JP2008097264A - Authentication system for authenticating wireless lan terminal, authentication method, authentication server, wireless lan terminal, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow update of authentication information only by operation of a manager for easily setting new authentication information and ensuring a stronger security system. <P>SOLUTION: This authentication system authenticating a wireless LAN terminal is provided with an authentication server and the wireless LAN terminal. The authentication server includes first authentication information and second authentication information and comprises a first authentication processing means receiving the first authentication information from the wireless LAN terminal to carry out authentication processing, a second authentication means receiving the second authentication information to carry out authentication processing, an authentication information transmission means transmitting the second authentication information to the wireless LAN terminal, and a change means changing the first authentication information to the second authentication information if authentication by the second authentication processing means is carried out successfully. The wireless LAN terminal includes first authentication information and comprises a first request transmission means transmitting the first authentication information to the authentication server to request authentication processing and a second request transmission means receiving second authentication information from the authentication server and transmitting the received second authentication information to the authentication server to request authentication processing. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an authentication system, an authentication method, an authentication server, a wireless LAN terminal, and a program for authenticating a wireless LAN (Local Area Network) terminal, and in particular, an authentication system and authentication for automatically updating authentication information of a wireless LAN terminal periodically. The present invention relates to a method, an authentication server, a wireless LAN terminal, and a program.

  In recent years, wireless LANs have become popular, and systems using large-scale wireless LANs have been constructed in public networks and corporate networks. Along with this, enhancement of security has become an issue, and the introduction of terminal authentication combined with a RADIUS (Remote Authentication Dial In User Service) authentication system based on IEEE802.1X is progressing.

  In IEEE802.1X, server authentication and client authentication are performed by EAP (Extensible Authentication Protocol), so that unauthorized terminals can be prevented from accessing, and it can be said that the security is stronger than the conventional WEP method or WPA-PSK method.

  Here, the WEP method is an encryption method adopted as an IEEE802.11b security system, and is the same WEP key (encryption key used in the WEP encryption method) in both devices performing wireless LAN communication. Is set, and the transmitted packet is encrypted so that the contents cannot be intercepted by a third party. And, it is possible to select from “64 bit” and “128 bit”. The security is stronger in 128 bits than in 64 bits, but the communication speed is slow.

  The WPA-PSK method is a security standard established by Wi-Fi Alliance (industry group) to reinforce the vulnerability of WEP (Wi-Fi Protected Access). Shared Key) is a shared (secret) key used to generate an encryption key in the TKIP encryption protocol. This key is not used for direct encryption but is used to generate an encryption key, so it is called a pre-shared key. PSK may represent an authentication method using a pre-shared key.

  In this way, WPA is not a security function based on a single technology, but is a combination of IEEE802.1X that performs client authentication and “TKIP” that is a new encryption method.

  In contrast, EAP is a specification for using an arbitrary authentication function, and was developed as an extension of PPP (Point to Point Protocol) used for dial-up. There are several types of EAP, such as EAP-TLS that uses an electronic certificate for client authentication, and EAP-PEAP that performs client authentication using a user ID and password.

  For example, EAP-TLS is an EAP authentication protocol using TLS (Transport Layer Security), and when using this EAP-TLS, a client certificate and a server certificate are required.

  EAP-PEAP is one of the IEEE802.1X / EAP authentication methods developed by Microsoft Corporation (registered trademark), etc., where the authentication server uses a digital certificate and the client performs mutual authentication using an ID / password. It is a method to do.

  In this way, in a wireless LAN system in which an authentication system is introduced by a method using EAP, in order to connect a wireless LAN terminal, in addition to an SSID (Service Set Identifier), an electronic certificate, a user ID, and a password required for authentication Since it is necessary to set server information and the like, it takes time to update the authentication information once it is set.

  Here, the SSID is an identifier of an access point in the IEEE802.11 series wireless LAN. This means that wireless LANs are grouped and communication is not possible unless the same SSID is set for the wireless LAN access point and the terminal.

  However, in an authentication system using a user ID and password such as EAP-PEAP, if the user ID and password information leaks due to an unexpected situation, there is a risk that an impersonation terminal may illegally access the network.

