JP4787730B2 - Wireless LAN terminal and wireless LAN system - Google Patents

Description

  The present invention relates to a wireless LAN terminal, an electronic certificate updating method and program thereof, and a wireless LAN system, and more particularly to a wireless LAN system that automatically updates an electronic certificate in a wireless LAN system that performs terminal authentication using an electronic certificate. The present invention relates to a LAN terminal and an electronic certificate updating method thereof.

  In recent years, wireless LANs (Local Area Networks) have become widespread, and systems using large-scale wireless LANs have been constructed in public networks and corporate networks. As a result, strengthening the security aspects of wireless LAN systems has become a challenge, and in accordance with the IEEE (Institute of Electrical and Electronic Engineers) 802.1X standard, terminal authentication is combined with a RADIUS (Remote Authentication Dial-In User Service) authentication system. Introduction is progressing.

  In IEEE802.1X, server authentication and client authentication, that is, two-way authentication is performed using EAP (Extensible authentication Protocol), so that unauthorized terminals can be prevented from accessing, and a conventional WEP (Wired Equivalent Privacy) method or WPA -Security is stronger than PSK (Wi-Fi Protected Access-pre-shared key) method.

  EAP authentication includes EAP-TLS (Transport Layer Security) that uses an electronic certificate for client authentication, EAP-PEAP (Protocol-Protected Extensible Authentication Protocol) that performs client authentication using a user ID (Identification Date) and password, etc. There are several methods. Among them, the EAP-TLS system that uses an electronic certificate in two-way authentication is generally considered to have the highest security.

As a prior art using such EAP authentication by IEEE802.1X, in Patent Document 1, mutual authentication using a digital certificate is performed between a terminal and an access point, and data flowing in a wireless section is encrypted. There has been proposed a wireless communication system in which an encryption key is changed at regular intervals.
JP 2006-33340 A

  However, in a wireless LAN system in which a conventional IEEE 802.1X authentication system is introduced, in order to connect a wireless LAN terminal, in addition to an SSID (Service Set Identifier), an electronic certificate necessary for authentication, a user ID, a password, In addition, since it is necessary to set authentication information such as server information, once it is set, it takes time to update the authentication information.

  For example, in the EAP authentication using the EAP-TLS method, although security is high, work such as issuance and installation of an electronic certificate is required, which takes time and labor. Considering the enhancement of security, it is desirable to renew the electronic certificate for the client, for example, every year or half a year. In many cases, this is not sufficient in terms of security enhancement.

  In the wireless communication system of Patent Document 1, since the terminal itself issues an electronic certificate, the load on the terminal is heavy and it is difficult to use it for a general-purpose terminal.

  The present invention has been made in view of the above points, a wireless LAN terminal capable of reducing the labor of an administrator and a user required for updating an electronic certificate for a client, and ensuring stronger security, An object of the present invention is to provide an electronic certificate updating method and program, and a wireless LAN system.

In order to achieve the above object, when a wireless LAN terminal according to the present invention accesses a network via a wireless LAN access point, an electronic certificate including an expiration date issued in advance by a certification authority on the network is used. The authentication server on the network is authenticated by a predetermined authentication method, and the public key of the user is confirmed by the authentication of the electronic certificate. Is a wireless LAN terminal that is connected to the network periodically, and a storage unit that stores the electronic certificate, and the electronic certificate at a predetermined time before the expiration date based on the expiration date of the electronic certificate. A setting means for setting a renewal time of the certificate, and authentication by the authentication server using the electronic certificate when accessing the network. The determination means for determining whether or not it is time to renew the electronic certificate, and if the determination means determines that it is the time to update the electronic certificate, the contents of the communication to be transmitted and received are encrypted Requesting the certificate authority to issue an electronic certificate including a new expiration date in the state, receiving the electronic certificate issued by the certificate authority in an encrypted state, and receiving the electronic certificate by the received electronic certificate Renewing means for renewing the electronic certificate in the storage unit; after renewing the electronic certificate, reconnecting the network to the authentication server via the wireless LAN access point using the renewed electronic certificate; And means for performing re-authentication .

