JP2016057726A - Authentication system, home gateway, authentication terminal, connection control method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an authentication system capable of reducing a communication line to be used for authentication in the case of constructing an authentication system.SOLUTION: An authentication system includes: a home gateway 10 having a WAN interface connected to a WAN line; a communication terminal 20 connected via the home gateway 10 to the WAN line; and an authentication terminal 30 connected via a radio LAN to the home gateway 10 for determining the connection propriety of the communication terminal 20 to the home gateway 10. The home gateway 10 is configured to, when receiving a connection request message transmitted from the communication terminal 20, transmit an inquiry message to make an inquiry for the connection propriety of the communication terminal 20 to the authentication terminal 30 connected via the radio LAN, and to, when receiving a reply message transmitted from the authentication terminal 30 in which the permission of the connection of the communication terminal 20 is indicated, permit the connection of the communication terminal 20.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an authentication system, a home gateway, an authentication terminal, a connection control method, and a program. For example, the present invention relates to an authentication system, a home gateway, an authentication terminal, a connection control method, and a program using a wireless LAN.

  In recent years, a wireless local area network (LAN) has been established in a home or office. When constructing a wireless LAN in such a limited area, it is desirable to limit the wireless terminals that permit wireless LAN connection in consideration of security. Further, there is a demand for a security system that can restrict wireless LAN connection even for a wireless terminal that has already been set with connection setting information including an encryption key necessary for wireless LAN connection with an access point device. For example, there is a case of using a wireless terminal possessed by a child while a parent is away at home to prevent unlimited access to the Internet via an access point device.

  Patent Document 1 discloses a configuration of an authentication system when accessing the Internet via a gateway device. Specifically, when the wireless terminal accesses the Internet via the gateway device, the Internet connection apparatus authenticates the wireless terminal. The Internet connection device permits connection to the Internet via the gateway device when an authentication request is received from the mobile terminal and the gateway device connected to the gateway device using the short-range wireless method. The Internet connection device communicates with the mobile terminal via the mobile phone line.

JP 2013-152484 A

  However, when the authentication system disclosed in Patent Document 1 is used, a mobile terminal that can use a plurality of lines such as a short-distance wireless line for connecting to a mobile phone line and a gateway device is provided in the authentication system. Need to be placed. For this reason, when the authentication system disclosed in Patent Document 1 is used, it is necessary to make a contract for a line for connecting to the Internet and a contract for a mobile phone line, which increases the cost burden.

  An object of the present invention is to provide an authentication system, a home gateway, an authentication terminal, a connection control method, and a program that can reduce the number of communication lines used for authentication in an authentication or security system.

  An authentication system according to a first aspect of the present invention includes a home gateway having a WAN interface connected to a WAN (Wide Area Network) line, a communication terminal connected to the WAN line via the home gateway, and the home gateway. And an authentication terminal that determines whether or not the communication terminal can connect to the home gateway, and the home gateway receives the connection request message transmitted from the communication terminal, and receives the connection request message. An inquiry message for inquiring whether or not the communication terminal can be connected is transmitted to the authentication terminal connected via the LAN, and a response message transmitted from the authentication terminal and indicated to permit connection of the communication terminal is sent. When received, the connection of the communication terminal is permitted.

  The home gateway according to the second aspect of the present invention includes a WAN interface connected to a WAN line, a communication terminal using the WAN line via its own device, and authentication for determining whether the communication terminal can connect to the own device. When receiving a connection request message transmitted from the communication terminal and a wireless LAN interface connected to the terminal via a wireless LAN line, the connection of the communication terminal to the authentication terminal connected via the wireless LAN interface A connection control unit that transmits an inquiry message for inquiring whether the communication terminal is permitted and receives a response message transmitted from the authentication terminal that indicates that the connection of the communication terminal is permitted; It is to be prepared.

  An authentication terminal according to a third aspect of the present invention includes: a wireless LAN communication unit connected to a home gateway via a wireless LAN; and a connection of the communication terminal from a home gateway that has received a connection request message transmitted from the communication terminal. When an inquiry message for inquiring availability is transmitted via the wireless LAN, a response message indicating information on whether the communication terminal can be connected is transmitted to the home gateway.

  The connection control method according to the fourth aspect of the present invention receives a connection request message transmitted from a communication terminal using a WAN line, and connects the communication terminal to an authentication terminal connected via a wireless LAN interface. An inquiry message for inquiring whether the communication terminal is acceptable is transmitted. When a response message transmitted from the authentication terminal indicating that the connection of the communication terminal is permitted is received, the connection of the communication terminal is permitted.

  A program according to a fifth aspect of the present invention receives a connection request message transmitted from a communication terminal using a WAN line, and determines whether or not the communication terminal can be connected to an authentication terminal connected via a wireless LAN interface. An inquiry message for inquiring is transmitted, and when a response message transmitted from the authentication terminal indicating that the connection of the communication terminal is permitted is received, the computer is allowed to permit the connection of the communication terminal. is there.

