JP2009055417A - Authentication system for authenticating radio terminal, authentication method thereof, and radio base station - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To continuously connect a radio terminal to a communication network, without requiring vast introduction cost and operation cost, even when the radio terminal cannot be connected to an authentication server. <P>SOLUTION: This authentication system for authenticating the radio terminal is an authentication system in which the radio terminal requests authentication from the authentication server. A radio base station has an authentication request packet transmission means for transmitting an authentication request packet to the authentication server, an authentication server operation confirming means for determining as normally operating when receiving an authentication response packet from the authentication server and determining as being not normally operating when the authentication response packet is not received, and an authentication server switching means for switching to a normally operating authentication server when the authentication server is not normally operated. The authentication server has an authentication determining means for comparing authentication request information with preregistered radio terminal authentication information by acquiring the authentication request information, and an authentication response packet authentication server transmitting means for transmitting the authentication response packet in coincidence. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication system that authenticates a wireless terminal that makes an authentication request to an authentication server connected to a communication network via a wireless base station, an authentication method thereof, and a wireless base station.

  Conventionally, in a system for authenticating a wireless terminal, the wireless terminal transmits a wireless connection request including authentication information such as a terminal unique ID (identification), a user ID, and a password.

  Then, the wireless base station functions as a relay between the wireless terminal and the authentication server via the communication network, and permits or denies communication of the wireless terminal by inquiring an authentication request to the authentication server in which the authentication information is registered. Is known to do.

  In addition, by installing a plurality of authentication servers, it is known to perform authentication by switching to another authentication server when one authentication server fails (see Patent Documents 1 and 2).

  Here, an example of a standard configuration of a system for authenticating related wireless terminals will be described with reference to FIG.

  The system for authenticating the wireless terminal shown in FIG. 14 includes a wireless base station # 1, which is a first wireless base station, a wireless base station # 2, which is a second wireless base station, and a third wireless base station. Radio base station # 3, radio terminal 21A, authentication server 31, and communication network 41 are provided.

  The radio base station # 1, which is the first radio base station, has the configuration shown in the radio base station 11A, and includes a radio interface unit 12, an authentication processing unit 14, a filtering table 15, a filtering unit 16, and a wired connection. And an interface unit 17.

  The radio base station # 2 that is the second radio base station and the radio base station # 3 that is the third radio base station have the same function as the radio base station 11A, and a plurality of radio base stations A communication network 41 is connected.

  The radio base station 11 </ b> A is connected to the authentication server 31 via the communication network 41.

  When the wireless base station 11A receives an authentication request including authentication information such as a user ID and a password from the wireless terminal 21A, the wireless base station 11A inquires the authentication request to the authentication server 31 in which the authentication information is registered. It has a function of permitting or denying communication with the terminal 21A.

  Here, once the wireless terminal 21A is authenticated by the authentication server 31 and communication is permitted, the wireless base station 11A stores the terminal ID of the wireless terminal 21A in the filtering table 15.

  For this reason, the communication permission / rejection determination in the wireless base station 11A is determined based on whether the terminal ID of the wireless terminal 21A is already stored in the filtering table 15 of the wireless base station 11A and then the terminal unique ID of the same wireless terminal 21A. It is judged by.

  The radio interface unit 12 of the radio base station 11A performs radio communication with the radio terminal 21A and transmits and receives packets. Then, the wireless interface unit 12 determines whether or not the received packet is a wireless connection request packet. If the received packet is a wireless connection request packet, the authentication information and the terminal unique ID are extracted from the wireless connection request packet.

  On the other hand, if the packet is not a wireless connection request packet, the wireless interface unit 12 extracts the terminal unique ID.

  When the received packet is a wireless connection request packet, the authentication processing unit 14 acquires authentication information and a terminal unique ID from the wireless interface unit 12, and generates an authentication request packet including the acquired authentication information.

  Then, the authentication processing unit 14 transmits this authentication request packet to the authentication server 31 via the wired interface unit 17 and the communication network 41.

  When the authentication processing unit 14 receives an authentication permission authentication response from the authentication server 31 via the communication network 41 and the wired interface unit 17, the authentication processing unit 14 stores the terminal unique ID in the filtering table 15, and A wireless connection permission packet is transmitted to 21A.

  Further, when receiving the authentication rejection authentication response, the authentication processing unit 14 does not store the terminal unique ID in the filtering table 15 and transmits a wireless connection rejection packet to the wireless terminal 21A.

  Next, the overall schematic operation of the authentication system for authenticating the wireless terminal 21A shown in FIG. 14 will be described.

  First, the wireless terminal 21A makes a connection request to the communication network 41 to the authentication server 31 connected to the communication network 41 via the wireless base station 11A.

  In this case, the radio base station 11A acquires the authentication information and the terminal unique ID from the radio connection request packet including the authentication information transmitted from the radio terminal 21A, and transmits it to the authentication server 31 as an authentication request packet.

  Then, the authentication server 31 acquires authentication information from the authentication request packet sent from the radio base station 11A.

  Then, the authentication server 31 compares the authentication information registered in advance in the authentication information management table 32 inside the authentication server 31 and determines whether there is authentication information that matches the authentication information management table 32.

  If there is no authentication information that matches the authentication information management table 32 in the authentication server 31, the authentication server 31 determines that the wireless terminal 21 </ b> A is rejected, and in contrast, the authentication information management table 32. If there is authentication information that matches, authentication is permitted.

  If it is determined that the authentication is permitted, the authentication server 31 generates an authentication permission response packet and transmits the authentication permission response packet to the radio base station 11A. On the other hand, when it is determined that the authentication is rejected, the authentication server 31 generates an authentication reject response packet and transmits the authentication reject response packet to the radio base station 11A.

  When the wireless base station 11A receives the authentication permission response packet, the wireless base station 11A transmits the wireless connection permission response packet to the wireless terminal 21A. On the other hand, when the wireless base station 11A receives the authentication rejection response packet, the wireless base station 11A transmits a wireless connection rejection packet to the wireless terminal 21A.

  In this way, the wireless terminal 21A that has received the wireless connection permission packet is connected to the communication network 41 via the wireless base station 11A, and can communicate with devices connected to the communication network 41.

  On the other hand, for the wireless terminal 21A having authentication information that does not match the authentication information management table 32 in the authentication server 31, the authentication server 31 refuses connection to the communication network 41, thereby preventing unauthorized use.

  If the authentication server 31 fails, the authentication processing unit 14 cannot receive the authentication response packet or the authentication rejection packet from the authentication server 31 after the authentication request packet is transmitted. Can be detected.

In this case, the authentication processing unit 14 switches the authentication request destination to another authentication server and makes an authentication request, whereby the authentication processing of the wireless terminal 21A can be continued instead.
JP 2005-284552 A JP 2001-060184 A JP 2006-268719 A

  However, in the authentication device, the authentication system, the authentication method, and the method program described in Patent Document 1, and the user authentication system, the control method, and the recording medium described in Patent Document 2, all the authentication servers If the communication is interrupted, the authentication process cannot be continued.

  Therefore, the devices described in Patent Documents 1 and 2 have a problem that all wireless terminals cannot be connected to the communication network.

  Therefore, in all systems described in Patent Documents 1 and 2 including a plurality of wireless base stations and a plurality of authentication servers, a certain wireless base station cannot communicate with all the authentication servers by constructing the system in a duplex structure. Can be avoided and prevented.

  However, although it is possible to avoid communication interruption, there is a problem that enormous introduction cost and operation cost are required.

  In addition, the password authentication system and the password authentication method described in Patent Document 3 describe that user authentication devices are distributedly introduced in addition to the password central management device.