In addition, the determination means is a means for changing the value of the flag when it is time to update the electronic certificate, and a means for determining whether it is the time to update the electronic certificate based on the value of the flag. And a means for returning the value of the flag to the original value when the digital certificate is updated by the updating means and the reconnection and re-authentication is successful .

  In addition, when the renewal unit determines that the renewal time of the digital certificate is determined by the determination unit, the renewal unit sets a new expiration date from the certification authority by executing a digital certificate installation software set in advance. You may have a means to acquire the electronic certificate which contains and to install in the said storage part.

Furthermore, prior Symbol predetermined authentication scheme may be EAP-TLS method.

  A wireless LAN system according to the present invention includes any one of the wireless LAN terminals described above.

  According to the present invention, a wireless LAN terminal capable of reducing the trouble of an administrator and a user required for updating a digital certificate for a client and ensuring stronger security, an electronic certificate updating method and a program thereof, In addition, a wireless LAN system can be provided.

  Embodiments of a wireless LAN system and an electronic certificate updating method thereof according to the present invention will be described below with reference to the drawings.

  In the present embodiment, a PKI (Public Key Infrastructure) mechanism using an electronic certificate issued in advance by a certification authority (also referred to as “certification authority” or “CA (Certification Authority)”). An EAP-TLS system that performs mutual authentication between client authentication and server authentication is used. The details of the EAP-TLS system itself are not a characteristic part of the present invention, and the description thereof is omitted.

  The electronic certificate includes a client electronic certificate used for client authentication and a server electronic certificate used for server authentication. The electronic certificate is, for example, ITU-T (International Telecommunication Union-Telecommunication sector) X. A format conforming to the 509 standard is applied. 509 version number, electronic certificate serial number, electronic signature algorithm, issuer name, expiration date, owner (user) name, owner public key information, and the like.

  FIG. 1 is a configuration diagram of a wireless LAN system according to the present embodiment. The wireless LAN system shown in FIG. 1 includes a wireless LAN access point 11, an authentication server 12, a certification authority 13 that issues an electronic certificate, and a wireless LAN terminal 14 that constitutes a wireless client.

  The wireless LAN access point 11 is a base station that relays the network between the wired LAN 15 and the wireless LAN 16, and in this embodiment, corresponds to the IEEE 802.1X, WPA, or IEEE 802.11i standard.

  As the authentication server 12, for example, a RADIUS server is used. In the case of the EAP-TLS method, the authentication server 12 confirms a user's public key by authenticating an electronic certificate transmitted from the wireless LAN terminal 14, and uses this for the distribution of the encryption key. Share the user's encryption key, and deliver the encryption key to the wireless LAN access point 11.

  The authentication server 12 and the certification authority 13 are connected to a network via a wired LAN 15 that is a wired network. On the other hand, the wireless LAN terminal 14 is connected to a network via a wireless LAN 16 that is a wireless network. Each of these nodes relays the wireless LAN access point 11 and can perform bidirectional communication via a mutual network (wired LAN 15 and wireless LAN 16).

  As shown in FIG. 1, the wireless LAN terminal 14 includes a wireless LAN card 141, a certificate store 142, dedicated application software 143, certificate installation software 144, and a control unit 145.

  The wireless LAN card 141 includes, for example, a wireless LAN communication function (communication antenna, transmission / reception circuit, baseband circuit, control circuit, etc.) including an authentication function and a security function corresponding to the IEEE802.11X, WPA, or IEEE802.11i standards. Including).

  The certificate store 142 constitutes a storage unit of the present invention. The certificate store 142 is provided in a recording medium such as a memory or a part of the recording area, and includes setting information for connecting to the wireless LAN access point 11 and an authentication server. X.12 used when performing EAP-TLS authentication with the X.12. An electronic certificate (a root certificate and an electronic certificate for a client) including an expiration date of a format conforming to 509 is installed in advance. The setting information and electronic certificate installed in the certificate store 142 can be accessed by the control unit 145.