  According to the present invention, it is possible to provide an authentication system, a home gateway, an authentication terminal, a connection control method, and a program that can reduce the number of communication lines used for authentication when an authentication or security system is constructed.

1 is a configuration diagram of an authentication system according to a first exemplary embodiment; It is a block diagram of the home gateway concerning Embodiment 2. FIG. FIG. 10 is a diagram for explaining a main device list according to the second embodiment; FIG. 10 is a diagram for explaining a sub device list according to the second embodiment; It is a figure which shows the flow of the main device registration process to the home gateway concerning Embodiment 2. FIG. It is a figure which shows the flow of the subdevice registration process to the home gateway concerning Embodiment 2. FIG. It is a figure which shows the flow of the authentication process at the time of the subdevice concerning Embodiment 2 using wireless LAN. It is a block diagram of the home gateway concerning Embodiment 3. It is a figure explaining the use restriction conditions concerning Embodiment 3. FIG. FIG. 10 is a diagram for explaining a sub device list according to the third embodiment; FIG. 10 is a diagram showing a flow of secondary device registration processing to the home gateway according to the third embodiment. It is a figure which shows the flow of a process at the time of using the use restriction condition concerning Embodiment 3. FIG.

(Embodiment 1)
Embodiments of the present invention will be described below with reference to the drawings. First, a configuration example of the authentication system according to the first exemplary embodiment of the present invention will be described with reference to FIG. The authentication system in FIG. 1 includes a home gateway 10, a communication terminal 20, and an authentication terminal 30. Further, the home gateway 10 is connected to the public network 40 via a WAN line.

  The home gateway 10, the communication terminal 20, and the authentication terminal 30 may be computer devices that operate by a CPU (Central Processing Unit) executing a program executed in a memory.

  The home gateway 10 may be a server device or the like. The home gateway 10 may have an access point function used as a base unit in wireless LAN communication. The communication terminal 20 may be a mobile phone terminal, a smartphone terminal, or a computer device having a communication function. The authentication terminal 30 may be a server device or a personal computer device, or may be a mobile phone terminal or a smartphone terminal.

  The home gateway 10 has a WAN interface connected to the WAN line. The WAN line may be, for example, a line using ADSL (Asymmetric Digital Subscriber Line), an optical fiber, or CATV. The public network 40 includes network communication devices that communicate with the home gateway 10 using a line using ADSL, optical fiber, CATV, or the like. The public network 40 may be, for example, a network provided by a telecommunications carrier or the so-called Internet. The home gateway 10 is a device arranged in a house, for example. The home gateway 10 is a device that relays communication between a communication terminal owned by a family and a home electric appliance having a communication function. The home gateway 10 is a device that controls a plurality of communication devices existing in the house.

  The communication terminal 20 is connected to the WAN line via the home gateway 10. For example, the communication terminal 20 accesses a Web server on the Internet via the home gateway 10. The communication terminal 20 is connected to the home gateway 10 via a wireless LAN.

  The authentication terminal 30 is connected to the home gateway 10 via a wireless LAN. Further, the authentication terminal 30 determines whether or not the communication terminal 20 can connect to the home gateway 10. That is, the authentication terminal 30 determines whether or not the communication terminal 20 can connect to the home gateway 10 via the wireless LAN. In other words, the authentication terminal 30 executes an authentication process related to the communication terminal 20.

  Next, the operation in the home gateway 10 will be described. The home gateway 10 receives the connection request message transmitted from the communication terminal 20. The communication terminal 20 sends a connection request message when it wishes to connect to the WAN line via the home gateway 10 or when it wishes to communicate with other devices connected to the home gateway 10. Transmit to home gateway 10.

  When the home gateway 10 receives the connection request message, the home gateway 10 transmits an inquiry message asking whether the communication terminal 20 can be connected to the authentication terminal 30 connected via the wireless LAN. When the home gateway 10 receives the response message transmitted from the authentication terminal 30 and indicated to permit the connection of the communication terminal 20, the home gateway 10 permits the connection of the communication terminal 20.

  As described above, the home gateway 10 can determine whether or not the communication terminal 20 can be connected using the response message transmitted from the authentication terminal 30 connected via the wireless LAN. At this time, the authentication terminal 30 may be connected to the home gateway 10 via the wireless LAN, and does not need to have another communication line or the like. Therefore, the authentication terminal 30 does not need to use another communication line different from the wireless LAN such as a mobile phone line when authenticating the communication terminal 20. Therefore, since the configuration of the authentication system can be simplified, the cost for configuring the authentication system can be kept low.

(Embodiment 2)
Then, the structural example of the home gateway 10 concerning Embodiment 2 of this invention is demonstrated using FIG. The home gateway 10 includes an antenna 101, a WLAN interface unit 102, a WAN interface unit 103, a routing control unit 104, a wireless connection control unit 105, a LAN interface unit 106, a device authentication control unit 107, an LED (Light Emitting Diode) 108, and connection settings. An information control unit 109, a main device list 110, a sub device list 111, a main device registration button 112, a sub device registration button 113, and a connection setting information storage unit 114 are provided. Of the communication terminals connected to the home gateway 10, the administrator communication terminal is referred to as a main device, and the non-administrator communication terminal is referred to as a sub device. For example, the main device corresponds to the authentication terminal 30 in FIG. 1, and the sub device corresponds to the communication terminal 20 in FIG.

