JP2012134703A - Wireless lan connection method, wireless lan client, and wireless lan access point - Google Patents

Abstract

PROBLEM TO BE SOLVED: To allow a user to connect to a wireless LAN access point without performing user authentication through a Web.SOLUTION: The wireless LAN connection methods include: a step in which the wireless LAN access point advertises a provision of a connection service; a step in which the wireless LAN client which has received the advertisement requests a server for the connection service using second connection means; a step in which the server authenticates the wireless LAN client which has requested the connection service and requests the wireless LAN access point to accept the wireless LAN client; a step in which the wireless LAN access point permits the server to accept the wireless LAN client; a step in which the server notifies an acceptance permission of the wireless LAN access point of the wireless LAN client; and a step in which the wireless LAN client connects to the wireless LAN access point.

Description

  The present invention relates to a wireless LAN (IEEE 802.11 series) connection method. The wireless LAN is standardized as the IEEE 802.11 series. The series includes IEEE802.11a / b / g / n, etc., but these differences are differences in the frequency band and modulation method used, resulting in different transmission rates (Non-Patent Document 1).

  In order for a wireless LAN client to connect to a wireless LAN access point, the wireless LAN client must know the ESSID and encryption key in advance, and in some cases, register a MAC address in the wireless LAN access point. (If MAC address filtering is used).

  Some services called public wireless LAN services notify the user in advance of the ESSID and encryption key, and when the wireless LAN client connects to the wireless LAN access point, further web authentication is performed. is there. In some cases, encryption is not performed, ESSID is released (broadcast in non-stealth mode), anyone can freely connect to a wireless LAN access point, and Internet access is performed by Web authentication as described above. There are also things to do.

  In addition, mobile phones such as smartphones are equipped with a wireless LAN function in addition to a communication (voice communication or packet communication) function using a dedicated line (the CDMA-2000 or WCDMA system is currently used in the third-generation mainstream). There are many. Similarly, some personal computers and the like have a function of connecting to a mobile phone network (there is also WiMAX other than CDMA-2000 and WCDMA systems) in addition to the wireless LAN function.

IEEE 802.11 IEEE Computer Society IEEE802.1X IEEE Computer Society

  Consider a case where a mobile phone such as a smartphone and a client terminal such as a personal computer have a function of connecting to a mobile phone network and a wireless LAN. The mobile phone network generally has a wide coverage area and can communicate in almost any place. On the other hand, although the wireless LAN has a higher communication speed than the mobile network, it can be connected only near the place where the access point is installed (at most within about 100 m). From the viewpoint of communication speed and efficient use of the wireless band, it is considered better to connect to the wireless LAN if it can be connected to both the cellular phone network and the wireless LAN.

  For example, when a client can set a wireless LAN, such as at home, the connection switching from the cellular phone network to the wireless LAN can be automatically performed. However, in order to connect to a public wireless LAN, in many cases, the user must enter a user ID and password on the Web screen. Furthermore, even if there is a wireless LAN access point that is not a public wireless LAN but is installed personally, it cannot be used without permission. As a client authentication technique, there is a method standardized as IEEE 802.1X. This is a method in which a general authentication server such as RADIUS is used to determine whether the client is a correct user before the connection procedure to the wireless LAN and to issue an encryption key. However, since this method cannot authenticate the wireless LAN access point, it is difficult to use IEEE 802.1X at a wireless LAN access point that is not installed by a communication carrier such as a private house.

  Therefore, the present invention provides a connection method, a wireless LAN client, and a wireless LAN access point that can connect to any nearby wireless LAN access point and that can be realized without performing user authentication via the Web. For the purpose. Also, the installer of the wireless LAN access point can provide wireless LAN connectivity to others and receive payment from the mobile phone operator without special registration in advance.

