JP5813830B1 - Communications system - Google Patents

Abstract

Provided are a communication terminal device, a communication system, and a method thereof capable of controlling communication via a wireless LAN relay device based on communication policy information without increasing the load on the communication terminal device and the communication network. An authentication server receives an authentication request including user identification information and access point identification information from a communication terminal device, performs user authentication processing based on the user identification information, and performs access point identification information. Is transmitted to the policy server 50, communication policy information for the access point 20 is received from the policy server 50, and an authentication response is sent to the communication terminal device 10 based on the result of the user authentication process and the communication policy information. Send. The policy server 50 receives the policy confirmation request from the authentication server 40, and transmits a policy confirmation response including communication policy information or connection availability information for the access point 20 to the authentication server 40 based on the access point identification information. [Selection] Figure 3

Description

  The present invention relates to a communication terminal device and a communication system that can be connected to a communication network via a wireless LAN relay device.

  Conventionally, a communication terminal device such as a mobile phone or a smartphone having a wireless LAN (Local Area Network) communication function is known. A user uses a wireless LAN communication function incorporated in a communication terminal device, for example, Wi-Fi (registered trademark), which is a wireless LAN relay device installed in a fast food restaurant or a station premises in a city. Access point, and after a predetermined authentication process, the access point can be connected to the backbone communication network.

  The communication terminal device having the wireless LAN communication function includes access point type information accessible from the communication terminal device (for example, ESSID: Extended Service Set Identifier), a timeout time during communication path establishment processing and authentication processing, Communication policy information including a threshold of accessible received signal strength (RSSI) is stored, and communication via the access point is controlled based on the communication policy information. For example, it is controlled to be accessible only to a specific type of access point (for example, an access point of a specific communication service provider) designated by the type information included in the communication policy information. In addition, it starts timing when communication with the gateway on the communication network side via the access point of the wireless LAN is started, and when it is determined that a predetermined time-out period has elapsed before establishing the communication path in the gateway, A portable terminal that disconnects the connection is also known (see Patent Document 1).

  The communication policy information stored in the communication terminal device is updated by, for example, being periodically distributed from a predetermined server to the communication terminal device via a communication network. However, the communication policy information periodically distributed to the communication terminal device in this way is communication policy information having a relatively large data size applied to a plurality of access points that the communication terminal device may access. Therefore, there is a possibility that the load on the communication network and the communication terminal device may increase due to the distribution of the communication policy information.

  The present invention has been made in view of the above problems, and an object of the present invention is to control communication via a wireless LAN relay device based on communication policy information without increasing the load on the communication terminal device and the communication network. A communication terminal device and a communication system are provided.

A communication system according to an aspect of the present invention is a communication system that can be connected to a communication network from a communication terminal device via a relay device of a wireless LAN, from the communication terminal device to the communication network via the relay device. An authentication processing device that executes authentication processing at the time of connection, and a policy management device that manages communication policy information related to communication between the communication terminal device and a communication network via the relay device, and the authentication processing device Means for receiving from the communication terminal device an authentication request including user identification information capable of identifying a user of the terminal device and device identification information capable of identifying a relay device connected to the communication terminal device; User authentication processing for determining whether or not communication via the relay device is permitted by the user of the communication terminal device based on the included user identification information Means for transmitting a policy confirmation request including the device identification information to the policy management device, communication policy information for the relay device, or information on whether or not to connect to the relay device determined based on the communication policy information Based on the means for receiving a policy confirmation response from the policy management device, the result of the user authentication process, and the communication policy information or the connection availability information included in the policy confirmation response. Means for transmitting an authentication response to the communication terminal device, wherein the policy management device receives a policy confirmation request including the device identification information from the authentication processing device, and searches based on the device identification information. Communication policy information for the relay device obtained in the above or the relay determined based on the communication policy information The policy acknowledgment including the connection permission information to the location, and means for transmitting to said authentication device.
In the communication system, the authentication processing device transmits the policy confirmation request to the policy management device when the user authentication processing is successful, and the policy confirmation request when the user authentication processing fails. May not be transmitted to the policy management apparatus.
A communication system according to another aspect of the present invention is a communication system connectable from a communication terminal device to a communication network via a wireless LAN relay device, and communicates from the communication terminal device via the relay device. An authentication processing device that executes authentication processing when connected to a network; and a policy management device that manages communication policy information related to communication between the communication terminal device and a communication network via the relay device, and the authentication processing device. Can identify means for storing the communication policy information, means for receiving communication policy information to be updated from the policy management apparatus, updating the stored communication policy information, and a user of the communication terminal apparatus An authentication request including the user identification information and the device identification information capable of identifying the relay device connected to the communication terminal device. Means for receiving from the user, and means for performing user authentication processing for determining whether or not communication via the relay device is permitted by a user of the communication terminal device based on user identification information included in the authentication request; and A result of user authentication processing, and communication policy information for the relay device obtained by searching based on the device identification information or connection permission information to the relay device determined based on the communication policy information, Means for transmitting an authentication response to the authentication request to the communication terminal device, and the policy management device comprises means for transmitting communication policy information to be updated to the authentication processing device.
In the communication system, the authentication request may include at least one of model information of the communication terminal device and type information of the relay device.

A communication system according to yet another aspect of the present invention is a communication system that can be connected to a communication network from a communication terminal device via a wireless LAN relay device, the communication terminal device via the relay device to the communication network. An authentication processing device that executes an authentication process when connected to a network, and a policy management device that manages communication policy information for communication between the communication terminal device and a communication network via the relay device, the authentication processing device comprising: A means for receiving from the communication terminal device an authentication request including user identification information capable of identifying a user of the communication terminal device, and based on the user identification information included in the authentication request, Means for performing user authentication processing for determining whether or not communication is permitted by the user via the relay device; and an authentication response including a result of the user authentication processing. Means for transmitting to the communication terminal device, wherein the policy management device receives from the communication terminal device a policy confirmation request including device identification information that can identify the relay device to which the communication terminal device is connected. A policy confirmation response including communication policy information for the relay device obtained by searching based on the device identification information or connection permission / inhibition information to the relay device determined based on the communication policy information; Means for transmitting to the apparatus.
In the communication system, the policy management device receives the policy confirmation request from the communication terminal device when the user authentication processing by the authentication processing device is successful, and the user authentication processing by the authentication processing device. May fail to receive the policy confirmation request from the communication terminal device.
A communication system according to still another aspect of the present invention is a communication system connectable from a communication terminal device to a communication network via a wireless LAN relay device, from the communication terminal device via the relay device. An authentication processing device that executes authentication processing when connected to a communication network; and a policy management device that manages communication policy information for communication between the communication terminal device and the communication network via the relay device, the relay device Means for receiving an association request from the communication terminal device, means for transmitting a policy confirmation request including device identification information capable of identifying the relay device to the policy management device based on the association request, and the relay Communication policy information for a device or the relay device determined based on the communication policy information Means for receiving a policy confirmation response including connection permission information from the policy management apparatus; and means for transmitting the communication policy information included in the policy confirmation response or an association response including the connection permission information to the communication terminal apparatus And the authentication processing device receives, from the communication terminal device that has received the association response, an authentication request including user identification information that can identify a user of the communication terminal device; and the authentication request Means for performing user authentication processing for determining whether or not communication via the relay device is permitted by the user of the communication terminal device based on the user identification information included in the authentication, and authentication including a result of the user authentication processing Means for transmitting a response to the communication terminal device, wherein the policy management device includes a policy confirmation request including the device identification information. A policy confirmation response including means for receiving from the relay device, and communication policy information for the relay device searched based on the device identification information or connection permission information to the relay device determined based on the communication policy information, Means for transmitting to the relay device.
A communication system according to still another aspect of the present invention is a communication system connectable from a communication terminal device to a communication network via a wireless LAN relay device, from the communication terminal device via the relay device. An authentication processing device that executes authentication processing when connected to a communication network, a policy management device that manages communication policy information for communication between the communication terminal device and the communication network via the relay device, and the relay device A relay device management device, wherein the relay device management device is configured to receive an association request from the communication terminal device via the relay device, and to identify the relay device based on the association request Means for transmitting a policy confirmation request including identification information to the policy management device; Communication policy information or means for receiving from the policy management device a policy confirmation response including information on whether or not to connect to the relay device determined based on the communication policy information, and the communication policy information included in the policy confirmation response Or means for transmitting an association response including the connection permission information to the communication terminal device via the relay device, wherein the authentication processing device receives the communication terminal from the communication terminal device that has received the association response. Means for receiving an authentication request including user identification information capable of identifying a user of the device, and the user of the communication terminal device via the relay device based on the user identification information included in the authentication request; A means for performing user authentication processing for determining whether communication is permitted; and an authentication response including a result of the user authentication processing. And the policy management device receives the policy confirmation request including the device identification information from the relay device management device, and is obtained by searching based on the device identification information. Means for transmitting to the relay device management apparatus a policy confirmation response including communication policy information for the relay device or information on whether or not to connect to the relay device determined based on the communication policy information.
In the communication system, the policy confirmation request may include at least one of user identification information that can identify a user of the communication terminal device, model information of the communication terminal device, and type information of the relay device. Good.

A communication system according to yet another aspect of the present invention is a communication system that can be connected to a communication network from a communication terminal device via a wireless LAN relay device, the communication terminal device via the relay device to the communication network. An authentication processing device that executes an authentication process when connected to a network, and a policy management device that manages communication policy information for communication between the communication terminal device and a communication network via the relay device, and the relay device includes: Means for storing the communication policy information; means for receiving the communication policy information to be updated from the policy management apparatus; updating the stored communication policy information; and means for receiving an association request from the communication terminal apparatus Communication policy information for itself obtained by searching based on the association request, or Means for transmitting to the communication terminal device an association response that includes connection permission / inhibition information determined based on the communication policy information, wherein the authentication processing device receives from the communication terminal device that has received the association response. Means for receiving an authentication request including user identification information capable of identifying the user of the communication terminal device, and the relay by the user of the communication terminal device based on the user identification information included in the authentication request Means for performing a user authentication process for determining whether or not to allow communication via a device; and a means for transmitting an authentication response including a result of the user authentication process to the communication terminal device. Means for transmitting the communication policy information to the relay device.
A communication system according to yet another aspect of the present invention is a communication system that can be connected to a communication network from a communication terminal device via a wireless LAN relay device, the communication terminal device via the relay device to the communication network. An authentication processing device that executes authentication processing when connected to a network, a policy management device that manages communication policy information for communication between the communication terminal device and a communication network via the relay device, and a relay device that manages the relay device A management device, wherein the relay device management device receives the communication policy information to be updated from the means for storing the communication policy information and the policy management device, and updates the stored communication policy information. Means for receiving an association request from the communication terminal device via the relay device; and An association response including communication policy information for the relay device obtained by searching based on a request for connection or connection permission information to the relay device determined based on the communication policy information, via the relay device, Means for transmitting to the communication terminal device, wherein the authentication processing device receives an authentication request including user identification information capable of identifying a user of the communication terminal device from the communication terminal device that has received the association response. Means for performing user authentication processing for determining whether communication via the relay device is permitted by a user of the communication terminal device based on user identification information included in the authentication request, and the user Means for transmitting an authentication response including a result of the authentication process to the communication terminal device, wherein the policy management device provides the communication policy information in advance. Comprising means for transmitting to the relay apparatus management apparatus.