  The antenna 101 is used for performing wireless LAN communication. The wireless LAN communication is communication using a communication standard defined in IEEE 802.11, for example. The WLAN interface unit 102 executes wireless LAN communication in infrastructure mode. In infrastructure mode, for example, communication terminals used as slave units in wireless LAN communication do not directly communicate with each other, but slave units communicate with each other via an access point used as a master unit.

  Here, the home gateway 10 corresponds to an access point, and is used as a master unit in wireless LAN communication. On the other hand, the communication terminal 20 and the authentication terminal 30 are used as slave units in wireless LAN communication.

  The WLAN interface unit 102 outputs the packet output from the routing control unit 104 to the antenna 101. In addition, the WLAN interface unit 102 outputs the packet output from the antenna 101 to the routing control unit 104.

  The WAN interface unit 103 is an interface used when connecting to a WAN line using ADSL, optical fiber, CATV, or the like. The WAN interface unit 103 communicates with the opposing network communication device via the WAN line.

  The LAN interface unit 106 is an interface used when connecting to a network device such as a personal computer. For example, the setting of the home gateway 10 may be changed using a personal computer or the like connected to the LAN interface unit 106.

  The routing control unit 104 includes a protocol stack that performs IP routing processing and termination processing of various protocols. The routing control unit 104 performs routing processing using the destination IP address of the IP packet transmitted from the WLAN interface unit 102, the WAN interface unit 103, and the LAN interface unit 106. Also, the routing control unit 104 performs packet termination processing when the destination IP address of the received IP packet indicates the own device. Further, when the routing control unit 104 determines that the IP packet destined for the own device is a packet having a predetermined content, the routing control unit 104 outputs the IP packet to each functional block according to the content.

  The packet having the contents decided in advance may be, for example, a packet for requesting wireless connection setting, a packet for requesting wireless LAN connection, or a packet for notifying an authentication result. The packet for requesting the wireless connection setting is sent to the home gateway 10 when the communication terminal 20 acquires setting information necessary for the wireless LAN connection including the SSID, encryption method, encryption key, and the like in the home gateway 10, for example. This is the packet to send.

  The packet for requesting the wireless LAN connection requests, for example, that the communication terminal 20 establishes a wireless link with the home gateway 10 to perform wireless LAN communication after acquiring the wireless connection setting information. This is a packet used for this purpose.

  The packet for notifying the authentication result is, for example, a packet indicating a result of the authentication terminal 30 executing an authentication process related to the communication terminal 20. The authentication process related to the communication terminal 20 is executed, for example, when the communication terminal 20 transmits a packet for requesting wireless connection setting or a packet for requesting wireless LAN connection to the home gateway 10.

  When the routing control unit 104 determines that the received packet is a packet for requesting wireless connection setting, the routing control unit 104 outputs the packet to the connection setting information control unit 109. When the routing control unit 104 determines that the received packet is a packet for requesting a wireless LAN connection, the routing control unit 104 outputs the packet to the wireless connection control unit 105. When the routing control unit 104 determines that the received packet is a packet for notifying the authentication result, the routing control unit 104 outputs the packet to the device authentication control unit 107.

  As shown in FIG. 3 as an example, the main device list 110 includes a MAC (Media Access Control) address of the main device, a wireless terminal name expressed using an arbitrary character string, and whether the main device has been registered or provisionally registered. This is a memory capable of registering a plurality of pieces of information. As illustrated in FIG. 4 as an example, the secondary device list 111 is a memory capable of registering a plurality of wireless terminal names represented by using the MAC address of the secondary device and an arbitrary character string.

  The connection setting information storage unit 114 stores setting information necessary for wireless LAN connection including an SSID (Service Set Identification), an encryption method, an encryption key, and the like in the home gateway 10. The connection setting information storage unit 114 may be a memory provided in the home gateway 10 or a storage medium device connected to the home gateway 10.

  The main device registration button 112 is a button that the user presses when registering the main device in the main device list 110. For example, the user presses the main device registration button 112 when registering the authentication terminal 30 as the main device in the home gateway 10. The main device registration button 112 is connected to the connection setting information control unit 109.

  The secondary device registration button 113 is a button that is pressed when the user registers the secondary device in the secondary device list 111. For example, the user presses the sub device registration button 113 when registering the communication terminal 20 as a sub device in the home gateway 10. The secondary device registration button 113 is connected to the connection setting information control unit 109.

  The LED 108 is an LED that can be lit in green, red, or the like. The LED 108 may be used to indicate an authentication result of the communication terminal 20. For example, when the LED 108 indicates green, the authentication result of the communication terminal 20 may indicate OK, and when the LED 108 indicates red, the authentication result of the communication terminal 20 may indicate NG.

