speed. Therefore, there is no problem even if the frequency of handover increases. That is, the method of the present invention is suitable for UWB. In addition, unlike existing wireless LAN products, UWB has the advantage that customization such as MAC expansion can be easily performed.

  The present invention is not limited to the above-described embodiment, and various modifications and applications can be made within the scope of the claims.

It is a figure which shows the radio | wireless communications system in embodiment of this invention. It is a figure for demonstrating main operation | movement of the radio | wireless communications system in embodiment of this invention. It is a figure for demonstrating main operation | movement of the radio | wireless communications system in embodiment of this invention. It is a functional block diagram of each apparatus in a radio | wireless communications system. It is a list of messages transmitted and received between the host server and the wireless terminal device. It is a list of messages transmitted and received between the key server and the host server. It is a figure which shows the content of the message transmitted / received between a host server and a wireless terminal device. It is a figure which shows the content of the message transmitted / received between a host server and a wireless terminal device. It is a figure which shows the content of the message transmitted / received between a key server and a host server. It is a flowchart which shows operation | movement of a host server. It is a flowchart which shows operation | movement of a radio | wireless terminal apparatus. It is a flowchart which shows operation | movement of a key server. It is a flowchart which shows operation | movement of a key server.

Explanation of symbols

1-3 Wireless access point (host server)
4 Key server 5 Wireless terminal device 6 Network 11 Data reception unit 12 Data transmission unit 13 Data transfer unit 14 Host key storage DB
15 Data processing unit 16 Cookie processing unit 41 Data receiving unit 42 Data transmitting unit 43 Host key processing unit 44 User authentication unit 45 Host data storage DB
46 User data storage DB
51 Data receiver 52 Data transmitter 53 Cookie storage DB
54 Handover processing unit

Claims (9)

