JP2012138863A - Network system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network system which can efficiently perform authentication of a terminal even when an AAA server malfunctions or stops in a network comprising a plurality of terminals.SOLUTION: A network system 10 comprises an AAA server 16, and base stations 14a, 14b and 14c wirelessly connected with a terminal 12. An overlay network 18 is formed by the AAA server 16 and base stations 14a, 14b and 14c. The base stations 14a, 14b and 14c has: distributed hash tables 20a, 20b and 20c storing an identification code of the terminal 12; an operation monitoring unit 24 for monitoring an operational state of the AAA server 16; and a terminal authentication unit 26 which starts up based on a monitoring result of the operation monitoring unit 24 for performing authentication of the terminal 12 by referring to the distributed hash tables 20a, 20b and 20c.

Description

  The present invention relates to a network system including an AAA server and a plurality of base stations.

  A user who uses a network connection service generally needs to connect to a network by wireless connection from a terminal to a base station. Upon receiving a network entry request from a terminal, the base station makes an authentication request for the terminal to an AAA (Authentication Authorization Accounting) server connected on the network. When the terminal is authenticated by the AAA server, the user can use the network connection service.

  However, if the AAA server on the network fails, the desired user of the network service cannot enter the network from the terminal to the base station after the failure, and cannot use the network service until the AAA server is restored. .

  As a system that considers such a failure of the AAA server, there is a wireless LAN system disclosed in Patent Document 1. In this system, when a failure occurs in the authentication server, authentication based on the MAC address of the terminal is performed at the access point. Patent Document 1 also describes a case where there are two access points.

JP 2001-111544 A

  However, in the system disclosed in Patent Document 1, each access point needs to have a table of MAC addresses of all terminals used by the user. In reality, the MAC address table is related to the amount of data. It is difficult to prepare.

  Further, in Patent Document 1, when each access point performs authentication based on a MAC address, information in the MAC address table is not exchanged between the access points. For this reason, since the MAC address table is not updated after a failure occurs in the authentication server, the MAC addresses of all terminals are included in the MAC addresses that each access point has immediately before the failure. If not, a problem may occur during handover. That is, in a neighboring access point, when a terminal connected to one access point hands over to the other access point, the MAC address of the terminal is not included in the MAC address table of the other access point Then, handover of the terminal is not permitted.

  The present invention has been made in consideration of the above-described problems, and can efficiently perform terminal authentication even when an abnormality occurs or stops in an AAA server in a network having a large number of terminals. An object is to provide a possible network system.

  The network system according to the present invention includes an AAA (Authentication Authorization Accounting) server and a plurality of base stations. Each base station is wirelessly connected to a terminal, and an overlay network is formed by the AAA server and each base station. Each base station is formed with a distributed hash table in which an identification code of the terminal is stored;

  An operation monitoring unit that monitors an operation state of the AAA server, and a terminal authentication unit that is activated based on a monitoring result of the operation monitoring unit and authenticates the terminal with reference to the distributed hash table. Features.

  In the network system, billing information of the terminal connected to each base station is stored in the distributed hash table.

  In the network system, the AAA server collects charging information stored in the distributed hash table.

  In the network system, each base station has a shared key necessary for authentication of the terminal by the terminal authentication unit and storage of charging information in the distributed hash table.

  In the network system, a new base station has a shared key necessary for participating in the overlay network.

  According to the network system of the present invention, each base station activates the terminal authentication unit based on the monitoring result of the AAA server, and authenticates the terminal with reference to the distributed hash table in which the terminal identification code is stored. As a result, even when an abnormality occurs or stops in the AAA server in a network having a large number of terminals, the terminals can be efficiently authenticated.

  Further, the charging information of the terminal is stored in the distributed hash table, and the AAA server collects the charging information stored in the distributed hash table, so that the AAA server can be operated even when an abnormality occurs or stops. Billing information until recovery can be collected.

  Furthermore, each base station has a shared key required for terminal authentication by the terminal authentication unit and storage of billing information in the distributed hash table, or a new base station other than each base station enters the overlay network. By having a shared key necessary for participation, security for a third party can be ensured.

It is explanatory drawing of the network system which concerns on embodiment of this invention. It is explanatory drawing of a structure of a base station. It is explanatory drawing of a structure of an AAA server. It is explanatory drawing of an identification code table. 5A is an explanatory diagram of the distributed hash table, FIG. 5B is an explanatory diagram of the distributed hash table, and FIG. 5C is an explanatory diagram of the distributed hash table. It is a flowchart for demonstrating operation | movement of a network system.