  When the connection setting information control unit 109 receives the packet for requesting the wireless connection setting from the routing control unit 104, the connection setting information control unit 109 transmits the connection setting information to the communication terminal 20 to the authentication terminal 30 registered in the main device list 110. A packet for inquiring whether or not to permit this is generated. The connection setting information control unit 109 outputs the generated packet to the device authentication control unit 107. Further, when the connection setting information control unit 109 receives a packet for permitting transmission of the connection setting information to the communication terminal 20 via the device authentication control unit 107, the connection setting information control unit 109 receives a connection setting from the connection setting information storage unit 114. Read information. The connection setting information control unit 109 outputs the read connection setting information to the routing control unit 104.

  When receiving a packet for requesting a wireless LAN connection from the routing control unit 104, the wireless connection control unit 105 sends a packet including information necessary for the wireless LAN connection to the routing control unit 104. The information necessary for the wireless LAN connection may be, for example, an inquiry packet for inquiring whether or not to permit the wireless LAN connection of the communication terminal 20 to the authentication terminal 30 registered in the main device list 110. The wireless connection control unit 105 outputs the inquiry packet to the device authentication control unit 107.

  When the device authentication control unit 107 receives a packet for notifying the authentication result in the main device from the routing control unit 104, the device authentication control unit 107 notifies the connection setting information control unit 109 or the wireless connection control unit 105 of the authentication result. Further, the device authentication control unit 107 receives an authentication request to the main device from the connection setting information control unit 109 or the wireless connection control unit 105. The authentication request includes, for example, a packet for inquiring whether to permit transmission of connection setting information to the communication terminal 20 and a packet for inquiring whether to permit the wireless LAN connection of the communication terminal 20. The device authentication control unit 107 outputs the received packet related to the authentication request to the main device to the routing control unit 104.

  Further, the device authentication control unit 107 accesses the main device list 110 and the sub device list 111 to read and update the wireless terminal information. The wireless terminal includes an authentication terminal 30 operated by an administrator and a communication terminal 20 operated by a non-administrator.

  Next, the flow of the main device registration process to the home gateway 10 according to the second embodiment of the present invention will be described with reference to FIG. Here, a flow of processing when registering the authentication terminal 30 as a main device in the home gateway 10 will be described. The main device registration button 112 of the home gateway 10 is pressed (S511), and the authentication terminal 30 starts connection setting processing (S501). The connection setting process in the authentication terminal 30 is performed, for example, when the authentication terminal 30 is turned on, when the authentication terminal 30 moves to the wireless LAN communication area formed by the home gateway 10 or when the user of the authentication terminal 30 is specified. It may be started when the operation is performed.

  Next, the authentication terminal 30 transmits a packet for requesting wireless connection setting to the home gateway 10 (S502). Next, the device authentication control unit 107 of the home gateway 10 refers to the main device list 110, and there is a registered main device having a MAC address that matches the source MAC address of the packet for requesting wireless connection setting. It is confirmed whether or not to perform (S512).

  Here, the processing relating to step S512 will be described in detail. The connection setting information control unit 109 of the home gateway 10 receives a packet for requesting wireless connection setting via the antenna 101, the WLAN interface unit 102, and the routing control unit 104. Further, the connection setting information control unit 109 analyzes the received packet and extracts the source MAC address. The connection setting information control unit 109 outputs to the device authentication control unit 107 that the main device registration button 112 has been pressed and the extracted transmission source MAC address. The device authentication control unit 107 executes the process in step S512 based on the information output from the connection setting information control unit 109.

  Next, when it is determined that there is no registered main device having a MAC address that matches the transmission source MAC address, the device authentication control unit 107 registers the transmission source MAC address in the main device list 110 as temporary registration ( S513). Temporary registration is performed because unauthorized wireless terminals that are not recognized by the administrator are not registered as main devices without limitation. The administrator may change the temporarily registered device to the registered main device.

  For example, the administrator may connect a network device such as a personal computer to the LAN interface unit 106 and access the management Web page of the home gateway 10. At this time, the administrator may access the main device list 110 via the management Web page and change the temporarily registered device to a registered state. Furthermore, the administrator may set a name with an arbitrary character string to the device changed to the registered state. The administrator may delete the temporarily registered device from the main device list 110.

  If the device authentication control unit 107 determines that there is a registered main device having a MAC address that matches the transmission source MAC address, the device authentication control unit 107 outputs the determination result to the connection setting information control unit 109.

  Next, when notified that the transmission source address of the authentication terminal 30 is already registered in the main device list 110, the connection setting information control unit 109 displays the connection setting information read from the connection setting information storage unit 114 as the authentication terminal. 30 (S514). The connection setting information control unit 109 transmits the connection setting information to the authentication terminal 30 via the routing control unit 104, the WLAN interface unit 102, and the antenna 101.