  In order to achieve the above object, a wireless LAN connection method according to the present invention includes a first connection means for communicating with a wireless LAN access point in a wireless LAN, and a second connection means for communicating with a server. In a wireless LAN system comprising a client, a wireless LAN access point having server connection means for communicating with the server, and a server having network connection means for communicating with the wireless LAN access point and the wireless LAN client, A wireless LAN connection method for the wireless LAN client to connect to the wireless LAN access point, wherein the wireless LAN access point advertises provision of a connection service, and the wireless LAN that has received the advertisement The second client A connection requesting step of requesting the connection service to the server by connection means; and an acceptance requesting the wireless LAN access point to accept the wireless LAN client by authenticating the wireless LAN client that has made the request. A request step, an acceptance permission step in which the wireless LAN access point permits the server to accept the wireless LAN client, and the server notifies the wireless LAN client of permission to accept the wireless LAN access point. A connection request response step, and a connection step in which the wireless LAN client connects to the wireless LAN access point.

  In the acceptance requesting step, after authenticating the wireless LAN client, the server confirms the provision of a connection service to the wireless LAN access point, and the wireless LAN access point connects the server to the server. It is also preferable to further include a response step of authenticating with a public key and responding with confirmation of the provision of the connection service.

  Further, after the connection step, the wireless LAN client further includes a connection completion step of connecting to the server by the first connection means and notifying the server of completion of connection with the wireless LAN access point. Is also preferable.

  The wireless LAN client transmits a confirmation random number to the server in the connection request step and the connection completion step, and the server transmits the confirmation random number and the connection completion step transmitted in the connection request step. It is preferable that the method further includes a step of comparing the transmitted confirmation random numbers.

  The wireless LAN access point performs the advertisement using an ESSID including an IP address and a port number of the server connection means in the advertisement step, and the wireless LAN client performs the connection request step or the confirmation step. The IP address and the port number are transmitted to the server, and the server preferably connects to the wireless LAN access point using the IP address and the port number in the acceptance request step.

  In the acceptance requesting step, the server preferably performs the authentication with the user name and password of the wireless LAN client or a certificate.

  The wireless LAN access point transmits an ESSID, a wireless LAN encryption key, and an encryption type for wireless LAN connection to the server in the acceptance permission step, and the server transmits the ESSID in the connection request response step. , Notifying the wireless LAN client of the wireless LAN encryption key and the encryption type, and the wireless LAN client uses the ESSID, the wireless LAN encryption key and the encryption type in the connection step, It is also preferable to connect to.

  Also, the wireless LAN client transmits the MAC address of the first connection means in the connection request step, the server transmits the MAC address in the acceptance request step, and the wireless LAN access point It is also preferable to register the MAC address in the acceptance permission step.

  In addition, communication from the server to the wireless LAN access point is encrypted with the public key of the server, and communication from the wireless LAN access point to the server is encrypted with the secret key of the server. preferable.

  The second connection means is preferably means for connecting to a mobile phone network, and the server connection means and the network connection means are preferably means for connecting to the Internet.

  In order to achieve the above object, a wireless LAN client according to the present invention comprises first connection means for communicating with a wireless LAN access point over a wireless LAN, and second connection means for communicating with a server. 1 connection means receives a connection service providing advertisement from the wireless LAN access point, the second connection means requests the server for the connection service, and the second connection means receives the connection service from the server. An acceptance permission is received, and the first connection means connects to the wireless LAN access point.

  In order to achieve the above object, a wireless LAN access point according to the present invention comprises server connection means for communicating with a server and wireless LAN connection means, advertises provision of a connection service through the wireless LAN connection means, and connects the connection. A request from the wireless LAN client that received the service is received from the server by the server connection means, and an acceptance permission of the wireless LAN client is transmitted to the server, and the wireless LAN connection means sends the request to the wireless LAN client. Provide connection services.

  According to the present invention, it becomes possible for a client to connect to an unknown wireless LAN access point without performing a password or the like via the Web without prior knowledge about the wireless LAN access point. In this case, it is not necessary to modify the low level (MAC layer) of the wireless LAN.

  In addition, the installer of the wireless LAN access point does not need to have a contract with the communication carrier in advance. Furthermore, the installer of the wireless LAN access point does not need to register information (IP address, port number, ESSID, encryption key) in advance with the communication carrier.