  Embodiments of the present invention will be described below with reference to the drawings. 1 is an explanatory diagram of the network system 10, FIG. 2 is an explanatory diagram of the configuration of the base station 14a, FIG. 3 is an explanatory diagram of the configuration of the AAA server 16, and FIG. 4 is an identification code table. 38 is an explanatory diagram of the distributed hash table 20a, FIG. 5B is a distributed hash table 20b, and FIG. 5C is an explanatory diagram of the distributed hash table 20c.

  The network system 10 includes terminals (MS) 12a to 12e (hereinafter also referred to as terminals 12) which are computers or mobile phones having a communication function, base stations 14a to 14c to which the terminals 12a to 12e are wirelessly connected, and an AAA server. 16, and the base stations 14 a to 14 c and the AAA server 16 form an overlay network 18. The terminals 12a, 12b, and 12c are wirelessly connected to the base station 14a, the terminal 12d is wirelessly connected to the base station 14b, and the terminal 12e is wirelessly connected to the base station 14c. The network system 10 includes terminals 12a to 12e and base stations 14a to 14c, but the number of terminals and base stations is not limited to these.

The base station 14a has a distributed hash table (DHT: Distributed) in which an identification code for receiving authentication when the terminal 12 is a network entry and charging information are stored.
Hash Table) 20a, a table management unit 22 that manages the distributed hash table 20a, an operation monitoring unit 24 that monitors the operation state of the AAA server 16 (Keep Alive), and EAP authentication (Extensible at the time of network entry of the terminal 12) A terminal authentication unit 26 that performs authentication protocol authentication, a charging information management unit 28 that manages charging information for the terminal 12, and a charging information recording unit 30 that records the charging information managed by the charging information management unit 28. With. The billing information includes a billing ID that is an identification code of the terminal 12, and access information regarding the access time of the terminal 12, the amount of packets transmitted and received by the terminal 12, and the like. In the terminal authentication unit 26, the same server certificate as that of the AAA server 16 is recorded. Furthermore, the base station 14 a has a shared key that cannot be known by a third party in order to form the overlay network 18. The base stations 14b to 14c have the same configuration as the base station 14a. However, the base station 14b corresponds to the distributed hash table 20b (FIG. 5B) and the base station 14a corresponding to the distributed hash table 20a (FIG. 5A). Each station 14c has a distributed hash table 20c (FIG. 5C).

  The AAA server 16 includes a terminal authentication unit 32 that performs EAP authentication of the terminal 12, a service approval unit 34 that performs authorization of a service provided to the terminal 12, and an accounting unit 36 that manages accounting information of the terminal 12. Prepare.

  The terminal authentication unit 32 includes an identification code table 38. In the identification code table 38, a connection ID and a password that are identification codes of the terminal 12 are recorded. Here, the connection ID of the terminal 12a is Ia, the password is Pa, the connection ID of the terminal 12b is Ib, the password is Pb, and similarly, the connection IDs of the terminals 12c, 12d, and 12e are Ic, Id, and Ie. The passwords are Pc, Pd, and Pe.

  As will be described later, the connection ID and password in the identification code table 38 are transmitted (put) to the overlay network 18 and stored in the distributed hash tables 20a, 20b, and 20c. A hash space corresponding to a key obtained by hashing the connection ID which is InnerNAI is assigned to each of the base stations 14a, 14b and 14c. The connection hash IDs of the terminals 12a and 12d are assigned to the distributed hash table 20a of the base station 14a, and the connection IDs of the terminals 12b and 12e are assigned to the distributed hash table 20b of the base station 14b. The connection hash ID of the terminal 12c is assigned to the distributed hash table 20c. In each of the distributed hash tables 20a, 20b, and 20c, a connection ID hashed as a key and a password as a value are stored. Here, the connection ID of the terminal 12a is Ia, the password is Pa, the connection ID of the terminal 12b is Ib, the password is Pb, and similarly, the connection IDs of the terminals 12c, 12d, and 12e are Ic, Id, and Ie. The passwords are Pc, Pd, and Pe.