  In such a case, it is necessary to change the user ID and password immediately. However, it is difficult to identify the corresponding wireless LAN terminal, or the administrator collects the corresponding wireless LAN terminal and changes the setting. Since it takes time to do so, there is a possibility that the use of the leaked user ID and password will be continued.

  Here, even if authentication information is not leaked as a solution, further security enhancement can be achieved by periodically updating the electronic certificate, user ID, and password.

  However, if the user of the wireless LAN terminal changes the setting of authentication information, the setting items are difficult to understand without knowledge about EAP authentication, and network access may be impossible due to misconfiguration, or information leakage from the user may occur. There is a fear.

Therefore, in Patent Document 1, when the access requesting client is authenticated as a legitimate access by the user ID and password, unique authentication information corresponding to the user ID is generated, and this authentication information is sent to the mail. And sent to the mail address of the user ID.
JP 2004-118541 A

  However, in the invention described in Patent Document 1, when the server determines that the access request from the client is a legitimate access request, the server generates authentication information specific to the user ID and also sends the authentication information to the mail. Is transmitted to the client, and the client makes a next access request using the authentication information given to the mail received from the server.

  Therefore, in the invention of Patent Document 1, even if the access request of the client is valid, the updated authentication information is transmitted by e-mail every time the server is accessed, so that the access request described in the e-mail is sent each time. There was a problem that authentication information had to be confirmed first.

  The present invention has been made in view of the above-mentioned problems, and it takes time for an administrator or a user. Thus, authentication information that has not been frequently performed in the past can be automatically updated only by the operation of the administrator. It is an object to provide an authentication system, an authentication method, an authentication server, a wireless LAN terminal, and a program for easily authenticating a wireless LAN terminal that can set new authentication information and ensure a stronger security system. To do.

  An authentication system according to the present invention is an authentication system for authenticating a wireless LAN terminal, wherein the authentication system includes an authentication server that performs an authentication process, and the authentication server includes first identification information used as authentication information, and A first password, second identification information, and a second password are provided, and the first identification information and the first password are received from the wireless LAN terminal, and a first authentication process is performed. A first authentication processing means, a second authentication processing means for receiving the second identification information and the second password from the wireless LAN terminal and performing a second authentication process; and the first authentication processing means. After the authentication is completed, after the authentication is completed by the authentication information transmitting means for transmitting the second identification information and the second password to the wireless LAN terminal, and the second authentication processing means, Authentication information changing means for changing the first identification information and the first password into the second identification information and the second password, and the wireless LAN terminal uses the authentication information as authentication information. First authentication request transmission means comprising first identification information and the first password, and transmitting the first identification information and the first password to the authentication server and requesting the authentication processing; , Receiving the second identification information and the second password from the authentication server, transmitting the second identification information and the second password to the authentication server, and requesting a second authentication process. Overwriting the second identification information and the second password received from the authentication server on the first identification information and the first password. And authentication information updating means for updating the authentication information, and further comprising a.

  Further, in the authentication system according to the present invention, the authentication server uses the first identification information and the first password, the second identification information and the second password as unique identification information of the wireless LAN terminal. An identification information holding unit that holds the information in association with each other may be further provided.

  In the authentication system according to the present invention, the authentication information changing unit included in the authentication server changes the first identification information and the first password to the second identification information and the second password. In this case, change information deleting means for deleting the second identification information and the second password from the authentication server may be further provided.

  According to the present invention, conventionally, it is difficult to update the authentication information by automating only the update processing on the authentication server side, thereby eliminating the trouble of changing the setting of each wireless LAN terminal. Can do. This saves the administrator the trouble of collecting wireless LAN terminals and creating setting change procedure manuals, and provides stronger security by automatically updating authentication information periodically. An authentication system, an authentication method, an authentication server, a wireless LAN terminal, and a program for authenticating a wireless LAN terminal that secures the system can be realized.

  In the embodiment of the present invention, in a wireless LAN system that performs IEEE 802.1X authentication of a wireless LAN terminal using an authentication server, an administrator previously registers new authentication information (second identification information and second information of the present invention) in the authentication server. This is equivalent to the password.)