In the communication system, the device identification information may be identification information uniquely set for each of the relay devices.
Further, in the communication system, the communication policy information includes identification information of a relay device that is permitted or prohibited to connect from the communication terminal device, and a time that the connection from the communication terminal device to the relay device is permitted or prohibited. At least one of a band, a timeout time at the time of establishing a communication path via the relay device, and a threshold value of received signal strength at the communication terminal device when connecting to the relay device.
Further, in the communication system, the communication terminal device is in a state in which a means for communicating via a mobile communication network and a first communication path for communicating with an external communication network via the mobile communication network are established. And means for starting a process for establishing a second communication path for communicating with the external communication network via the wireless LAN relay device, and if the connection to the relay device is permitted, the external communication When the communication path preferentially used for communication with the network is switched from the first communication path to the second communication path, and connection to the relay device is rejected, communication with the external communication network is performed. And a means for maintaining a preferentially used communication path in the first communication path.

A communication terminal device according to still another aspect of the present invention is a communication terminal device connectable to a communication network via a wireless LAN relay device, from the communication terminal device to the communication network via the relay device. Means for transmitting an authentication request including user identification information capable of identifying the user of the communication terminal device to an authentication processing device that executes authentication processing at the time of connection; and a user made based on the user identification information Means for receiving an authentication response including a result of the authentication processing from the authentication processing device, and a policy management device for managing communication policy information for communication between the communication terminal device and the communication network via the relay device; Means for transmitting a policy confirmation request including device identification information capable of identifying the relay device to which the terminal device is connected; and a search based on the device identification information. Means for receiving from the policy management device a policy confirmation response including communication policy information for the relay device or information on whether or not to connect to the relay device, and a result of the user authentication processing received from the authentication processing device; Means for controlling connection to the relay device based on the communication policy information or the connection availability information received from the policy management device.
In the communication terminal device, when the user authentication processing by the authentication processing device is successful, the policy confirmation request is transmitted to the policy management device, and when the user authentication processing by the authentication processing device is unsuccessful. The policy confirmation request may not be transmitted to the policy management apparatus.

  According to the present invention, communication via a wireless LAN relay device can be controlled based on communication policy information without increasing the load on the communication terminal device and the communication network.

1 is a schematic configuration diagram illustrating an example of a communication system according to an embodiment of the present invention. The block diagram which shows an example of the hardware constitutions of the communication terminal device which concerns on one Embodiment of this invention. The sequence diagram which shows an example of connection control of wireless LAN communication when the connection of a communication terminal device and an access point is successful in the communication system of this embodiment. The sequence diagram which shows an example of connection control of wireless LAN communication when the connection of a communication terminal device and an access point fails in the communication system of this embodiment. The sequence diagram which shows the other example of connection control of wireless LAN communication when the connection of a communication terminal device and an access point is successful in the communication system of this embodiment. The sequence diagram which shows the other example of connection control of wireless LAN communication when the connection of a communication terminal device and an access point fails in the communication system of this embodiment. The sequence diagram which shows the further another example of the connection control of wireless LAN communication when the connection of a communication terminal device and an access point is successful in the communication system of this embodiment. The sequence diagram which shows the further another example of the connection control of wireless LAN communication when the connection of a communication terminal device and an access point fails in the communication system of this embodiment. The sequence diagram which shows the further another example of the connection control of wireless LAN communication when the connection of a communication terminal device and an access point is successful in the communication system of this embodiment. The sequence diagram which shows the further another example of the connection control of wireless LAN communication when the connection of a communication terminal device and an access point fails in the communication system of this embodiment. The sequence diagram which shows the further another example of the connection control of wireless LAN communication when the connection of a communication terminal device and an access point is successful in the communication system of this embodiment. The sequence diagram which shows the further another example of the connection control of wireless LAN communication when the connection of a communication terminal device and an access point fails in the communication system of this embodiment. The schematic block diagram which shows an example of the communication system which concerns on other embodiment of this invention. FIG. 14 is a sequence diagram illustrating an example of connection control for wireless LAN communication when a connection between a communication terminal device and an access point is successful in the communication system of FIG. 13. FIG. 14 is a sequence diagram illustrating an example of connection control for wireless LAN communication when connection between a communication terminal device and an access point fails in the communication system of FIG. 13. FIG. 14 is a sequence diagram illustrating another example of connection control for wireless LAN communication when the connection between the communication terminal device and the access point is successful in the communication system according to the embodiment of FIG. 13. FIG. 14 is a sequence diagram illustrating another example of connection control for wireless LAN communication when connection between a communication terminal device and an access point fails in the communication system of FIG. 13.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a schematic configuration diagram showing an example of a communication system according to an embodiment of the present invention.
In the communication system according to the present embodiment, a communication terminal device 10 such as a user's mobile phone or smartphone is a wireless LAN relay device (hereinafter referred to as “access point”) 20 provided in a fast food restaurant or a station premises. When located in the wireless communicable area 20A, the communication terminal device 10 having a wireless LAN communication function can be connected to the communication network via the access point 20. The access point 20 is a wireless LAN relay device such as Wi-Fi (registered trademark) that can wirelessly communicate with the communication terminal device 10, and authenticates as an authentication processing device via the backbone network 30 and the gateway (GW) 35. The server 40 is connected to a policy server 50 as a policy management apparatus, the Internet 90 as an external communication network, and the like.

  In FIG. 1, one communication terminal apparatus 10 is illustrated, but two or more communication terminal apparatuses 10 may be provided. In FIG. 1, the communication terminal device 10 of this embodiment is a portable mobile communication terminal such as a mobile phone or a smartphone that can communicate via a cellular mobile communication network. As long as they can communicate with each other, a communication terminal device other than the mobile communication terminal may be used. For example, the communication terminal device 10 of the present embodiment may be a device having a communication function, such as a personal computer device such as a notebook computer, a game machine, a tablet terminal, a digital camera, a printer, or a book browsing terminal. In addition, the communication terminal device according to the present embodiment is a communication device such as a home appliance capable of network cooperation (for example, a TV, a refrigerator, a recording device), a wearable device such as a watch or glasses, a weight scale, a blood pressure monitor, other medical devices, a robot, or the like. It may be a device having a function.

  In the communication system according to the present embodiment, when the communication terminal device 10 is located in a cell 60A of mobile communication (hereinafter also referred to as “cellular communication”) such as a macro cell or a small cell, the third generation (3G) Through a base station 60 such as a macro cell base station or a small cell base station of cellular communication compliant with standards such as LTE (Long Term Evolution), LTE-Advanced, 4th generation (4G), and 5th generation (5G) The communication terminal device 10 having the cellular communication function can be connected to the communication network. The base station 60 is a relay device that can wirelessly communicate with the communication terminal device 10, and is connected to various servers (not shown), the Internet 90, and the like via a core network 70 and a gateway (GW) 75.

  The access point 20 wirelessly communicates with the communication terminal device 10 in the wireless communicable area 20A by, for example, a wireless LAN wireless communication method such as Wi-Fi conforming to the IEEE 802.11 standard, and the communication terminal device 10 communicates with the communication network. It is possible to relay communication between

  The authentication server 40 is, for example, a RADIUS (Remote Authentication Dial In User Service) server to which a subscriber database (DB) 45 storing various information of subscribers who subscribe to the communication service is connected. The authentication server 40 refers to the information stored in the subscriber database 45 and refers to WISPr (Wireless Internet Service Provider Roaming) authentication or EAP (Extensible Authentication Protocol) authentication when the communication terminal device 10 is connected to the communication network. It is a server that performs the authentication process. The authentication server 40 has a function of communicating with the policy server 50. The authentication server 40 has a function of communicating with the access point 20 via the backbone network 30 and the gateway (GW) 35 and a function of communicating with the communication terminal device 10 via the access point 20.

  Information stored in the subscriber database 45 includes, for example, user identification information (user ID), password, subscriber identification information, user information such as name and address, information on available services, Information on the communication terminal device that is in use.

  The policy server 50 is connected to a policy database (DB) 55 that stores communication policy information related to communication between the communication terminal device 10 and the communication network via the access point 20, and manages communication policy information of a plurality of access points 20. Server. The policy server 50 has a function of communicating with the authentication server 40. The policy server 50 may have a function of communicating with the access point 20 via the backbone network 30 and the gateway (GW) 35 and a function of communicating with the communication terminal device 10 via the access point 20.

  The policy server 50 also has a function of providing requested communication policy information in response to an inquiry from an external device such as the authentication server 40 or the communication terminal device 10. The policy server 50 determines whether connection to the inquiry target access point 20 is possible based on the communication policy information without providing the communication policy information itself regarding the inquiry target access point 20, and the determination result. Information on whether or not the access point 20 can be connected to the access point 20 may be provided.

  The communication policy information stored in the policy database 55 identifies, for example, access point identification information (for example, BSSID: Basic Service Set Identifier) uniquely set for each access point 20 and the type of the access point 20. Possible access point type information (for example, ESSID: Extended Service Set Identifier), a time zone during which connection from the communication terminal apparatus 10 to the access point 20 is permitted or prohibited, and a timeout at the time of communication path establishment processing via the access point 20 Time, a threshold value of received signal strength (for example, RSSI: Received Signal Strength Indicator) in the communication terminal device 10 when connecting to the access point 20. When the policy server 50 receives an inquiry about communication policy information from the communication terminal device 10, the communication policy information stored in the policy database 55 includes user identification information (user ID) and a password regarding the user of the communication terminal device 10. May be included.

  Each of the authentication server 40, the subscriber database 45, the policy server 50, and the policy database 55 can be constituted by, for example, a single computer device or a combination of a plurality of computer devices. Various processes and control can be executed by executing the program. Further, the authentication server 40 and the subscriber database 45 may be configured by one computer device, and the policy server 50 and the policy database 55 may be configured by one computer device. Further, the authentication server 40, the subscriber database 45, the policy server 50, and the policy database 55 may be configured by one computer device.

  In the present embodiment, each of the authentication server 40 and the policy server 50 can implement the following functions as means by executing a predetermined program.

For example, the authentication server 40 functions as each unit shown in the following (A401) to (A411) by executing a predetermined program.
(A401) An authentication request including user identification information (user ID) that can identify a user of the communication terminal apparatus 10, or an access point 20 at which the communication terminal apparatus 10 is connected to the user identification information (user ID). Means for receiving from the communication terminal device 10 an authentication request including access point identification information (for example, BSSID) that can be identified.
(A402) Means for performing user authentication processing for determining whether or not communication via the access point 20 by a user of the communication terminal device 10 is permitted based on user identification information (user ID) included in the authentication request.
(A403) Means for transmitting a policy confirmation request including access point identification information to the policy server 50.
(A404) Policy confirmation response including communication policy information for the access point 20 or information on whether or not to connect to the access point 20 determined based on the communication policy information (for example, 0: connection impossible, 1: connection possible flag data) Is received from the policy server 50.
(A405) Means for transmitting an authentication response to the authentication request to the communication terminal device 10 based on the result of the user authentication process and the communication policy information or connection availability information included in the policy confirmation response.
(A406) Means for transmitting an authentication response including a result of the user authentication processing to the communication terminal device 10.
(A407) Means for storing the communication policy information.
(A408) Means for receiving communication policy information to be updated from the policy server 50 and updating the stored communication policy information.
(A409) Means for searching and acquiring communication policy information for the access point 20 based on the access point identification information.
(A410) Means for determining whether or not connection to the access point 20 is possible based on communication policy information for the access point 20.
(A411) Communication policy information for the access point 20 obtained by searching based on the result of the user authentication process and the access point identification information, or information on whether or not to connect to the access point 20 determined based on the communication policy information Means for transmitting an authentication response to the authentication request to the communication terminal device 10.