  According to Patent Document 3, it is described that when a centralized password management apparatus breaks down by introducing user authentication apparatuses in a distributed manner, the user authentication apparatus performs authentication in place of the central password management apparatus. ing.

  However, in the case described in Patent Document 3, when the system scale is increased, it is necessary to increase the number of user authentication devices, so that the problem that enormous introduction cost and operation cost are required is still solved. I couldn't.

  The present invention has been made in view of the above problems, and even when the wireless base station cannot connect to all the authentication servers, the wireless terminal does not require enormous introduction cost and operation cost. It is an object of the present invention to provide an authentication system for authenticating a wireless terminal, an authentication method thereof, and a wireless base station that can continuously connect to a communication network.

  An authentication system for authenticating a wireless terminal according to the present invention is an authentication system for authenticating a wireless terminal that makes an authentication request to the communication network with respect to an authentication server connected to the communication network via a wireless base station. When the wireless base station receives a wireless authentication request packet including authentication request information and a terminal unique ID from the wireless terminal, the wireless base station generates an authentication request packet and stores the authentication request packet in the authentication server information table of the wireless base station. An arbitrary authentication server is selected from all pre-registered authentication servers, and an authentication request packet transmitting means for transmitting the authentication request packet to the selected arbitrary authentication server is transmitted. Later, when an authentication response packet is received from the arbitrary authentication server, the arbitrary authentication server operates normally. An authentication server that determines that the arbitrary authentication server is not operating normally if the authentication response packet is not received from the arbitrary authentication server after transmitting the authentication request packet. When it is determined that the operation check means and the authentication server operation check means are not operating normally, the authentication server is switched to the authentication server determined to be operating normally by the authentication server operation check means. Authentication server switching means for performing authentication, wherein the authentication server acquires the authentication request information from the authentication request packet transmitted by the authentication request packet transmitting means, and stores the authentication request information and the authentication server in advance. Authentication determination means for comparing the wireless terminal authentication information in the registered authentication information management table to determine whether or not they match Wherein when the authentication request information by the authentication decision means and said wireless terminal authentication information match, characterized in that it comprises an authentication response packet authentication server transmission means for transmitting the authentication response packet.

  An authentication method in an authentication system for authenticating a wireless terminal according to the present invention authenticates a wireless terminal that makes an authentication request to the communication network with respect to an authentication server connected to the communication network via a wireless base station. An authentication method in an authentication system for generating an authentication request packet when the wireless base station receives a wireless authentication request packet including authentication request information and a terminal unique ID from the wireless terminal, and the wireless base station An authentication request packet transmission step of selecting an arbitrary authentication server from all the authentication servers registered in advance in the authentication server information table possessed by and transmitting the authentication request packet to the selected arbitrary authentication server; Whether the arbitrary authentication server is the authentication request packet transmitted by the authentication request packet transmission step. An authentication determination step of acquiring the authentication request information, comparing the authentication request information with wireless terminal authentication information in an authentication information management table registered in advance in the authentication server, and determining whether or not they match And when the authentication request information matches the wireless terminal authentication information in the authentication determination step, the arbitrary authentication server transmits an authentication response packet authentication server that transmits an authentication response packet, and the wireless base station When the station receives the authentication response packet from the arbitrary authentication server, the station determines that the arbitrary authentication server is operating normally and does not receive the authentication response packet from the arbitrary authentication server. If the authentication server operation confirmation step of determining that the arbitrary authentication server is not operating normally, the radio base station, If it is determined in the authentication server operation confirmation step that the arbitrary authentication server is not operating normally, authentication processing is performed by switching to the authentication server determined to be operating normally in the authentication server operation confirmation step. An authentication server switching step.

  The wireless base station according to the present invention generates an authentication request packet when receiving a wireless authentication request packet including authentication request information and a terminal unique ID from a wireless terminal, and stores the authentication request packet in the authentication server information table of the local station in advance. After selecting an arbitrary authentication server from all the registered authentication servers and transmitting the authentication request packet to the selected arbitrary authentication server, and after transmitting the authentication request packet When an authentication response packet is received from the arbitrary authentication server, it is determined that the arbitrary authentication server is operating normally, and after transmitting the authentication request packet, the authentication from the arbitrary authentication server. An authentication server operation confirmation means for determining that the arbitrary authentication server is not operating normally when a response packet is not received, and the authentication Authentication server switching means for performing authentication processing by switching to the authentication server determined to be operating normally by the authentication server operation checking means when it is determined that the server operation checking means is not operating normally And.

  Further, the wireless base station according to the present invention, when it is determined by the authentication server operation confirmation means that all the authentication servers registered in the authentication server information table are not operating normally, the wireless base station When the wireless authentication request packet is received from the wireless terminal, the terminal unique ID is acquired, and the terminal information table of the own station is referred to, and there is terminal information that matches the terminal unique ID The wireless base station transmits an encryption key set ID request packet for requesting an encryption key set ID to the wireless terminal by an encryption key set ID requesting means and an encryption key set ID response means from the wireless terminal. When the received encryption key set ID response packet is received, the encryption key set ID included in the encryption key set ID response packet is The encryption key set ID comparing means for comparing the encryption key set ID associated with the wireless terminal registered in the terminal information table in the wireless base station, and the encryption key set ID comparing means If the encryption key set ID included in the response packet matches the encryption key set ID associated with the wireless terminal registered in the terminal information table in the wireless base station, the local station authenticates. It is determined that authentication is permitted on behalf of the server, the wireless base station transmits a wireless authentication permission response packet to the wireless terminal, and the encryption key set ID comparing means includes the encryption included in the encryption key set ID response packet. Key set ID and encryption key set ID associated with the wireless terminal registered in the terminal information table in the wireless base station The wireless base station determines that the authentication is rejected on behalf of the authentication server, and the wireless base station transmits a wireless authentication rejection response packet to the wireless terminal; You may make it provide further.

  According to the present invention, as described above, the wireless base station can switch the connection even if the wireless base station cannot perform authentication processing with all the authentication servers due to some factor. The terminal can continue to connect to the communication network.

  Thereby, even when the wireless base station can no longer connect to all the authentication servers, the wireless terminal can be continuously connected to the communication network without requiring enormous introduction cost and operation cost. An authentication system for authenticating a wireless terminal, an authentication method thereof, and a wireless base station can be realized.

Next, Embodiment 1 for carrying out the present invention will be described in detail with reference to the drawings.
(Embodiment 1)
(1) Configuration of Authentication System for Authenticating Wireless Terminal FIG. 1 is a schematic diagram showing a configuration of an authentication system for authenticating a wireless terminal in Embodiment 1 according to the present invention.

  The authentication system for authenticating the wireless terminal shown in FIG. 1 includes a wireless base station # 1, which is a first wireless base station, a wireless base station # 2, which is a second wireless base station, and a third wireless base station. A certain wireless base station # 3, a wireless terminal 21, an authentication server # 1 as a first authentication server, an authentication server # 2 as a second authentication server, and an authentication server # 3 as a third authentication server And a communication network 41.

  In addition, about the same structure as a related technique, suppose that the same code | symbol is attached | subjected, Since the same structure overlaps the already demonstrated content, the description is abbreviate | omitted.

  FIG. 2 is a schematic diagram showing a configuration of the radio base station 11 of the authentication system for authenticating the radio terminal according to the first embodiment of the present invention.

  Radio base station # 1 (FIG. 1), which is the first radio base station, has the configuration shown in radio base station 11 (FIG. 2), and communicates with radio interface unit 101, radio communication control unit 102, and the like. A control unit 103, an authentication processing unit 104, an authentication server information table 105, a terminal information table 106, a wired communication control unit 107, and a wired interface unit 108 are provided.