  When the authentication information of the authentication server (corresponding to the second identification information and the second password of the present invention) is updated, the wireless LAN terminal under the network acquires this new authentication information. This wireless LAN terminal temporarily stores the acquired authentication information (that is, corresponding to the second identification information and the second password of the present invention), and at the time of next authentication, the temporarily stored user ID and password. Is sent to the authentication server, and the authentication server performs authentication.

  When the authentication server succeeds in the second authentication, the wireless LAN terminal uses the temporarily stored authentication information (that is, corresponds to the second identification information and the second password of the present invention). The existing authentication information (corresponding to the first identification information and the first password of the present invention) is overwritten.

  At this time, since the wireless LAN terminal is accessing the network with the old authentication information already set in itself, the content of the communication to be transmitted / received is also encrypted, and new authentication information cannot be intercepted. In addition, since the latest authentication information is received without the user being aware of it, there is a feature that it also prevents information leakage.

Next, the best mode for carrying out the invention will be described in detail with reference to the drawings.
(First embodiment)
(1) Configuration of Wireless LAN Authentication System (1-1) Overall Configuration of Wireless LAN Authentication System FIG. 1 shows a wireless LAN authentication for authenticating a wireless LAN terminal according to an embodiment of the present invention as a first embodiment. 1 shows a system configuration diagram.

  The wireless LAN authentication system shown in FIG. 1 includes a wireless LAN access point 101, an authentication server 102, a certification authority 103, a wireless LAN terminal 104, a wired LAN 105, and a wireless LAN 106.

  The wireless LAN access point 101, the authentication server 102, and the certification authority 103 are network-connected by a wired LAN 105, and the wireless LAN terminal 104 is network-connected by the wireless LAN access point 101 and the wireless LAN 106, each using a network. It shall be possible. The wireless LAN terminal 104 is assumed to be compatible with the IEEE 802.1X standard.

  The authentication server 102 notifies the wireless LAN terminal 104 of the server certificate 102-1 issued from the certification authority 103, the database 102-2 for managing the authentication information of the wireless LAN terminal 104, and the update of the authentication information. Dedicated application software 102-3 is installed.

  The wireless LAN terminal 104 is installed with the wireless LAN card 104-1, authentication information 104-2, and dedicated application software 104-3 for receiving authentication information update notification and acquiring information.

The wireless LAN terminal 104 is pre-set with information for connecting to the wireless LAN access point 101 via the wireless LAN 106 and authentication information 104-2 for EAP-PEAP authentication. In addition, the authentication server 102 can be connected to the wireless LAN.
(1-2) Configuration of Each Part of Wireless LAN Authentication System Next, the configuration of each part of the wireless LAN authentication system that authenticates the wireless LAN terminal 104 according to the first embodiment will be described with reference to FIGS. This will be described in detail.

  In this embodiment, user ID and password authentication using the EAP-PEAP method will be described as an example. However, the present invention is not limited to the EAP-PEAP method, and it is only necessary to perform an encryption process for authentication processing. .

  In FIG. 2, the database 102-2 of the authentication server 102 includes the database 102-2 after receiving the information before update 201 and the update completion message 502 indicating the completion of update from the wireless LAN terminal 104 described later. The authentication information (after receiving the update completion message 202) is described.

  As shown in FIG. 2, when authentication information is managed in the database 102-2 of the authentication server 102 and there is no update in the authentication information, the MAC of the wireless LAN terminal is exemplified as before the information update 201. (Media Access Control) Address, user ID-1 for EAP-PEAP authentication, and password-1 only are set. Null data is stored in user ID-2 and password-2, which are update information. Has been.

  When updating the authentication information, the administrator inputs user ID-2 and password-2, which are update information, to the database 102-2 of the authentication server 102, respectively.

  Next, FIG. 3 shows the role of the application software 102-3 included in the authentication server 102 according to the first embodiment.

  The application software 102-3 of the authentication server 102 shown in FIG. 3 receives the update completion message 502 indicating the completion of update from the wireless LAN terminal 104 described later, and the old authentication information on the database 102-2 of the authentication server 102 Process to delete.

  Next, FIG. 4 shows the authentication information 104-2 in the wireless LAN terminal 104 of the first embodiment.