A plurality of wireless base station devices that perform wireless communication with the wireless terminal device and relay communication between the wireless terminal device and other devices, and are further connected to the plurality of wireless base station devices via a network A wireless communication system including a key management device,
The key management device includes means for transmitting a predetermined key commonly used in the plurality of radio base station devices to each radio base station device in the plurality of radio base station devices,
Each radio base station device in the plurality of radio base station devices,
Key storage means for storing a predetermined key received from the key management device;
Means for transmitting a login request to an authentication device when receiving a login request from a certain wireless terminal device, and receiving an authentication result from the authentication device;
When authentication of the wireless terminal device by the authentication device is successful, terminal authentication information, which is information obtained by encrypting information including identification information of the wireless terminal device with the predetermined key, is transmitted to the wireless terminal device. Means,
When terminal authentication information is received from another wireless terminal device that has moved under the control of another wireless base station device, the terminal authentication information is decrypted with the predetermined key, and information included in the terminal authentication information is used. And a means for relaying communication between the other wireless terminal device and the other device when the authentication is successful and the authentication is successful. system.   The wireless communication system according to claim 1, wherein each of the wireless terminal device and the wireless base station device in the wireless communication system includes a UWB communication interface, and performs UWB communication between the wireless terminal device and the wireless base station device.   The identification information of the wireless terminal device is a MAC address of the wireless terminal device, and the wireless base station device includes a MAC address of a wireless terminal device that is a transmission source of the terminal authentication information and a MAC included in the terminal authentication information. The wireless communication system according to claim 1, wherein the wireless terminal device that is the transmission source of the terminal authentication information is authenticated by comparing with an address. The key management device periodically transmits counter information to each radio base station device,
Each radio base station apparatus includes counter information in the terminal authentication information, and compares the counter information included in the terminal authentication information received from the radio terminal apparatus with the latest counter information held, thereby authenticating the terminal. The wireless communication system according to claim 1, wherein validity of the information is determined. A wireless base station device that performs wireless communication with a wireless terminal device and relays communication between the wireless terminal device and another device,
Key storage means for storing a predetermined key used in common with other radio base station devices;
Means for transmitting a login request to an authentication device when receiving a login request from a certain wireless terminal device, and receiving an authentication result of the wireless terminal device from the authentication device;
Means for transmitting, to the wireless terminal device, terminal authentication information, which is information obtained by encrypting information including identification information of the wireless terminal device with the predetermined key when authentication by the authentication device is successful;
When terminal authentication information is received from another wireless terminal device that has moved under the control of another wireless base station device, the terminal authentication information is decrypted with the predetermined key, and information included in the terminal authentication information is used. And a means for relaying communication between the other wireless terminal device and the other device when the authentication is successful and the authentication is successful. Station equipment. A wireless terminal device used in a wireless communication system including a plurality of wireless base station devices that perform wireless communication with a wireless terminal device and relay communication between the wireless terminal device and another device,
Means for transmitting a login request including user authentication information in order to connect to a certain radio base station device;
If the authentication result based on the user authentication information by the authentication device is successful, terminal authentication information, which is information obtained by encrypting information including identification information of the wireless terminal device with a predetermined key, from the wireless base station device. Means for receiving;
When the radio terminal apparatus moves under the control of another radio base station apparatus different from the radio base station apparatus, the other radio base station apparatus is connected to connect to the other radio base station apparatus. Means for transmitting the terminal authentication information to and receiving an authentication result based on the terminal authentication information from the other radio base station device;
A wireless terminal device comprising: A wireless communication method executed by a wireless base station device that performs wireless communication with a wireless terminal device and relays communication between the wireless terminal device and another device,
Receiving a predetermined key used in common with other radio base station apparatus from the key management apparatus and storing it in the key storage means;
When a login request is received from a certain wireless terminal device, the login request is transmitted to the authentication device, and an authentication result of the wireless terminal device is received from the authentication device;
When authentication by the authentication device is successful, transmitting to the wireless terminal device terminal authentication information that is information obtained by encrypting information including identification information of the wireless terminal device with the predetermined key;
When terminal authentication information is received from another wireless terminal device that has moved under the control of another wireless base station device, the terminal authentication information is decrypted with the predetermined key, and information included in the terminal authentication information is used. Wireless communication, comprising: authenticating the other wireless terminal device, and relaying communication between the other wireless terminal device and the other device when the authentication is successful. Method. A program for causing a computer to perform wireless communication with a wireless terminal device and to realize a function as a wireless base station device that relays communication between the wireless terminal device and another device, the computer comprising:
Means for transmitting a login request to an authentication device when receiving a login request from a certain wireless terminal device, and receiving an authentication result of the wireless terminal device from the authentication device;
When authentication by the authentication device is successful, a predetermined key used in common with other wireless base station devices is read from the storage device, and information including identification information of the wireless terminal device is encrypted with the predetermined key Means for transmitting terminal authentication information, which is information obtained, to the wireless terminal device,
When terminal authentication information is received from another wireless terminal device that has moved under the control of another wireless base station device, the terminal authentication information is decrypted with the predetermined key, and information included in the terminal authentication information is used. Means for relaying communication between the other wireless terminal device and the other device when the other wireless terminal device is authenticated and the authentication is successful,
Program to function as. Functions as a wireless terminal device used in a wireless communication system including a plurality of wireless base station devices that perform wireless communication with a wireless terminal device and relay communication between the wireless terminal device and other devices in a computer A program for realizing the computer,
Means for transmitting a login request including user authentication information in order to connect to a certain radio base station apparatus;
If the authentication result based on the user authentication information by the authentication device is successful, terminal authentication information, which is information obtained by encrypting information including identification information of the wireless terminal device with a predetermined key, from the wireless base station device. Means for receiving,
When the computer moves under the control of another radio base station apparatus different from the radio base station apparatus, the other radio base station apparatus is connected to the other radio base station apparatus in order to connect to the other radio base station apparatus. Means for transmitting terminal authentication information and receiving an authentication result based on the terminal authentication information from the other radio base station apparatus;
Program to function as.

Images