On the other hand, the policy server 50 functions as the following means (A501) to (A505) by executing a predetermined program.
(A501) Means for receiving a policy confirmation request including access point identification information from the authentication server 40, the communication terminal device 10, the access point 20, or the AP management server 80 described later.
(A502) Means for searching and acquiring communication policy information for the access point 20 based on the access point identification information included in the policy confirmation request.
(A503) Means for determining whether or not connection to the access point 20 is possible based on communication policy information for the access point 20.
(A504) A policy including communication policy information for the access point 20 obtained by searching based on the access point identification information included in the policy confirmation request or information on whether or not to connect to the access point 20 determined based on the communication policy information A means for transmitting a confirmation response to the authentication server 40, the communication terminal device 10, the access point 20, or the AP management server 80 described later.
(A505) Means for transmitting communication policy information to be updated to the authentication server 40, the access point 20, or the AP management server 80 described later.

  FIG. 2 is a block diagram illustrating an example of a hardware configuration of the communication terminal device 10 according to an embodiment of the present invention. The communication terminal apparatus 10 according to the present embodiment includes a main control unit 110, a wireless communication unit 111, a baseband processing unit 112, a sound input / output unit 113, a display unit 114, and an operation unit 115 as an operation unit. The communication terminal device 10 is equipped with a USIM 15 as an IC module, which is a subscriber information storage medium that can be attached to and detached from the device body.

  The main control unit 110 includes a storage device including an MPU (Micro Processing Unit), a RAM, a ROM, and the like, and controls each unit such as the baseband processing unit 112 by executing a program such as a predetermined basic OS or middleware. Or build a native platform environment or application execution environment on the software configuration.

  The storage device of the main control unit 110 includes, for example, at least one of a semiconductor memory, a magnetic disk device, and an optical disk device. The storage device stores a driver program, an operating system program, an application program, data, and the like used for processing in each unit. For example, the storage device includes, as a driver program, a communication driver program that executes a wireless communication method of IEEE802.11 standard and a wireless communication method of mobile communication (cellular communication), an input device driver program that controls the operation unit 115, and a display unit An output device driver program for controlling 114 is stored. In addition, the storage device has, as an operating system program, for example, a basic OS such as Android (registered trademark) OS or iOS (registered trademark), a wireless communication method of IEEE 802.11 standard, or wireless communication of mobile communication (cellular communication). A connection control program for performing authentication and the like in the system is stored. The storage device also stores, as application programs, an authentication program that performs web authentication, a time measurement program that measures time, a web browser program that acquires and displays a web page, an e-mail program that transmits and receives e-mail, and the like. The storage device may store various text data, video data, image data, and the like, or temporarily store temporary data related to a predetermined process. The storage device stores various information for connecting to a wireless LAN access point.

  The wireless communication unit 111 functions as a wireless LAN communication unit that communicates via a wireless LAN access point 20 and a mobile communication unit that communicates via a base station 60 for cellular communication. For example, a synthesizer, a frequency converter, and a high frequency amplifier It is composed of an antenna and the like. The wireless communication unit 111 executes high-frequency signal processing for wireless communication with the access point 20 using a predetermined communication method such as IEEE 802.11, or performs predetermined communication with the base station 60 such as 3G or LTE. High-frequency signal processing for wireless communication by a communication method is executed.

  The baseband processing unit 112 performs digital processing for performing voice communication and data transmission / reception communication with communication terminal devices such as other mobile phones and various servers. The baseband processing unit 112 and the wireless communication unit 111 are connected via a D / A converter or an A / D converter.

  The sound input / output unit 113 includes a microphone, a speaker, a sound signal processing unit, and the like. The analog audio signal output from the microphone is converted into a digital signal by the sound signal processing unit and sent to the main control unit 110, the baseband processing unit 112, and the like. The speaker receives an analog signal converted from a digital signal by the sound signal processing unit, and outputs a voice during a call, or outputs a ringtone for a mail, a ringing tone for a telephone, music, or the like. The speaker may be configured by separately providing a receiver speaker (receiver) for listening to voice during a call and an external output speaker for outputting ringtones, music, etc. You may comprise with one speaker so that a speaker and an external output speaker may be combined.

  The display unit 114 is configured by an LCD (liquid crystal display), an organic EL (Electro-Luminescence) display, or the like, and displays various images based on commands from the main control unit 110. For example, the display unit 114 may display an image indicating the state of wireless LAN connection such as Wi-Fi.

  The operation unit 115 includes a touch panel incorporated in the display unit 114, various operation keys and buttons, a power switch as a power ON / OFF unit, and the like. This operation unit 115 is used when the user turns on / off the main body power supply of the communication terminal device 10, instructs a call start / end, menu selection, screen switching, etc., or inputs information. It is done.

  Further, the communication terminal apparatus 10 includes a GPS (Global Positioning System) unit 117 as a position information acquisition unit, a camera unit 118 as an imaging unit, a sensor unit 119, a power supply unit 120 as a power supply unit, a clock unit (not shown), and the like. It also has.

  The GPS unit 117 includes a GPS receiving module, a GPS antenna, and the like, receives radio waves from a plurality of GPS satellites arranged around the earth, and the latitude and longitude at which the communication terminal device 10 is located based on the reception result And altitude data.

  The camera unit 118 includes a lens, an imaging device, and the like, and is used when shooting a person, a landscape, and the like. As the imaging device, a CCD (Charge Coupled Device) camera or a CMOS camera can be used.

  The sensor unit 119 includes an acceleration sensor and / or a geomagnetic sensor. The acceleration sensor may be a uniaxial acceleration sensor or a multi-axis acceleration sensor such as a biaxial or triaxial acceleration sensor. Further, the geomagnetic sensor may be a uniaxial geomagnetic sensor, or may be a multiaxial geomagnetic sensor such as a biaxial or a triaxial. Based on the output of the sensor unit 119, data indicating the position, orientation, posture, and movement of the communication terminal device 10 can be calculated. Further, based on the output of the sensor unit 119, the communication terminal device 10 determines whether or not the communication terminal device 10 is based on history information that is information on temporal changes in acceleration data and geomagnetic data when the user's communication terminal device 10 moves from a reference position at a predetermined altitude. Data indicating the altitude, angle, and the like that are located can be calculated.

  The power supply unit 120 includes a rechargeable battery, a power supply circuit that supplies power of a predetermined voltage from the battery to each unit, a charging circuit that charges the battery, and the like. The clock unit includes a clock circuit and the like, counts accurate date and time, and generates time information for various information update processing and the like.

In the present embodiment, the main control unit 110 of the communication terminal apparatus 10 can implement the following functions as each means in cooperation with other wireless communication units 111 and the like by executing a predetermined program. It is.
For example, the main control unit 110 of the communication terminal device 10 functions as the following units (A101) to (A108) by executing a predetermined program.
(A101) A means for transmitting an authentication request including user identification information (user ID) that can identify a user of the communication terminal device 10 to the authentication server 40.
(A102) Means for receiving, from the authentication server 40, an authentication response including a result of user authentication processing performed based on user identification information (user ID).
(A103) Means for transmitting a policy confirmation request including access point identification information capable of identifying the access point 20 to which the communication terminal apparatus 10 is connected to the policy server 50.
(A104) Means for receiving, from the policy server 50, a policy confirmation response including communication policy information for the access point 20 obtained by searching based on the access point identification information or information on whether or not to connect to the access point 20.
(A105) Means for controlling connection to the access point 20 based on the result of the user authentication process received from the authentication server 40 and the communication policy information or connection permission information received from the policy server 50.
(A106) Means for communicating via a mobile communication network.
(A107) Second communication for communicating with an external communication network via the access point 20 in a state where a first communication path for communicating with an external communication network such as the Internet 90 via the mobile communication network is established. Means for starting the process of establishing a route.
(A108) When the connection to the access point 20 is permitted, the communication path used preferentially for communication with the external communication network is switched from the first communication path to the second communication path, and the connection to the access point 20 is performed. Means for maintaining the communication path preferentially used for communication with the external communication network in the first communication path when the communication is rejected.

  The access point 20 includes, for example, a control unit, a first communication unit that performs wireless LAN communication with the communication terminal device 10 using a predetermined communication method, and the various servers 40 and 50 and the Internet 90 via the core network 30 and the GW 35. A second communication unit that communicates with the various servers. The control unit includes a storage device including, for example, an MPU, a RAM, and a ROM, and can control each unit such as the communication unit by executing a program such as a predetermined basic OS or middleware.

In the present embodiment, the control unit of the access point 20 can implement the following functions as means in cooperation with other communication units and the like by executing a predetermined program.
For example, the control unit of the access point 20 functions as the following units (A201) to (A210) by executing a predetermined program.
(A201) Means for receiving a probe request, an authentication request, and an association request from the communication terminal device 10.
(A202) Means for transmitting a policy confirmation request including access point identification information capable of identifying the access point 20 (self) to the policy server 50 based on the association request.
(A203) Means for receiving, from the policy server 50, a policy confirmation response including communication policy information for the access point 20 (self) or information indicating whether or not the access point 20 (self) can be connected based on the communication policy information.
(A204) Means for transmitting an association response including communication policy information or connection permission information included in the policy confirmation response to the communication terminal device 10.
(A205) Means for transmitting a probe response and an authentication request to the communication terminal apparatus 10.
(A206) Means for storing communication policy information.
(A207) Means for receiving communication policy information to be updated from the policy server 50 and updating the stored communication policy information.
(A208) Means for searching and acquiring communication policy information for the access point 20 (self) based on the association request received from the communication terminal device 10.
(A209) Means for determining whether or not to connect to the access point 20 (self) based on communication policy information for the access point 20 (self).
(A210) Means for transmitting, to the communication terminal device 10, an association response including communication policy information for the access point 20 (self) or connection permission / inhibition information to the access point 20 (self) determined based on the communication policy information.

FIG. 3 is a sequence diagram illustrating an example of connection control of wireless LAN communication when the connection between the communication terminal device 10 and the access point 20 is successful in the communication system of the present embodiment.
The operation sequences in FIG. 3 and FIGS. 4 to 6 below are based on the program stored in the storage device or the like of the main control unit 110, mainly by the main control unit 110, etc. It is executed in cooperation with the band processing unit 112, the access point 20, the gateway 35, the authentication server 40, and the policy server 50.

  When the communication terminal device 10 detects that the connection to the wireless LAN is turned on, the main control unit 110 refers to the list stored in the storage device, and uses the access point type information of the network to be connected. One ESSID is acquired, and a probe request including the ESSID is broadcast (step S101).

  When the probe request is received from the communication terminal apparatus 10, the access point 20 returns a probe response to the communication terminal apparatus 10 if the ESSID included in the probe request is the same as its own ESSID (step S102). The probe response includes parameters such as BSSID, which is access point identification information of the access point 20, an encryption method, an authentication method, and a communication speed.