  The authentication information 104-2 of the wireless LAN terminal 104 shown in FIG. 4 includes user ID-1, password-1 (401-1), and user ID-Temp and password-Temp (401-2) which are temporary authentication information. I have. The authentication information 104-2 is divided into a pre-information acquisition 401, a post-information acquisition 402, and a new information authentication success 403 according to the acquisition status of the authentication information.

  First, as shown in 401 before information acquisition in FIG. 4, authentication information is normally stored in user ID-1 and password-1, and null data is stored in user ID-Temp and password-Temp. ing.

  Next, when the wireless LAN terminal 104 receives the updated authentication information, the acquired authentication information is stored in the user ID-Temp and the password-Temp, respectively, as shown in 402 after information acquisition in FIG. The The authentication server 102 succeeds in re-authentication using temporary authentication information (that is, user ID-Temp and password-Temp), and the wireless LAN terminal 104 passes through the wireless LAN access point 101. When two sets of “EAP Success” and “EAPOL Key” are received from the authentication server 102, the temporary authentication information (401-2) is overwritten on the user ID-1 and password-1 (reception shown in FIG. 5 described later). (See terminal action 503 by message).

  This state is shown in 403 after successful new information authentication in FIG. After successful new information authentication 403 shown in FIG. 4, User 02 and Password 02 described as user ID-Temp and password-Temp, which are new authentication information, are overwritten on user ID-1 and password-1. .

  The process of overwriting this authentication information is incorporated in the application software 104-3 provided in the wireless LAN terminal 104, and is performed by a terminal operation 503 based on a received message shown in FIG.

  Next, FIG. 5 shows the role of the application software 104-3 in the wireless LAN terminal 104 of the first embodiment.

  The application software 104-3 of the wireless LAN terminal 104 shown in FIG. 5 plays the roles of a generation message 501 for generating an update completion message 502, an update completion message 502 for notifying that the update is completed, and a terminal operation 503 based on the received message. Indicates what to do.

  Specifically, the application software 104-3 of the wireless LAN terminal 104 generates an update completion message 502 that notifies the authentication server 102 that the process of overwriting temporary information has been completed by using the generation message 501. A mechanism for transmitting to 102 is incorporated.

  In this update completion message 502, the MAC address of the wireless LAN terminal 104 and the content of the update completion notification are described as detailed information.

  Further, as described above, when the terminal operation 503 based on the received message receives “EAP Success” and “EAPOL Key”, the authentication information is updated by overwriting the old authentication information with the temporary authentication information.

By such processing for updating the authentication information, the setting information of the authentication information 104-2 of the wireless LAN terminal 104 is updated as indicated by 403 after the successful new information authentication shown in FIG.
(2) Operation of Wireless LAN Authentication System (2-1) Authentication Information Update Processing Procedure of Wireless LAN Terminal 104 Next, an operation flowchart shown in FIG. 6 is used for the operation of the wireless LAN terminal 104 in the first embodiment. An authentication information update processing procedure for updating the authentication information of the wireless LAN terminal 104 will be described.

  First, the wireless LAN terminal 104 performs connection and authentication processing with respect to the authentication server 102, and also accesses the database 102-2 (FIG. 2) of the authentication server 102 to check whether there is update information (step 601). ).

  The authentication information (FIG. 2) on the database 102-2 of the authentication server 102 is managed for each MAC address of the wireless LAN terminal 104, and the wireless LAN terminal 104 checks the own MAC address and updates the authentication information. (Step 602).

  Here, the wireless LAN terminal 104 determines that there is no update information when the update information (FIG. 2) of the user ID-2 and the password-2 remains Null in the database 102-2 of the authentication server 102. Then, this process ends.

  On the other hand, when the setting information is updated in the user ID-2 and the password-2, the authentication server 102 sets the setting information described in the user ID-2 and the password-2 (that is, updated). Authentication information) is transmitted to the wireless LAN terminal 104.

  As a result, the wireless LAN terminal 104 acquires update information (that is, updated authentication information) from the database 102-2 of the authentication server 102 (step 603).