  Next, the authentication terminal 30 sets the received connection setting information in its own device (S503). After setting the connection setting information, the authentication terminal 30 transmits a connection setting completion notification message to the home gateway 10 (S504).

  Subsequently, a flow of registration processing of the secondary device to the home gateway 10 according to the second exemplary embodiment of the present invention will be described with reference to FIG. Here, a flow of processing when registering the communication terminal 20 in the home gateway 10 as a sub device will be described.

  The secondary device registration button 113 of the home gateway 10 is pressed (S611), and the communication terminal 20 starts connection setting processing (S621). The connection setting process in the communication terminal 20 is performed, for example, when the communication terminal 20 is turned on, when the communication terminal 20 moves to the wireless LAN communication area formed by the home gateway 10 or when the user of the communication terminal 20 specifies It may be started when the operation is performed.

  Next, the communication terminal 20 transmits a packet for requesting wireless connection setting to the home gateway 10 (S622). Next, the device authentication control unit 107 of the home gateway 10 generates a sub device registration authentication request message whose destination is the MAC address of the main device registered in the main device list 110. The secondary device registration request authentication message includes information regarding the MAC address of the communication terminal 20 that is the secondary device. The device authentication control unit 107 transmits a sub device registration request authentication message to the authentication terminal 30 that is the main device via the routing control unit 104, the WLAN interface unit 102, and the antenna 101 (S612).

  Next, the authentication terminal 30 performs a registration authentication process based on the MAC address of the communication terminal 20 (S601). In the registration authentication process, for example, when the authentication terminal 30 receives the sub device registration authentication request message, the authentication terminal 30 displays an image for accepting input of information regarding whether or not the communication terminal 20 is registered on the display unit or the like of the authentication terminal 30. It may be a process of accepting information input. When the user operating the authentication terminal 30 inputs information related to whether or not the communication terminal 20 can be registered to the authentication terminal 30, the authentication terminal 30 transmits a registration propriety message indicating information about whether or not registration is possible to the home gateway 10 (S602). In addition, the user operating the authentication terminal 30 may input an arbitrary character string indicating the name of the communication terminal 20 when registration of the communication terminal 20 is permitted. In this case, the authentication terminal 30 may also transmit information related to the name of the communication terminal 20 to the home gateway 10 together with the registration availability message.

  Next, when receiving the registration permission information of the communication terminal 20, the device authentication control unit 107 determines whether registration is permitted (S613). When the registration of the communication terminal 20 is not permitted, that is, when the registration is rejected, the device authentication control unit 107 turns on the LED 108 in red and displays a rejection (S614). By transferring the LED 108 to red, the user of the communication terminal 20 can recognize that the communication terminal 20 has been refused to connect to the home gateway 10.

  When the device authentication control unit 107 determines that the registration of the communication terminal 20 is permitted, the connection setting information control unit 109 extracts the connection setting information from the connection setting information storage unit 114 and uses the extracted connection setting information as the communication terminal. 20 (S615).

  Next, the communication terminal 20 sets the received connection setting information in its own device (S623). After setting the connection setting information, the communication terminal 20 transmits a connection setting completion notification message to the home gateway 10 (S624). Upon receiving the connection setting completion notification message from the communication terminal 20, the device authentication control unit 107 of the home gateway 10 registers the MAC address of the communication terminal 20 and the name of the communication terminal 20 transmitted from the authentication terminal 30 in the sub device list 111. (S616).

  Next, the flow of authentication processing when the secondary device according to the second embodiment of the present invention uses a wireless LAN will be described with reference to FIG. Here, a processing flow when the communication terminal 20 uses a wireless LAN as a sub device will be described. First, the communication terminal 20 transmits a packet for requesting a wireless LAN connection to the home gateway 10 (S721). In this case, it is assumed that the communication terminal 20 has set connection setting information.

  Next, the device authentication control unit 107 determines whether or not a MAC address that matches the transmission source MAC address of the packet for requesting the wireless LAN connection is registered in the secondary device list 111 (S711). If the device authentication control unit 107 determines that the MAC address that matches the transmission source MAC address is not registered in the sub device list 111, the device authentication control unit 107 turns on the LED 108 in red and displays a rejection (S712).

  When the device authentication control unit 107 determines that the MAC address that matches the transmission source MAC address is registered in the sub device list 111, the wireless connection control unit 105 requests wireless LAN connection authentication for the communication terminal 20. A wireless LAN connection authentication request message is transmitted to the authentication terminal 30 (S713). The wireless LAN connection authentication request message includes the MAC address of the communication terminal 20 and the name information of the communication terminal 20.

  Next, the authentication terminal 30 performs an authentication process for determining whether to permit the use of the wireless LAN of the communication terminal 20 based on the MAC address or name information of the communication terminal 20 (S701). Next, the authentication terminal 30 transmits an availability message indicating availability of the wireless LAN to the home gateway 10 (S702). A user who operates the authentication terminal 30 may determine whether or not to allow the communication terminal 20 to use the wireless LAN, and may input the determination result to the authentication terminal 30. The user confirms the MAC address or name information of the communication terminal 20 displayed on the display unit of the authentication terminal 30 and determines whether to permit the use of the wireless LAN of the communication terminal 20.

