JP3961968B2

JP3961968B2 - Mobile communication method and apparatus

Info

Publication number: JP3961968B2
Application number: JP2003046026A
Authority: JP
Inventors: 弘高吉岡; 実松本; 真由美柳谷
Original assignee: Nippon Telegraph and Telephone Corp
Current assignee: Nippon Telegraph and Telephone Corp
Priority date: 2003-02-24
Filing date: 2003-02-24
Publication date: 2007-08-22
Anticipated expiration: 2023-02-24
Also published as: JP2004260309A

Description

【０００１】
【発明の属する技術分野】
本発明は、無線ＬＡＮ、特にインターネット（ＩＰ網）を用いた公衆無線ＬＡＮにおける移動通信技術に関する。
【０００２】
【従来の技術】
無線ＬＡＮの基本的な構成を図１に示す。図中、１はユーザが使用する無線ＬＡＮ対応ＰＣ端末（以下、無線ＬＡＮ端末）、２は無線ＬＡＮ端末１との間で無線通信が可能な複数の無線基地局（以下、アクセスポイント）、３は無線ＬＡＮ端末（もしくはそのユーザ）１を認証する認証サーバであり、アクセスポイント２及び認証サーバ３は通常、有線のネットワーク４を介して接続されている。
【０００３】
無線ＬＡＮにおける従来の移動通信では、移動等に伴って通信中の無線ＬＡＮ端末１とアクセスポイント２との間の電波が弱まり、アクセスポイント２が自動的に切換えられる場合、新たなアクセスポイント２との間でも、通信開始時と同じ認証処理を行う必要があったため、アクセスポイント２の自動切換えの際の、無線ＬＡＮ端末１〜アクセスポイント２〜認証サーバ３間のユーザ認証時間分のオーバーヘッドを削減し、切換え時間を大幅に短縮することは出来なかった。
【０００４】
前述した各装置の詳細構成を図２に示す。即ち、無線ＬＡＮ端末１は、無線チャネル探索部１１、ユーザ認証部１２、パケットヘッダ処理部１３、認証制御部１４及びアクセスポイント対応通信部１５を備えている。また、アクセスポイント２は、保守情報設定部２１、ユーザ静的情報管理部２２、ユーザ動的情報管理部２３、データパケット認証部２４、データパケット転送判定部２５、パケット種別振り分け部２６、認証制御部２７、端末対応通信部２８及び認証サーバ対応通信部２９を備えている。また、認証サーバ３は、保守情報設定部３１、ユーザ情報管理部３２、アクセスポイント情報管理部３３、ユーザ認証処理部３４、主要処理部３５及びアクセスポイント対応通信部３６を備えている。
【０００５】
無線ＬＡＮ端末１、アクセスポイント２及び認証サーバ３は、通信開始要求時でも、アクセスポイントの自動切換え時でも同じ処理を行う。無線ＬＡＮ端末１は、まずアクセスポイント２との間の無線チャネルを探索し、アクセスポイント２との通信が可能となった後、網へのデータ転送を許可してもらうために、アクセスポイント２を介して認証サーバ３との間で暗号処理を含んだ複雑な認証処理を行う。認証には、ユーザのＩＤとパスワード、認証サーバ３と無線ＬＡＮ端末１でのみ管理する秘密鍵を使用する。
【０００６】
認証がＯＫとなった後、無線ＬＡＮ端末１はその認証時に認証鍵と動的な数値を元に算出した一時的な値やＭＡＣアドレス等を認証ヘッダとしてデータパケットのヘッダに組み込み、網へデータパケットを転送する。アクセスポイント２では、この値が正しいパケットのみを簡単なパケット認証処理で判定して網へ転送し、不正なパケットは廃棄する。
【０００７】
各アクセスポイント２間では情報の交換を行わないため、アクセスポイント２の自動切換えの際に無線ＬＡＮ端末自体の認証処理を毎回行う必要があり、この複雑な認証処理を完全に省略することは困難であった（特許文献１参照）。
【０００８】
類似のシステムとして、第３世代携帯電話での基地局自動切換え方法（ＣＤＭＡ方式）があるが、これは端末が特定機能に特化して開発でき、無線チャネルを同時に２つ確保できるため、切換え自体の処理は高速であるが、切換えのために端末と認証サーバとの間で前もって認証するだけであり、認証を省略しているわけではない。また、汎用的なＰＣ端末の使用を基本とする無線ＬＡＮにおいて、この方式を用いようとすると、無線ＬＡＮカードが２枚必要となり、また、専用のドライバの開発も必要となり、端末側での改造・変更の負担が大きく、現実的な手法ではなかった。
【０００９】
【特許文献１】
特開平１０−１３９５６号公報
【００１０】
【発明が解決しようとする課題】
このように、無線ＬＡＮにおける従来の移動通信では、アクセスポイント自動切換え時にも複雑な認証処理が必要であり、該認証処理のオーバーヘッドが切換え時間の短縮を妨げてしまうという問題があった。
【００１１】
また、従来、アクセスポイント自動切換え時の認証処理を省略するには、端末に無線ＬＡＮカードを２枚実装し、専用のドライバを搭載するなど、端末の大きな改造が必要になるという問題があった。
【００１２】
本発明の目的は、端末への大きな改造を必要とすることなく、アクセスポイント自動切換え時の認証処理を省略可能とし、これによって経済的なアクセスポイント自動切換え時のオーバーヘッドの削減、切換え時間の短縮を可能とすることにある。
【００１３】
【課題を解決するための手段】
本発明では上記課題を解決するため、アクセスポイントに関する情報として認証に必要な情報の外、新たに各アクセスポイントの地理的な情報（地理情報）を、事前のアクセスポイント登録の際に追加・登録し、通信開始を要求した無線ＬＡＮ端末を収容したアクセスポイント周辺のアクセスポイントを、アクセスポイント自動切換え時に無線ＬＡＮ端末を収容する可能性のあるアクセスポイントとして検索し、認証サーバから当該無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイントへ認証済み状態であるという情報及び当該一の無線ＬＡＮ端末のデータパケットを転送させる際のパケット毎の認証に必要な情報（パケット転送に必要な認証情報）を配布することにより、無線チャネルを同時に２つ確保したり、そのための改造を端末に施すことなく、アクセスポイント自動切換え時の認証処理を省略可能とする（請求項１）。