  The dedicated application software 143 is installed in advance in a recording medium (not shown) such as a memory in the wireless LAN terminal 141 and executed by the control unit 145 to realize its function. This dedicated application software 143 constitutes the main part of the setting means and the judgment means of the present invention together with the control unit 145, and is executed by the control unit 145, thereby enabling the expiration date of the electronic certificate in the certificate store 142. And a function of changing wireless settings when the electronic certificate is updated.

  FIG. 2 shows a configuration based on the roles of the functions of the dedicated application software 143. As shown in the figure, the dedicated application software 143 includes setting information a1, flag a2, command information a3, and application a4.

  3 (a) to 3 (d) explain these contents.

FIG. 3A illustrates setting items, setting values, and contents of the setting information a1. As shown in the figure, in the setting information a1, an electronic certificate update setting a11 and an electronic certificate update date a12 can be set.

The electronic certificate renewal setting a11 is a setting for how long (eg, how many days) the certificate renewal process is to be executed before the expiration date of the currently used electronic certificate. It is set to an arbitrary value (example: unit: xx days).

  The electronic certificate renewal date a12 is calculated by referring to the electronic certificate renewal setting a11 and the expiration date of the electronic certificate currently in use, and calculating and automatically setting the renewal date (renewal deadline) of the electronic certificate. Is.

  FIG. 3B illustrates the item number, flag name, flag (value), and contents of the flag a2. As shown in the figure, the flag a2 includes an electronic certificate update flag a21 for requesting an electronic certificate update process, and a client certificate used for EAP-TLS authentication after the installation of the electronic certificate is completed. And a setting update flag a22 for changing.

  The electronic certificate renewal flag a21 is composed of values “0” and “1”, and is set when the number of days for renewal setting is less than the expiration date of the electronic certificate, that is, the set value (renewal deadline) of the electronic certificate renewal date a12. The value is set to “1”, and when the installation of the electronic certificate is completed, the value is returned to “0”.

  The setting update flag a22 is composed of values “0” and “1”. When the electronic certificate is successfully installed by the certificate installation software 144 and the electronic certificate is updated, the value is set to “1” and used. If the setting of the electronic certificate is changed, the value is returned to “0”.

  FIG. 3C illustrates the type and operation content of the command a3. As shown in the figure, the command a3 includes a certificate installation command a31 for executing the certificate installation software 144. This certificate install command a31 is for starting the certificate install software 144 when the value of the electronic certificate update flag a21 is "1".

  FIG. 3D illustrates the type and operation content of the application a4. As shown in the figure, the application a4 includes setting change application software a41 for changing the electronic certificate used after updating the electronic certificate. The setting change application software a41 has a function of updating the electronic certificate used in the wireless LAN setting to the latest one when the value of the setting update flag a22 is “1”, and performing reconnection after the setting is changed. Have

  The certificate installation software 144 is installed in advance in a recording medium (not shown) such as a memory in the wireless LAN terminal 141 and is executed by the control unit 145 so that its function can be realized. The certificate installation software 144 constitutes a main part of the updating means of the present invention together with the control unit 145. When executed by the control unit 145, the certificate installation software 144 has a function of automatically acquiring an electronic certificate and the certificate authority 13 And a function for designating the name of the electronic certificate and automatically issuing and installing the electronic certificate.

  A recording medium constituting each of the certificate store 142, the dedicated application software 143, and the certificate installation software 144 or a part of the recording area thereof may be individually configured with different recording media, but may be included in the same recording medium. The recording areas may be configured in different recording areas.

  The control unit 145 includes, for example, a CPU (Central Processing Unit) that constitutes a processor that operates under program control, a memory (ROM (Read Only Memory) and RAM (Random Access Memory)), an I / O (input / output) unit, and the like. It is composed of a computer and controls the overall operation within the wireless LAN terminal 14. In this embodiment, the control unit 145 controls the overall operation of wireless communication by the wireless LAN card 141 according to a control program set in advance, and accesses setting information and an electronic certificate in the certificate store 142. Or the program code constituting the dedicated application software 143 and the certificate installation software 144 is read and each instruction thereof is executed.

  Next, the operation of the present embodiment will be described.

