JP3856223B2 - User authentication method and program, and data communication terminal - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a user authentication method, a user authentication program, and a data communication terminal, and more particularly, to a user authentication method, a user authentication program, and a data communication terminal that simplify an authentication procedure.
[0002]
[Prior art]
As a method for accessing Internet services, use a wired medium such as FTTH (Fiber To The Home) or ADSL (Asymmetric Digital Subscriber Line) to connect a local IP network or Internet service provider (hereinafter ISP = Internet Service Provider). There are two types: a method for enjoying the service via the Internet, and a method for connecting to the ISP using a communication infrastructure such as a mobile phone or PHS (Personal Handy-Phone System) to enjoy the service.
[0003]
In the public wireless access system, the international standards IEEE802.11b and 802.11a are used in public areas such as downtowns, coffee shops, hotels, and airports. A compliant wireless LAN (Local Area Network) access point is installed. Any user having a wireless LAN client adapter existing in the area or a user (data communication terminal) registered with the ISP can enjoy the Internet service by accessing the ISP via the access point.
[0004]
[Problems to be solved by the invention]
In public wireless access systems, systems such as ESS-ID (Extended Service Set ID) and WEP (Wired Equivalent Privacy) are used as access control in the lower layer. For terminals with Microsoft's Windows (registered trademark) XP as the OS (Operation System), the ESS-ID broadcast from the access point can be displayed and the ESS-ID can be associated with the WEP key. There is little inconvenience to the user regarding the choice of access control.
[0005]
On the other hand, user authentication procedures for IP address assignment and service authorization include a unique method and PPPoE (Point-To-Point Protocol over Ethernet) (Broadband Access Server). Trademark)) method, HTTP / HTTPS (Hyper Text Transfer Protocol / HTTP Security) method using wireless GW (Gateway), or IEEE802.1x method using RADIUS (= Remote Access Dial-Up User Service) .
[0006]
FIG. 7 is a block diagram schematically showing a user authentication method based on the PPPoE method, and PPPoE client software is installed in advance as user authentication software in the user terminal. Since the PPPoE method cannot pass through a router, the access point and the Internet (or intranet) are connected via BAS.
[0007]
FIG. 8 is a block diagram schematically representing a user authentication method based on the HTTP / HTTPS method, and a Web browser is installed in advance as user authentication software in the user terminal. The access point and the Internet are connected via a wireless GW.
[0008]
FIG. 6 is a flowchart showing a control procedure in the data communication terminal from conventional access control to login to the system.
[0009]
In step S51, when the ESS-ID is acquired from the access point, in step S52, the user selects user authentication software corresponding to the ESS-ID by manual operation. Here, description will be made assuming that the HTTP / HTTPS method or the PPPoE method can be selected.
[0010]
In step S53, the selected user authentication software is activated. In step S54, it is determined whether the selected user authentication software is a PPPoE client for the PPPoE system or a Web browser for the HTTP / HTTPS system. If the PPPoE client has been activated, the user name and password are input manually by the user in step S55. When the “connect” button is pressed by the user in step S56, an authentication packet including the user name and password is transmitted in step S57. That is, log in to the system.
[0011]
On the other hand, if the Web browser is activated as the user authentication software, in step S58, the authentication URL is automatically redirected according to the instruction of the wireless gateway GW. In step S59, the user name and password are input by the user's manual operation on the redirect destination authentication screen. In step S60, when the "login" button is pressed by the user, the system logs in to the system in the same manner as described above in step S57.
[0012]
As described above, in the conventional public wireless access system, not only the user authentication method is not unified, but also the user authentication code such as the user name and the password varies depending on the system even in the same authentication method. Therefore, a user who uses different public wireless access systems in a plurality of areas has to select a user authentication method and input a user name and password for each access point.
[0013]
Furthermore, in public wireless access, so-called hotspot service, a DHCP system that dynamically assigns IP addresses to user terminals (PCs, etc.) is used by the wireless gateway or BAS that carries out or relays authentication work. Since wireless is used, logout such as when the user leaves the service area of the access point or interrupts the internet surfing (idle state) is not clear.