  The wireless LAN terminal 104 uses the received update information (that is, updated authentication information) as the temporary information of the authentication information 104-2 of the wireless LAN terminal 104, the user ID-Temp and the password -Temp ( Temporarily stored in 401-2) of FIG.

  Then, the wireless LAN terminal 104 transmits temporarily stored temporary information (that is, updated authentication information) to the authentication server 102, and performs re-authentication processing again in the authentication server 102 (step 604).

  Specifically, the authentication server 102 updates information (temporary information) transmitted from the wireless LAN terminal 104, and user ID-2 and password-2 setting information described in the database 102-2 on the authentication server 102 Again, the authentication process is performed again.

  Next, the wireless LAN terminal 104 determines the result of re-authentication performed by the authentication server 102 (step 605).

  This is because when the re-authentication process is completed, the authentication server 102 transmits a re-authentication result to the wireless LAN terminal 104, and whether or not the re-authentication has succeeded based on the re-authentication result received by the wireless LAN terminal 104. To determine.

  Specifically, in the authentication server 102, when the update information (temporary information) matches the setting information of the user ID-2 and the password-2, the wireless LAN indicates that the authentication server 102 has succeeded in re-authentication. The terminal 104 is notified. If the wireless LAN terminal 104 receives a re-authentication result indicating that the re-authentication is successful from the authentication server 102, the process proceeds to step 606.

  On the other hand, in the authentication server 102, if the update information (temporary information) and the setting information of the user ID-2 and the password-2 do not match, it is indicated that the authentication server 102 has not succeeded in re-authentication. Notify the LAN terminal 104. If the wireless LAN terminal 104 receives a re-authentication result indicating that the re-authentication has not succeeded from the authentication server 102, the process returns to step 604 to perform authentication processing again.

  Here, when the re-authentication is successful, the authentication server 102 transmits “EAP Success” and “EAPOL Key” to the wireless LAN terminal 104 via the wireless LAN access point 101.

  When the wireless LAN terminal 104 receives the “EAP Success” and “EAPOL Key” messages, the wireless LAN terminal 104 obtains temporary information (401-2) of the wireless LAN terminal 104 based on the terminal operation 503 based on the received message shown in FIG. The authentication information (401-1) is overwritten (step 606).

  As a result, since the re-authenticated User02 and Password02 are overwritten on the setting information of the user ID-1 and password-1, as in 403 after the successful new information authentication shown in FIG. 4, the updated User02 and Password02 are overwritten. Is used as authentication information.

  As described above, when the authentication information 104-2 of the wireless LAN terminal 104 is updated, the wireless LAN terminal 104 generates an update completion message 502 indicating that the update is completed by the application software 104-3 of the wireless LAN terminal 104. At the same time, this update completion message 502 is transmitted to the authentication server 102 (step 607).

Upon receiving the update completion message 502, the authentication server 102 deletes the old authentication information (user ID-1, password-1) on the database 102-2 of the authentication server 102 by the application software 102-3 shown in FIG. Then, the re-authenticated new authentication information (that is, user ID-2, password-2) is moved up, and the update user ID-3 and password-3 are added. (Figure 2-202)
Thereby, in this Embodiment, the database 102-2 of the authentication server 102 can be automatically updated like 202 after the update completion message reception shown in FIG.

  In this embodiment, when the re-authentication process of the authentication server 102 is not successful in step 605, the process returns to step 604, and the authentication server 102 performs the re-authentication process again. However, the present embodiment is not limited to this, and the processing may return to step 603 and the authentication server 102 may transmit update information (temporary information) again.

In this case, the wireless LAN terminal 104 receives and acquires update information (temporary information) again, and then performs re-authentication processing from the wireless LAN terminal 104 to the authentication server 102, thereby improving the accuracy of the re-authentication processing. Can do.
(2-2) Operation Process of Wireless LAN Authentication System Finally, FIG. 7 is a flowchart showing the operation process of the wireless LAN authentication system that authenticates the wireless LAN terminal 104 in the first embodiment. .

  The operation process of the wireless LAN authentication system shown in FIG. 7 shows the relationship of the operation process associated with the authentication process in the wireless LAN terminal 104, the access point 101, and the authentication server 102.