  Next, when receiving the wireless LAN use availability message, the device authentication control unit 107 of the home gateway 10 checks whether or not the use of the wireless LAN in the communication terminal 20 is permitted (S714). If the device authentication control unit 107 determines that the use of the wireless LAN in the communication terminal 20 is not permitted, the device authentication control unit 107 turns on the LED 108 in red and displays a rejection (S715).

  When the device authentication control unit 107 determines that the use of the wireless LAN in the communication terminal 20 is permitted, the wireless connection control unit 105 establishes a wireless link with the communication terminal 20, and the communication terminal 20 Is made available (S722).

  As described above, the home gateway 10 according to the second embodiment of the present invention is for the non-administrator only when information indicating registration permission and wireless LAN use permission is received from the authentication terminal 30 held by the administrator. The communication terminal 20 can use a wireless LAN. As a result, it is possible to prevent the communication terminal from using the wireless LAN unintended by the administrator.

  Further, when the administrator goes out with the authentication terminal 30, the authentication terminal 30 moves outside the communication area formed by the home gateway 10. In this case, the home gateway 10 cannot communicate with the authentication terminal 30 via the wireless LAN. Therefore, when the administrator goes out with the authentication terminal 30, unauthorized use of the wireless LAN by the non-administrator communication terminal including impersonation can be completely prevented.

(Embodiment 3)
Then, the structural example of the home gateway 11 concerning Embodiment 3 of this invention is demonstrated using FIG. The home gateway 11 has a configuration in which a use restriction processing unit 115 is added to the home gateway 10 of FIG. Further, the home gateway 11 will explain the secondary device list 111 in the home gateway 10 as a secondary device list 116. Since the other configuration of the home gateway 11 is the same as that of the home gateway 10, a detailed description thereof will be omitted.

  The use restriction processing unit 115 controls communication in the communication terminal 20 in accordance with a predetermined use restriction condition. For example, as shown in FIG. 9, the use restriction condition may be an available information amount or a continuous available time for a communication protocol and a port number used in various IP communication services. The usage restriction condition may be set for each secondary device as shown in FIG. For example, the usage restriction processing unit 115 may include a packet counter for confirming the communication amount of the secondary device.

  The usage restriction processing unit 115 monitors the communication of the secondary device via the routing control unit 104. When the use restriction processing unit 115 detects communication using a protocol and a port number defined in the use restriction condition, the use restriction processing unit 115 counts up the packet counter. The usage restriction processing unit 115 notifies the device authentication control unit 107 when the packet counter exceeds the amount of usable information specified in the usage restriction condition. When notified from the usage restriction processing unit 115 that the usable information amount has been exceeded, the device authentication control unit 107 transmits an authentication request packet destined for the authentication terminal 30 via the routing control unit 104.

  Subsequently, a flow of a registration process of the secondary device to the home gateway 11 according to the third embodiment of the present invention will be described with reference to FIG. Steps S1111, S1121, S1122, S1112, and S1101 are the same as steps S611, S621, S622, S612, and S601 in FIG.

  If the authentication terminal 30 permits registration of the communication terminal 20 in step S1101, the authentication terminal 30 accepts input of information related to the use restriction of the communication terminal 20 (S1102). Next, the authentication terminal 30 transmits the usage restriction information of the communication terminal 20 to the home gateway 11 in addition to the registration permission information and the name information of the communication terminal 20 (S1103). Steps S1113, S1114, S1115, S1123, S1124, and S1116 are the same as steps S613, S614, S615, S623, S624, and S616 in FIG.

  When the device authentication control unit 107 registers the MAC address and name information of the communication terminal 20 in the sub device list 111 in step S1116, the device authentication control unit 107 also registers the use restriction condition of the communication terminal 20 (S1117).

  Next, the flow of processing using the use restriction condition according to the third embodiment of the present invention will be described with reference to FIG. It is assumed that the communication terminal 20 is using a wireless LAN via the home gateway 11 (S1221). Next, the use restriction processing unit 115 determines whether or not the use of the wireless LAN of the communication terminal 20 satisfies the use restriction condition (S1211). The usage restriction processing unit 115 refers to the usage restriction conditions of the communication terminal 20 stored in the secondary device list 111 via the device authentication control unit 107. Satisfying the usage restriction condition means, for example, that the communication amount at the communication terminal 20 exceeds the available information amount defined in the usage restriction condition. Not satisfying the usage restriction condition means, for example, that the communication amount in the communication terminal 20 does not reach the usable information amount defined in the usage restriction condition.

  If the use restriction processing unit 115 determines that the use of the wireless LAN of the communication terminal 20 does not satisfy the use restriction condition, the use restriction processing unit 115 repeats the process of step S1211. If the usage restriction processing unit 115 determines that the usage restriction condition is satisfied, the device authentication control unit 107 transmits a wireless LAN connection authentication request message including the MAC address information of the communication terminal 20 to the authentication terminal 30 that is the main device. (S1212).