  The radio base station # 2 (FIG. 1), which is the second radio base station, and the radio base station # 3 (FIG. 1), which is the third radio base station, are the same as the radio base station 11 (FIG. 2). A plurality of base stations are connected to the communication network 41.

  FIG. 3 is a schematic diagram illustrating a configuration of the wireless terminal 21 of the authentication system for authenticating the wireless terminal according to the first embodiment of the present invention.

  The wireless terminal 21 illustrated in FIG. 3 includes a communication control unit 201, an authentication processing unit 202, a terminal information table 203, an authentication information table 204, a wireless communication control unit 205, and a wireless interface unit 206. .

  FIG. 4 is an example showing an authentication server information table 105 (FIG. 2) and a terminal information table 106 (FIG. 2) in the wireless base station 11 of the authentication system for authenticating a wireless terminal according to the first embodiment of the present invention. .

  The authentication server information table 105 shown in FIG. 4 includes items such as an authentication server name, an IP (internet protocol) address, a port, a shared secret key, and an operation state corresponding to the number assigned to the Index.

  The terminal information table 106 shown in FIG. 4 includes items of terminal unique ID, connection state, connection time, validity period, encryption key # 1, encryption key # 2, and encryption key set ID.

  FIG. 5 is an example showing an authentication information management table 32 (FIG. 1) in the authentication server 31 of the authentication system for authenticating the wireless terminal according to the first embodiment of the present invention.

  The authentication information management table 32 shown in FIG. 5 includes items of user ID, password, base station ID, authentication state, authentication time, and validity period.

  FIG. 6 is an example showing a terminal information table 203 (FIG. 3) and an authentication information table 204 (FIG. 3) in the wireless terminal 21 of the authentication system for authenticating a wireless terminal according to the first embodiment of the present invention.

  The terminal information table 203 illustrated in FIG. 6 includes items of terminal unique ID, base station ID, communication state, connection time, encryption key # 1, encryption key # 2, and encryption key set ID.

  The authentication information table 204 shown in FIG. 6 includes items of user ID, password, authentication state, authentication time, and validity period.

  FIG. 7 shows an authentication server operation confirmation process (corresponding to the authentication server operation confirmation means of the present invention) and an authentication server switching process (authentication of the present invention) of the authentication system for authenticating the wireless terminal according to the first embodiment of the present invention. It corresponds to a server switching means).

  FIG. 8 is an example of a flowchart showing the operation of the authentication server operation advance confirmation process (corresponding to the authentication server operation advance confirmation means of the present invention) of the authentication system for authenticating the wireless terminal according to the first embodiment of the present invention. .

  FIG. 9 is an example of a flowchart showing the operation of the authentication server operation confirmation timer control process (corresponding to the authentication server operation confirmation timer control means of the present invention) of the authentication system for authenticating the wireless terminal according to the first embodiment of the present invention. It is.

  FIG. 10 is a flowchart showing an operation of an authentication inquiry process by the authentication system for authenticating a wireless terminal according to the first embodiment of the present invention.

  FIG. 11 is a flowchart illustrating the operation of the terminal unique ID registration status determination process from the wireless terminal by the authentication system for authenticating the wireless terminal according to the first embodiment of the present invention.

  FIG. 12 is a flowchart showing the operation of the terminal unique ID registration status determination process from the communication network by the authentication system for authenticating the wireless terminal according to the first embodiment of the present invention.

  FIG. 13 is a flowchart showing an operation of receiving a wireless authentication request packet from a wireless terminal by the authentication system for authenticating the wireless terminal according to the first embodiment of the present invention.

  It should be noted that the flowcharts shown in FIGS. 7 to 13 will be described respectively when the operation of the authentication system for authenticating the wireless terminal is described.

  In the authentication system for authenticating a wireless terminal shown in FIG. 1, a wireless base station 11 is connected to an authentication server # 1, an authentication server # 2, and an authentication server # 3 via a communication network 41.

  When the wireless base station 11 receives a wireless authentication request including authentication information such as a user ID and a password from the wireless terminal 21, the authentication server # 1, authentication server # 2, authentication server in which the authentication information is registered It has a function of permitting or rejecting communication with the wireless terminal 21 by inquiring an authentication request to any of # 3.

  Also, once the wireless terminal 21 is authenticated by the authentication server 31 and communication is permitted, the wireless base station 11 stores the terminal unique ID of the wireless terminal 21 in the terminal information table 106 (FIG. 4).

  Thereafter, the wireless base station 11 stores the communication control unit 103 (FIG. 2) in the terminal unique ID of the wireless terminal 21 and the terminal information table 106 for determining whether to permit or reject communication from the same wireless terminal 21. This is done by comparing with the terminal unique ID.

  The wireless interface unit 101 performs wireless communication with the wireless terminal 21. When receiving a wireless packet from the wireless terminal 21, the wireless interface unit 101 converts the wireless packet into digital data and sends the digital data to the wireless communication control unit 102.

  Further, the wireless interface unit 101 converts the digital data from the wireless communication control unit 102 into a wireless packet and transmits it to the wireless terminal 21 (FIG. 1).

  The wireless communication control unit 102 (FIG. 2) is connected to the wireless interface unit 101 and the communication control unit 103, and controls a protocol for performing wireless communication with the wireless terminal 21.

  The communication control unit 103 is connected to the wireless communication control unit 102 and the wired communication control unit 107, and is further connected to the authentication processing unit 104, the authentication server information table 105, and the terminal information table 106. .

  The communication control unit 103 extracts the terminal unique ID and the packet type from the communication packet from the wireless terminal 21 sent from the wireless communication control unit 102. If the packet type is a wireless authentication request, the communication control unit 103 The packet is sent to the authentication processing unit 104.

  If the packet type is other than the wireless authentication request, the extracted terminal unique ID is compared with the terminal unique ID registered in the terminal information table 106. If registered, the wired communication control unit 107 and the wired interface unit are registered. The communication packet is sent to the communication network 41 (FIG. 1) via the network 108.

  In contrast, if the extracted terminal unique ID is not registered in the terminal information table 106 (FIG. 2), the communication control unit 103 has a function of discarding the communication packet transmitted from the wireless communication control unit 102. ing.

  Further, the communication control unit 103 sends the authentication request packet generated by the authentication processing unit 104 to the wired communication control unit 107, and the authentication server 31 (via the wired communication control unit 107, the wired interface unit 108, and the communication network 41). 1).

  Further, the communication control unit 103 (FIG. 2) receives an authentication response packet from the authentication server 31 via the communication network 41, the wired interface unit 108, and the wired communication control unit 107, and sends it to the authentication processing unit 104. Also have.

  The communication control unit 103 (FIG. 2) also transmits a wireless authentication response packet generated by the authentication processing unit 104 to the wireless terminal 21 (FIG. 1) via the wireless communication control unit 102 and the wireless interface unit 101. Also have.

  Further, when the authentication response from the authentication server 31 (FIG. 1) is an authentication permission response, the communication control unit 103 (FIG. 2) generates an encryption key used for encryption of communication data with the wireless terminal 21. Then, the data is sent to the authentication processing unit 104 (FIG. 2).

  Further, the communication control unit 103 has a function of registering the terminal unique ID, connection time, validity period, encryption key, and encryption key set ID in the terminal information table 106.

  In this case, the communication control unit 103 transmits the encryption key distribution packet including the encryption key generated by the authentication processing unit 104 to the wireless terminal 21 (FIG. 1) via the wireless communication control unit 102 and the wireless interface unit 101. It has a function to transmit.