  If the probe response is not received from the access point 20, the communication terminal apparatus 10 acquires one other ESSID from the storage device and broadcasts a probe request including the ESSID. On the other hand, when receiving the probe response from the access point 20, the communication terminal device 10 stores the BSSID, which is the access point identification information included in the probe response, and the corresponding ESSID in the storage device.

  Next, after receiving the probe response, the communication terminal device 10 transmits an authentication request including information on its own MAC (Media Access Control) address to the access point 20 (step S103). The access point 20 determines whether or not to authenticate the communication terminal apparatus 10 using a predetermined algorithm, and returns an authentication response including the result of the authentication (step S104). This authentication is performed using, for example, the MAC address of the communication terminal device 10 as an identifier.

  Next, after confirming that the access terminal 20 has authenticated, the communication terminal apparatus 10 transmits an association (connection) request to the access point 20 (step S105). The association request includes parameters such as the ESSID of the access point 20, the support rate, and the necessity of polling use. The access point 20 confirms that the MAC address of the communication terminal device 10 is the authenticated MAC address, and all the parameters included in the association request received from the communication terminal device 10 correspond to itself, and then permits the connection. An association response including information to that effect is transmitted to communication terminal device 10 (step S106).

  Through the processes in S101 to S106 described above, a communication path for network connection by wireless LAN communication from the communication terminal apparatus 10 via access point connection is established at the communication network level. In this state, the communication terminal device 10 can transmit and receive data frames with the authentication server 40 and the policy server 50 via the backbone network 30. However, at this point in time, the user has not been authenticated by the authentication server 40, and the connection has not been completed at the application level. Therefore, the user cannot connect to the Internet 90 or the like via the gateway 35.

  Next, the communication terminal apparatus 10 transmits an authentication request including a user ID, a password, and a BSSID to the access point 20 via a login page with a predetermined URL by, for example, HTTP communication (step S107). The BSSID may be added to the authentication request transferred from the access point 20 to the authentication server 40 without being included in the authentication request transmitted from the communication terminal device 10.

  When receiving the authentication request from the communication terminal device 10, the access point 20 transmits the authentication request to the authentication server 40 via the gateway 35 (step S108).

  When receiving the authentication request from the access point 20, the authentication server 40 refers to the subscriber database 45 for user ID and password included in the authentication request, and performs user authentication (step S109). In this user authentication, whether the user of the communication terminal apparatus 10 that has transmitted the authentication request is a user registered in advance as a user who can use the wireless LAN communication via the access point corresponding to the ESSID. Authentication to be confirmed. If the user authentication is successful, a policy confirmation request including the BSSID is transmitted to the policy server 50 (step S110).

  When the policy confirmation request is received from the authentication server 40, the policy server 50 searches the policy database 55 based on the BSSID included in the policy confirmation request, and refers to the communication policy information related to the BSSID (step S111). Here, the communication policy information to be searched and referred to is, for example, a black list that is a list of connection points that cannot be connected in the past in which connection errors have occurred, or connectable access points that have not had connection errors in the past. This is information such as a white list that is a list of the above (the same applies to the following connection control examples).

  Next, the policy server 50 determines whether or not the communication terminal device 10 can connect to the access point 20 to be connected based on the referenced communication policy information (step S112). For example, it is determined by checking whether the BSSID of the access point 20 is included in the black list or the white list. If it is determined that the access point 20 can be connected because the BSSID of the access point 20 is not included in the black list (or included in the white list), an access is made based on the determination result. A policy confirmation response including information on whether or not to connect to the point 20 (for example, flag data “1” indicating that connection is possible) is returned to the authentication server 40 (step S113).

  Upon reception of the policy confirmation response from the policy server 50, the authentication server 40 transmits an authentication response to the access point 20 via the gateway 35 based on the user authentication result and the connectability information included in the policy confirmation response ( Step S114). For example, if the user authentication is successful and the BSSID of the access point 20 is not included in the black list (or included in the white list), it is determined that the connection to the access point 20 is possible. When the information is received, the authentication server 40 transmits an authentication response indicating that the authentication process has been successful to the access point 20 via the gateway 35 (step S114). And the access point 20 transmits the authentication response received from the authentication server 40 to the communication terminal device 10 (step S115).

  In the example of FIG. 3, the policy server 50 determines whether or not connection is possible, but the authentication server 40 may determine whether or not connection is possible. In this case, when the policy server 50 receives the policy confirmation request from the authentication server 40, the policy server 50 searches the policy database 55 based on the BSSID included in the policy confirmation request, and extracts the communication policy information related to the BSSID. Then, the policy server 50 returns a policy confirmation response including the extracted communication policy information to the authentication server 40. Based on the communication policy information received from the policy server 50, the authentication server 40 determines whether or not the communication terminal device 10 can connect to the access point 20 to be connected. For example, it is determined by checking whether the BSSID of the access point 20 is included in the black list or the white list. Based on the determination result and the user authentication result, the authentication server 40 transmits an authentication response to the access point 20 via the gateway 35. For example, if the user authentication is successful and the BSSID of the access point 20 is not included in the black list (or included in the white list), it is determined that the connection to the access point 20 is possible. The server 40 transmits an authentication response indicating that the authentication process has been successful to the access point 20 via the gateway 35.

  When receiving the authentication response from the access point 20, the communication terminal apparatus 10 uses a communication path (hereinafter referred to as “default communication path for network connection”) that is preferentially used for connection to the Internet 90 at the application level. The communication path (first communication path) for cellular communication via the base station 60 is switched to the communication path (second communication path) for wireless LAN communication via the access point 20 (step S116). As a result, the communication terminal device 10 can connect to the Internet 90 using the wireless LAN communication path preferentially.

  FIG. 4 is a sequence diagram showing an example of connection control for wireless LAN communication when the connection between the communication terminal device 10 and the access point 20 fails in the communication system of the present embodiment. In this operation sequence, steps S201 to S211 are the same as steps S101 to S111 shown in FIG.

  After searching the policy database 55 based on the BSSID included in the policy confirmation request and referring to the communication policy information related to the BSSID, the policy server 50 determines that the communication terminal device 10 is to be connected based on the referred communication policy information. It is determined whether or not connection to the access point 20 is possible (step S212). For example, it is determined by checking whether or not BSSID is included in the black list or white list. Here, when the user authentication is successful but the BSSID of the access point 20 is included in the black list (or is not included in the white list), it is determined that connection to the access point 20 is impossible. Based on the result, a policy confirmation response including information on whether or not to connect to the access point 20 (for example, flag data “0” indicating that connection is not possible) is returned to the authentication server 40 (step S213).

  Upon reception of the policy confirmation response from the policy server 50, the authentication server 40 sends an authentication error authentication response indicating that the authentication processing has failed based on the user authentication result and the connection availability information included in the policy confirmation response. It transmits to the access point 20 via the gateway 35 (step S214). And the access point 20 transmits the authentication response received from the authentication server 40 to the communication terminal device 10 (step S215).

  Upon receiving the authentication response from the access point 20, the communication terminal apparatus 10 confirms that the authentication has failed, and then transmits a disconnection request for stopping the connection process with the access point 20 to the access point 20 (step) S216). Then, the default communication path of the network connection is maintained as a communication path of cellular communication via the base station 60 and cannot be switched to wireless LAN communication via the access point 20. Therefore, when viewed from the user operating the communication terminal device 10, the network connection at the application level is not disconnected and the network connection can be used continuously. And convenience are improved.

  As described above, according to the connection control examples of the wireless LAN communication of FIGS. 3 and 4, when the authentication server 40 receives the authentication request, the policy server 50 is accessed, and the communication terminal device 10 can determine whether or not to connect to the access point 20. And an authentication response including the result of the connection determination is transmitted to the communication terminal device 10. Therefore, the communication terminal device 10 needs to store communication policy information related to a plurality of access points in advance, or periodically download and update communication policy information related to the plurality of access points via a communication network. Absent. Therefore, communication via the access point 20 can be controlled based on the latest communication policy information for each individual access point (for each BSSID) without increasing the load on the communication terminal device 10 and the communication network. .

  In particular, for each of a plurality of access points that can roam with each other when the communication terminal apparatus 10 is moving, the access point 20 is set for each individual access point (for each BSSID) based on the latest communication policy information. Communication can be controlled.

  Further, according to the connection control examples of the wireless LAN communication shown in FIGS. 3 and 4, the sequence between the communication terminal device 10 and the authentication server 40 is the same as the conventional one, and therefore existing processing is applied in the sequence. Can do. In addition, since the overhead of communication volume and processing time can be kept low at the time of wireless LAN communication connection processing, there is no change in the user experience and operability of the communication terminal device 10, and the same experience and operation as before. Wireless LAN communication can be used.

  Further, according to the connection control examples of the wireless LAN communication in FIGS. 3 and 4, if the communication terminal device 10 supports the authentication process with the authentication server 40, there is no additional mounting on the communication terminal device 10. However, the communication policy information can be applied at the time of authentication without being divided even for communication terminal devices that do not support connection control to the access point 20 based on the communication policy information (hereinafter referred to as “policy control”). In other words, the communication policy information stored in the policy server 50 may be created based on information uploaded by additional mounting to a specific communication terminal device or information managed on the network side. The communication policy information created by the above can be applied to a communication terminal device that has not been additionally implemented with respect to policy control as long as it supports the authentication process with the authentication server 40.

  Further, according to the connection control examples of the wireless LAN communication in FIGS. 3 and 4, since the communication path of the cellular communication is maintained until the authentication response is received from the authentication server 40, the authentication indicating that the authentication process has failed. Even if an error authentication response is received, the network connection is not disconnected.

  3 and 4, the authentication server 40 transmits a policy confirmation request to the policy server 50 when the user authentication process is successful, and the user authentication process fails. It may be controlled not to send a policy confirmation request to the policy server 50. In this case, when the user authentication process fails, an unnecessary confirmation process for confirming the communication policy information for the access point 20 is omitted, so that the processing load on the authentication server 40 and the policy server 50 and the server 40 , 50, the load on the communication line or communication network can be reduced.

  3 and 4, the authentication server 40 acquires communication policy information from the policy server 50 and determines whether or not the connection target access point 20 can be connected. The policy server 50 may determine whether or not the connection target access point 20 can be connected based on the communication policy information. In this case, connection enable / disable information indicating whether or not the connection target access point 20 determined by the policy server 50 can be connected is transmitted from the policy server 50 to the authentication server 40. Then, the authentication server 40 transmits an authentication response to the communication terminal device 10 based on the connectability information received from the policy server 50 and the user authentication result. Since the policy server 50 transmits not the communication policy information itself but the connection availability information having a relatively small data size, the communication network load between the authentication server 40 and the policy server 50 is increased. Can be prevented.

  In the wireless LAN communication connection control examples of FIGS. 3 and 4, the policy search and the connection possibility determination (S111 to S113, S211 to S213) are performed after the user authentication (S109, S209). User authentication may be performed after the connection possibility determination.

  FIG. 5 is a sequence diagram showing another example of connection control of wireless LAN communication when the connection between the communication terminal device 10 and the access point 20 is successful in the communication system of the present embodiment. In this operation sequence, steps S301 to S309 are the same as steps S101 to S109 shown in FIG.

  If the user authentication is successful in step S309 in FIG. 5, the authentication server 40 transmits an authentication response indicating that the user authentication is successful to the access point 20 via the gateway 35 (step S310). And the access point 20 transmits the authentication response received from the authentication server 40 to the communication terminal device 10 (step S311).