【００１４】
また、アクセスポイントでデータパケットを受信した時、初めてのアクセスかどうかを判定し、初めてであればアクセスポイント自動切換えの発生を認証サーバへ通知し、認証サーバでは、新たに一の無線ＬＡＮ端末を収容したアクセスポイント周辺のアクセスポイントを検索し、新たに一の無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイントへ認証済み状態であるという情報及びパケット転送に必要な認証情報を配布するとともに、周辺でなくなったアクセスポイントへ認証済み状態であるという情報及びパケット転送に必要な認証情報の削除を要求することことにより、無線ＬＡＮ端末が移動を続けているような場合でも継続してアクセスポイント自動切換え時の認証処理を省略可能とする（請求項２）。
【００１５】
また、無線ＬＡＮ端末に関する情報として認証に必要な情報の外、新たにアクセスポイント自動切換え時の認証を省略可能か否かを表す情報を、事前のユーザ登録の際に追加・登録し、通信開始時の認証を要求する無線ＬＡＮ端末がアクセスポイント自動切換え時の認証を省略可能な無線ＬＡＮ端末であれば、当該無線ＬＡＮ端末を収容したアクセスポイント周辺のアクセスポイントを、アクセスポイント自動切換え時に無線ＬＡＮ端末を収容する可能性のあるアクセスポイントとして検索し、当該無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイントへ認証済み状態であるという情報及びパケット転送に必要な認証情報を配布することにより、アクセスポイント自動切換え時の認証を省略できない従来の無線ＬＡＮ端末に対して、従来通りのアクセスポイント自動切換え毎の認証を行うことを可能とする（請求項３）。
【００１６】
また、認証済みの無線ＬＡＮ端末が離脱した時、当該無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイントに対し、当該無線ＬＡＮ端末について認証済み状態であるという情報及びパケット転送に必要な認証情報の削除を要求することにより、認証サーバにてその後、認証不可とされた無線ＬＡＮ端末のデータパケットの転送を防止可能とする（請求項４）。
【００１７】
なお、アクセスポイントの地理情報として緯度及び経度を用い、無線ＬＡＮ端末を収容したアクセスポイントの緯度及び経度より一定の範囲内に含まれる緯度及び経度を備えたアクセスポイントを抽出することができる（請求項５）。
【００１８】
また、地理情報をアクセスポイント毎に登録・管理するアクセスポイント情報管理部と、無線ＬＡＮ端末を認証するための情報、認証済みか否かの情報及びパケット転送に必要な認証情報とともにアクセスポイント自動切換え時の認証を省略可能か否かの情報を登録・管理するユーザ情報管理部と、認証省略可能な無線ＬＡＮ端末について通信開始時の認証要求が許可された場合、周辺のアクセスポイントを検索し、当該無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイントへ認証済み状態であるという情報及びパケット転送に必要な認証情報を配布し、また、自動切換えの発生が通知された時、新たな周辺のアクセスポイントを検索し、新たに無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイントへ認証済み状態であるという情報及びパケット転送に必要な認証情報を配布するとともに、周辺でなくなったアクセスポイントへ情報の削除を要求し、さらに離脱要求を受信した時、当該無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイントに対し、情報の削除を要求する認証状態配布部と、通信開始時の認証要求を受信した際、認証省略可能な無線ＬＡＮ端末であれば以後の処理を認証状態配布部へ引き継がせる主要処理部とを備えた認証サーバ（請求項６）と、
一の無線ＬＡＮ端末が認証済み状態であるという情報及びパケット転送に必要な認証情報とともに、認証済み状態の一の無線ＬＡＮ端末からのパケットを受信したか否かを示す情報を登録・管理するユーザ動的情報管理部と、受信したデータパケットが初めてアクセスした無線ＬＡＮ端末からのものかを判定するデータパケット転送判定部と、初めてアクセスした無線ＬＡＮ端末からのデータパケット受信を判定した時、認証サーバへアクセスポイント自動切換えの発生を通知する認証制御部とを備えたアクセスポイントと、
アクセスポイント自動切換え時の認証処理を省略する認証制御部を備えた無線ＬＡＮ端末とにより、これらの通信方法を実現することができる。
【００１９】
【発明の実施の形態】
図３は本発明の実施の形態の一例、ここでは本発明にかかる無線ＬＡＮを構成する各装置の詳細を示すもので、図中、従来技術と同一構成部分は同一符号をもって表す。
【００２０】
即ち、１０は無線ＬＡＮ端末であり、無線チャネル探索部１１、ユーザ認証部１２、パケットヘッダ処理部１３、認証制御部１４ａ及びアクセスポイント対応通信部１５を備えている。また、２０はアクセスポイントであり、保守情報設定部２１、ユーザ静的情報管理部２２、ユーザ動的情報管理部２３ａ、データパケット認証部２４、データパケット転送判定部２５ａ、パケット種別振り分け部２６、認証制御部２７ａ、端末対応通信部２８及び認証サーバ対応通信部２９を備えている。また、３０は認証サーバであり、保守情報設定部３１、ユーザ情報管理部３２ａ、アクセスポイント情報管理部３３ａ、ユーザ認証処理部３４、主要処理部３５ａ、アクセスポイント対応通信部３６及び認証状態配布部３７を備えている。
【００２１】
ここで、番号による符号に「ａ」を付した構成部分は、従来の構成に以下のような情報や処理を追加したことを表している。
【００２２】
即ち、無線ＬＡＮ端末１０の認証制御部１４ａは、アクセスポイント自動切換え時に認証を省略し、すぐにデータパケット転送を行う処理を実行する。
【００２３】