  In addition, the communication control unit 103 (FIG. 2) has a function of confirming the operation state of the authentication server 31 registered in advance in the authentication server information table 105, and displays the result of confirming the operation state of the authentication server 31. And a function to update the corresponding authentication server information table 105.

  Further, in the present embodiment, when the communication control unit 103 determines that the operation states of all the authentication servers registered in the authentication server information table 105 have been stopped, the terminal information table 106 stores the wireless terminal information. When there is a terminal unique ID that matches the terminal unique ID, it has an alternative authentication function for performing authentication on behalf of the authentication server from the information of the encryption key and the encryption key set ID.

  In this alternative authentication function, in the present embodiment, if there is no terminal unique ID that matches the terminal unique ID of the wireless terminal 21 in the terminal information table 106, the presence exists to another wireless base station via the communication network 41. And a function for searching the terminal information table 106 and notifying the result when the inquiry is received.

  Then, when a terminal unique ID that matches the terminal unique ID exists in any of the radio base stations, it has a function of notifying the corresponding encryption key and encryption key set ID.

  Next, the authentication processing unit 104 is connected to the communication control unit 103, decodes the contents of the wireless authentication request packet and the authentication response packet sent from the communication control unit 103, and these packets are defined. It is determined whether or not it conforms to the authentication protocol.

  Then, when conforming to the prescribed authentication protocol, the authentication processing unit 104 generates an authentication request packet and a wireless authentication response packet and sends them to the communication control unit 103.

  On the other hand, if the specified authentication protocol is not complied with, the authentication processing unit 104 has a function of determining that the authentication packet is invalid, generating an authentication processing interruption packet, and sending it to the communication control unit 103. is doing.

  In addition, the authentication processing unit 104 has a function of generating an encryption key distribution packet including the encryption key transmitted from the communication control unit 103 and sending it to the communication control unit 103.

  The wired communication control unit 107 is connected to the communication control unit 103 and the wired interface unit 108, and has a function of performing protocol control for communicating with a device connected to the communication network 41 (FIG. 1). ing.

  The wired interface unit 108 (FIG. 2) is connected to the wired communication control unit 107 and the communication network 41, and converts digital data generated by the communication control unit 103 or the wired communication control unit 107 into an electrical signal for communication. Transmit to the network 41 (FIG. 1).

  The wired interface unit 108 (FIG. 2) also has a function of converting an electrical signal received from the communication network 41 (FIG. 1) into digital data and sending it to the wired communication control unit 107.

  Next, in the wireless terminal 21 of the authentication system for authenticating the wireless terminal shown in FIG. 3, the communication control unit 201, the authentication processing unit 202, the terminal information table 203, the authentication information table 204, the wireless communication control unit 205, And a wireless interface unit 206.

  The wireless terminal 21 has a function of making a wireless authentication request to the wireless base station 11 and communicating with a device connected to the communication network 41 via the wireless base station 11 when the authentication is permitted. ing.

  The communication control unit 201 is connected to the authentication processing unit 202, the terminal information table 203, the authentication information table 204, and the wireless communication control unit 205. The communication control unit 201 controls the flow of each communication state, generates and decodes communication packets, It has a function to send and receive.

  Here, the communication state includes an unconnected state, an authentication processing state, and a connected state.

  The unconnected state is an initial state in which the wireless base station 11 is not connected. The authentication processing state is a state in which authentication processing is being performed with the authentication server 31 via the wireless base station 11.

  The connection state is a state in which authentication is permitted and access to the communication network 41 is possible as a result of the authentication process.

  When communication is started from the unconnected state, the communication control unit 201 of the wireless terminal 21 shifts to the authentication processing state, so that the communication state of the terminal information table 203 (FIG. 6) is set to the authentication processing state.

  Then, the communication control unit 201 (FIG. 3) sends the user ID and password from the authentication information table 204 to the authentication processing unit 202, and adds the terminal unique ID of the terminal information table 203 to the generated wireless authentication request packet.

  Then, the communication control unit 201 transmits the wireless authentication request packet added with the terminal unique ID to the wireless base station 11 via the wireless communication control unit 205 and the wireless interface unit 206.

  Further, the communication control unit 201 has a function of receiving a wireless authentication response packet from the wireless base station 11 via the wireless interface unit 206 and the wireless communication control unit 205 and sending it to the authentication processing unit 202 for decoding. Yes.

  If the wireless authentication is permitted as a result of the decryption, the communication control unit 201 updates the authentication state, the authentication time, and the validity period of the authentication information table 204 (FIG. 6), and obtains the base station ID from the wireless authentication response packet. The base station ID, communication state, and connection time in the terminal information table 203 are updated.

  On the other hand, if the result of decryption is an encryption key distribution packet, the communication control unit 201 (FIG. 3) registers the encryption key and encryption key set ID in the terminal information table 203 (FIG. 6), and connects the communication state. It has a function to make a state.

  In the connected state, the terminal unique ID of the terminal information table 203 is added to the communication data, and the data is transmitted to the radio base station 11 via the radio communication control unit 205 (FIG. 3) and the radio interface unit 206.

  In addition, when the communication control unit 201 of the wireless terminal 21 receives a wireless packet from the wireless base station 11, the communication control unit 201 extracts the base station ID from the wireless packet and compares it with the base station ID of the terminal information table 203. If they match, it is captured as communication data.

  On the other hand, the communication control unit 201 of the wireless terminal 21 has a function of comparing the base station ID from the wireless packet and the base station ID of the terminal information table 203 and discarding the wireless packet if they do not match. is doing.

  When the communication control unit 201 continues communication beyond the validity period of the authentication information table 204, the communication control unit 201 changes the communication state from the connected state to the authentication processing state or the unconnected state, and again performs wireless authentication. It also has the function of making a request and updating the available time.

  The authentication processing unit 202 is connected to the communication control unit 201 and has a function of generating a wireless authentication request packet, receiving and decrypting a wireless authentication response packet, and determining whether the packet conforms to the regulation. Have.

  The wireless communication control unit 205 performs protocol control for performing wireless communication with the wireless base station 11.

The wireless interface unit 206 has a function of converting between digital data and a wireless signal.
(2) Operation of Authentication System that Authenticates Wireless Terminal Next, an example of the operation of the authentication system that authenticates the wireless terminal according to the first embodiment of the present invention will be described with reference to FIG. 1 to FIG. This will be described in detail with reference to an example of the various tables in FIG. 6 and the flowcharts in FIGS.

  First, the wireless terminal 21 shown in FIG. 1 is connected to any one of the wireless base station # 1, the wireless base station # 2, and the wireless base station # 3 when communicating with a server group or a terminal group on the communication network 41. I do.

  The wireless terminal 21 needs to access the communication network 41 via any of the connected wireless base stations, and at that time, a wireless authentication request packet including a terminal unique ID, a user ID, a password, and the like. Is transmitted to the radio base station 11.

  The radio base station 11 extracts the terminal unique ID, the user ID, and the password from the radio authentication request packet, and the authentication processing unit 104 generates an authentication request packet.

  Then, the wireless base station 11 is determined to be operating normally by the authentication server operation confirmation process of FIG. 7, the authentication server operation advance confirmation process of FIG. 8, or the authentication server operation confirmation timer control process of FIG. The authentication server 31 is inquired about authentication.

Here, the processing of each flowchart shown in FIGS. 7 to 9 will be described in detail.
(2-1) Authentication Server Operation Confirmation Process and Authentication Server Switching Process of Wireless Base Station 11 The flowchart shown in FIG. 7 is an authentication server operation in which the wireless base station 11 confirms the operation of the authentication server 31 and switches the authentication server 31. An example of a confirmation process and an authentication server switching process is shown.