  Steps S1201, S1202, S1213, S1214, and S1222 are the same as steps S701, S702, S714, S715, and S722 of FIG. If it is determined in step S1213 that the wireless LAN can be used, the use restriction processing unit 115 may clear the packet counter.

  As described above, the home gateway 11 according to the third embodiment of the present invention can impose a use restriction condition on the communication terminal 20 permitted to use the wireless LAN. For this reason, even after the communication terminal 20 is once permitted to use the wireless LAN, it is possible to control the wireless LAN of the communication terminal 20 to be disabled according to the usage status of the communication terminal 20. Thereby, for example, an increase in data communication amount of the communication terminal 20 unintended by the administrator or use of the network for a long time can be prevented.

  In the above-described embodiments, the present invention has been described as a hardware configuration, but the present invention is not limited to this. The present invention can also be realized by causing a CPU (Central Processing Unit) to execute a computer program for processing in the home gateway 10, the home gateway 11, or the authentication terminal 30. )

  In the above example, the program can be stored and supplied to a computer using various types of non-transitory computer readable media. Non-transitory computer readable media include various types of tangible storage media. Examples of non-transitory computer-readable media include magnetic recording media (for example, flexible disks, magnetic tapes, hard disk drives), magneto-optical recording media (for example, magneto-optical disks), CD-ROMs (Read Only Memory), CD-Rs, CD-R / W, semiconductor memory (for example, mask ROM, PROM (Programmable ROM), EPROM (Erasable PROM), flash ROM, RAM (Random Access Memory)) are included. The program may also be supplied to the computer by various types of transitory computer readable media. Examples of transitory computer readable media include electrical signals, optical signals, and electromagnetic waves. The temporary computer-readable medium can supply the program to the computer via a wired communication path such as an electric wire and an optical fiber, or a wireless communication path.

  Note that the present invention is not limited to the above-described embodiment, and can be changed as appropriate without departing from the spirit of the present invention.

  A part or all of the above-described embodiment can be described as in the following supplementary notes, but is not limited thereto.

(Appendix 1) A home gateway having a WAN interface connected to a WAN line, a communication terminal connected to the WAN line via the home gateway, connected to the home gateway via a wireless LAN, and the communication terminal An authentication terminal that determines whether or not connection to a home gateway is possible, and when the home gateway receives a connection request message transmitted from the communication terminal, the communication to the authentication terminal connected via the wireless LAN An authentication system that transmits an inquiry message for inquiring whether or not a terminal can be connected, and permits connection of the communication terminal upon receiving a response message transmitted from the authentication terminal and indicated to permit connection of the communication terminal .
(Supplementary Note 2) When the home gateway does not transmit a response message indicating that the connection of the communication terminal is permitted from the authentication terminal, or the response message indicates that the connection of the communication terminal is not permitted The authentication system according to appendix 1, wherein the connection of the communication terminal is rejected when the communication terminal is received.
(Supplementary Note 3) The connection request message is a connection setting information request message for requesting acquisition of connection setting information required when the communication terminal establishes a wireless LAN connection to the home gateway, or the connection setting information is set. The authentication system according to appendix 1 or 2, including a wireless LAN connection request message for requesting a connection to the wireless LAN by the communication terminal.
(Supplementary Note 4) Upon receipt of the inquiry message transmitted from the home gateway, the authentication terminal accepts input of information regarding connection availability from a user who operates the device, and according to the information input from the user, The authentication system according to any one of appendices 1 to 3, wherein a response message is transmitted to the home gateway.
(Supplementary note 5) The authentication system according to any one of supplementary notes 1 to 4, wherein the home gateway rejects connection of the communication terminal when the authentication terminal connected via a wireless LAN does not exist.
(Supplementary Note 6) The authentication terminal transmits a response message indicating that the connection of the communication terminal is permitted, and transmits use restriction information that is information for restricting the use of the communication terminal. 6. The authentication system according to any one of 5 above.
(Appendix 7) A WAN interface connected to a WAN line, a communication terminal using the WAN line via its own device, an authentication terminal for determining whether or not the communication terminal can be connected to its own device, and a wireless LAN line When receiving a connection request message transmitted from the communication terminal and a wireless LAN interface to be connected, an inquiry message for inquiring whether the communication terminal can be connected is transmitted to the authentication terminal connected via the wireless LAN interface, A home gateway comprising: a connection control unit that permits connection of the communication terminal when receiving a response message transmitted from the authentication terminal and indicated to permit connection of the communication terminal.
(Appendix 8) a wireless LAN communication unit connected to the home gateway via a wireless LAN;
When an inquiry message for inquiring whether or not the communication terminal can be connected is transmitted from the home gateway that has received the connection request message transmitted from the communication terminal via the wireless LAN, a response message indicating information on whether or not the communication terminal can be connected Is transmitted to the home gateway.
(Supplementary Note 9) A connection request message transmitted from a communication terminal using a WAN line is received,
A response message sent to the authentication terminal connected via the wireless LAN interface to inquire whether or not the communication terminal can be connected, and sent from the authentication terminal to indicate that the connection of the communication terminal is permitted A connection control method for permitting connection of the communication terminal when receiving the message.
(Supplementary Note 10) A response message is received from the home gateway that has received the connection request message transmitted from the communication terminal via the wireless LAN to inquire whether the communication terminal can be connected or not, and the response indicates information on whether the communication terminal can be connected. An authentication method for transmitting a message to the home gateway. (Supplementary note 11) A connection request message transmitted from a communication terminal using a WAN line is received, and the authentication terminal connected to the authentication terminal via a wireless LAN interface Sending an inquiry message for inquiring whether connection is possible, and receiving a response message sent from the authentication terminal indicating that the connection of the communication terminal is permitted, the computer is permitted to connect the communication terminal Program to make.
(Additional remark 12) The inquiry message which inquires the connection possibility of the said communication terminal is received via wireless LAN from the home gateway which received the connection request message transmitted from the communication terminal, and the response which shows the information regarding the connection possibility of the said communication terminal A program that causes a computer to send a message to the home gateway.