  Here, it is assumed that an EAP-TLS system using an electronic certificate for client authentication is used as bidirectional authentication between the authentication server 12 and the wireless LAN terminal 14 serving as a client thereof. The wireless LAN terminal 14 periodically connects to the network via the wireless LAN access point 11 by the operation of the wireless LAN card 141.

  Also, in the wireless LAN terminal 14, setting information for connecting to the wireless LAN access point 11 and an electronic certificate for a client for performing EAP-TLS authentication with the authentication server 12 are stored in the certificate store 142 in advance. Installed and connected to the network.

FIG. 4 is a flowchart showing the operation of the wireless LAN terminal 14. The control program shown in this flowchart is stored in advance in a memory in the control unit 145 and executed by a processor in the control unit 145.

  First, when the wireless LAN terminal 14 connects to the network via the wireless LAN access point 11, the wireless LAN access point 11 uses the setting information and the electronic certificate in the certificate store 142 according to the EAP-TLS method. Then, a connection / authentication process is performed with the authentication server 12 (step St1).

  Next, when the connection / authentication is completed, the wireless LAN terminal 14 uses the control unit 145 to confirm the value of the electronic certificate update flag a21 in the dedicated application software 143 (step St2). As a result, when the value of the electronic certificate update flag a21 is “0” (step St2: NO), the processing ends because the setting value of the electronic certificate update date a12 is not reached. On the other hand, when the value of the electronic certificate update flag a21 is “1” (step St2: YES), the setting value of the electronic certificate update date a12 is set. The certificate installation execution command a31 is executed to activate the certificate installation software 144 (step St3).

  Next, the wireless LAN terminal 14 executes the certificate installation software 144 by the control unit 145, thereby accessing the certification authority 13 via the wireless LAN access point 11 and obtaining an electronic certificate including a new expiration date. Then, the electronic certificate is installed in the certificate store 142.

  As a result, if the installation of the electronic certificate is successful (step St4: YES), the wireless LAN terminal 14 sets the setting update flag in the application software 143 to “1” by the control unit 145 (step St4). On the other hand, if the installation of the electronic certificate has failed (step St4: NO), the process returns to step St3, and the certificate installation software 144 is executed again by the certificate installation execution command a31.

  Next, after setting the setting update flag a22 to “1”, the wireless LAN terminal 14 activates the setting change application software a41 in the application software 143 by the control unit 145 (step St6), and the electronic certificate currently in use Is changed to the setting of the electronic certificate including the new expiration date installed in the certificate store 142, and the changed setting of the electronic certificate is used via the wireless LAN access point 11 according to the EAP-TLS method. The network is reconnected and re-authenticated with the authentication server 12 (step St7).

  As a result, when the reconnection / reauthentication is successful (step St8: YES), the values of the electronic certificate update flag a21 and the setting update flag a22 are returned from “1” to “0” (step St9), and the process is terminated. To do. On the other hand, if reconnection / reauthentication fails (step St8: NO), the process returns to step St7, and the same processing is repeated to try connection / authentication again.

  As described above, in the present embodiment, in the wireless LAN system in which EAP-TLS authentication is performed by the authentication server 12, an electronic certificate used in the initial setting is issued in advance and installed in the wireless LAN terminal 14. The wireless LAN terminal 14 monitors the expiration date of the electronic certificate currently in use, requests the certification authority 13 to issue an electronic certificate by itself before the expiration date, and installs the certificate. The wireless LAN terminal 14 in which the new electronic certificate is installed updates the electronic certificate used when the wireless LAN 16 is connected to a new one, and attempts to re-authenticate using this. According to this, at the time of updating the electronic certificate, the wireless LAN terminal 14 is accessing the network with the old electronic certificate already set in itself, so the content of communication to be transmitted / received is also encrypted. Electronic certificate information cannot be intercepted.

  Therefore, according to the present embodiment, the following effects can be achieved.

  The first effect is that it is possible to eliminate the trouble of setting and changing the settings of the wireless LAN terminals 14 one by one by automating the update of the client electronic certificate, which has conventionally been troublesome for the administrator and the user. As a result, it is possible to save the administrator from having to collect the terminal device or create a setting change procedure manual. Moreover, even if frequent renewal is required by setting a short expiration date for the electronic certificate, it is easy to renew, so it is possible to set a short expiration date for the electronic certificate and use the same thing for a long time It is possible to prevent the deterioration of security due to this.