  In addition, a hash space corresponding to a key obtained by hashing a charging ID that is an OuterNAI is also assigned to each of the base stations 14a, 14b, and 14c. The charging IDs of the terminals 12a and 12d are assigned to the distributed hash table 20a of the base station 14a, and the charging IDs of the terminals 12b and 12e are assigned to the distributed hash table 20b of the base station 14b. The charging ID of the terminal 12c is assigned to the distributed hash table 20c. In each of the distributed hash tables 20a, 20b, and 20c, a billing ID hashed as a key and access information as a value are stored. Here, the charging ID of the terminal 12a is Xa, the access information is Aa, the charging ID of the terminal 12b is Xb, the access information is Ab, and similarly, the charging IDs of the terminals 12c, 12d, and 12e are Xc, Xd, Xe and each access information are Ac, Ad, and Ae.

  Next, the operation of the network system 10 will be described with reference to FIG. FIG. 6 is a flowchart for explaining the operation of the network system 10. In the following, the description will be focused on the operation of the base station 14a. However, the base stations 14b and 14c operate in the same manner as the base station 14a, and thus the description thereof is omitted.

  In the network system 10, first, the terminal authentication unit 32 hashes the connection ID and password, which are identification codes in the identification code table 38, and puts them into the overlay network 18 (step S1). The connection ID and password put in the overlay network 18 are stored in the distributed hash tables 20a, 20b, and 20c based on the hash space assigned to the base stations 14a, 14b, and 14c (see FIGS. 5A to 5C). Step S2).

  Next, the operation monitoring unit 24 of the base station 14a monitors the operation state of the AAA server 16 (step S3). Specifically, the operation monitoring unit 24 polls the AAA server 16 regarding the operation state. As a result of monitoring by polling, if it is confirmed that the AAA server 16 is operating normally, the monitoring of the AAA server 16 is continued (YES in step S3).

  On the other hand, in the monitoring by polling, if the operation monitoring unit 24 does not receive a response for a predetermined time or more from the AAA server 16, it is determined that an abnormality has occurred or has stopped in the AAA server 16, and that is the terminal authentication. Is notified to the unit 26 and the billing information management unit 28 (NO in step S3).

  Upon receiving the notification, the terminal authentication unit 26 and the billing information management unit 28 activate the authentication function of the terminal 12 and the function related to the billing information (step S4). After an abnormality or the like occurs in the AAA server 16, the accounting information of the terminal 12 is not recorded by the AAA server 16. Correspondingly, the charging information management unit 28 records the charging information of the wirelessly connected terminal 12 a in the charging information recording unit 30. Similarly, the charging information management unit 28 of the base station 14b records the charging information of the terminal 12d, and the charging information management unit 28 of the base station 14c records the charging information of the terminal 12e.

  The billing information management unit 28 of the base station 14a periodically sends the billing information stored in the billing information recording unit 30 to the DHT management unit 22, and the DHT management unit 22 hashes the received billing information to generate an overlay. Put to network 18. The accounting information put to the overlay network 18 is stored in the distributed hash tables 20a, 20b, 20c via the DHT management units 22a, 22b, 22c based on the hash space assigned to the base stations 14a, 14b, 14c. (See FIGS. 5A-5C).

  After an abnormality or the like occurs in the AAA server 16, even if the terminals 12b and 12c desire a network entry for the base station 14a, the network entry by the AAA server 16 is not performed. Therefore, the terminal authentication unit 26 authenticates the terminals 12b and 12c.

  The connection ID and password are transmitted from the terminal 12b to the DHT management unit 22 via the terminal authentication unit 26, and the DHT management unit 22 executes a get command with the connection ID as an argument. Here, it is assumed that the regular connection ID and password are transmitted from the terminal 12b, the connection ID is Ib, and the password is Pb.

  Since Ib which is the connection ID is stored in the distributed hash table 20b of the base station 14b, the DHT management unit 22 of the base station 14b reads Pb which is a value corresponding to Ib which is the connection ID from the distributed hash table 20b. Is transmitted to the DHT management unit 22 of the base station 14a. The DHT management unit 22 of the base station 14a transmits the acquired value Pb to the terminal authentication unit 26, and the terminal authentication unit 26 collates the transmitted value with the password transmitted from the terminal 12b. As a result of the collation, the network entry of the terminal 12b is recognized because they match. On the other hand, when a connection ID and password different from the regular connection ID and password are transmitted from the terminal 12b to the terminal authentication unit 26, the terminal authentication unit 26 rejects the network entry of the terminal 12b.

  Similarly to the case of the terminal 12b, when a regular connection ID and password are transmitted from the terminal 12c to the terminal authentication unit 26 to the base station 14a, the terminal 12c's distributed hash table 20c includes the terminal 12c. Since the connection ID and password are stored, network entry is permitted.