アクセスポイント２０のユーザ動的情報管理部２３ａは、一の無線ＬＡＮ端末が認証済み状態であるという情報及びパケット転送に必要な認証情報（認証ヘッダ）とともに、認証済み状態の一の無線ＬＡＮ端末からのパケットを受信したか否かを示す情報（フラグ）を無線ＬＡＮ端末毎に登録・管理する。なお、認証ヘッダは暗号化するため、そのままの値は無線ネットワーク上には現れない。
【００２４】
また、データパケット転送判定部２５ａは、前記ユーザ動的情報管理部２３ａ内の情報に基づき、受信したデータパケットが既にアクセス済みの無線ＬＡＮ端末からのものか初めてアクセスした無線ＬＡＮ端末からのものかを判定し、初めてアクセスした無線ＬＡＮ端末からのものであれば、ユーザ動的情報管理部２３ａ内のフラグをセット（オン）するとともにこれを認証制御部２７ａへ通知する。
【００２５】
また、認証制御部２７ａは、前記データパケット転送判定部からの通知を受け、認証サーバ３０へアクセスポイント自動切換えの発生を通知する。
【００２６】
認証サーバ３０のユーザ情報管理部３２ａは、無線ＬＡＮ端末を認証するための情報、認証済みか否かの情報及び認証ヘッダとともにアクセスポイント自動切換え時の認証を省略可能か否かを表す情報を無線ＬＡＮ端末（ユーザ）毎に登録する。なお、認証ヘッダとしては、無線ＬＡＮ端末１０と認証サーバ３０との間で認証時に用いた暗号鍵と、現地時間等の動的な値とから一時的に生成した値を用いることにより、不正アクセスを防ぐ。
【００２７】
また、アクセスポイント情報管理部３３ａは、アクセスポイントに関する情報として、図４に示すように、アクセスポイントを認証するためのアクセスポイントＩＰアドレス、認証情報とともに、緯度及び経度からなる地理情報をアクセスポイント毎に登録する。アクセスポイントの地理情報は、アクセスポイント登録時に同時に装置管理者から静的な情報として登録しても良いし、アクセスポイントとの通信を行って、アクセスポイントからＧＰＳ等による位置情報を受け取り、自動的に登録しても良い。
【００２８】
また、主要処理部３５ａは、一の無線ＬＡＮ端末からの通信開始時の認証要求を受信した際、当該一の無線ＬＡＮ端末の認証を前記ユーザ情報管理部内の情報に基づきユーザ認証処理部に実行させるとともに、当該一の無線ＬＡＮ端末がアクセスポイント自動切換え時の認証を省略可能な無線ＬＡＮ端末であれば以後の処理を認証状態配布部へ引き継がせる。
【００２９】
また、認証状態配布部３７は、アクセスポイント自動切換え時の認証を省略可能な無線ＬＡＮ端末について通信開始時の認証要求が許可された場合、当該無線ＬＡＮ端末を収容したアクセスポイント周辺のアクセスポイントを前記アクセスポイント情報管理部３３ａから検索し、当該無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイントへ当該無線ＬＡＮ端末が認証サーバにて認証済み状態であるという情報及び認証ヘッダを配布し、また、アクセスポイントから自動切換えの発生が通知された時、新たに無線ＬＡＮ端末を収容したアクセスポイント周辺のアクセスポイントを前記アクセスポイント情報管理部３３ａから検索し、新たに無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイントへ当該無線ＬＡＮ端末が認証サーバにて認証済み状態であるという情報及び認証ヘッダを配布するとともに、周辺でなくなったアクセスポイントへ当該無線ＬＡＮ端末が認証サーバにて認証済み状態であるという情報及び認証ヘッダの削除を要求し、さらにまた、無線ＬＡＮ端末からの離脱要求を受信した時、当該無線ＬＡＮ端末が認証済みの無線ＬＡＮ端末であれば当該無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイントに対し、当該無線ＬＡＮ端末について認証済み状態であるという情報及び認証ヘッダの削除を要求する。
【００３０】
なお、その他の構成は従来の場合と同様である。
【００３１】
図５は認証サーバにおける事前登録時及び初回認証時の処理フローを示す。また、図６はアクセスポイント並びに認証サーバにおけるアクセスポイント自動切換え時及び網離脱時の処理フローを示す。なお、処理は変更又は追加したブロックに関するものに特化した。
【００３２】
以下、本発明にかかる無線ＬＡＮの動作について詳述する。
【００３３】
まず、認証サーバ３０において、アクセスポイント情報管理部３３ａにアクセスポイントのＩＰアドレス、認証情報及び地理情報が登録される（ｓ１）。次に、ユーザ情報管理部３２ａに新規ユーザのユーザＩＤ、パスワード、秘密鍵が登録され（ｓ２）、当該ユーザ（無線ＬＡＮ端末）がアクセスポイント自動切換え時の認証を省略可能なユーザであれば（ｓ３）、認証省略フラグをオンにする（ｓ４）。
【００３４】
次に、無線ＬＡＮ端末１０が通信を開始するため、任意のアクセスポイント（通常、最も近いアクセスポイント）２０との間で無線チャネルの探索を行い、当該アクセスポイント２０と通信が可能となった後、網へのデータ転送を許可してもらうためにアクセスポイント２０を介して認証サーバ３０に対して認証要求を行うと、認証サーバ３０の主要処理部３５ａは要求中のユーザＩＤをユーザ情報管理部３２ａに対して送ってユーザ情報の検索処理を行わせる（ｓ５）。
【００３５】
ユーザ情報管理部３２ａではユーザＩＤに対応するパスワード、認証情報、認証省略フラグを検索して認証サーバ３０へ返却し（ｓ６）、認証サーバ３０ではパスワード及び認証情報をユーザ認証処理部３４に送って認証処理を行わせ、この際、認証ＯＫであれば認証ヘッダを受け取る（ｓ７）。ここで、認証ＯＫでかつ認証省略フラグがオンでなければ通常の処理（即ち、ユーザに認証不可を返すか又は従来通りにアクセスポイント自動切換え毎に認証処理を繰り返す）とし、認証ＯＫでかつ認証省略フラグがオンであれば、認証ヘッダをユーザ情報管理部３２ａに送って記憶させる（ｓ９，ｓ１０）とともに、認証配布部３７に以後の処理を引き継がせる。
【００３６】
認証配布部３７は、アクセスポイント情報管理部３３ａに対して無線ＬＡＮ端末を収容したアクセスポイント周辺のアクセスポイントの検索を要求し（ｓ１１）、アクセスポイント情報管理部３３ａでは無線ＬＡＮ端末を収容したアクセスポイントの緯度及び経度より一定の範囲内に含まれる緯度及び経度を備えたアクセスポイントを抽出し、これを認証配布部３７へ返却する（ｓ１２）。認証配布部３７は、当該無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイント２０へ認証済み情報及び認証ヘッダを配布する（ｓ１３）。