  The contents of the operation processing of the wireless LAN authentication system shown in FIG. 7 substantially correspond to the operation flowchart of the wireless LAN terminal 104 shown in FIG. The only difference in FIG. 7 is that an association process 701 is described.

  The association process 701 illustrated in FIG. 7 is a security policy negotiation function in which the wireless LAN terminal 104 and the access point 101 exchange authentication information in order to realize an optimal security policy for both.

  In the association process 701, an authentication method between the wireless LAN terminal 104 and the access point 101 is determined.

Accordingly, FIG. 7 shows that in the association process 701, for example, the authentication process by the EAP-PEAP method is determined, and the authentication information update process according to the present embodiment is performed based on the operation flowchart of the wireless LAN terminal 104 shown in FIG. Shows what can be done.
(3) Effects of the present embodiment As described above, according to the present embodiment, the authentication information update of the wireless LAN terminal 104, which has conventionally been difficult to update the authentication information, is updated on the authentication server 102 side. By automating only the processing, the trouble of changing the setting of each wireless LAN terminal can be omitted.

  This saves the administrator from having to collect the wireless LAN terminal 104 or create a setting change procedure manual. Further, the authentication information of the wireless LAN terminal 104 can be periodically updated, and security can be improved.

  Further, when the authentication information of the authentication server 102 is updated and the wireless LAN terminal 104 succeeds in authentication with the new authentication information, the old authentication information is automatically deleted from the authentication server. Since the old authentication information leaked from the authentication server 102 can be automatically deleted even when the user ID and password authentication information leaked, the trouble of collecting the operating wireless LAN terminal 104 can be reduced. There is no need for it, and it can continue to operate without hindering operations and operations.

  Furthermore, access by impersonation can be avoided at an early stage by the leaked authentication information, and unauthorized access can be prevented.

  In this embodiment, not only the authentication information of the authentication server 102 is deleted, but also the old authentication information is automatically deleted by overwriting the old authentication information on the wireless LAN end 104 with the new authentication information. it can.

Further, in the present embodiment, since the updated authentication information is encrypted and transmitted and received, the wireless LAN terminal 104 can be used even if the authentication information transmitted and received on the wireless LAN 106 is intercepted. It is impossible to decipher the acquired update authentication information, and leakage of authentication information can be prevented.
(4) Other Embodiments The present invention is not limited to the above-described embodiments, and can be replaced within the scope of the present subject matter.

  Specifically, for example, in the present embodiment, authentication processing is performed by the EAP-PEAP method, but the present invention is not limited to this, and EAP-TTLS that performs authentication using a user ID and password is also used. Also for the EAP-TLS method that authenticates using a digital certificate or an electronic certificate, it is automatically updated by updating the same authentication information by replacing the user ID and password with the electronic certificate and treating them as authentication information. Authentication information can be updated.

It is a block diagram of the wireless LAN authentication system in 1st Embodiment concerning this invention. It is a structure of the database of the authentication server in 1st Embodiment concerning this invention. It is a role item of the application software of the authentication server in 1st Embodiment concerning this invention. It is a structure of the authentication information of the wireless LAN terminal in 1st Embodiment concerning this invention. It is a role item of application software of the wireless LAN terminal in the first embodiment according to the present invention. It is an operation | movement flowchart of the wireless LAN terminal in 1st Embodiment concerning this invention. It is an operation | movement process of the wireless LAN authentication system in 1st Embodiment concerning this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Wireless LAN access point 102 Wireless LAN authentication server 102-1 Server certificate 102-2 Database 102-3 Application software 103 Certification authority 104 Wireless LAN terminal 104-1 Wireless LAN card 104-2 Authentication information 104-3 Application software 105 Wired LAN
106 wireless LAN

Claims (11)