  When receiving the authentication response from the access point 20, the communication terminal apparatus 10 confirms that the user authentication is successful, and then sends a policy confirmation request including the BSSID of the access point 20 to be connected to the access point 20 by, for example, HTTP communication. Transmit (step S312). The BSSID may be added to the policy confirmation request transferred from the access point 20 to the authentication server 40 without being included in the policy confirmation request transmitted from the communication terminal device 10.

  When receiving the policy confirmation request from the communication terminal device 10, the access point 20 transmits the policy confirmation request to the policy server 50 via the gateway 35 (step S313).

  When receiving the policy confirmation request from the communication terminal device 10, the policy server 50 searches the policy database 55 based on the BSSID included in the policy confirmation request, and refers to the communication policy information related to the BSSID (step S314).

  Next, the policy server 50 determines whether or not the communication terminal device 10 is connectable to the connection target access point 20 based on the referenced communication policy information (step S315). For example, it is determined by checking whether the BSSID of the access point 20 is included in the black list or the white list. If it is determined that the access point 20 can be connected because the BSSID of the access point 20 is not included in the black list (or included in the white list), an access is made based on the determination result. A policy confirmation response including information on whether or not to connect to the point 20 (for example, flag data “1” indicating that connection is possible) is returned to the communication terminal device 10 via the access point 20 (steps S316 and 317).

  When receiving a policy confirmation response including a determination result determined that connection to the access point 20 is possible from the policy server 50, the communication terminal apparatus 10 uses the default communication path of the network connection as a cellular communication via the base station 60. The communication path is switched to the communication path for wireless LAN communication via the access point 20 (step S318). As a result, the communication terminal device 10 can connect to the Internet 90 using the wireless LAN communication path preferentially.

  FIG. 6 is a sequence diagram illustrating another example of connection control for wireless LAN communication when connection between the communication terminal device 10 and the access point 20 fails in the communication system according to the present embodiment. In this operation sequence, steps S401 to S417 are the same as steps S301 to S317 shown in FIG.

  In FIG. 6, when a policy confirmation response including a determination result determined that connection to the access point 20 is impossible from the policy server 50 or when the user authentication fails, the communication terminal device 10 A disconnection request for canceling the connection process with 20 is transmitted to the access point 20 (step S418). As a result, the default communication path for the network connection is maintained as a communication path for cellular communication via the base station 60 and cannot be switched to a communication path for wireless LAN communication via the access point 20. Therefore, when viewed from the user operating the communication terminal device 10, the network connection at the application level is not disconnected and the network connection can be used continuously. And convenience are improved.

  As described above, according to the connection control examples of the wireless LAN communication of FIGS. 5 and 6, when the communication terminal device 10 receives an authentication response indicating that the user authentication has been successful from the authentication server 40, the communication terminal device 10 accesses the policy server 50 to A policy confirmation response including the result of determining whether or not the terminal device 10 can be connected to the access point 20 is received, and the connection to the access point 20 is controlled based on the result of determining whether or not the connection is possible. Therefore, the communication terminal device 10 needs to store communication policy information related to a plurality of access points in advance, or periodically download and update communication policy information related to the plurality of access points via a communication network. Absent. Therefore, communication via the access point 20 can be controlled based on the latest communication policy information for each individual access point (for each BSSID) without increasing the load on the communication terminal device 10 and the communication network. .

  In particular, for each of a plurality of access points that can roam with each other when the communication terminal apparatus 10 is moving, the access point 20 is set for each individual access point (for each BSSID) based on the latest communication policy information. Communication can be controlled.

  Further, according to the wireless LAN communication connection control examples of FIGS. 5 and 6, since the communication path of cellular communication is maintained until the policy confirmation response is received from the policy server 50, the connection to the access point 20 is impossible. Even if it is judged, the network connection is not disconnected.

  Further, according to the connection control examples of the wireless LAN communication in FIGS. 5 and 6, since the process in the authentication server 40 is the same as the conventional process, the modification of the authentication server 40 is unnecessary.

  Further, according to the connection control example of the wireless LAN communication in FIGS. 5 and 6, not the communication policy information itself but the connection availability information having a relatively small data size is transmitted from the policy server 50 to the communication terminal device 10. Therefore, an increase in the load on the communication network between the communication terminal device 10 and the policy server 50 can be prevented.

  5 and 6, when the user authentication process by the authentication server 40 is successful, a policy confirmation request is transmitted from the communication terminal device 10 to the policy server 50, and the user authentication process is performed. Control may be performed so that a policy confirmation request is not transmitted from the communication terminal apparatus 10 to the policy server 50 when the process fails. In this case, when the user authentication process in the authentication server 40 fails, the communication terminal apparatus 10 omits an unnecessary confirmation process for confirming the communication policy information for the access point 20 with respect to the policy server 50. It is possible to reduce the processing load on the communication terminal device 10 and the policy server 50 and the load on the communication line or communication network between them.

  5 and 6, the policy server 50 determines whether or not the connection target access point 20 can be connected based on the communication policy information. May acquire communication policy information from the policy server 50 and determine whether or not the access point 20 to be connected is connectable. In this case, the communication policy information relating to the connection through the connection target access point 20 retrieved by the policy server 50 is transmitted from the policy server 50 to the communication terminal device 10. Then, the communication terminal device 10 determines whether or not the access point 20 to be connected is connectable based on the communication policy information received from the policy server 50 and controls the connection with the access point 20.

  Further, in the connection control examples of the wireless LAN communication of FIGS. 5 and 6, in consideration of the communication time overhead in the network communication, if it takes time for the user authentication processing in the authentication server 40, for example, the authentication request is transmitted to the authentication. If the time until the response is received is longer than a preset threshold value, the inquiry to the policy server 50 (transmission of the policy confirmation request) is omitted, and the access point 20 is based on the result of user authentication in the authentication server 40. You may control connection with. Thereby, connection processing of wireless LAN communication can be performed at best effort.

  In the wireless LAN communication connection control examples of FIGS. 5 and 6, the timeout time at the time of inquiry from the communication terminal device 10 to the policy server 50 (transmission of policy confirmation request to reception of policy confirmation response) is shortened (for example, Alternatively, it may be set shorter than the time-out period during authentication processing to the authentication server 40. When a time-out occurs when the communication terminal device 10 makes an inquiry to the policy server 50, the connection with the access point 20 is controlled based on the result of user authentication in the authentication server 40. Thereby, connection processing of wireless LAN communication can be performed at best effort.

  In the wireless LAN communication connection control examples of FIGS. 5 and 6, policy search and connection possibility determination (S312 to S317, S412 to S417) are performed after user authentication (S307 to S311, S407 to S411). The user authentication may be performed after the policy search and the connection possibility determination.

  FIG. 7 is a sequence diagram illustrating still another example of connection control of wireless LAN communication when the connection between the communication terminal device 10 and the access point 20 is successful in the communication system according to the present embodiment. In the connection control of FIG. 7, similarly to the policy server 50, the authentication server 40 includes a policy database (DB) in which communication policy information regarding communication between the communication terminal device 10 and the communication network via the access point 20 is stored. ing. In this operation sequence, steps S504 to S512 are the same as steps S101 to S109 shown in FIG.

  In FIG. 7, when the communication policy information stored in the policy database (DB) 55 of the policy server 50 is updated (step S501), the policy server 50 authenticates the policy update information related to the updated communication policy information. It transmits to the server 40 (step S502). The authentication server 40 updates predetermined communication policy information in the policy database (DB) based on the policy update information received from the policy server 50 (step S503). The update process of the policy database (DB) in the authentication server 40 is performed at a timing other than when the communication policy information stored in the policy database (DB) 55 of the policy server 50 is updated, for example, a predetermined predetermined value. You may go at regular timing. Further, the policy database (DB) in the authentication server 40 may be synchronized with the policy database (DB) 55 of the policy server 50 at a predetermined timing set in advance.

  If the user authentication is successful in step S512 in FIG. 7, the authentication server 40 searches the policy database based on the BSSID included in the authentication request from the access point 20, and refers to the communication policy information related to the BSSID (step). S513).

  Next, the authentication server 40 determines whether or not the communication terminal device 10 can connect to the access point 20 to be connected based on the referenced communication policy information (step S514). For example, it is determined by checking whether the BSSID of the access point 20 is included in the black list or the white list. Here, when it is determined that the access point 20 can be connected because the BSSID of the access point 20 is not included in the black list (or included in the white list), the user is determined based on the determination result. An authentication response indicating that the authentication has succeeded is transmitted to the access point 20 via the gateway 35 (step S515). The access point 20 transmits the authentication response received from the authentication server 40 to the communication terminal device 10 (step S516).

  When receiving the authentication response indicating that the user authentication is successful, the communication terminal apparatus 10 executes a communication path switching process (step S517). Specifically, the default communication path for the network connection is switched from the communication path for cellular communication via the base station 60 to the communication path for wireless LAN communication via the access point 20. As a result, the communication terminal device 10 can connect to the Internet 90 using the wireless LAN communication path preferentially.

  FIG. 8 is a sequence diagram showing still another example of connection control for wireless LAN communication when connection between the communication terminal device 10 and the access point 20 fails in the communication system of the present embodiment. In this operation sequence, steps S601 to S613 are the same as steps S501 to S513 shown in FIG.

  After searching the policy database based on the BSSID included in the authentication request and referring to the communication policy information related to the BSSID, the authentication server 40 determines that the communication terminal device 10 is connected to the connection target access based on the referred communication policy information. It is determined whether or not connection to the point 20 is possible (step S614). For example, it is determined by checking whether or not BSSID is included in the black list or white list. Here, when the user authentication is successful but the BSSID of the access point 20 is included in the black list (or is not included in the white list), it is determined that connection to the access point 20 is impossible. Based on the result, an authentication response to the effect that user authentication has failed is returned to the communication terminal device 10 via the access point 20 (steps S615 and S616).

  Upon receiving an authentication response from the authentication server 40 via the access point 20, the communication terminal apparatus 10 confirms that the authentication has failed, and then sends a disconnection request for canceling the connection processing with the access point 20 to the access point. 20 (step S617). As a result, the default communication path for the network connection is maintained as a communication path for cellular communication via the base station 60 and cannot be switched to a communication path for wireless LAN communication via the access point 20. Therefore, when viewed from the user operating the communication terminal device 10, the network connection at the application level is not disconnected and the network connection can be used continuously. And convenience are improved.

  As described above, according to the wireless LAN communication connection control examples of FIGS. 7 and 8, when the authentication server 40 receives the authentication request, the connection from the communication terminal device 10 to the access point 20 is referred to by referring to its own policy database. An authentication response including a result of the connection determination is transmitted to the communication terminal device 10. Therefore, the communication terminal device 10 needs to store communication policy information related to a plurality of access points in advance, or periodically download and update communication policy information related to the plurality of access points via a communication network. Absent. Therefore, communication via the access point 20 can be controlled based on the latest communication policy information for each individual access point (for each BSSID) without increasing the load on the communication terminal device 10 and the communication network. .

  In particular, for each of a plurality of access points that can roam with each other when the communication terminal apparatus 10 is moving, the access point 20 is set for each individual access point (for each BSSID) based on the latest communication policy information. Communication can be controlled.