【００３７】
次に、通信中の無線ＬＡＮ端末１０が移動して該通信中の無線ＬＡＮ端末１０と新たなアクセスポイント（但し、このアクセスポイントは通信中の無線ＬＡＮ端末１０に関する認証済み情報及び認証ヘッダを受信・登録しているものとする。）２０との間に無線チャネルが設定され、該新たなアクセスポイント２０にデータパケットが転送された場合（ｓ２１）、該アクセスポイント２０ではユーザ動的情報管理部２３ａ内の情報に基づき、データパケット認証部２４によりデータパケットのヘッダを認証し（ｓ２２）、認証不可であれば通常のＮＧ処理（廃棄等）を行い、認証可能であれば当該データパケットを転送する（ｓ２３）。また、この際、ユーザ動的情報管理部２３ａ内の情報に基づき、データパケット転送判定部２５ａにより初めてのアクセスした無線ＬＡＮ端末からのものかを判定し、この場合、初めてのアクセスした無線ＬＡＮ端末からのものであるから認証制御部２７ａにより認証サーバ３０へアクセスポイント自動切換えの発生を通知する（ｓ２４）。
【００３８】
アクセスポイント自動切換えの発生通知を受信した認証サーバ３０では、認証状態配布部３７がアクセスポイント情報管理部３３ａに対して無線ＬＡＮ端末を新たに収容したアクセスポイント周辺のアクセスポイントの検索を要求し（ｓ２５）、アクセスポイント情報管理部３３ａでは無線ＬＡＮ端末を新たに収容したアクセスポイントの緯度及び経度より一定の範囲内に含まれる緯度及び経度を備えたアクセスポイントを抽出し、これを認証配布部３７へ返却する（ｓ２６）。認証配布部３７は、新たに無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイント２０へ認証済み情報及び認証ヘッダを配布する（ｓ２７）とともに、範囲外となったアクセスポイント２０へ認証済み情報及び認証ヘッダの削除を要求する（ｓ２８）。
【００３９】
また、無線ＬＡＮ端末１０からの離脱要求をアクセスポイント２０を介して認証サーバ３０が受信する（ｓ２９）と、認証状態配布部３７がユーザ情報管理部３２ａに対して該当無線ＬＡＮ端末の離脱処理を要求し（ｓ３０）、これに従ってユーザ情報管理部３２ａが該当無線ＬＡＮ端末に対応する認証済み情報及び認証ヘッダ情報を削除し（ｓ３１）、また、当該無線ＬＡＮ端末が認証済みの無線ＬＡＮ端末であれば当該無線ＬＡＮ端末を収容したアクセスポイントを含む周辺のアクセスポイントに対し、当該無線ＬＡＮ端末に対応する認証済み情報及び認証ヘッダ情報の削除を要求する（ｓ３２）。
【００４０】
このようにして、アクセスポイント自動切換え時の認証処理を省略可能な無線ＬＡＮの提供が可能となる。
【００４１】
【発明の効果】
以上説明したように、本発明によれば、無線ＬＡＮ通信において、高速なアクセスポイント自動切換えを要求するユーザ（端末）に対して、切換え時には複雑な認証処理が省略でき、網へのデータパケット転送はアクセスポイントの無線チャネル探索のみの時間で開始可能となる。また、端末は、従来通り、無線ＬＡＮカード１枚でサービス提供を受けることが可能で、経済的である。また、従来のアクセスポイント自動切換えのみをサポートする端末に対しても受付可能であるため、１つの網で両方の端末にサービス提供を実現する。
【図面の簡単な説明】
【図１】無線ＬＡＮの基本的な構成図
【図２】従来の無線ＬＡＮを構成する各装置の詳細を示す構成図
【図３】本発明にかかる無線ＬＡＮを構成する各装置の詳細を示す構成図
【図４】本発明で事前情報配布に使用するアクセスポイントの管理表を示す図
【図５】認証サーバにおける事前登録時及び初回認証時の処理を示すフローチャート
【図６】アクセスポイント並びに認証サーバにおけるアクセスポイント自動切換え時及び網離脱時の処理を示すフローチャート
【符号の説明】
１０：無線ＬＡＮ端末、１１：無線チャネル探索部、１２：ユーザ認証部、１３：パケットヘッダ処理部、１４ａ：認証制御部、１５：アクセスポイント対応通信部、２０：アクセスポイント、２１：保守情報設定部、２２：ユーザ静的情報管理部、２３ａ：ユーザ動的情報管理部、２４：データパケット認証部、２５ａ：データパケット転送判定部、２６：パケット種別振り分け部、２７ａ：認証制御部、２８：端末対応通信部、２９：認証サーバ対応通信部、３０：認証サーバ、３１：保守情報設定部、３２ａ：ユーザ情報管理部、３３ａ：アクセスポイント情報管理部、３４：ユーザ認証処理部、３５ａ：主要処理部、３６：アクセスポイント対応通信部、３７：認証状態配布部。[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a mobile communication technique in a wireless LAN, particularly in a public wireless LAN using the Internet (IP network).
[0002]
[Prior art]
A basic configuration of a wireless LAN is shown in FIG. In the figure, 1 is a wireless LAN compatible PC terminal (hereinafter referred to as a wireless LAN terminal) used by a user, 2 is a plurality of wireless base stations (hereinafter referred to as access points) capable of wireless communication with the wireless LAN terminal 1, 3 Is an authentication server for authenticating the wireless LAN terminal (or its user) 1, and the access point 2 and the authentication server 3 are usually connected via a wired network 4.