  In addition, a mobile phone carrier (server installer) can collect information for paying for the wireless LAN access point accommodating the client.

2 shows an example of a network configuration of the present invention. The block diagram of AP of this invention, a client, and a server is shown. The sequence at the time of client connection is shown.

  The best mode for carrying out the present invention will be described in detail below with reference to the drawings. FIG. 1 shows an example of the network configuration of the present invention. The present invention includes a wireless LAN access point 1 (hereinafter referred to as AP) and a wireless LAN client 2 (hereinafter referred to as client) in the same manner as a normal wireless LAN mechanism. The present invention further includes a server 3, a NAT router 4, and a mobile phone base station 5.

  FIG. 2 shows a block diagram of the AP, client and server of the present invention. FIG. 2 a shows a block diagram of AP 1, which includes a wireless LAN connection unit 11, a server connection unit 12, and a service information holding unit 13.

The wireless LAN connection unit 11 is a unit that connects to the client 2 via a wireless LAN, and the server connection unit 12 is a unit that connects to the server 3 via the Internet. The service information holding unit 13 is information held by the AP 1 in order to provide the connection method of the present invention,
・ ESSID
-Encryption key / Service information-Service name-Server public key,
-AP identifier (identifier allocated from the server)
-Information necessary to receive payment (account number, etc.)
-Global IP address that can be reached by itself-Port number-Maximum number of users-Maximum connection time-Client list-Holds MAC address and connection start time.

  The client list of AP1 manages clients that are currently connected. The maximum number of users and the maximum connection time indicate the number of clients that can be added to the client list and the time until each client expires. This list is used to delete MAC address filtering (when a list entry expires, the corresponding entry of MAC address filtering is deleted at the same time, and a client having the MAC address is disconnected). Therefore, when MAC address filtering is not used, setting of the client list, maximum number, and connection time makes little sense.

  FIG. 2 b shows a block diagram of the client 2, and the client 2 includes a wireless LAN connection unit 21, a mobile phone network connection unit 22, and a server information holding unit 23.

  The client 2 is assumed to have a mobile phone network connection unit 22 which is a connection function to a mobile phone network (mobile network) in addition to the wireless LAN connection unit 21 which is a connection function to the wireless LAN. What is important is that it has a means for communicating with the server 3 completely independently of the AP 1 to be connected. In the present invention, it is a mobile network.

The server information holding unit 23
-User name-Password-Service name-Server address (server IP address)
-Server port (server port number)
• Holds the server's public key.

  FIG. 2 c shows a block diagram of the server 3, which includes a network connection unit 31, a client information holding unit 32, and a billing information database 33.

  The network connection unit 31 is connected to the Internet, and can communicate with the AP 1 and the client 2 via the network connection unit 31. In particular, it is possible to connect to the AP 1 directly or via the NAT router 4.

The client information holding unit 32 of the server 3
-Client information-User name, password-Random number for confirmation (Information for confirming that connection is completed)
Holding.

  The NAT router 4 refers to a gateway router of the network where the AP 1 is installed, and is, for example, a broadband router installed at home. Note that the presence of the NAT router 4 is not essential for the present invention (not necessary if the AP 1 has a global address). When the NAT router 4 is installed, it is assumed that the network in which the AP 1 is installed has a private address, and the NAT router 4 has an address conversion function such as NAT and NAPT. Accordingly, a global address (Internet side) and a private address (AP side) are set in the NAT router 4, and “a global IP address that can be reached by AP 1” indicates a global address of the NAT router 4. Further, the NAT router 4 can set to which host on the private address side a packet addressed to the global address on the Internet side is forwarded for each destination port number by the port mapping function. In the present invention, this port mapping function can be controlled by a UPnP message (Universal Plug and Play message) sent from the network on the private address side. Further, it is assumed that the AP 1 can know the global address of the NAT router 4 using the UPnP message. Of course, the port mapping and the global address may be manually acquired from the NAT router 4 and set in the AP 1.

  The mobile phone base station 5 is a base station for the mobile phone network connection unit 22 of the client 2 to connect to the mobile network. This base station is connected to the Internet, and allows the client 1 to connect to the server 3 via the mobile network.