  First, the wireless base station 11 receives a connection request for the wireless terminal 21 by acquiring a wireless authentication request from the wireless terminal 21 (step S01).

  Then, the radio base station 11 selects an arbitrary authentication server 31 from the authentication server information table 105 of the own station, and transmits an authentication request to the authentication server 31 (step S02).

  Specifically, an arbitrary authentication server 31 is selected from authentication servers # 1 to # 3 assigned to Index 1 to Index 3 shown in FIG. 4, and an authentication request is transmitted.

  Then, the radio base station 11 determines whether or not a response has been received from the selected authentication server 31 (step S03).

  Here, if the wireless base station 11 receives a response from the authentication server 31, the process proceeds to step S04, and the operation state of the corresponding authentication server in the authentication server information table 105 (FIG. 4) of the wireless base station 11 is set to “ Set to “operation”.

  Thereby, since the radio base station 11 was able to confirm the operation state of the authentication server 31, the authentication server operation confirmation process is terminated (step S09).

  On the other hand, if the wireless base station 11 does not receive a response from the authentication server 31, the process proceeds to step S05, and the operation state of the corresponding authentication server in the authentication server information table 105 (FIG. 4) is set to “stop”. To do.

  Then, the radio base station 11 determines whether there is another selectable authentication server 31 in the authentication server information table 105 (FIG. 4) (step S06).

  Here, when authentication servers # 1 to # 3 other than the authentication server 31 that did not receive the response in step S03 correspond to the authentication server 31, the process proceeds to step S07, and the authentication server information table 105 (FIG. 4) The authentication server is selected, and the process returns to step S03.

On the other hand, if there is no other selectable authentication server in step S06, the process proceeds to step S08, where it is determined that all the authentication servers 31 registered in the authentication server information table 105 are in an operation stopped state. The authentication server switching process is terminated (step S10).
(2-2) Authentication Server Operation Prior Confirmation Process of Wireless Base Station 11 The flowchart shown in FIG. 8 shows an example of the authentication server operation advance confirmation process in which the wireless base station 11 confirms the operation state of the authentication server 31 in advance. It is a thing.

  The radio base station 11 first confirms the operation state of the authentication server # 1 whose index is 1 in order to confirm the operation state of the authentication servers # 1 to # 3 described in the authentication server information table 105 of the own station. The target is set (step S21).

  Next, in step S22, the radio base station 11 compares the Index number with the maximum number of registered authentication servers 31.

  Considering the authentication server information table 105 shown in FIG. 4, if Index is 1 at first, since three authentication servers 31 are registered, the process proceeds to step S24, and authentication server # 1 is selected. Then, an authentication test is transmitted to the authentication server # 1.

  In step S25, the radio base station 11 determines whether or not a response is received from the authentication server # 1, and when the radio base station 11 receives the response, the process proceeds to step S26. .

  When the wireless base station 11 receives the response, the wireless base station 11 determines that the authentication server # 1 is operating normally, sets the operation state of the authentication server information table 105 to “operation”, and step S28. Proceed to

  On the other hand, if the wireless base station 11 does not receive a response in step S25, the process proceeds to step S27, where it is determined that the authentication server # 1 is stopped because it is not operating normally, and the authentication server The operation state of the information table 105 is set to “stop”, and the process proceeds to step S28.

  In step S28, the radio base station 11 adds one to the Index number in the authentication server information table 105, and returns to step S22.

  In step S22, the index number is changed from 1 to 2, and three authentication servers 31 are described in the authentication server information table 105. Therefore, the determination is performed again in the same manner as described above.

  In the example of FIG. 4, since there are three authentication servers 31, the wireless base station 11 confirms the operation state of all three units, and proceeds to step S23 with the index set to 4, confirming the authentication server prior operation confirmation. The process ends (step S23).

Thereby, the authentication server prior operation confirmation processing shown in FIG. 8 can confirm the operation states of all the authentication servers 31 in advance.
(2-3) Authentication Server Operation Confirmation Timer Control Process of Wireless Base Station 11 The flowchart shown in FIG. 9 is a flowchart in which the wireless base station 11 sets the response time of the authentication server 31 in the authentication server operation advance confirmation process of FIG. An example in which an authentication server operation confirmation timer control process is added is shown.

  In the authentication server operation confirmation timer control process shown in FIG. 9, the same step numbers are assigned to the same parts as those in the authentication server preliminary operation confirmation process shown in FIG. 8, and the description thereof is omitted.

  Here, the authentication server operation confirmation timer control process shown in FIG. 9 is different in operation in step S26 of the authentication server advance operation confirmation process shown in FIG. 8, and otherwise, the authentication server advance operation confirmation process in FIG. Works as well.

  That is, when the wireless base station 11 receives a response from the authentication server 31 in step S25, the process proceeds to step S40, and the wireless base station 11 transmits the response after the authentication server 31 transmits a response of the authentication test. Is the response time.

  Then, the radio base station 11 sets a time twice as long as the calculated response time as a response time for the index number authentication server 31 to reciprocate (step S42).

  Thereby, the radio base station 11 has a response time to the authentication server for each Index number, and can determine the operation state of the authentication server 31 based on the response time for each authentication server 31.

  In this embodiment, twice the response time from the authentication server 31 is set as the response time to and from the wireless base station 11, but in this embodiment, the present invention is not limited to this and any user's This time may be set as a predetermined time.

  Further, in consideration of a time loss for communication, 2.5 times the response time from the authentication server 31 may be set as the response time for the wireless base station 11 to make a round trip from transmission to reception.

  Thereby, in this embodiment, since the wireless base station 11 can set the response time to each authentication server 31, a time restriction can be added to the response from the authentication server received in step S25. .

Further, in the present embodiment, it is added to the authentication server operation advance confirmation process shown in FIG. 8, but in the present embodiment, the present invention is not limited thereto, and step S03 of the authentication server operation confirmation process shown in FIG. A time constraint may be added to the reception of the response in.
(2-4) Authentication Inquiry Operation of Authentication System that Authenticates Wireless Terminal Next, the authentication inquiry operation of the authentication system that authenticates the wireless terminal will be described in detail with reference to the flowchart shown in FIG.

  First, the radio base station 11 is determined to be operating normally by the authentication server operation confirmation process of FIG. 7, the authentication server operation advance confirmation process of FIG. 8, or the authentication server operation confirmation timer control process of FIG. An authentication inquiry is made to 31 (step S60).

  Next, the authentication server 31 compares authentication information such as a user ID, password, and validity period registered in advance with authentication information of an authentication request packet transmitted from the radio base station 11 (step S61).

  If the authentication information such as the user ID, password, and validity period matches, the authentication server 31 transmits authentication permission to the radio base station 11 (step S62).

  On the other hand, when the authentication information such as the user ID, password, and validity period does not match, the authentication server 31 transmits an authentication rejection to the radio base station 11 (step S63).

  Thereby, when the wireless base station 11 receives the authentication permission from the authentication server 31, the terminal unique ID, the connection time, and the validity period of the wireless terminal 21 are registered in the terminal information table 106 of the own station (step S64). ).

  Further, the radio base station 11 generates an encryption key and an encryption key set ID and registers them in the terminal information table 106, and also generates and transmits a wireless authentication permission packet and an encryption key distribution packet to the wireless terminal 21 (step S65). .

  When the wireless terminal 21 receives the wireless authentication permission packet and the encryption key distribution packet, the wireless terminal 21 registers the base station ID, the connection time, the encryption key, and the encryption key set ID in the terminal information table 203 of the own station, and the authentication information table The authentication state, authentication time, and validity period are registered in 204 (step S66), and the process shifts to the connection state (step S67).