[0014]
Therefore, in the DHCP system, communication with the user terminal is performed periodically (in units of several minutes), and if there is no response (ACK), the IP address assignment is canceled. Therefore, when the user uses the service again, the authentication procedure must be executed manually and the user name and password must be entered again.
[0015]
The object of the present invention is to solve the above-mentioned problems of the prior art and automatically improve the user's convenience by automatically processing the authentication procedure required for each public radio access system in the user's terminal. An object is to provide an authentication method, a user authentication program, and a data communication terminal.
[0016]
[Means for Solving the Problems]
In order to achieve the above object, the present invention provides at least one user authentication software, an access point identification code, a user, and a user in a data communication terminal that establishes a wireless link with an access point and performs data communication. A first data table in which a relationship with the authentication software is registered; means for receiving an identification code from an access point; and user authentication software corresponding to the received identification code is selected from the first data table. A first selection means, a means for activating the selected user authentication software, a second data table in which a relationship between the user authentication software and a user authentication code is registered, and the activated user authentication software. Second selection for selecting a corresponding user authentication code from the second data table And stage, the user authentication code said selected characterized in that it comprises a means for applying to the activated user authentication software.
[0017]
According to the above-described feature, when the data communication terminal receives an identification code unique to the access point from the access point, user authentication software associated with the identification code is automatically started. The user of the communication terminal is freed from the work of selecting and starting user authentication software corresponding to the identification code of the access point.
[0018]
Furthermore, when the user authentication software is activated, a user authentication code (user name and password) associated with the user authentication software in advance is selected and automatically applied to the user authentication software. The user of the data communication terminal is also freed from the work of inputting a user authentication code such as a user name and a password.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. Here, a case where two methods, the PPPoE method and the HTTP / HTTPS method, which are frequently used, can be selected as an authentication method of the public wireless access system will be described as an example.
[0020]
In using the public radio access system, the user completes user registration for using at least one public radio access system, and for each system for which user registration is completed, the ESS-ID, WEP key, and It is assumed that user authentication user name, password, and user authentication method (either PPPoE method or HTTP / HTTPS method) are obtained in advance. It is assumed that software corresponding to the user authentication method (a PPPoE client in the case of the PPPoE method, a web browser in the case of the HTTP / HTTPS method) is installed (implemented) in advance on the user terminal.
[0021]
FIG. 1 is a flowchart showing a manual registration procedure that is first executed in a data communication terminal as a preparation process when realizing the automation of the authentication procedure according to the present invention.
[0022]
In step S11, an ESS-ID is acquired from the access point. If the data communication terminal is a Windows (registered trademark) XP terminal, this ESS-ID can be acquired by using an OID_802_11_SSID command of WMI (Windows (registered trademark) Management Instrumentation). In step S12, the user selects user authentication software corresponding to the ESS-ID by manual operation. In step S13, the selected user authentication software is activated.
[0023]
In step S14, the correspondence between the selected user authentication software and the ESS-ID is registered in the data table as shown in FIG. Here, since PPPoE is selected as the user authentication software for the ESS-ID “tatsumaki” by the user, the WAN miniport that is the PPPoE driver is associated with the ESS-ID “tatsumaki”. If a Microsoft component public Web browser / Internet Explorer is selected for the ESS-ID “tsunami”, the executable file is associated with the ESS-ID “tsunami”. As a result, when a connection to the same access point is attempted after the next time, an appropriate user authentication software is automatically selected based on the ESS-ID.
[0024]
In step S15, it is determined whether the activated user authentication software is a PPPoE client or a Web browser. If the PPPoE client is activated, the user name “hirake” and the password “goma” are input by the user's manual operation in step S16. When the “connect” button is pressed by the user in step S17, the correspondence between the user authentication software, the user name “hirake”, and the password “goma” is automatically displayed in a data table format, for example, as shown in FIG. be registered.