  A relationship between the communication carrier, the client, and the AP will be described. The communication carrier refers to, for example, a carrier that provides a mobile phone service or a public wireless LAN. The client subscribes to at least one company's service. Even if you have subscribed to the services of multiple companies, the service of any one company will be used below.

  In the present invention, various clients connect to the AP. However, not all clients are allowed to connect indefinitely. The AP administrator decides in advance a communication carrier that is allowed to accept, and only clients who subscribe to the service of that carrier are allowed to access that AP. Enable connection. Furthermore, in the present invention, it is assumed that the AP that accommodates the client pays the consideration from the telecommunications carrier to which the client subscribes (whether or not to actually charge, flat rate system, pay-per-use system, etc.) Billing methods are outside the scope of the present invention).

  It is determined by the service information which communication carrier's client accepts the AP. In other words, the AP administrator keeps in mind that the service name (ID for identifying the carrier) of the carrier that permits acceptance and information necessary for receiving payment (direct transfer to the bank account) Then, the account number and card number are set in advance in the AP, and the AP manager may be a subscriber number if the AP manager is also a user of the carrier. In order to simplify the processing at the second and subsequent accesses, an identification number is issued from the server (communication carrier) at the first access from the AP, and this is also recorded in the service information. A set of a plurality of service names or the like can be set in the service information. In this case, an ESSID and an encryption key (including an encryption method) can be set for each service name. As the service name, it is also possible to set a service name for a service as an AP that does not belong to any communication carrier (that is, a stand-alone).

  The AP administrator does not need to make a contract with the communication carrier in advance, and only exchanges necessary information every time a client is accepted. However, it is necessary to determine in advance which carrier's clients will be provided with wireless LAN connectivity, and in order to do so, the service name and the public key of the server must be obtained. (For example, a telecommunications carrier may upload these information on a homepage and download and set these information from a telecommunications carrier desired by the AP administrator).

  When the client wants to use the wireless LAN connection service according to the present invention, it is necessary for the client to know the service name of the telecommunications carrier to which the client subscribes, the IP address of the server, and the port number of the server.

  FIG. 3 shows a sequence at the time of client connection. With reference to this figure, the client connection procedure is shown below. As described above, it is assumed that the AP has a global address or knows port mapping information (NAT router global address and port number) for reaching the AP from the Internet side.

(1) Advertising First, the AP periodically advertises that it provides a connection service. In the present invention, advertisement is performed using ESSID as follows. As described above, it is assumed that the AP can hold and advertise a plurality of ESSIDs.

  The ESSID that the AP uses for advertisement includes a service, a global IP address, and a listening port number. For example, “SERVICE: 100.99.98.97: 1234”. This ESSID consists of three parts separated by a semicolon. The first SERVICE is a character string indicating that a service according to the present invention is provided, and is commonly known by all APs and clients (may be another character string, of course). The second is a global IP address that can reach the AP, and the third is the listening port number of the AP. In the above example, the server can cause the packet to reach the AP by transmitting the packet to the destination address 100.99.98.97 and the destination port 1234.

(2) Connection Registration Request A client that has received an advertisement from an AP sends a connection registration request message to the server and requests setting so that the client can connect to the AP. However, for example, if the advertisement is from an AP whose connection is permitted in advance by a known AP such as a home AP, the subsequent procedure is unnecessary, and a normal connection defined by IEEE 802.11 or the like may be performed. If it is not a known AP, a registration request message is sent to the server via the mobile network. The connection registration request message includes the following information.
・ User name ・ Password ・ Service name ・ MAC address ・ AP address ・ AP port number ・ Random number for confirmation

  The user name and password are information registered by the client with the communication carrier, and may be any information that allows the communication carrier (server) to correctly identify the client. Therefore, for example, a certificate may be used instead of the user name and password. The server (communication carrier) first checks whether the client subscribes to the wireless LAN connection service of the present invention.

  The service name is checked by the server, and if it is an invalid service name (a character string not specified by the carrier), the request is discarded (a connection registration failure message is returned to the client, and the procedure is Exit).