DESCRIPTION OF SYMBOLS 10 Home gateway 11 Home gateway 20 Communication terminal 30 Authentication terminal 40 Public network 101 Antenna 102 WLAN interface part 103 WAN interface part 104 Routing control part 105 Wireless connection control part 106 LAN interface part 107 Device authentication control part 108 LED
109 Connection Setting Information Control Unit 110 Main Device List 111 Sub Device List 112 Main Device Registration Button 113 Sub Device Registration Button 114 Connection Setting Information Storage Unit 115 Usage Restriction Processing Unit 116 Sub Device List

Claims (10)

A home gateway having a WAN interface connected to the WAN line;
A communication terminal connected to the WAN line via the home gateway;
An authentication terminal that connects to the home gateway via a wireless LAN and determines whether the communication terminal can connect to the home gateway;
The home gateway is
Upon receipt of the connection request message transmitted from the communication terminal, an inquiry message for inquiring whether the communication terminal can be connected is transmitted to the authentication terminal connected via the wireless LAN, and transmitted from the authentication terminal. An authentication system that permits connection of the communication terminal when receiving a response message indicating that the connection of the communication terminal is permitted. The home gateway is
When a response message indicating that the connection of the communication terminal is permitted is not transmitted from the authentication terminal, or when a response message indicating that the connection of the communication terminal is not permitted is received, the communication terminal The authentication system according to claim 1, wherein the connection is rejected. The connection request message is:
A connection setting information request message for requesting acquisition of connection setting information required when the communication terminal establishes a wireless LAN connection to the home gateway, or the communication terminal that has set the connection setting information connects to the wireless LAN. The authentication system according to claim 1, further comprising a wireless LAN connection request message requesting The authentication terminal is
When the inquiry message transmitted from the home gateway is received, an input of information regarding connection availability is received from a user operating the device, and a response message is transmitted to the home gateway according to the information input from the user. The authentication system according to any one of claims 1 to 3. The home gateway is
The authentication system according to any one of claims 1 to 4, wherein when there is no authentication terminal connected via a wireless LAN, the connection of the communication terminal is rejected. The authentication terminal is
The response message indicating that the connection of the communication terminal is permitted is transmitted, and the use restriction information which is information for restricting the use of the communication terminal is transmitted. Authentication system. A WAN interface connected to the WAN line;
A communication terminal that uses the WAN line via its own device, an authentication terminal that determines whether the communication terminal can be connected to the own device, a wireless LAN interface that is connected via a wireless LAN line,
Upon receiving the connection request message transmitted from the communication terminal, an inquiry message for inquiring whether the communication terminal can be connected is transmitted to the authentication terminal connected via the wireless LAN interface, and transmitted from the authentication terminal. A home gateway comprising: a connection control unit that permits connection of the communication terminal when receiving a response message indicating that the connection of the communication terminal is permitted. A wireless LAN communication unit connected to the home gateway via the wireless LAN;
When an inquiry message for inquiring whether or not the communication terminal can be connected is transmitted from the home gateway that has received the connection request message transmitted from the communication terminal via the wireless LAN, a response message indicating information on whether or not the communication terminal can be connected Is transmitted to the home gateway. Receiving a connection request message sent from a communication terminal using a WAN line;
An inquiry message for inquiring whether the communication terminal can be connected to the authentication terminal connected via the wireless LAN interface;
A connection control method for permitting connection of the communication terminal upon receiving a response message transmitted from the authentication terminal and indicated to permit connection of the communication terminal. Receiving a connection request message sent from a communication terminal using a WAN line;
An inquiry message for inquiring whether the communication terminal can be connected to the authentication terminal connected via the wireless LAN interface;
A program for causing a computer to permit connection of the communication terminal upon receiving a response message transmitted from the authentication terminal and indicated to permit connection of the communication terminal.

Images