[0025]
The automatic registration of the user name and password can be performed using a user name / password automatic saving function provided as a standard in the OS if it is a Windows (registered trademark) XP terminal. In step S18, an authentication packet including the user name “hirake” and the password “goma” is transmitted to the public wireless access point. That is, log in to the system.
[0026]
On the other hand, if the Web browser is activated as the user authentication software, in step S21, it is automatically redirected to the authentication URL according to the instruction of the wireless GW. In step S22, the user name and password are input by the user's manual operation on the redirect destination authentication screen.
[0027]
In step S23, when the "login" button is pressed by the user and login is successful in step S24, in step S25, for example, the carrier name of the hotspot service is used as identification information unique to the combination of the user name and password. Is input. Here, a description will be given assuming that “jumon” is input as identification information. In step S26, the correspondence relationship between the execution file of the user authentication software and the authentication data is registered, for example, in a data table format as shown in FIG.
[0028]
In the case of a Windows (registered trademark) XP terminal, the registration can be performed using the Web browser control function of Microsoft's component public Web browser / Internet Explorer. At this time, if the IP address included in the authentication URL transmitted from the wireless GW is different even with the same ESS-ID, the user name and password are registered in association with other identification information. Here, the user name “hirake” and the password “goma” are registered in association with the identification information “jumon”, and the user name “yama” and the password “kawa” are registered in association with the identification information “aikotoba”. ing.
[0029]
The authentication data to be registered differs depending on a method (method) for transferring a user name and password to CGI (Common Gateway Interface) on HTTP / HTTPS. In the case of the GET method, as shown in FIG. 4A, the authentication URL information to which the user name, password, and login instruction are added and the HTML file of the authentication URL are registered. In the case of the POST method, authentication URL information, a user name, a password, a login variable scalar variable $ PostData, and an authentication URL HTML file are registered as shown in FIG.
[0030]
Next, the automatic authentication process according to the present invention will be described in detail with reference to the flowchart of FIG.
[0031]
First, in step S31, the ESS-ID is acquired from the access point through the wireless LAN client adapter attached to the data communication terminal in the same manner as described above. In step S32, the newly acquired ESS-ID is compared with the ESS-ID already registered in the data table. If the ESS-ID matching the newly acquired ESS-ID is already registered, the ESS-ID User authentication software (PPPoE client or Web browser) associated with the ID is automatically started.
[0032]
In step S33, the activated authentication software is determined. If it is a PPPoE client, the process proceeds to step S42, and the user name / password automatically selected as a default (that is, the user name / password input in step S16 in FIG. 1). An authentication packet including an instruction to press the “Connect” button is transmitted. As an example of the means for transmitting the authentication packet, a method using a RAS API (Remote Access Service Application Program Interface) function can be cited as an example for a Windows (registered trademark) XP terminal.
[0033]
On the other hand, if the Web browser is activated as the authentication software, the process proceeds to step S35. In step S35, the authentication URL is automatically redirected according to the instruction from the wireless GW. In step S36, it is determined whether or not the same URL is already registered. If it is already registered, whether or not the HTML of the authentication URL is the same as the HTML already registered in the data table in step S37. Determined. If they match, it is determined in step S38 whether or not a plurality of sets of user names / passwords are registered.
[0034]
If a plurality of sets of user names / passwords are registered as shown in FIG. 4, a list of identification information of each set (“jumon” and “aikotoba” in the example of FIG. 4) is obtained in step S39. Will pop up. When any identification information is selected by the user in step S40, a user name / password corresponding to the selected identification information is extracted in step S41, and authentication including the user name and password is performed in step S42. A packet is sent.
[0035]
If it is determined in step S38 that only one set of user name / password is registered, the user name / password is extracted in step S41, and login is performed in the same manner as described above in step S42.