  The MAC address is the MAC address of the wireless LAN interface of the client, and is stored as it is in the “accept request” sent from the server to the AP in a later procedure. At this point, these pieces of information are not particularly processed.

  The AP address and the AP port number are information included in the advertisement (1).

  The confirmation random number is information used in a later registration completion message ((7) in FIG. 3). The server registers this confirmation random number in the corresponding client information.

  The connection request ((2) in FIG. 3) to the connection registration response ((5) in FIG. 3) is one session, and the server manages to which client the connection registration response message should be returned. I have to leave. The client must retain the AP address, the AP port number, the confirmation random number, the AP identification number acquired later, and the like until disconnected from the AP.

(3) AP registration request / AP registration response In the present invention, it is assumed that payment is made from the communication carrier to the AP administrator who provided the wireless LAN connection (whether or not the payment is actually made depends on the present invention). Is out of range). Therefore, the telecommunications carrier must confirm whether the AP is correctly recognized and whether the wireless LAN connection is actually provided correctly. The AP registration request / AP registration response ((3a) and (3b) in FIG. 3) is a message for realizing this.

(3a) AP registration request The server transmits an AP registration request message with the AP address and AP port number as the destination address and destination port in the connection registration request message received from the client. The AP registration request message includes the following information.
-Service name-Server certificate (confirm with server public key)

  The service name is an identifier for identifying the communication carrier. The AP confirms whether the corresponding service name exists from the service information. If the AP does not exist, the AP does not provide wireless LAN connectivity to the client of the carrier, and therefore returns “connection rejection” in the AP registration response.

  The server certificate is used for confirming whether the AP registration request message is sent from a real server. The AP confirms the server certificate, and if it is correct, proceeds with the subsequent procedures. If it is invalid, no further processing is performed (no response is returned).

(3b) AP registration response Next, the AP sends an AP registration response message to the server in order to register its information with the server. The AP registration response message includes the following information.
・ Encryption with status server public key-AP identification number (leave it empty if you do not have one)
-ID required to receive payment

  The status is a status code indicating whether the registration request is accepted or rejected. In the case of rejection, it is not necessary to store the subsequent information.

  The AP identification number and ID information necessary for receiving payment are collectively encrypted with the server's public key (held in advance by the AP). Since the server has a corresponding private key, it can be decrypted. This prevents the ID information from leaking to an unauthorized server.

  The AP identification number is information included in an acceptance request described later. That is, when there is an AP registration request for the second time or more from the same communication carrier, it is possible to simplify the server searching for information on the AP by adding the AP identification number.

  The ID necessary for receiving the payment is information necessary for the AP administrator to actually receive the payment, as described in (2). The server registers this information in the accounting database. If it is a new registration (AP identification number is empty), a new AP identification number is issued (if the AP identifier facilitates access to the entry, such as the entry number of the accounting database) Good).

(4) Acceptance request / acceptance permission (acceptance rejection)
(4a) Acceptance request The server sends an acceptance request message to the AP detected by the client. An AP address and an AP port number are designated as the destination of this message. The acceptance request message includes the following information.
・ Encryption with service name and server secret key -AP identification number -MAC address

  The server encrypts the AP identifier and the MAC address in the acceptance request message together with a secret key. The AP that has received the acceptance request message first checks the service name, decrypts the part encrypted with the public key of the corresponding server, and obtains the AP identification number and MAC address. The fact that the message was correctly decoded indicates that the message was sent from the correct server. If the server is invalid (it could not be decrypted correctly), the message is discarded (no response is sent).

  If the AP identification number is not registered, the AP registers it in association with the corresponding service name in the service information.

  Next, the AP sets the acquired MAC address in MAC address filtering (permission) (of course, MAC address filtering need not be set). Further, the MAC address and the current time are registered as new clients in the client list (only the time is updated if there is a duplicate).