An authentication system for authenticating a wireless LAN terminal,
The authentication system includes an authentication server that performs authentication processing,
The authentication server is
A first identification information and a first password used as authentication information, a second identification information and a second password;
First authentication processing means for receiving the first identification information and the first password from the wireless LAN terminal and performing a first authentication process;
Second authentication processing means for receiving the second identification information and the second password from the wireless LAN terminal and performing a second authentication process;
Authentication information transmitting means for transmitting the second identification information and the second password to the wireless LAN terminal after authentication is completed by the first authentication processing means;
Authentication information changing means for changing the first identification information and the first password to the second identification information and the second password after authentication by the second authentication processing means is completed,
The wireless LAN terminal is
Including the first identification information and the first password used as authentication information;
First authentication request transmitting means for transmitting the first identification information and the first password to the authentication server and requesting the authentication processing;
The second identification information and the second password are received from the authentication server, and the second identification information and the second password are transmitted to the authentication server to request a second authentication process. A second authentication request transmitting means;
Authentication information updating means for updating the authentication information by overwriting the second identification information and the second password received from the authentication server on the first identification information and the first password;
An authentication system, further comprising: The authentication server is
An identification information holding unit for holding the first identification information and the first password, and the second identification information and the second password in association with the unique identification information of the wireless LAN terminal; The authentication system according to claim 1. The authentication information changing means provided in the authentication server includes:
When the first identification information and the first password are changed to the second identification information and the second password, the second identification information and the second password are obtained from the authentication server. The authentication system according to claim 1, further comprising change information deleting means for deleting. An authentication method in an authentication system for authenticating a wireless LAN terminal,
The authentication system includes an authentication server that performs authentication processing,
A first authentication request transmitting step in which the wireless LAN terminal transmits first identification information and a first password to the authentication server, and requests the authentication processing;
A first authentication processing step in which the authentication server receives the first identification information and the first password from the wireless LAN terminal, and performs a first authentication process;
An authentication information transmitting step in which the authentication server transmits the second identification information and the second password to the wireless LAN terminal after the authentication is completed in the first authentication processing step;
The wireless LAN terminal receives the second identification information and the second password from the authentication server, transmits the second identification information and the second password to the authentication server, and again A second authentication request transmission step for requesting the authentication processing of
A second authentication processing step in which the authentication server receives the second identification information and the second password from the wireless LAN terminal, and performs a second authentication process;
An authentication information changing step in which the authentication server changes the first identification information and the first password to the second identification information and the second password after the authentication is completed in the second authentication processing step; ,
Authentication information in which the wireless LAN terminal updates authentication information by overwriting the second identification information and the second password received from the authentication server on the first identification information and the first password. An update step;
An authentication method in an authentication system comprising: The authentication server is
An identification information holding step of holding the first identification information and the first password, and the second identification information and the second password in association with the unique identification information of the wireless LAN terminal. The authentication method in the authentication system according to claim 4. The authentication information changing step provided in the authentication server includes:
When the first identification information and the first password are changed to the second identification information and the second password, the second identification information and the second password are obtained from the authentication server. The authentication method in the authentication system according to claim 4, further comprising a change information deletion step of deleting. An authentication server for performing authentication processing of a wireless LAN terminal,
A first identification information and a first password used as authentication information, a second identification information and a second password;
First authentication processing means for receiving the first identification information and the first password from the wireless LAN terminal and performing a first authentication process;
Second authentication processing means for receiving the second identification information and the second password from the wireless LAN terminal and performing a second authentication process;
Authentication information transmitting means for transmitting the second identification information and the second password to the wireless LAN terminal after authentication is completed by the first authentication processing means;
Authentication information changing means for changing the first identification information and the first password to the second identification information and the second password after authentication is completed by the second authentication processing means;
An authentication server further comprising:   And further comprising identification information holding means for holding the first identification information and the first password, and the second identification information and the second password in association with the unique identification information of the wireless LAN terminal. The authentication server according to claim 7. Including first identification information used as authentication information and the first password,
First authentication request transmitting means for transmitting the first identification information and the first password to the outside and requesting an authentication process;
The second identification information and the second password are received from the outside, the second identification information and the second password are transmitted to the outside, and a second authentication request is transmitted to request a second authentication process. Means,
Authentication information updating means for updating the authentication information by overwriting the second identification information and the second password received from outside the first identification information and the first password;
A wireless LAN terminal, further comprising:   A program for causing a computer to function as the authentication server according to claim 7 or 8.   A program for causing a computer to function as the wireless LAN terminal according to claim 9.