  Further, according to the connection control examples of the wireless LAN communication shown in FIGS. 7 and 8, the sequence between the communication terminal device 10 and the authentication server 40 is the same as the conventional one, so that the existing processing is applied in the sequence. Can do. In addition, since the overhead of communication volume and processing time can be kept low at the time of wireless LAN communication connection processing, there is no change in the user experience and operability of the communication terminal device 10, and the same experience and operation as before. Wireless LAN communication can be used.

  Further, according to the wireless LAN communication connection control examples of FIGS. 7 and 8, if the communication terminal device 10 supports the authentication process with the authentication server 40, there is no additional mounting on the communication terminal device 10. However, communication policy information can be applied at the time of authentication without being divided even for communication terminal devices that do not support policy control. That is, the communication policy information stored in the authentication server 40 and the policy server 50 may be created based on, for example, information uploaded by additional mounting on a specific communication terminal device or information managed on the network side. However, the communication policy information created thereby can be applied to a communication terminal device that is not additionally implemented with respect to policy control as long as it can handle authentication processing with the authentication server 40.

  Further, according to the wireless LAN communication connection control examples of FIGS. 7 and 8, since the communication path of cellular communication is maintained until an authentication response is received from the authentication server 40, authentication indicating that the authentication process has failed. Even if an error authentication response is received, the network connection is not disconnected.

  In the wireless LAN communication connection control example of FIGS. 7 and 8, policy search and connection possibility determination (S513 to S514, S613 to S614) are performed after user authentication (S512, S612). User authentication may be performed after the connection possibility determination.

  FIG. 9 is a sequence diagram showing still another example of connection control of wireless LAN communication when the connection between the communication terminal apparatus 10 and the access point 20 is successful in the communication system of the present embodiment. In this operation sequence, steps S701 to S704 are the same as steps S101 to S104 shown in FIG.

  In FIG. 9, when the association request is received from the communication terminal device 10, the access point 20 transmits a policy confirmation request including its own BSSID to the policy server 50 (step S706).

  When receiving the policy confirmation request from the access point 20, the policy server 50 searches the policy database 55 based on the BSSID included in the policy confirmation request, and refers to the communication policy information related to the BSSID (step S707).

  Next, the policy server 50 determines whether or not the communication terminal device 10 can be connected to the access point 20 to be connected based on the referenced communication policy information (step S708). For example, it is determined by checking whether the BSSID of the access point 20 is included in the black list or the white list. If it is determined that the access point 20 can be connected because the BSSID of the access point 20 is not included in the black list (or included in the white list), an access is made based on the determination result. A policy confirmation response including information on whether or not to connect to the point 20 (for example, flag data “1” indicating that connection is possible) is returned to the access point 20 (step S709).

  When receiving the policy confirmation response from the policy server 50, the access point 20 returns an association response including information indicating that connection to the access point 20 is permitted to the communication terminal device 10 (step S710).

  In the example of FIG. 9, the policy server 50 determines whether or not connection is possible, but the access point 20 may determine whether or not connection is possible. In this case, when the policy server 50 receives a policy confirmation request from the access point 20, the policy server 50 searches the policy database 55 based on the BSSID included in the policy confirmation request, and extracts communication policy information related to the BSSID. Then, the policy server 50 returns a policy confirmation response including the extracted communication policy information to the access point 20. Based on the communication policy information received from the policy server 50, the access point 20 determines whether or not the communication terminal device 10 can be connected to itself. For example, it is determined by checking whether the BSSID of the access point 20 is included in the black list or the white list. Based on the determination result, the access point 20 transmits an association response to the communication terminal device 10. For example, when the BSSID of the access point 20 is not included in the black list (or is included in the white list), if it is determined that the connection to the access point 20 is possible, the access point 20 permits the connection. An association response indicating that is transmitted to the communication terminal device 10.

  Upon receiving the association response from the access point 20, the communication terminal apparatus 10 executes an authentication process (steps S 711 to S 715) with the authentication server 40, and then sets the default communication path for the network connection to the base station 60. The communication path of the cellular communication via is switched to the communication path of the wireless LAN communication via the access point 20 (step S716). As a result, the communication terminal device 10 can connect to the Internet 90 using the wireless LAN communication path preferentially.

  FIG. 10 is a sequence diagram illustrating another example of connection control for wireless LAN communication when connection between the communication terminal device 10 and the access point 20 fails in the communication system according to the present embodiment. In this operation sequence, steps S801 to S808 are the same as steps S701 to S708 shown in FIG.

  In FIG. 10, when a policy confirmation response including a determination result that it is determined that connection to the access point 20 is not possible is received from the policy server 50 (step S809), the access point 20 refuses connection to itself. The association response is transmitted to the communication terminal device 10 (step S810). The communication terminal apparatus 10 interrupts the connection process to the access point 20 based on the association response received from the access point 20 (step S811). Thereby, the default communication path for the network connection is maintained as the communication path for cellular communication via the base station 60 and cannot be switched to the communication path for wireless LAN communication via the access point 20.

  9 and 10, according to the wireless LAN communication connection control example, when the access point 20 receives the association request from the communication terminal device 10, the access point 20 accesses the policy server 50 and the access point 20 from the communication terminal device 10. A policy confirmation response including the result of connection permission / inhibition determination is received, and connection to the access point 20 is controlled based on the connection permission determination result. Therefore, the communication terminal device 10 needs to store communication policy information related to a plurality of access points in advance, or periodically download and update communication policy information related to the plurality of access points via a communication network. Absent. Therefore, communication via the access point 20 can be controlled based on the latest communication policy information for each individual access point (for each BSSID) without increasing the load on the communication terminal device 10 and the communication network. .

  In particular, for each of a plurality of access points that can roam with each other when the communication terminal apparatus 10 is moving, the access point 20 is set for each individual access point (for each BSSID) based on the latest communication policy information. Communication can be controlled.

  Also, according to the wireless LAN communication connection control examples of FIGS. 9 and 10, since the communication path of cellular communication is maintained until the policy confirmation response is received from the policy server 50, the connection to the access point 20 is impossible. Even if it is judged, the network connection is not disconnected.

  Further, according to the connection control examples of the wireless LAN communication in FIGS. 9 and 10, since the processing in the authentication server 40 is the same as the conventional processing, the modification of the authentication server 40 is unnecessary.

  Further, according to the connection control examples of the wireless LAN communication in FIGS. 9 and 10, not the communication policy information itself but the connection availability information having a relatively small data size is transmitted from the policy server 50 to the access point 20. The increase in the load on the communication network between the access point 20 and the policy server 50 can be prevented.

  FIG. 11 is a sequence diagram showing still another example of connection control of wireless LAN communication when the connection between the communication terminal device 10 and the access point 20 is successful in the communication system of the present embodiment. In the connection control of FIG. 11, as with the policy server 50, the access point 20 includes a policy database (DB) that stores communication policy information related to communication between the communication terminal device 10 and the communication network via the access point. Yes. In this operation sequence, steps S904 to S907 are the same as steps S101 to S104 shown in FIG. 3, and steps S912 to S917 are the same as steps S711 to S716 shown in FIG. Description of is omitted.

  In FIG. 11, when the communication policy information stored in the policy database (DB) 55 of the policy server 50 is updated (step S901), the policy server 50 accesses the policy update information related to the updated communication policy information. It transmits to the point 20 (step S902). The access point 20 updates predetermined communication policy information in the policy database (DB) based on the policy update information received from the policy server 50. The update process of the policy database (DB) in the access point 20 is performed at a timing other than when the communication policy information stored in the policy database (DB) 55 of the policy server 50 is updated, for example, a predetermined predetermined value. You may go at regular timing. Further, the policy database (DB) in the access point 20 may be synchronized with the policy database (DB) 55 of the policy server 50 at a predetermined timing set in advance.

  When the association request is received in step S908 in FIG. 11, the access point 20 searches the policy database based on its own BSSID, and refers to the communication policy information related to the BSSID (step S909).

  Next, the access point 20 determines whether or not the communication terminal device 10 is connectable to the connection target access point (self) based on the referenced communication policy information (step S910). For example, it is determined by checking whether the BSSID of the access point 20 is included in the black list or the white list. Here, when it is determined that the connection to the access point 20 is possible because its own BSSID is not included in the black list (or included in the white list), based on the determination result, An association response for permitting connection to is transmitted to the communication terminal device 10 (step S911).

  Upon receiving the association response from the access point 20, the communication terminal device 10 executes an authentication process (steps S 912 to S 916) with the authentication server 40, and then sets the base station 60 as the default communication path for the network connection. The communication path of the cellular communication via the network is switched to the communication path of the wireless LAN communication via the access point 20 (step S917). As a result, the communication terminal device 10 can connect to the Internet 90 using the wireless LAN communication path preferentially.

  FIG. 12 is a sequence diagram illustrating another example of connection control for wireless LAN communication when connection between the communication terminal device 10 and the access point 20 fails in the communication system according to the present embodiment. In this operation sequence, steps S1001 to S1009 are the same as steps S901 to S909 shown in FIG.

  In FIG. 12, when it is determined that connection to itself is not possible (step S1010), the access point 20 transmits an association response indicating that connection to itself is rejected to the communication terminal device 10 (step S1011). The communication terminal apparatus 10 interrupts the connection process to the access point 20 based on the association response received from the access point 20 (step S1012). As a result, the default communication path for the network connection is maintained as a communication path for cellular communication via the base station 60 and cannot be switched to a communication path for wireless LAN communication via the access point 20.

  11 and 12, when the access point 20 receives an association request from the communication terminal device 10, it determines whether the communication terminal device 10 can connect to itself, The connection from the communication terminal device 10 to the access point 20 is controlled by transmitting an association response reflecting the determination result to the communication terminal device 10. Therefore, the communication terminal device 10 needs to store communication policy information related to a plurality of access points in advance, or periodically download and update communication policy information related to the plurality of access points via a communication network. Absent. Therefore, communication via the access point 20 can be controlled based on the latest communication policy information for each individual access point (for each BSSID) without increasing the load on the communication terminal device 10 and the communication network. .

  In particular, for each of a plurality of access points that can roam with each other when the communication terminal apparatus 10 is moving, the access point 20 is set for each individual access point (for each BSSID) based on the latest communication policy information. Communication can be controlled.

  Further, according to the connection control example of the wireless LAN communication of FIG. 11 and FIG. 12, until the user authentication is completed based on the association response (connection permission) from the access point 20 or the association response from the access point 20 ( Since the communication path of the cellular communication is maintained until the connection process is interrupted based on (connection rejection), the network connection is not disconnected even when it is determined that connection to the access point 20 is impossible.

  Further, according to the connection control examples of the wireless LAN communication in FIGS. 11 and 12, since the processing in the authentication server 40 is the same as the conventional processing, the modification of the authentication server 40 is unnecessary.

  FIG. 13 is a schematic configuration diagram illustrating an example of a communication system according to another embodiment of the present invention. In FIG. 13, the same parts as those in FIG.

  The communication system of FIG. 13 includes an access point management server (hereinafter referred to as “AP management server”) 80 as a relay device management apparatus that manages a plurality of access points 20 in addition to the authentication server 40 and policy server 50 described above. ing. The AP management server 80 is configured to be able to communicate with each of the plurality of access points 20 via the core network 30 and the GW 35, and is connected to an access point database (AP DB) 85 in which information on each access point is stored.