  As a result, access to the communication network 41 becomes possible thereafter (step S68).

For the generation of the encryption key set ID, both the wireless terminal 21 and the wireless base station 11 determine rules such as using a hash function such as MD5 and SHA-1, thereby preventing unauthorized use and detecting tampering. It can be carried out.
(2-5) Terminal Unique ID Registration Status Judgment Processing of Authentication System for Authenticating Wireless Terminal Next, in the authentication system for authenticating the wireless terminal, the operation of the terminal unique ID registration status judgment processing from the wireless terminal is shown in FIG. This will be described in detail with reference to the flowchart shown.

  When receiving the wireless communication data packet from the wireless terminal 21, the wireless base station 11 extracts the terminal unique ID from the packet (step S70).

  Then, the radio base station 11 determines whether or not the terminal unique ID corresponding to the extracted terminal unique ID has been registered in the terminal information table 106 of the own station (step S71).

  If the terminal unique ID corresponding to the extracted terminal unique ID has already been registered in the terminal information table 106, it is then determined whether or not the connection state is connection (step S72). It is confirmed whether it is within the valid period (step S73).

  Thereby, when the terminal unique ID is within the valid period, the wireless communication data packet is passed to the communication network 41 (step S74).

  On the other hand, if any one of the determinations in step S71, step S72, or step S73 cannot be satisfied, the radio base station 11 does not pass the radio communication data packet to the communication network 41 ( Step S76).

Thereby, the radio base station 11 can prevent unauthorized access.
(2-6) Terminal unique ID registration status determination process 2 of the authentication system for authenticating the wireless terminal
Next, the operation of the terminal unique ID registration status determination process from the communication network 41 in the authentication system for authenticating the wireless terminal will be described in detail with reference to the flowchart shown in FIG.

  When the wireless base station 11 receives a communication data packet from the communication network 41 to the wireless terminal 21, a terminal unique ID is extracted from the communication data packet (step S80).

  Then, it is determined whether or not the terminal unique ID corresponding to the extracted terminal unique ID has been registered in the terminal information table 106 possessed by the own station (step S81).

  If the terminal unique ID corresponding to the extracted terminal unique ID has already been registered in the terminal information table 106, it is then determined whether or not the connection state is connection (step S82). It is confirmed whether it is within the valid period (step S83).

  Thereby, when the terminal unique ID is within the valid period, the communication data packet is converted into a wireless communication data packet and passed to the wireless terminal 21 (step S84).

  On the other hand, when there is no new authentication permission with the wireless terminal 21 within the effective period (step S83), the wireless base station 11 changes the corresponding connection state in the terminal information table 106 to disconnected. Thereafter, communication can be blocked (step S86).

  In step S86, when there is a new authentication permission, the connection time may be updated to allow continuous communication.

Furthermore, when a period such as twice or more of the valid period has passed without a new authentication permission, the information on the corresponding wireless terminal may be deleted from the terminal information table 106.
(2-7) Radio Authentication Request Packet Reception Processing of Authentication System for Authenticating Wireless Terminal Next, in the authentication system for authenticating the wireless terminal, the operation when the wireless authentication request packet from the wireless terminal 21 is received will be described with reference to FIG. This will be described in detail with reference to the flowchart shown in FIG.

  In the present embodiment, when the wireless base station 11 receives a wireless authentication request packet from the wireless terminal 21, the authentication server operation confirmation processing in FIG. 7, the authentication server operation advance confirmation processing in FIG. 8, or the authentication server operation in FIG. If it is determined by the confirmation timer control process that there is no authentication server operating normally, the communication control unit 103 in the radio base station 11 extracts the terminal unique ID from the radio authentication request packet (step S90).

  Then, the communication control unit 103 of the radio base station 11 confirms whether or not the terminal unique ID has been registered in the terminal information table 106 possessed by the own station (step S91).

  If the terminal unique ID is already registered in the terminal information table 106, the corresponding encryption key set ID request packet is transmitted to the wireless terminal 21 (step S92).

  When receiving the encryption key set ID request packet, the wireless terminal 21 generates an encryption key set ID response packet including the encryption key set ID in the terminal information table 203 and transmits it to the wireless base station 11 (step S93). ).

  At this time, the wireless terminal 21 can prevent unauthorized use due to eavesdropping or the like by encrypting the encryption key set ID response packet with the corresponding encryption key and transmitting it.

  As a result, when the wireless base station 11 receives the encryption key set ID response packet (step S94), the wireless base station 11 extracts the encryption key set ID and compares it with the corresponding encryption key set ID in the terminal information table 106 of the own station. (Step S95).

  As a result of comparing the encryption key set IDs, if the encryption key set IDs match, it is determined that the authentication is permitted (step S96). On the other hand, if the encryption key set IDs do not match, it is determined that the authentication is rejected ( In step S97), a wireless authentication response packet is transmitted to the wireless terminal 21.

  On the other hand, if the terminal unique ID is not registered in the terminal information table 106 in step S91, the communication control unit 103 of the wireless base station 11 transmits the terminal unique ID to another wireless base station via the communication network 41. A search request packet is transmitted to inquire about the registration state of the terminal unique ID of the corresponding wireless terminal 21 (step S99).

  Then, the radio base station that has received the terminal unique ID search request packet searches the terminal information table 106 in its own station and determines whether or not the corresponding terminal unique ID exists (step S100).

  If the corresponding terminal unique ID exists, the wireless base station transmits a terminal unique ID search response packet including the corresponding encryption key and encryption key set ID to the wireless base station 11 (step S101).

  Thereby, the radio base station 11 extracts the encryption key and the encryption key set ID from the terminal unique ID search response packet, and registers them in the terminal information table 106 possessed by the own station (step S103).

  Then, the process returns to step 91, performs the same processing as described above, and performs authentication determination of the wireless terminal 21.

  On the other hand, when the terminal unique ID corresponding to the terminal information table 106 in the own station does not exist, the radio base station that has received the terminal unique ID search request packet does not transmit the terminal unique ID search response packet ( Step S102).

In this case, returning to step S97, the radio base station 11 determines that the radio terminal 21 is denied authentication, transmits a radio authentication response packet to the radio terminal 21, and ends (step S98).
(3) Effect of Authentication System that Authenticates Wireless Terminal According to the present embodiment, as described above, the authentication system that authenticates the wireless terminal is configured so that the wireless base station performs authentication processing with all authentication servers for some reason. Even when the wireless base station cannot be performed, the wireless base station can substitute for authentication, so that the wireless terminal can continuously connect to the communication network.

  In other words, according to the present embodiment, the authentication system for authenticating a wireless terminal can substitute authentication by the substitute authentication means based on the encryption key set ID, so that the wireless terminal can continuously connect to the communication network.

  In addition, since the encryption key set ID uses the hash value of the encryption key, it is resistant to decryption and tampering, and authentication processing can be replaced safely and reliably.