[0003]
In the conventional mobile communication in the wireless LAN, when the radio wave between the wireless LAN terminal 1 and the access point 2 in communication is weakened due to movement or the like, and the access point 2 is automatically switched, Since the same authentication process as at the start of communication had to be performed even during communication, the overhead for user authentication time between the wireless LAN terminal 1 to the access point 2 to the authentication server 3 when the access point 2 was automatically switched was reduced However, the switching time could not be significantly reduced.
[0004]
The detailed configuration of each device described above is shown in FIG. That is, the wireless LAN terminal 1 includes a wireless channel search unit 11, a user authentication unit 12, a packet header processing unit 13, an authentication control unit 14, and an access point corresponding communication unit 15. The access point 2 includes a maintenance information setting unit 21, a user static information management unit 22, a user dynamic information management unit 23, a data packet authentication unit 24, a data packet transfer determination unit 25, a packet type distribution unit 26, an authentication control. Unit 27, terminal-compatible communication unit 28, and authentication server-compatible communication unit 29. The authentication server 3 also includes a maintenance information setting unit 31, a user information management unit 32, an access point information management unit 33, a user authentication processing unit 34, a main processing unit 35, and an access point corresponding communication unit 36.
[0005]
The wireless LAN terminal 1, the access point 2, and the authentication server 3 perform the same processing when a communication start request is made or when an access point is automatically switched. The wireless LAN terminal 1 first searches for a wireless channel with the access point 2, and after communication with the access point 2 becomes possible, the access point 2 is used to permit data transfer to the network. Through the authentication server 3, complicated authentication processing including encryption processing is performed. For the authentication, a user ID and password, and a secret key managed only by the authentication server 3 and the wireless LAN terminal 1 are used.
[0006]
After the authentication is successful, the wireless LAN terminal 1 incorporates a temporary value or a MAC address calculated based on the authentication key and a dynamic numerical value at the time of authentication into the data packet header as an authentication header, and transmits data to the network. Forward the packet. In the access point 2, only packets with the correct value are determined by simple packet authentication processing and transferred to the network, and illegal packets are discarded.
[0007]
Since information is not exchanged between the access points 2, it is necessary to perform authentication processing of the wireless LAN terminal itself every time the access point 2 is automatically switched, and it is difficult to completely omit this complicated authentication processing. (See Patent Document 1).
[0008]
As a similar system, there is a base station automatic switching method (CDMA method) in a third-generation mobile phone, but this can be developed by a terminal specialized for a specific function and two radio channels can be secured simultaneously, so switching itself This process is high-speed, but only authentication is performed in advance between the terminal and the authentication server for switching, and authentication is not omitted. In addition, when using this method in a wireless LAN based on the use of a general-purpose PC terminal, two wireless LAN cards are required, and development of a dedicated driver is also required.・ The burden of change was large and it was not a realistic method.
[0009]
[Patent Document 1]
Japanese Patent Laid-Open No. 10-13956
[Problems to be solved by the invention]
As described above, the conventional mobile communication in the wireless LAN has a problem that a complicated authentication process is required even when the access point is automatically switched, and the overhead of the authentication process prevents the switching time from being shortened.
[0011]
Conventionally, in order to omit the authentication process at the time of automatic access point switching, there has been a problem that a large modification of the terminal is required, such as mounting two wireless LAN cards in the terminal and installing a dedicated driver. .
[0012]
The object of the present invention is that it is possible to omit the authentication process at the time of automatic access point switching without requiring a large remodeling to the terminal, thereby reducing the overhead at the time of economical automatic access point switching and shortening the switching time. Is to make it possible.
[0013]
[Means for Solving the Problems]
In the present invention, in order to solve the above-mentioned problem, in addition to information necessary for authentication as information relating to an access point, geographical information (geographic information) of each access point is newly added / registered at the time of prior access point registration. The access point around the access point that accommodated the wireless LAN terminal that requested the communication start is searched as an access point that may accommodate the wireless LAN terminal at the time of automatic access point switching, and the wireless LAN terminal is retrieved from the authentication server. Information that is in an authenticated state to peripheral access points including the accommodated access point and information necessary for authentication for each packet when transferring the data packet of the one wireless LAN terminal (authentication information necessary for packet transfer) To distribute two wireless channels at the same time, Without applying modification of fit to the terminal, and optional authentication processing at the access point automatic switching (claim 1).
[0014]
When the access point receives a data packet, it determines whether it is the first access. If it is the first time, it notifies the authentication server of the occurrence of automatic access point switching, and the authentication server adds a new wireless LAN terminal. Search for access points around the accommodated access point, and distribute information indicating that authentication has been completed and information necessary for packet transfer to peripheral access points including the access point that newly accommodated one wireless LAN terminal. The access point continues even when the wireless LAN terminal continues to move by requesting the access point that is no longer in the vicinity to request the deletion of the information indicating that it has been authenticated and the authentication information necessary for packet transfer. Authentication processing at the time of automatic switching can be omitted (claim 2).
[0015]
In addition to information necessary for authentication as information on wireless LAN terminals, information indicating whether authentication at the time of automatic access point automatic switching can be omitted is added / registered at the time of prior user registration, and communication starts If the wireless LAN terminal that requests authentication at the time is a wireless LAN terminal that can omit the authentication at the time of automatic access point switching, an access point around the access point that accommodates the wireless LAN terminal is connected to the wireless LAN terminal at the time of automatic access point switching. By searching as an access point that may accommodate the terminal, and distributing information indicating that the terminal is authenticated and information necessary for packet transfer to peripheral access points including the access point that accommodates the wireless LAN terminal , Conventional wireless LAN terminal that can not omit the authentication at the time of automatic access point switching Against, makes it possible to perform authentication for each access point automatic switching conventional (claim 3).
[0016]
Further, when an authenticated wireless LAN terminal leaves, information indicating that the wireless LAN terminal is in an authenticated state and authentication necessary for packet transfer to peripheral access points including the access point accommodating the wireless LAN terminal. By requesting the deletion of information, it is possible to prevent the data packet from being transferred from the wireless LAN terminal, which is subsequently disabled by the authentication server (claim 4).