(4b) Acceptance acceptance (acceptance rejection)
Then, the AP responds to the server with an acceptance permission message. The acceptance permission message includes the following information.
-Encryption with status server public key-AP identification number-ESSID
-Wireless LAN encryption key information (type of encryption method and encryption key)
-Maximum connection time-IP address

  The status is a status code indicating whether the client is accepted or rejected (and the reason). In the case of rejection, only the IP address is stored among the subsequent information.

  Information other than the status is collectively encrypted with the server's public key (which the AP should have in advance). Since the server has a corresponding private key, it can be decrypted. This prevents information from leaking unnecessarily. Among the obtained information, the ESSID, the encryption key information, and the maximum connection time are stored as they are in the next connection registration response message. The IP address is a destination address of the connection registration response message.

  If the maximum number of clients are registered in the client list and cannot be accepted any more, an acceptance rejection message is returned to the server. Only the IP address is stored in the acceptance rejection message.

(5) Connection Registration Response When the server receives an acceptance permission message from the AP, the server returns the content as a connection registration response to the client via the mobile network. If the server manages the session correctly, it should know which client to send the connection registration response message to. The registration response message includes the following information.
・ Status ・ AP identification number ・ ESSID
・ Wireless LAN encryption key information ・ Maximum connection time

  The status is a status code indicating whether or not the AP has accepted the connection. When the AP is rejected, information after the ESSID is not stored.

  The client connects to the AP using the obtained ESSID and encryption key. Further, the AP identification number is retained until disconnected from the AP.

(6) Wireless LAN connection Connection to the AP is performed according to a normal procedure defined by IEEE 802.11 or the like.

(7) Connection completion When the connection to the AP is completed, the client sends a connection completion message to the server via the AP. The connection completion message includes the following information.
-Encryption with server public key-User ID
-AP identification number-Random number for confirmation

  The above message is encrypted with the public key of the server. Therefore, only correct servers can be decrypted.

  Since the confirmation random number is information exchanged via the mobile network in the connection registration request message (2), the AP should not know it.

  The server checks the client information based on the user ID and checks whether the received confirmation random number is equal to the confirmation random number already registered in the client information. If they are equal, it can be confirmed that the AP of the AP identification number has correctly provided the wireless LAN connection, and charging is started (the connection start time and the like are registered in the charging database).

(8) Leave from AP When a client leaves a connected AP, that is, when the connection with the AP is disconnected and another AP or mobile communication network is connected, the client notifies the AP via the server to that effect. .
The connection release request message from the client to the server includes the following information.
-MAC address-Service name-AP address-AP port number-AP identifier

  These pieces of information are the same as those used when sending the connection registration request message. Therefore, as described above, the AP address, AP port number, and AP identifier information must be retained until the connection release is completed (or until another AP is connected).

  The server receiving this information records that the connection is completed in the entry for the corresponding AP in the accounting database.

(8) Release request The release request message from the server to the AP includes the following information.
・ Encryption with service name and server secret key-MAC address

  The AP acquires the server's public key based on the service name, and decrypts the code using it. If the decryption is successful, the MAC address is obtained. Therefore, the corresponding MAC address entry is deleted from the client list, and the MAC address filtering entry is also deleted.

  Even if the registration deletion procedure is not performed, each entry of the client list is expired in a certain time, so that the entry does not remain forever (Be sure to delete an entry from the client list. Delete entries from MAC address filtering as well).

When performing reconnection (connection update) The client can update the connection by performing the connection procedure again before the maximum connection time specified in the connection registration response message has passed since the start of connection (reconnecting at any timing) Is optional).

  Moreover, all the embodiments described above are illustrative of the present invention and are not intended to limit the present invention, and the present invention can be implemented in other various modifications and changes. Therefore, the scope of the present invention is defined only by the claims and their equivalents.