It is the schematic of the authentication system which authenticates the radio | wireless terminal in Embodiment 1 which concerns on this invention. FIG. 2 is a schematic configuration diagram of a radio base station according to the first embodiment of the present invention. 1 is a schematic configuration diagram of a wireless terminal according to Embodiment 1 of the present invention. It is an example of the table in the wireless base station in Embodiment 1 which concerns on this invention. It is an example of the table in the authentication server in Embodiment 1 which concerns on this invention. It is an example of the table in the radio | wireless terminal in Embodiment 1 which concerns on this invention. It is a flowchart which shows operation | movement of the authentication server operation | movement confirmation process and authentication server switching process in Embodiment 1 which concerns on this invention. It is a flowchart which shows operation | movement of the authentication server operation | movement prior confirmation process in Embodiment 1 which concerns on this invention. It is a flowchart which shows the operation | movement of the authentication server operation | movement confirmation timer control process in Embodiment 1 which concerns on this invention. It is a flowchart which shows the operation | movement of the inquiry process of the wireless base station in Embodiment 1 which concerns on this invention. It is a flowchart which shows the operation | movement of the terminal specific ID registration condition judgment process from the radio | wireless terminal in Embodiment 1 which concerns on this invention. It is a flowchart which shows the operation | movement of the terminal specific ID registration condition judgment process from the communication network in Embodiment 1 which concerns on this invention. It is a flowchart which shows the operation | movement of the radio | wireless authentication request packet reception process from the radio | wireless terminal in Embodiment 1 which concerns on this invention. It is the figure which showed the standard structure in the authentication system of the conventional radio | wireless terminal.

Explanation of symbols

11 wireless base station 21 wireless terminal 31 authentication server 41 communication network 101 wireless interface unit 102 wireless communication control unit 103 communication control unit 104 authentication processing unit 105 authentication server information table 106 terminal information table 107 wired communication control unit 108 wired interface unit 201 communication Control unit 202 Authentication processing unit 203 Terminal information table 204 Authentication information table 205 Wireless communication control unit 206 Wireless interface unit

Claims (13)