[0017]
Note that latitude and longitude are used as the geographical information of the access point, and an access point having a latitude and longitude included within a certain range can be extracted from the latitude and longitude of the access point that accommodates the wireless LAN terminal. Item 5).
[0018]
In addition, an access point information management unit for registering and managing geographic information for each access point, automatic access point switching together with information for authenticating a wireless LAN terminal, information on whether or not authenticated, and authentication information necessary for packet transfer When the authentication request at the start of communication is permitted for a wireless LAN terminal that can register and manage information on whether or not the authentication at the time can be omitted, and a wireless LAN terminal that can omit the authentication, search for nearby access points, Distribute information indicating that authentication has been completed and authentication information necessary for packet transfer to peripheral access points including the access point that accommodates the wireless LAN terminal. Access points in the vicinity including access points that newly accommodated wireless LAN terminals Distributes information indicating that it is in an authenticated state and authentication information necessary for packet transfer to the access point that is no longer in the vicinity, and when it receives a withdrawal request, it accommodates the wireless LAN terminal An authentication status distribution unit that requests deletion of information to peripheral access points including the access point, and a wireless LAN terminal that can omit authentication when receiving an authentication request at the start of communication, the subsequent processing is authenticated. An authentication server comprising a main processing unit to be handed over to the distribution unit (claim 6);
A user who registers and manages information indicating whether or not a packet from an authenticated wireless LAN terminal is received, together with information indicating that the wireless LAN terminal is authenticated and authentication information necessary for packet transfer. A dynamic information management unit, a data packet transfer determination unit that determines whether the received data packet is from a wireless LAN terminal that is accessed for the first time, and an authentication server that determines whether the data packet is received from a wireless LAN terminal that is accessed for the first time an access point comprising an authentication control unit for notifying the occurrence of the access point automatically switched to,
By a wireless LAN terminal end having a omitted authentication control unit authentication processing at the access point automatic switching, it is possible to implement these communication methods.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
FIG. 3 shows an example of an embodiment of the present invention, and here shows details of each device constituting the wireless LAN according to the present invention. In the figure, the same components as those of the prior art are denoted by the same reference numerals.
[0020]
That is, reference numeral 10 denotes a wireless LAN terminal, which includes a wireless channel search unit 11, a user authentication unit 12, a packet header processing unit 13, an authentication control unit 14a, and an access point corresponding communication unit 15. Reference numeral 20 denotes an access point, which includes a maintenance information setting unit 21, a user static information management unit 22, a user dynamic information management unit 23a, a data packet authentication unit 24, a data packet transfer determination unit 25a, a packet type distribution unit 26, An authentication control unit 27a, a terminal-compatible communication unit 28, and an authentication server-compatible communication unit 29 are provided. Reference numeral 30 denotes an authentication server, which includes a maintenance information setting unit 31, a user information management unit 32a, an access point information management unit 33a, a user authentication processing unit 34, a main processing unit 35a, an access point corresponding communication unit 36, and an authentication state distribution unit. 37.
[0021]
Here, the components with “a” added to the reference numerals indicate that the following information and processing are added to the conventional configuration.
[0022]
That is, the authentication control unit 14a of the wireless LAN terminal 10 omits the authentication at the time of automatic access point switching, and immediately executes a process of transferring data packets.
[0023]
The user dynamic information management unit 23a of the access point 20 receives information indicating that one wireless LAN terminal is in an authenticated state and authentication information (authentication header) necessary for packet transfer from one wireless LAN terminal in the authenticated state. The information (flag) indicating whether or not the packet is received is registered and managed for each wireless LAN terminal. Since the authentication header is encrypted, the value as it is does not appear on the wireless network.
[0024]
The data packet transfer determination unit 25a determines whether the received data packet is from an already accessed wireless LAN terminal or the first accessed wireless LAN terminal based on the information in the user dynamic information management unit 23a. If it is from the wireless LAN terminal accessed for the first time, the flag in the user dynamic information management unit 23a is set (turned on) and notified to the authentication control unit 27a.
[0025]
Further, the authentication control unit 27a receives the notification from the data packet transfer determination unit and notifies the authentication server 30 of the occurrence of automatic access point switching.
[0026]
The user information management unit 32a of the authentication server 30 wirelessly transmits information for authenticating the wireless LAN terminal, information on whether or not authenticated, and information indicating whether or not authentication at the time of automatic access point switching can be omitted. Register for each LAN terminal (user). As the authentication header, an illegal access is made by using a value temporarily generated from an encryption key used for authentication between the wireless LAN terminal 10 and the authentication server 30 and a dynamic value such as local time. prevent.
[0027]
Further, as shown in FIG. 4, the access point information management unit 33a obtains geographical information including latitude and longitude together with an access point IP address and authentication information for authenticating the access point, as shown in FIG. Register with. The geographical information of the access point may be registered as static information from the device administrator at the same time when the access point is registered, or it communicates with the access point, receives location information by GPS etc. from the access point, and automatically You may register for.
[0028]
When the main processing unit 35a receives an authentication request at the start of communication from one wireless LAN terminal, the main processing unit 35a executes authentication of the one wireless LAN terminal to the user authentication processing unit based on information in the user information management unit. In addition, if the one wireless LAN terminal is a wireless LAN terminal capable of omitting the authentication at the time of automatic access point switching, the subsequent processing is transferred to the authentication state distribution unit.