1 Wireless LAN access point (AP)
DESCRIPTION OF SYMBOLS 11 Wireless LAN connection part 12 Server connection part 13 Service information holding part 2 Wireless LAN client (client)
DESCRIPTION OF SYMBOLS 21 Wireless LAN connection part 22 Mobile telephone network connection part 23 Server information holding part 3 Server 31 Network connection part 32 Client information holding part 33 Accounting information database 4 NAT router 5 Mobile telephone base station

Claims (12)

A wireless LAN client having a first connection means for communicating with a wireless LAN access point in a wireless LAN, and a second connection means for communicating with a server;
A wireless LAN access point having server connection means for communicating with the server;
A server having network connection means for communicating with the wireless LAN access point and the wireless LAN client;
In a wireless LAN system comprising:
A wireless LAN connection method for the wireless LAN client to connect to the wireless LAN access point,
An advertising step in which the wireless LAN access point advertises provision of a connection service;
The wireless LAN client that has received the advertisement makes a connection request step for requesting the connection service to the server by the second connection means;
An acceptance request step for authenticating the wireless LAN client making the request and requesting the wireless LAN access point to accept the wireless LAN client;
An acceptance permission step in which the wireless LAN access point allows the server to accept the wireless LAN client;
A connection request response step in which the server notifies the wireless LAN client of acceptance of the wireless LAN access point;
A connection step in which the wireless LAN client connects to the wireless LAN access point;
A wireless LAN connection method comprising: In the acceptance request step, after authenticating the wireless LAN client,
A confirmation step in which the server confirms the provision of a connection service to the wireless LAN access point;
A response step in which the wireless LAN access point authenticates the server with the public key of the server and responds with confirmation of provision of the connection service;
The wireless LAN connection method according to claim 1, further comprising: After the connecting step,
The wireless LAN client further includes a connection completion step of connecting to the server by the first connection means and notifying the server of completion of connection with the wireless LAN access point. The wireless LAN connection method according to 2. The wireless LAN client transmits a confirmation random number to the server in the connection request step and the connection completion step,
4. The wireless LAN connection method according to claim 3, further comprising the step of comparing the confirmation random number transmitted in the connection requesting step with the confirmation random number transmitted in the connection completion step. The wireless LAN access point performs the advertisement using an ESSID including an IP address and a port number of the server connection means in the advertisement step,
The wireless LAN client transmits the IP address and the port number to the server in the connection request step,
5. The server according to claim 1, wherein the server connects to the wireless LAN access point using the IP address and the port number in the acceptance requesting step or the confirmation step. 6. Wireless LAN connection method.   The wireless LAN connection method according to any one of claims 1 to 5, wherein the server performs the authentication with a user name and password of the wireless LAN client or a certificate in the acceptance requesting step. . The wireless LAN access point transmits an ESSID, a wireless LAN encryption key, and an encryption type for wireless LAN connection to the server in the acceptance permission step,
In the connection request response step, the server notifies the wireless LAN client of the ESSID, the wireless LAN encryption key, and the encryption type,
The wireless LAN client connects to the wireless LAN access point using the ESSID, the wireless LAN encryption key, and the encryption type in the connection step, according to any one of claims 1 to 6. The wireless LAN connection method described. The wireless LAN client transmits the MAC address of the first connection means in the connection request step;
The server sends the MAC address in the accept request step;
The wireless LAN connection method according to claim 1, wherein the wireless LAN access point registers the MAC address in the accepting permission step. Communication from the server to the wireless LAN access point is encrypted with the public key of the server,
The wireless LAN connection method according to any one of claims 1 to 8, wherein communication from the wireless LAN access point to the server is encrypted with a secret key of the server. The second connection means is means for connecting to a mobile phone network;
10. The wireless LAN connection method according to claim 1, wherein the server connection unit and the network connection unit are units for connecting to the Internet. First connection means for communicating with a wireless LAN access point over a wireless LAN;
A second connection means for communicating with the server;
The first connection means receives an advertisement for providing a connection service from the wireless LAN access point, the second connection means requests the connection service from the server, and the second connection means The wireless LAN client receives an acceptance permission from the server and connects to the wireless LAN access point by the first connection means. Server connection means for communicating with the server;
Wireless LAN connection means;
The wireless LAN connection means advertises the provision of a connection service, receives a request from the wireless LAN client that has received the connection service from the server, and grants permission to accept the wireless LAN client. The wireless LAN access point transmits to the server, and the wireless LAN connection means provides a connection service to the wireless LAN client.

Images