[0036]
On the other hand, if it is determined in step S36 that the same URL is not registered, or if it is determined in step S37 that the HTML does not match, in step S43, the user inputs a user name and password on the authentication screen. In step S44, the "login" button is pressed. After successful login in step S45, when identification information is input in step S46, in step S47, the correspondence relationship between the authentication URL, user name / password, and identification information is registered in the data table in the same manner as described above. Used when logging in.
[0037]
【The invention's effect】
According to the present invention, the following effects are achieved.
(1) When the data communication terminal receives an identification code specific to the group to which the access point belongs from the access point, user authentication software associated with this identification code is automatically started. The user of the terminal is freed from the work of selecting and starting user authentication software.
(2) When the user authentication software is started, a user name and password associated with the user authentication software are selected in advance, and an authentication packet including this is automatically transmitted to the access point. The user of the communication terminal is freed from the work of inputting the user name and password.
(3) The HTML file of the authentication URL is stored in advance, and when redirected to the authentication URL, the redirected HTML file is compared with the registered HTML file, and an authentication packet is sent only when the two match. Therefore, it is possible to prevent authentication packet transmission to an incorrect authentication URL.
[Brief description of the drawings]
FIG. 1 is a flowchart showing a manual registration procedure that is first executed in a data communication terminal as a preparation process when realizing automation of an authentication procedure according to the present invention.
FIG. 2 is a diagram showing an example of a data table in which a correspondence relationship between user authentication software and ESS-ID is registered.
FIG. 3 is a diagram illustrating an example of a data table in which a correspondence relationship between user authentication software and a user authentication code is registered.
FIG. 4 is a diagram illustrating an example of a data table in which a correspondence relationship between an execution file of user authentication software and an authentication URL is registered.
FIG. 5 is a flowchart showing a procedure of automatic authentication processing according to the present invention.
FIG. 6 is a flowchart showing a procedure of a conventional automatic authentication process.
FIG. 7 is a block diagram of a user authentication method based on the PPPoE method.
FIG. 8 is a block diagram of a user authentication method based on an HTTP / HTTPS method.

Claims (5)

In a method in which a data communication terminal wirelessly connected to an access point requests user authentication from the access point,
A procedure for receiving an identification code unique to the access point from the access point;
A procedure for starting user authentication software registered in advance corresponding to the received identification code;
A procedure for selecting a pre-registered user authentication code corresponding to the activated user authentication software;
And a procedure for applying the selected user authentication code to the activated user authentication software. In a user authentication program that is implemented in a data communication terminal that is wirelessly connected to an access point and requests user authentication for the access point,
A procedure for receiving an identification code unique to the access point from the access point;
A procedure for starting user authentication software registered in advance corresponding to the received identification code;
A procedure for selecting a pre-registered user authentication code corresponding to the activated user authentication software;
A user authentication program for executing a procedure for applying the selected user authentication code to the activated user authentication software. In a data communication terminal that establishes a wireless link with an access point and performs data communication,
At least one user authentication software;
A first data table in which the relationship between an access point identification code and user authentication software is registered;
Means for receiving an identification code from an access point;
First selection means for selecting user authentication software corresponding to the received identification code from the first data table;
Means for activating the selected user authentication software;
A second data table in which the relationship between the user authentication software and the user authentication code is registered;
Second selection means for selecting a user authentication code corresponding to the activated user authentication software from the second data table;
A data communication terminal comprising: means for applying the selected user authentication code to the activated user authentication software. In the second data table, a plurality of user authentication codes are registered together with identification information unique to each user authentication code,
Means for displaying the identification information;
Means for selecting any identification information,
4. The data communication terminal according to claim 3, wherein the second selection unit selects a user authentication code associated with the selected identification information from the second data table. 5. In the second data table, an authentication URL and an HTML file of the authentication URL are registered together with a user authentication code corresponding to a Web browser as user authentication software.
A means for comparing the HTML file of the authentication URL redirected by the activated web browser with the HTML file of the authentication URL registered together with the user authentication code selected by the second selection means;
5. The data communication terminal according to claim 3, wherein when the two match, the selected user authentication code is applied to the activated web browser. 6.

Images