[0029]
Further, when an authentication request at the start of communication is permitted for a wireless LAN terminal capable of omitting authentication at the time of automatic access point switching, the authentication status distribution unit 37 selects an access point around the access point that accommodates the wireless LAN terminal. Search from the access point information management unit 33a, distribute information that the wireless LAN terminal is authenticated by the authentication server and an authentication header to peripheral access points including the access point that accommodates the wireless LAN terminal, Further, when the occurrence of automatic switching is notified from the access point, an access point around the access point that newly accommodates the wireless LAN terminal is retrieved from the access point information management unit 33a, and the access that newly accommodates the wireless LAN terminal Applies to nearby access points including points The information and authentication header that the wired LAN terminal is authenticated by the authentication server are distributed and the information that the wireless LAN terminal is authenticated by the authentication server and the authentication header Further, when the wireless LAN terminal is an authenticated wireless LAN terminal when a request for deletion is received and a disconnection request from the wireless LAN terminal is received, access points around the access point including the access point accommodating the wireless LAN terminal On the other hand, deletion of information indicating that the wireless LAN terminal is authenticated and an authentication header are requested.
[0030]
Other configurations are the same as in the conventional case.
[0031]
FIG. 5 shows a processing flow at the time of pre-registration and initial authentication in the authentication server. FIG. 6 shows a processing flow at the time of automatic switching of access points and leaving of the network at the access point and the authentication server. The processing is specialized for the changed or added block.
[0032]
The operation of the wireless LAN according to the present invention will be described in detail below.
[0033]
First, in the authentication server 30, the IP address, authentication information, and geographic information of the access point are registered in the access point information management unit 33a (s1). Next, the user ID, password, and secret key of the new user are registered in the user information management unit 32a (s2), and if the user (wireless LAN terminal) can omit the authentication at the time of automatic access point switching ( s3) The authentication omission flag is turned on (s4).
[0034]
Next, after the wireless LAN terminal 10 starts communication, after searching for a wireless channel with an arbitrary access point (usually the closest access point) 20, communication with the access point 20 becomes possible. When an authentication request is made to the authentication server 30 via the access point 20 in order to allow data transfer to the network, the main processing unit 35a of the authentication server 30 assigns the requested user ID to the user information management unit 32a is sent to 32a to perform user information search processing (s5).
[0035]
The user information management unit 32a searches for the password, authentication information, and authentication skip flag corresponding to the user ID and returns them to the authentication server 30 (s6). The authentication server 30 sends the password and authentication information to the user authentication processing unit 34. Authentication processing is performed. At this time, if the authentication is OK, an authentication header is received (s7). Here, if the authentication is OK and the authentication omission flag is not ON, normal processing (that is, authentication is returned to the user or authentication processing is repeated every time the access point is automatically switched) is performed. If the omission flag is on, the authentication header is sent to the user information management unit 32a for storage (s9, s10), and the authentication distribution unit 37 takes over the subsequent processing.
[0036]
The authentication distribution unit 37 requests the access point information management unit 33a to search for an access point around the access point that accommodates the wireless LAN terminal (s11), and the access point information management unit 33a accesses the access point that accommodates the wireless LAN terminal. An access point having a latitude and longitude included within a certain range from the latitude and longitude of the point is extracted and returned to the authentication distribution unit 37 (s12). The authentication distribution unit 37 distributes the authenticated information and the authentication header to the peripheral access points 20 including the access point accommodating the wireless LAN terminal (s13).
[0037]
Next, the wireless LAN terminal 10 in communication moves and the wireless LAN terminal 10 in communication and a new access point (however, this access point receives authenticated information and an authentication header related to the wireless LAN terminal 10 in communication) When a wireless channel is set up with 20 and a data packet is transferred to the new access point 20 (s21), the user dynamic information management unit at the access point 20 Based on the information in 23a, the data packet authentication unit 24 authenticates the header of the data packet (s22). If the authentication is impossible, normal NG processing (discarding) is performed. If the authentication is possible, the data packet is transferred. (S23). At this time, based on the information in the user dynamic information management unit 23a, the data packet transfer determination unit 25a determines whether the access is from the first wireless LAN terminal accessed, and in this case, the first accessed wireless LAN terminal Therefore, the authentication control unit 27a notifies the authentication server 30 of the occurrence of automatic access point switching (s24).
[0038]
In the authentication server 30 that has received the notification of the occurrence of automatic access point switching, the authentication status distribution unit 37 requests the access point information management unit 33a to search for access points around the access point that newly accommodates the wireless LAN terminal ( s25) In the access point information management unit 33a, an access point having a latitude and longitude included in a certain range is extracted from the latitude and longitude of the access point that newly accommodates the wireless LAN terminal, and this is extracted as the authentication distribution unit 37. (S26). The authentication distribution unit 37 distributes the authenticated information and the authentication header to the peripheral access points 20 including the access point that newly accommodates the wireless LAN terminal (s27), and the authenticated information to the access point 20 that is out of the range. And deletion of the authentication header is requested (s28).
[0039]
Further, when the authentication server 30 receives a request for leaving from the wireless LAN terminal 10 via the access point 20 (s29), the authentication status distributing unit 37 performs the process of leaving the corresponding wireless LAN terminal to the user information managing unit 32a. In response to the request (s30), the user information management unit 32a deletes the authenticated information and authentication header information corresponding to the corresponding wireless LAN terminal according to the request (s31), and the wireless LAN terminal is an authenticated wireless LAN terminal. For example, the peripheral access point including the access point accommodating the wireless LAN terminal is requested to delete the authenticated information and authentication header information corresponding to the wireless LAN terminal (s32).
[0040]
In this way, it is possible to provide a wireless LAN that can omit the authentication processing at the time of automatic access point switching.
[0041]
【The invention's effect】
As described above, according to the present invention, in wireless LAN communication, complicated authentication processing can be omitted at the time of switching for a user (terminal) that requests high-speed automatic access point switching, and data packets are transferred to the network. Can be started in a time only for searching the wireless channel of the access point. In addition, the terminal can receive service with a single wireless LAN card, as is conventional, and is economical. In addition, since it is possible to accept a terminal that supports only conventional automatic access point switching, a service can be provided to both terminals in one network.