  The AP management server 80 can be configured by, for example, a single computer device or a combination of a plurality of computer devices, and can execute various processes and controls by executing a predetermined program installed in advance. Can be executed. In addition, the AP management server 80 and the access point database (AP DB) 85 may be configured by a single computer device.

  In the present embodiment, the AP management server 80 can implement the following functions as means by executing a predetermined program.

For example, the AP management server 80 functions as the following units (A801) to (A809) by executing a predetermined program.
(A801) Means for receiving an association request from the communication terminal device 10 via the access point 20.
(A802) Means for transmitting a policy confirmation request including access point identification information capable of identifying the access point 20 to the policy server 50 based on the association request.
(A803) Means for receiving, from the policy server 50, a policy confirmation response including communication policy information for the access point 20 or information on whether or not to connect to the access point 20 determined based on the communication policy information.
(A804) Means for transmitting an association response including the communication policy information or connection permission information included in the policy confirmation response to the communication terminal device 10 via the access point 20.
(A805) Means for storing communication policy information.
(A806) Means for receiving communication policy information to be updated from the policy server 50 and updating the stored communication policy information.
(A807) Means for searching and acquiring communication policy information for the access point 20 based on the access point identification information included in the association request.
(A808) Means for determining whether or not connection to the access point 20 is possible based on communication policy information for the access point 20.
(A809) communication policy information for the access point 20 obtained by searching based on the access point identification information included in the association request, or information on whether or not to connect to the access point 20 determined based on the communication policy information. A means for transmitting an association response to the communication terminal device 10 via the access point 20.

  FIG. 14 is a sequence diagram illustrating an example of connection control of wireless LAN communication when the connection between the communication terminal device 10 and the access point 20 is successful in the communication system of FIG. In this operation sequence, steps S1101 to S1104 are the same as steps S101 to S104 shown in FIG. 3, and steps S1111 to S1116 are the same as steps S711 to S716 shown in FIG. These descriptions are omitted.

  In FIG. 14, when the association request is received from the communication terminal device 10, the access point 20 transmits an association request including its own BSSID to the AP management server 80 (step S1105). Upon receiving the association request, the AP management server 80 transmits a policy confirmation request including the BSSID of the access point 20 to the policy server 50 (step S1106).

  When receiving the policy confirmation request from the AP management server 80, the policy server 50 searches the policy database 55 based on the BSSID included in the policy confirmation request, and refers to the communication policy information related to the BSSID (step S1107).

  Next, the policy server 50 determines whether or not the communication terminal device 10 can connect to the access point 20 to be connected based on the referenced communication policy information (step S1108). For example, it is determined by checking whether the BSSID of the access point 20 is included in the black list or the white list. If it is determined that the access point 20 can be connected because the BSSID of the access point 20 is not included in the black list (or included in the white list), an access is made based on the determination result. A policy confirmation response including information on whether or not to connect to the point 20 (for example, flag data “1” indicating that connection is possible) is returned to the AP management server 80 (step S1109).

  Upon reception of the policy confirmation response from the policy server 50, the AP management server 80 transmits an association response including information indicating that connection to the access point 20 is permitted to the communication terminal device 10 via the access point 20 (step). S1110).

  In the example of FIG. 14, the policy server 50 determines whether or not connection is possible, but the AP management server 80 may determine whether or not connection is possible. In this case, when the policy server 50 receives the policy confirmation request from the AP management server 80, the policy server 50 searches the policy database 55 based on the BSSID included in the policy confirmation request, and extracts the communication policy information related to the BSSID. Then, the policy server 50 returns a policy confirmation response including the extracted communication policy information to the AP management server 80. The AP management server 80 determines whether or not the communication terminal device 10 can connect to the access point 20 based on the communication policy information received from the policy server 50. For example, it is determined by checking whether the BSSID of the access point 20 is included in the black list or the white list. Based on the determination result, the AP management server 80 transmits an association response to the communication terminal device 10 via the access point 20. For example, if the BSSID of the access point 20 is not included in the black list (or is included in the white list) and it is determined that connection to the access point 20 is possible, the AP management server 80 determines that the access point 20 Then, an association response indicating that the connection is permitted is transmitted to the communication terminal device 10.

  When the association response is received from the AP management server 80 via the access point 20, the communication terminal device 10 executes authentication processing (steps S <b> 1111 to S <b> 1115) with the authentication server 40, and then performs default communication for the network connection. The route is switched from the communication route of cellular communication via the base station 60 to the communication route of wireless LAN communication via the access point 20 (step S1116). As a result, the communication terminal device 10 can connect to the Internet 90 using the wireless LAN communication path preferentially.

  FIG. 15 is a sequence diagram illustrating an example of connection control for wireless LAN communication when connection between the communication terminal device 10 and the access point 20 fails in the communication system of FIG. In this operation sequence, steps S1201 to S1208 are the same as steps S1101 to S1108 shown in FIG.

  In FIG. 15, when receiving a policy confirmation response including a determination result determined that connection to the access point 20 is not possible from the policy server 50 (step S1209), the AP management server 80 establishes connection to the access point 20. An association response indicating rejection is transmitted to the communication terminal device 10 via the access point 20 (step S1210). The communication terminal apparatus 10 interrupts the connection process to the access point 20 based on the association response received from the access point 20 (step S1211). As a result, the default communication path for the network connection is maintained as a communication path for cellular communication via the base station 60 and cannot be switched to a communication path for wireless LAN communication via the access point 20. Therefore, when viewed from the user operating the communication terminal device 10, the network connection at the application level is not disconnected and the network connection can be used continuously. And convenience are improved.

  14 and 15, when the AP management server 80 receives an association request from the communication terminal device 10 via the access point 20, it accesses the policy server 50 and communicates. A policy confirmation response including the result of determining whether or not the terminal device 10 can be connected to the access point 20 is received, and the connection to the access point 20 is controlled based on the result of determining whether or not the connection is possible. Therefore, the communication terminal device 10 needs to store communication policy information related to a plurality of access points in advance, or periodically download and update communication policy information related to the plurality of access points via a communication network. Absent. Therefore, communication via the access point 20 can be controlled based on the latest communication policy information for each individual access point (for each BSSID) without increasing the load on the communication terminal device 10 and the communication network. .

  In particular, for each of a plurality of access points that can roam with each other when the communication terminal apparatus 10 is moving, the access point 20 is set for each individual access point (for each BSSID) based on the latest communication policy information. Communication can be controlled.

  Further, according to the connection control examples of the wireless LAN communication in FIGS. 14 and 15, since the communication path of the cellular communication is maintained until the communication terminal apparatus 10 receives the association response from the AP management server 80, the access point 20 Even if it is determined that connection to the network is impossible, the network connection is not disconnected.

  Further, according to the connection control examples of the wireless LAN communication in FIGS. 14 and 15, since the process in the authentication server 40 is the same as the conventional process, the modification of the authentication server 40 is unnecessary.

  Further, according to the connection control example of the wireless LAN communication of FIGS. 14 and 15, not the communication policy information itself but the connection availability information having a relatively small data size is transmitted from the policy server 50 to the AP management server 80. Therefore, an increase in the load on the communication network between the AP management server 80 and the policy server 50 can be prevented.

  FIG. 16 is a sequence diagram illustrating another example of connection control of wireless LAN communication when the connection between the communication terminal device 10 and the access point 20 is successful in the communication system of FIG. In the connection control of FIG. 16, the AP management server 80, like the policy server 50, stores a policy database (DB) that stores communication policy information related to communication between the communication terminal device 10 and the communication network via the access point 20. I have. In this operation sequence, steps S1304 to S1307 are the same as steps S101 to S104 shown in FIG. 3, and steps S1312 to S1317 are the same as steps S711 to S716 shown in FIG. Description of is omitted.

  In FIG. 16, when the communication policy information stored in the policy database (DB) 55 of the policy server 50 is updated (step S1301), the policy server 50 displays the policy update information regarding the updated communication policy information as AP. It transmits to the management server 80 (step S1302). The AP management server 80 updates predetermined communication policy information in the policy database (DB) based on the policy update information received from the policy server 50 (step S1303). Note that the policy database (DB) update processing in the AP management server 80 is performed at a timing other than when the communication policy information stored in the policy database (DB) 55 of the policy server 50 is updated, for example, a preset predetermined value. You may go to the regular timing. Further, the policy database (DB) in the AP management server 80 may be synchronized with the policy database (DB) 55 of the policy server 50 at a predetermined timing set in advance.

  When the association request is received in step S1308 in FIG. 16, the AP management server 80 searches the policy database based on the BSSID of the access point 20 and refers to the communication policy information related to the BSSID (step S1309).

  Next, the AP management server 80 determines whether or not the communication terminal device 10 can connect to the access point 20 to be connected based on the referenced communication policy information (step S1310). For example, it is determined by checking whether the BSSID of the access point 20 is included in the black list or the white list. If it is determined that the access point 20 can be connected because the BSSID of the access point 20 is not included in the black list (or included in the white list), an access is made based on the determination result. An association response for permitting connection to the point 20 is transmitted to the communication terminal apparatus 10 via the access point 20 (step S1311).

  Upon receiving the association response from the AP management server 80, the communication terminal apparatus 10 executes an authentication process (steps S1312 to S1316) with the authentication server 40, and then sets the default communication path for the network connection to the base station 60. Is switched from the communication path of cellular communication via the wireless LAN to the communication path of wireless LAN communication via the access point 20 (step S1317). As a result, the communication terminal device 10 can connect to the Internet 90 using the wireless LAN communication path preferentially.

  FIG. 17 is a sequence diagram illustrating another example of connection control for wireless LAN communication when connection between the communication terminal device 10 and the access point 20 fails in the communication system of FIG. In this operation sequence, steps S1401 to S1409 are the same as steps S1301 to S1309 shown in FIG.

  In FIG. 17, when it is determined that connection to the access point 20 is not possible (step S1410), the AP management server 80 sends an association response indicating that connection to the access point 20 is rejected via the access point 20 to the communication terminal. It transmits to the apparatus 10 (step S1411). The communication terminal device 10 interrupts the connection process to the access point 20 based on the association response received from the AP management server 80 (step S1412). As a result, the default communication path for the network connection is maintained as a communication path for cellular communication via the base station 60 and cannot be switched to a communication path for wireless LAN communication via the access point 20. Therefore, when viewed from the user operating the communication terminal device 10, the network connection at the application level is not disconnected and the network connection can be used continuously. And convenience are improved.

  As described above, according to the connection control examples of the wireless LAN communication of FIGS. 16 and 17, when the AP management server 80 receives the association request from the communication terminal device 10, it is determined whether or not the communication terminal device 10 can connect to the access point 20. The connection from the communication terminal apparatus 10 to the access point 20 is controlled by transmitting an association response reflecting the determination result to the communication terminal apparatus 10. Therefore, the communication terminal device 10 needs to store communication policy information related to a plurality of access points in advance, or periodically download and update communication policy information related to the plurality of access points via a communication network. Absent. Therefore, communication via the access point 20 can be controlled based on the latest communication policy information for each individual access point (for each BSSID) without increasing the load on the communication terminal device 10 and the communication network. .

  In particular, for each of a plurality of access points that can roam with each other when the communication terminal apparatus 10 is moving, the access point 20 is set for each individual access point (for each BSSID) based on the latest communication policy information. Communication can be controlled.