  In the base station 14a, even after the terminal authentication unit 26 and the billing information management unit 28 are activated, the operation monitoring unit 24 monitors the operation of the AAA server 16 (step S5). When the base station 14a confirms that the AAA server 16 has returned and is operating normally as a result of monitoring by polling the AAA server 16, the terminal authentication unit 26, the billing information management unit, and so on are confirmed. 28 stops (step S6).

  The accounting unit 36 of the restored AAA server 16 collects the billing information recorded from each billing information recording unit 30 of the base stations 14a to 14c (step S7).

  In the network system 10, the base stations 14 a to 14 c have a shared key that cannot be known by a third party, and the overlay network 18 can be formed by providing this shared key. Therefore, when a base station other than the base stations 14a to 14c joins the overlay network 18, the base station needs to have the shared key. When the base station 14a executes a command such as put, get, and join, the shared key may be included in the command.

  As described above, the network system 10 includes the AAA server 16 and the base stations 14a, 14b, and 14c. The base stations 14a, 14b, and 14c are wirelessly connected to the terminal 12, and the AAA server 16 and the base station 14a, 14b, 14c form an overlay network 18, and the base stations 14a, 14b, 14c monitor the operating states of the distributed hash tables 20a, 20b, 20c in which the identification codes of the terminals 12 are stored and the AAA server 16 The monitoring unit 24 includes a terminal authentication unit 26 that is activated based on the monitoring result of the operation monitoring unit 24 and authenticates the terminal 12 with reference to the distributed hash tables 20a, 20b, and 20c.

  According to the network system 10, the base stations 14a, 14b, and 14c activate the terminal authentication unit 26 based on the monitoring result of the AAA server 16, and refer to the distributed hash table 20 in which the identification code of the terminal 12 is stored. By authenticating the terminal 12, the terminal 12 can be efficiently authenticated even when an abnormality occurs or stops in the AAA server 16 in a network having a large number of terminals 12.

  In addition, the charging information of the terminal 12 is stored in the distributed hash table 20, and the AAA server 16 collects the charging information stored in the distributed hash table 20, so that the AAA server 16 becomes abnormal or stops. Even so, it is possible to collect billing information until recovery.

  Further, the base stations 14a, 14b, and 14c have a shared key required for authentication of the terminal 12 by the terminal authentication unit 26 and storage of charging information in the distributed hash table 20, or the base stations 14a, 14b, and 14c. Since a new base station other than the above has a shared key necessary for joining the overlay network 18, security for a third party can be ensured.

  It should be noted that the present invention is not limited to the above-described embodiment, and various configurations can be adopted without departing from the gist of the present invention.

  For example, the connection ID and the billing ID are not particularly limited as long as the terminal 12 can be identified, and a MAC address can be used.

  In the restored AAA server 16, the accounting unit 36 collects the billing information recorded in the billing information recording units 30 of the base stations 14 a to 14 c, but instead of the accounting unit 36 collecting the billing information. In addition, after each operation monitoring unit 24 of the base stations 14 a to 14 c confirms the return of the AAA server 16, each charging information management unit 28 transmits the charging information from each charging information recording unit 30 to the AAA server 16. May be.

DESCRIPTION OF SYMBOLS 10 ... Network system 12 ... Terminal 14 ... Base station 16 ... AAA server 18 ... Overlay network 20 ... Distributed hash table 22 ... DHT management part 24 ... Operation monitoring part 26, 32 ... Terminal authentication part 28 ... Billing information management part 30 ... Billing Information recording unit 34 ... service approval unit 36 ... accounting unit 38 ... identification code table

Claims (5)

AAA (Authentication Authorization Accounting) server;
With multiple base stations,
Each base station wirelessly connects with a terminal, and an overlay network is formed by the AAA server and each base station,
Each of the base stations
A distributed hash table in which identification codes of the terminals are stored;
An operation monitoring unit for monitoring an operation state of the AAA server;
A terminal authentication unit that is activated based on the monitoring result of the operation monitoring unit, authenticates the terminal with reference to the distributed hash table, and
A network system comprising: The network system according to claim 1,
Billing information of the terminal connected to each base station is stored in the distributed hash table. The network system according to claim 2, wherein
The network system, wherein the AAA server collects billing information stored in the distributed hash table. The network system according to claim 3, wherein
Each of the base stations has a shared key required for authentication of the terminal by the terminal authentication unit and storage of charging information in the distributed hash table. The network system according to claim 1 or 4,
A new base station has a shared key required to participate in the overlay network.