[Brief description of the drawings]
FIG. 1 is a basic configuration diagram of a wireless LAN. FIG. 2 is a configuration diagram showing details of each device constituting a conventional wireless LAN. FIG. FIG. 4 is a diagram showing a management table of access points used for pre-information distribution in the present invention. Flow chart showing processing at the time of automatic access point switching and network disconnection in the server
10: Wireless LAN terminal, 11: Wireless channel search unit, 12: User authentication unit, 13: Packet header processing unit, 14a: Authentication control unit, 15: Access point compatible communication unit, 20: Access point, 21: Maintenance information setting Unit: 22: user static information management unit, 23a: user dynamic information management unit, 24: data packet authentication unit, 25a: data packet transfer determination unit, 26: packet type distribution unit, 27a: authentication control unit, 28: Terminal compatible communication unit 29: Authentication server compatible communication unit 30: Authentication server 31: Maintenance information setting unit 32a: User information management unit 33a: Access point information management unit 34: User authentication processing unit 35a: Main Processing unit, 36: access point compatible communication unit, 37: authentication status distribution unit.

Claims

In a wireless LAN including a wireless LAN terminal used by a user, a plurality of access points capable of wireless communication with the wireless LAN terminal and an authentication server for authenticating the wireless LAN terminal, the wireless authenticated by the authentication server among the wireless LAN terminals Only the LAN terminal is communicably connected to the network side via one access point, and the radio wave between the wireless LAN terminal and one access point communicating with the wireless LAN terminal is weakened due to the movement of the wireless LAN terminal. It is a mobile communication method that automatically switches the one access point to another access point,
A step of registering the authentication server including the access point geographical information as information about the access point;
When the authentication server processes the authentication request at the start of communication of one wireless LAN terminal, the access server searches for an access point around the access point that accommodates the one wireless LAN terminal from the geographical information of the registered access point, and Distributing information that the one wireless LAN terminal is in an authenticated state and authentication information necessary for packet transfer to peripheral access points including an access point that accommodates the one wireless LAN terminal;
When the access point receives the data packet, it is determined whether or not the data packet can be authenticated by the distributed information; if the authentication is possible, the data packet is transferred; A mobile communication method characterized by comprising:

The mobile communication method according to claim 1, wherein
When the access point receives a data packet, it determines whether the data packet can be authenticated with the distributed information and whether it is the first access, and if it is authentic and is the first access, transfers the data packet And notifying the authentication server of the occurrence of automatic access point switching, transferring the data packet if authentication is possible and access is not performed for the first time, and discarding if authentication is impossible,
When the authentication server receives the notification, the access point around the access point that newly accommodated one wireless LAN terminal is searched from the geographical information of the registered access point, and the access that newly accommodated one wireless LAN terminal Distributes information that the one wireless LAN terminal is authenticated to the access points around the point and authentication information necessary for packet transfer, and the one wireless LAN terminal is authenticated to the access points that are no longer in the vicinity And a step of requesting deletion of authentication information necessary for packet transfer.

The mobile communication method according to claim 1 or 2,
A step of registering an authentication server including information indicating whether or not authentication at the time of automatic access point switching can be omitted as information on the wireless LAN terminal;
When the authentication server processes an authentication request at the time of starting communication of one wireless LAN terminal, information on the registered wireless LAN terminal indicates whether the one wireless LAN terminal can omit the authentication at the time of automatic access point switching If it is a wireless LAN terminal that can be determined from the authentication and the authentication can be omitted, an access point around the access point accommodating the one wireless LAN terminal is searched from the geographical information of the registered access point, and the one wireless LAN terminal Distributing information indicating that the wireless LAN terminal is in an authenticated state and authentication information necessary for packet transfer to peripheral access points including an access point that accommodates the mobile communication method.

The mobile communication method according to any one of claims 1 to 3,
When the authentication server receives a withdrawal request from an authenticated wireless LAN terminal, information and packets indicating that the wireless LAN terminal is in an authenticated state with respect to peripheral access points including the access point accommodating the wireless LAN terminal And a step of requesting deletion of authentication information necessary for transfer.

The mobile communication method according to any one of claims 1 to 4,
When latitude and longitude are used as the geographical information of the access point and the authentication server searches for an access point around the access point that accommodates the wireless LAN terminal, it is within a certain range from the latitude and longitude of the access point that accommodates the wireless LAN terminal. An access point with latitude and longitude included in is extracted.

An authentication server that configures a wireless LAN together with a wireless LAN terminal used by a user and a plurality of access points capable of wireless communication with the wireless LAN terminal, and authenticates the wireless LAN terminal,
As access point information, an access point information management unit that registers and manages geographical information for each access point together with information for authenticating the access point,
Information regarding the wireless LAN terminal includes information for authenticating the wireless LAN terminal, information indicating whether or not authentication has been performed, and information indicating whether authentication at the time of automatic access point switching can be omitted together with authentication information necessary for packet transfer. A user information management unit that registers and manages each wireless LAN terminal;
When an authentication request at the start of communication is permitted for a wireless LAN terminal that can omit authentication at the time of automatic access point switching, the access point information management unit is made to search for an access point around the access point that accommodates the wireless LAN terminal. Distributing information that the wireless LAN terminal is in an authenticated state and authentication information necessary for packet transfer to peripheral access points including the access point that accommodates the wireless LAN terminal, and automatic switching from the access point Is notified, the access point information management unit searches for an access point around the access point that newly accommodated the wireless LAN terminal, and the access point around the access point including the access point that newly accommodated the wireless LAN terminal If the LAN terminal is authenticated Distribution information and authentication information necessary for packet transfer, requesting access points that are no longer in the vicinity to request that the wireless LAN terminal is authenticated and delete authentication information necessary for packet transfer. If the wireless LAN terminal is an authenticated wireless LAN terminal when a disconnection request is received from the wireless LAN terminal, the wireless LAN terminal is accessed with respect to peripheral access points including the access point accommodating the wireless LAN terminal. An authentication status distribution unit for requesting deletion of information indicating an authenticated state and authentication information necessary for packet transfer;
When receiving an authentication request at the start of communication from one wireless LAN terminal, the user authentication processing unit is made to execute authentication of the one wireless LAN terminal based on information in the user information management unit, and the one wireless LAN terminal An authentication server, comprising: a main processing unit for handing over subsequent processing to an authentication status distribution unit if the terminal is a wireless LAN terminal capable of omitting authentication at the time of automatic access point switching.