  Further, according to the wireless LAN communication connection control examples of FIGS. 16 and 17, until the user authentication is completed based on the association response (connection permission) from the AP management server 80 or the association from the AP management server 80. Since the communication path of cellular communication is maintained until the connection process is interrupted based on the response (connection rejection), the network connection is not disconnected even when it is determined that the connection to the access point 20 is impossible.

  Further, according to the connection control examples of the wireless LAN communication shown in FIGS. 16 and 17, since the processing in the authentication server 40 is the same as the conventional processing, the authentication server 40 does not need to be modified.

  As described above, according to each of the above embodiments, communication via the wireless LAN access point 20 can be controlled based on the latest communication policy information without increasing the load on the communication terminal device 10 and the communication network.

  In the connection control example (communication path establishment processing example) of each of the above embodiments, the communication policy information managed by the policy server 50 and inquired of the policy server 50 is an access for which connection from the communication terminal device 10 is permitted or prohibited. The case of a list (white list or black list) of access point identification information (for example, BSSID) that can identify the point 20 has been described. However, the present invention relates to a case where wireless LAN connection control is performed using other communication policy information. Can be applied similarly.

  For example, the communication policy information used for wireless LAN connection control (communication route establishment processing) is a time zone during which connection from the communication terminal apparatus 10 to the access point 20 is permitted or prohibited, and communication route establishment processing via the access point 20. May include at least one of information such as a time-out time and a threshold value of received signal strength (RSSI) in the communication terminal device 10 when connecting to the access point 20. In this case, the policy database 55 stores, for example, the time zone, timeout time, received signal strength (RSSI) threshold value, and the like in association with access point identification information (for example, BSSID) of a plurality of access points. Further, when the policy server 50 receives a policy confirmation request including access point identification information (for example, BSSID), the policy server 50 refers to the policy database 55 and refers to the time zone, timeout time, Communication policy information including a threshold of received signal strength (RSSI) and the like are acquired. Then, the policy server 50 includes a list of access point identification information (white list or black list) of access points that are permitted or prohibited to connect from the communication terminal device 10 and a policy confirmation response including the retrieved communication policy information. Is transmitted to the authentication server 40 or the communication terminal device 10. The authentication server 40 and the communication terminal device 10 that have received this policy confirmation response receive the list (white list or black list) of the access point identification information included in the policy confirmation response received from the policy server 50, the time zone, and the timeout time. Based on the communication policy information including the received signal strength, it is possible to determine whether or not connection from the communication terminal apparatus 10 to the access point to be connected is possible.

  In the connection control examples (communication path establishment processing examples) of FIGS. 3 to 17 of the present embodiment, the policy transmitted from the policy server 50 to the authentication server 40, the communication terminal device 10, the access point 20, or the AP management server 80. Although the case where the confirmation response includes communication policy information such as a list of access point identification information (white list or black list) of the access point has been described, the policy confirmation response includes information on whether or not the access point can be connected as shown below. May be included. In this case, that is, the policy server 50 includes a list (white list or black list) of access point identification information of access points that are permitted or prohibited to connect from the communication terminal device 10, the time zone, the timeout time, and the received signal strength. Based on the communication policy information such as, it is determined whether or not connection from the communication terminal device 10 to the access point to be connected is possible, and a policy confirmation response including the connection permission information to the access point that is the determination result, You may transmit to the authentication server 40, the communication terminal device 10, the access point 20, or the AP management server 80. In this case, the processing load on the authentication server 40, the communication terminal device 10, the access point 20 and the AP management server 80, and the policy server 50 and the authentication server 40, the communication terminal device 10, the access point 20 and the AP management server 80, It is possible to reduce the load on the communication line and the communication network.

  In addition, the communication policy information indicates whether each access point 20 (for each BSSID), accessible time zone, day of the week, season (for example, New Year or Christmas period), etc. can be connected to the access point 20. May be set so as to prescribe. For example, the policy server 50 determines whether or not the connection is possible based on information such as date, day of the week, and time when performing the determination, and the communication policy information searched and referenced. In this case, for each access point 20 (for each BSSID), the access point by the communication terminal device 10 according to the time zone, day of the week, season (for example, New Year or Christmas period), etc., defined in the communication policy information. Communication via 20 can be controlled.

  Further, the communication policy information specifies whether or not connection to the access point 20 is possible for each model of the communication terminal device 10 or whether or not connection to the access point 20 is possible for each type of the access point 20. May be set. In this case, communication via the access point 20 by the communication terminal apparatus 10 can be controlled for each model of the communication terminal apparatus 10 or for each type of the access point 20.

DESCRIPTION OF SYMBOLS 10 Communication terminal device 20 Wireless LAN access point 20A Access point wireless communication area 30 Backbone network 35 Gateway 40 Authentication server 45 Subscriber database 50 Policy server 55 Policy database 60 Base station 60A Cell 70 Core network 75 Gateway 80 AP (Access point) ) Management server 85 AP (access point) database 90 Internet

JP 2014-14049 A

Claims (10)

A communication system connectable from a communication terminal device to a communication network via a wireless LAN relay device,
An authentication processing device that executes an authentication process when connected to the communication network from the communication terminal device via the relay device;
A policy management device that manages communication policy information related to communication between the communication terminal device and a communication network via the relay device;
The authentication processing device includes:
Means for receiving from the communication terminal device an authentication request including user identification information capable of identifying a user of the communication terminal device and device identification information capable of identifying a relay device connected to the communication terminal device;
Means for performing user authentication processing for determining whether communication via the relay device is permitted by a user of the communication terminal device based on user identification information included in the authentication request;
Means for transmitting a policy confirmation request including the device identification information to the policy management device;
Means for receiving, from the policy management device, a policy confirmation response including communication policy information for the relay device or information on whether or not to connect to the relay device determined based on the communication policy information;
Means for transmitting an authentication response to the authentication request to the communication terminal device based on the result of the user authentication process and the communication policy information or the connection availability information included in the policy confirmation response;
The policy management device includes:
Means for receiving a policy confirmation request including the device identification information from the authentication processing device;
A policy confirmation response including communication policy information for the relay device obtained by searching based on the device identification information or connection permission information to the relay device determined based on the communication policy information is sent to the authentication processing device. And means for transmitting. The communication system of claim 1.
The authentication processing device includes:
When the user authentication process is successful, the policy confirmation request is transmitted to the policy management device,
A communication system, wherein the policy confirmation request is not transmitted to the policy management apparatus when the user authentication process fails. A communication system connectable from a communication terminal device to a communication network via a wireless LAN relay device,
An authentication processing device that executes an authentication process when connected to the communication network from the communication terminal device via the relay device;
A policy management device that manages communication policy information related to communication between the communication terminal device and a communication network via the relay device;
The authentication processing device includes:
Means for storing the communication policy information;
Means for receiving communication policy information to be updated from the policy management device, and updating the stored communication policy information;
Means for receiving from the communication terminal device an authentication request including user identification information capable of identifying a user of the communication terminal device and device identification information capable of identifying a relay device connected to the communication terminal device;
Means for performing user authentication processing for determining whether communication via the relay device is permitted by a user of the communication terminal device based on user identification information included in the authentication request;
A result of the user authentication process, and communication policy information for the relay device obtained by searching based on the device identification information, or connection permission / inhibition information to the relay device determined based on the communication policy information. And means for transmitting an authentication response to the authentication request to the communication terminal device,
The said policy management apparatus is provided with the means to transmit the communication policy information of update object to the said authentication processing apparatus, The communication system characterized by the above-mentioned. The communication system according to any one of claims 1 to 3,
The communication request characterized in that the authentication request includes at least one of model information of the communication terminal device and type information of the relay device . A communication system connectable from the communication terminal device to the communication network via a relay device for a continuously line LAN,
An authentication processing device that executes an authentication process when connected to the communication network from the communication terminal device via the relay device;
A policy management device that manages communication policy information for communication between the communication terminal device and a communication network via the relay device;
A relay device management device for managing the relay device,
The relay device management device
Means for receiving an association request from the communication terminal device via the relay device;
Means for transmitting a policy confirmation request including device identification information capable of identifying the relay device to the policy management device based on the association request;
Means for receiving, from the policy management device, a policy confirmation response including communication policy information for the relay device or information on whether or not to connect to the relay device determined based on the communication policy information;
Means for transmitting an association response including the communication policy information or the connectability information included in the policy confirmation response to the communication terminal device via the relay device,
The authentication processing device includes:
Means for receiving an authentication request including user identification information capable of identifying a user of the communication terminal device from the communication terminal device that has received the association response;
Means for performing user authentication processing for determining whether communication via the relay device is permitted by a user of the communication terminal device based on user identification information included in the authentication request;
Means for transmitting an authentication response including a result of the user authentication processing to the communication terminal device,
The policy management device includes:
Means for receiving a policy confirmation request including the device identification information from the relay device management device;
A policy confirmation response including communication policy information for the relay device obtained by searching based on the device identification information or connection permission / inhibition information to the relay device determined based on the communication policy information is transmitted to the relay device management device. And a means for transmitting to the communication system. The communication system of claim 5 ,
The policy confirmation request includes at least one of user identification information that can identify a user of the communication terminal device, model information of the communication terminal device, and type information of the relay device. A communication system connectable from a communication terminal device to a communication network via a wireless LAN relay device,
An authentication processing device that executes an authentication process when connected to the communication network from the communication terminal device via the relay device;
A policy management device that manages communication policy information for communication between the communication terminal device and a communication network via the relay device;
A relay device management device for managing the relay device,
The relay device management device
Means for storing the communication policy information;
Means for receiving communication policy information to be updated from the policy management device, and updating the stored communication policy information;
Means for receiving an association request from the communication terminal device via the relay device;
An association response including communication policy information for the relay device obtained by searching based on the association request or connection permission information to the relay device determined based on the communication policy information is transmitted via the relay device. Means for transmitting to the communication terminal device,
The authentication processing device includes:
Means for receiving an authentication request including user identification information capable of identifying a user of the communication terminal device from the communication terminal device that has received the association response;
Means for performing user authentication processing for determining whether communication via the relay device is permitted by a user of the communication terminal device based on user identification information included in the authentication request;
Means for transmitting an authentication response including a result of the user authentication processing to the communication terminal device,
The said policy management apparatus is equipped with a means to transmit the said communication policy information to the said relay apparatus management apparatus, The communication system characterized by the above-mentioned. The communication system according to any one of claims 1 to 7 ,
The communication apparatus characterized in that the device identification information is identification information uniquely set for each of the relay devices. The communication system according to any one of claims 1 to 8 ,
The communication policy information includes identification information of a relay device that is permitted or prohibited to connect from the communication terminal device, a time zone during which connection from the communication terminal device to the relay device is permitted or prohibited, and via the relay device. The communication system includes at least one of a timeout time at the time of communication path establishment processing and a threshold value of received signal strength at the communication terminal device when connecting to the relay device. The communication system according to any one of claims 1 to 9 ,
The communication terminal device
Means for communicating via a mobile communication network;
With the first communication path communicating with the external communication network established through the mobile communication network, the second communication path communicating with the external communication network via the wireless LAN relay device is established. Means for initiating the establishment process;
When the connection to the relay device is permitted, the communication path used preferentially for communication with the external communication network is switched from the first communication path to the second communication path, and the connection to the relay apparatus is performed. And a means for maintaining, in the first communication path, a communication path that is preferentially used for communication with the external communication network.

Images