  The second effect is that the administrator does not have to consider the renewal time of the certificate by providing the wireless LAN terminal 14 with a setting for monitoring the expiration date of the electronic certificate.

  A third effect is that the wireless LAN connection setting can be automatically changed. Thereby, it can authenticate with a new electronic certificate, without taking an administrator and a user's effort.

  A fourth effect is that the electronic certificate issued by the certification authority 13 is received in an encrypted state. As a result, even if the information received over the air is intercepted, it is impossible to copy the installed electronic certificate file, leading to prevention of information leakage.

  The fifth effect is that since the wireless LAN terminal 14 does not issue an electronic certificate, but the certificate authority 13 issues an electronic certificate, the certificate authority 13 can manage the electronic certificate, and the terminal Forgery by the device can be prevented, and the load on the terminal device can be reduced.

  Note that the present invention is not limited to the above-described embodiment, and can be replaced within the scope of the present subject matter. For example, in the above-described embodiment, an authentication method using EAP-TLS is taken as an example. However, any authentication method that uses an electronic certificate is used in the same processing procedure. Is possible.

  The present invention is applicable to a wireless LAN system that performs terminal authentication using an electronic certificate, and is particularly applicable to all wireless LAN terminals that employ EAP-TLS authentication.

1 is a configuration diagram of a wireless LAN system according to an embodiment of the present invention. It is a figure which shows the structure in the application software of the wireless LAN terminal shown in FIG. (A)-(d) is a figure explaining the role in the structure in the application software shown in FIG. 3 is a flowchart for explaining the operation of the wireless LAN terminal shown in FIG.

Explanation of symbols

11 Wireless LAN access point 12 Authentication server 13 Certification authority 15 Wired LAN
16 Wireless LAN
14 Wireless LAN terminal 141 Wireless LAN card 142 Certificate store 143 Application software 144 Certificate installation software 145 Control unit

Claims (5)

When accessing a network via a wireless LAN access point, an authentication certificate issued in advance by a certification authority on the network is used to authenticate with a predetermined authentication method by an authentication server on the network. A wireless LAN terminal that confirms a user's public key by authentication of the electronic certificate, shares the encryption key with the authentication server using this for distribution of the encryption key, and periodically connects to the network. And
A storage unit for storing the electronic certificate;
Setting means for setting the renewal time of the electronic certificate at a predetermined time before the expiry date based on the expiry date of the electronic certificate;
Determining means for determining whether it is time to renew the electronic certificate after being authenticated by the authentication server using the electronic certificate when accessing the network;
When it is determined by the determination means that the renewal time of the electronic certificate, the certificate authority is requested to issue an electronic certificate including a new expiration date in a state where the contents of communication to be transmitted / received are encrypted Updating means for receiving the electronic certificate issued by the certification authority in an encrypted state and updating the electronic certificate in the storage unit with the received electronic certificate;
After updating of the electronic certificate, using the updated digital certificate to; and a means for performing a reconnection and re-authentication of the network between the authentication server via the wireless LAN access point wireless LAN terminal that. The determining means is a means for changing a value of the flag when it is time to update the electronic certificate; a means for determining whether it is the time to update the electronic certificate based on the value of the flag; The wireless LAN terminal according to claim 1, further comprising means for returning the value of the flag to the original value when the digital certificate is updated by the updating means and the reconnection and re-authentication is successful. .   When the update means determines that it is time to renew the electronic certificate, the update means executes electronic certificate installation software that is set in advance, thereby providing an electronic certificate including a new expiration date from the certification authority. The wireless LAN terminal according to claim 1, further comprising means for acquiring a certificate and installing the certificate in the storage unit.   The wireless LAN terminal according to any one of claims 1 to 3, wherein the predetermined authentication method is an EAP-TLS method. Wireless LAN system comprising the wireless LAN terminal according to any one of claims 1 to 4.

Images