In an authentication system for authenticating a wireless terminal that makes an authentication request to the communication network with respect to an authentication server connected to the communication network via a wireless base station,
The radio base station is
Generates an authentication request packet when receiving a wireless authentication request packet including authentication request information and a terminal unique ID from the wireless terminal, and all authentications registered in advance in the authentication server information table of the wireless base station An authentication request packet transmitting means for selecting an arbitrary authentication server from the servers and transmitting the authentication request packet to the selected arbitrary authentication server;
After transmitting the authentication request packet, if an authentication response packet is received from the arbitrary authentication server, it is determined that the arbitrary authentication server is operating normally,
After transmitting the authentication request packet, if the authentication response packet is not received from the arbitrary authentication server, an authentication server operation confirmation unit that determines that the arbitrary authentication server is not operating normally;
Authentication server switching for performing authentication processing by switching to the authentication server determined to be operating normally by the authentication server operation checking means when it is determined that the authentication server operation checking means is not operating normally Means, and
The authentication server is
The authentication request information is acquired from the authentication request packet transmitted by the authentication request packet transmitting means, and the authentication request information and wireless terminal authentication information in an authentication information management table registered in advance in the authentication server are obtained. An authentication determining means for comparing and determining whether or not they match,
An authentication response packet authentication server transmitting means for transmitting the authentication response packet when the authentication request information matches the wireless terminal authentication information by the authentication determination means;
An authentication system for authenticating a wireless terminal, comprising: The authentication server operation confirmation means includes
An authentication server operation prior confirmation means for periodically confirming operation states of all the authentication servers registered in the authentication server information table at a timing independent of the wireless terminal;
An authentication system for authenticating a wireless terminal according to claim 1, comprising: The authentication server operation confirmation means includes
Authentication server operation confirmation timer control means for determining the operation state of all of the authentication servers registered in advance in the authentication server information table, and adjusting a predetermined time until reception of the authentication response packet for each authentication server ,
An authentication system for authenticating a wireless terminal according to claim 1, comprising: The authentication server is
When the authentication request information matches the wireless terminal authentication information by the authentication determination means, it is determined that authentication is permitted,
If the authentication request information and the wireless terminal authentication information do not match by the authentication determination means, it is determined that the authentication is rejected,
When it is determined that the authentication is permitted by the authentication determining means, an authentication permission response packet indicating the authentication permission is generated as authentication response information, and the authentication permission response packet is transmitted to the radio base station,
Authentication result transmitting means for generating an authentication rejection response packet indicating the authentication rejection as authentication response information and transmitting the authentication rejection response packet to the radio base station when the authentication determination means determines that the authentication is rejected Further comprising
The radio base station is
Authentication response packet transmitting means for acquiring the authentication response information from the authentication response packet transmitted from the authentication server, generating a wireless authentication response packet, and transmitting the wireless authentication response packet to the wireless terminal;
When the authentication permission response packet transmitted by the authentication result transmission unit of the authentication server is received, the wireless authentication permission response packet is transmitted to the wireless terminal by the authentication response packet transmission unit,
Authentication result base station transmitting means for transmitting the wireless authentication rejection packet to the wireless terminal by the authentication response packet transmitting means when receiving the authentication rejection response packet transmitted by the authentication result transmitting means of the authentication server When,
The authentication system for authenticating a wireless terminal according to any one of claims 1 to 3, further comprising: The radio base station is
When receiving the authentication permission response packet transmitted by the authentication result transmitting means of the authentication server, an encryption key generating means for generating a unique encryption key for encrypting communication data with the wireless terminal;
A hash value is calculated from the unique encryption key generated by the encryption key generation means, the hash value is set as an encryption key set ID, and the unique encryption key and the encryption key set ID are set to be unique to the wireless terminal. Terminal information registration means for registering in the terminal information table of the wireless base station in association with the terminal unique ID;
Encryption key transmission means for transmitting the unique encryption key generated by the encryption key generation means and the encryption key set ID to the wireless terminal, and
The wireless terminal is
When receiving the unique encryption key and the encryption key set ID transmitted by the encryption key transmitting means of the wireless base station, the hash value calculated from the unique encryption key and the unique encryption key is used. An encryption key registration means for registering the encryption key set ID in a terminal information table of the wireless terminal in association with a base station ID unique to the wireless base station;
The authentication system for authenticating a wireless terminal according to claim 4, further comprising: The authentication server is
If it is determined that the authentication is permitted by the authentication determination means, an authentication permission response packet with an authentication period obtained by adding a valid period registered in the wireless terminal authentication information to the authentication permission response packet is transmitted to the wireless base station. Further comprising an authentication permission period transmitting means for transmitting to
The radio base station is
An authentication permission period base station transmitting means for adding the authentication period to the wireless authentication permission response packet and transmitting the wireless authentication permission response packet with an authentication period to the wireless terminal;
When the authentication permission response packet with authentication period transmitted by the authentication permission period transmission means of the authentication server is received, the time when the wireless authentication permission response packet with authentication period is transmitted is associated with the authentication period. A terminal information registration means with an authentication period for registering in the terminal information table in the radio base station,
If a new wireless authentication request packet from the wireless terminal is not received within the authentication period from the time registered by the terminal information registration means with authentication period, the wireless terminal information in the terminal information table Terminal information deleting means for deleting
The wireless terminal is
When the wireless authentication permission response packet with an authentication period transmitted by the authentication permission period base station transmitting means is received, the time when the encryption key is received by the encryption key transmitting means is associated with the authentication period. , An encryption key registration means with an authentication period to be registered in the terminal information table in the wireless terminal,
The authentication system for authenticating a wireless terminal according to claim 5, further comprising: The radio base station is
In the case where it is determined by the authentication server operation confirmation unit or the authentication server operation prior confirmation unit that all the authentication servers registered in the authentication server information table are not operating normally, the wireless base When a station receives the wireless authentication request packet from the wireless terminal, the terminal obtains the terminal unique ID, refers to the terminal information table in the wireless base station, and finds terminal information that matches the terminal unique ID. If present, the wireless base station transmits an encryption key set ID request packet for requesting an encryption key set ID to the wireless terminal;
When receiving the encryption key set ID response packet transmitted from the wireless terminal by the encryption key set ID response means, the encryption key set ID included in the encryption key set ID response packet, and the wireless base station An encryption key set ID comparing means for comparing an encryption key set ID associated with a wireless terminal registered in the terminal information table;
The encryption key set ID comparing means includes an encryption key set ID included in the encryption key set ID response packet and an encryption key associated with the wireless terminal registered in the terminal information table in the wireless base station. When the set ID matches, it is determined that authentication is permitted on behalf of the authentication server, the wireless base station transmits a wireless authentication permission response packet to the wireless terminal,
The encryption key set ID comparing means includes an encryption key set ID included in the encryption key set ID response packet and an encryption key associated with the wireless terminal registered in the terminal information table in the wireless base station. If the set ID does not match, it is determined that the authentication is rejected on behalf of the authentication server, and the wireless base station transmits a wireless authentication rejection response packet to the wireless terminal. In addition,
The wireless terminal is
When receiving the encryption key set ID request packet transmitted by the encryption key set ID request means of the wireless base station, the encryption key set ID registered in the terminal information table in the wireless terminal, The encryption key set ID response means for transmitting to the radio base station as the encryption key set ID response packet;
The authentication system for authenticating a wireless terminal according to claim 5, further comprising: The radio base station is
When the wireless authentication request packet is received from the wireless terminal by the encryption key set ID requesting unit, the terminal unique ID of the wireless terminal is acquired and the terminal information table in the wireless base station is referred to. If there is no terminal information that matches the terminal unique ID, an inquiry is made to the other radio base station via the communication network as to whether or not the terminal information matching the terminal unique ID is owned. A terminal unique ID search request means for transmitting an ID search request packet;
If the terminal unique ID search request packet transmitted by the terminal unique ID search request means is received, the terminal unique ID to be searched from the terminal unique ID search request packet is acquired and the terminal of the radio base station When there is a search that matches the terminal unique ID to be searched in the information table, the wireless base that has made an inquiry about the encryption key and encryption key set ID associated with the terminal unique ID A terminal unique ID search response means for transmitting as a terminal unique ID search response packet in response to the station;
When the wireless base station that has made the inquiry receives the terminal unique ID search response packet by the terminal unique ID search response means, the encryption key and the encryption key set ID from the terminal unique ID search response packet Alternative authentication result base station transmitting means for determining that authentication is permitted on behalf of the authentication server and transmitting a wireless authentication permission response packet,
The authentication system for authenticating the wireless terminal according to claim 7, further comprising: The radio base station is
When the alternative authentication result base station transmission means determines that the authentication is permitted, the wireless authentication permission response packet is transmitted by the alternative authentication result base station transmission means, and then communication data with the wireless terminal is encrypted. The encryption key generating means for generating a unique encryption key;
A hash value is calculated from the unique encryption key generated by the encryption key generation means, the hash value is set as an encryption key set ID, and the unique encryption key and the encryption key set ID are set to be unique to the wireless terminal. The terminal information registration means for registering in a terminal information table in the radio base station in association with a terminal unique ID;
The encryption key transmitting means for transmitting the unique encryption key generated by the encryption key generating means and the encryption key set ID to the wireless terminal, and
The wireless terminal is
When receiving the unique encryption key and the encryption key set ID transmitted by the encryption key transmitting means of the wireless base station, the hash value calculated from the unique encryption key and the unique encryption key is used. An encryption key registration means for registering the encryption key set ID in a terminal information table of the wireless terminal in association with a base station ID unique to the wireless base station;
The authentication system for authenticating a wireless terminal according to claim 8, further comprising: The radio base station is
If it is determined that the authentication is permitted instead of the authentication server by the alternative authentication result base station transmission means, wireless authentication is permitted using an encryption key registered in association with the terminal unique ID in the terminal information table The authentication system for authenticating a wireless terminal according to claim 8 or 9, further comprising: an alternative authentication result base station encrypted transmission means for encrypting and transmitting the response packet. An authentication method in an authentication system for authenticating a wireless terminal that makes an authentication request to the communication network with respect to an authentication server connected to the communication network via a wireless base station,
When the wireless base station receives a wireless authentication request packet including authentication request information and a terminal unique ID from the wireless terminal, the wireless base station generates an authentication request packet and is registered in advance in an authentication server information table of the wireless base station. An authentication request packet transmission step of selecting an arbitrary authentication server from among all the authentication servers and transmitting the authentication request packet to the selected arbitrary authentication server;
The arbitrary authentication server acquires the authentication request information from the authentication request packet transmitted by the authentication request packet transmission step, and the authentication request information and an authentication information management table registered in the authentication server in advance Authentication determination step of comparing the wireless terminal authentication information and determining whether or not they match,
When the arbitrary authentication server matches the authentication request information and the wireless terminal authentication information in the authentication determination step, an authentication response packet authentication server transmission step of transmitting an authentication response packet;
When the wireless base station receives the authentication response packet from the arbitrary authentication server, the wireless base station determines that the arbitrary authentication server is operating normally, and sends the authentication response packet from the arbitrary authentication server. If not received, the authentication server operation confirmation step for determining that the arbitrary authentication server is not operating normally;
If the wireless base station determines that the arbitrary authentication server is not operating normally in the authentication server operation confirmation step, the authentication server determined to be operating normally in the authentication server operation confirmation step An authentication server switching step for performing authentication processing by switching to
An authentication method for authenticating a wireless terminal, comprising: An authentication request packet is generated when a wireless authentication request packet including authentication request information and a terminal unique ID is received from a wireless terminal, and all authentication servers registered in advance in the authentication server information table of the local station An authentication request packet transmitting means for selecting an arbitrary authentication server from among the selected authentication servers and transmitting the authentication request packet to the selected arbitrary authentication server;
After transmitting the authentication request packet, if an authentication response packet is received from the arbitrary authentication server, it is determined that the arbitrary authentication server is operating normally, and after transmitting the authentication request packet, If the authentication response packet is not received from the arbitrary authentication server, an authentication server operation confirmation unit that determines that the arbitrary authentication server is not operating normally;
Authentication server switching for performing authentication processing by switching to the authentication server determined to be operating normally by the authentication server operation checking means when it is determined that the authentication server operation checking means is not operating normally Means,
A radio base station comprising: When it is determined by the authentication server operation check means that all authentication servers registered in the authentication server information table are not operating normally,
When the wireless base station receives the wireless authentication request packet from the wireless terminal, the terminal unique ID is acquired and the terminal information matching the terminal unique ID is obtained by referring to the terminal information table of the own station. Is present, the wireless base station transmits an encryption key set ID request packet for requesting an encryption key set ID to the wireless terminal, an encryption key set ID requesting unit;
When receiving the encryption key set ID response packet transmitted from the wireless terminal by the encryption key set ID response means, the encryption key set ID included in the encryption key set ID response packet, and the wireless base station An encryption key set ID comparing means for comparing an encryption key set ID associated with a wireless terminal registered in the terminal information table;
The encryption key set ID comparing means includes an encryption key set ID included in the encryption key set ID response packet and an encryption key associated with the wireless terminal registered in the terminal information table in the wireless base station. If the set ID matches, the local station determines that authentication is permitted on behalf of the authentication server, the wireless base station transmits a wireless authentication permission response packet to the wireless terminal,
The encryption key set ID comparing means includes an encryption key set ID included in the encryption key set ID response packet and an encryption key associated with the wireless terminal registered in the terminal information table in the wireless base station. If the set ID does not match, the local station determines that the authentication is rejected on behalf of the authentication server, and the wireless base station transmits a wireless authentication rejection response packet to the wireless terminal. When,
The radio base station according to claim 12, further comprising:

Images