JP5925739B2 - Wireless LAN device for access point and system using the same - Google Patents

Description

  The present invention relates to a technique for enabling seamless connection to an adjacent access point while maintaining a connection state with an ISP when a mobile terminal moves between adjacent access points.

  Passpoint ("Wi-Fi CERTIFIED PASSPOINT" registered trademark) has been standardized as a next-generation public wireless LAN standard. This is so that when a portable terminal is wirelessly connected to a contracted public wireless LAN service, when the wireless terminal enters the Wi-Fi area of the wireless LAN service, secure authentication is automatically performed to connect to the Wi-Fi service. It is a mechanism for making it.

  Specifically, the access point notifies that the access point is compatible with Passpoint in a beacon frame, and the mobile terminal of the client that receives the notification transmits an ANQP (Access Network Query Protocol) query, and the Advertisement server (or ANQP server) ) Returns information on the mobile carrier network to which the mobile terminal is authenticated and information on the authentication method to the mobile terminal through the access point. The portable terminal selects information that can be used in the contract from the notified information, and automatically authenticates the authentication server. For this authentication, secure EAP-SIM using information such as a SIM card or 802.1x authentication such as EAP-AKA can be used. As a result, the user of the mobile terminal does not have to perform any operation on his / her own, but can automatically receive authentication and enjoy a usable wireless LAN access environment when entering the usable range of the access point. This content is described in Patent Literature 1 and Non-Patent Literature 1, and is based on the technology defined in Non-Patent Literature 2.

JP 2013-17164 A

Passpoint. http://www.wi-fi.org/discover-and-learn/wi-fi-certified-passpoint%E2%84%A2 IEEE802.11u

  However, when actually using Passpoint, simply connecting to a single access point is not convenient. After connecting to one access point while moving on foot, it is required to be able to connect seamlessly to adjacent access points, and the time lag must be as short as possible. That is, in practice, it is desirable that the connection is not cut off when moving between wireless LAN areas of adjacent access points.

  In addition, with the expansion of smartphone usage, the flat-rate mobile phone system has collapsed, and an upper limit has been set on the amount of packets, so users with high traffic volumes should consciously avoid sending packets over the mobile phone network. There is an urgent need to offload to the wireless LAN. Therefore, if the connection via the access point can be continued, it will be a great merit for the user.

  Accordingly, an object of the present invention is to provide an environment in which a connection state can be maintained seamlessly even when a user moves while using the technology of Passpoint.

This invention
An access point for constructing a wireless LAN,
An AP search function unit for searching other access points capable of wireless communication with each other by direct reception of radio waves;
A GAS information acquisition function unit that receives GAS information for authenticating connection to a specific ISP in advance from the advertisement server;
When receiving a connection availability inquiry information (GAS Initial Request) for inquiring whether or not connection to one of the ISPs is possible from a mobile terminal wirelessly connected to the access point or another access point, Inquiry information relay means to relay to other detected access points,
Whether there is no other access point other than the transmission source to relay the above connection permission inquiry information, or whether the GAS information for connection authentication to the ISP requested by the received connection permission inquiry information has not been received. Inquiry termination notification means for transmitting connection availability termination information (GAS Initial Response) indicating that connection availability is terminated to the transmission source access point without relaying connection availability inquiry information, if at least either When,
Inquiry termination relay means for returning the connection availability termination information (GAS Initial Response) received from another access point to the transmission source when the connection availability inquiry information is received,
An authentication relay function unit that relays connection authentication to the ISP requested from the mobile terminal;
Connected information transmitting means for transmitting connected information that is information indicating that the mobile terminal is authenticated and connected to the ISP to the other access point;
For the portable terminal that has received the connected information in advance and the access point has the GAS information for the ISP in advance, the connection information to the ISP is not separately obtained, and the connection information is followed. A connection information cooperation means for permitting wireless connection;
The above-mentioned problem has been solved by an access point having Note that the transmission source includes both the case of the mobile terminal itself and the case of an adjacent access point.

  In other words, when the adjacent AP search means is executed, another access point that can directly communicate with each other without going through the server (hereinafter, also referred to as “adjacent access point” or “adjacent AP”) may be detected. It can be seen that when the adjacent AP moves into the wireless LAN area, the wireless connection can be continued. On the other hand, each access point receives the above GAS information in advance and records it in the database, so that it can be transmitted from the mobile terminal without inquiring whether it can be connected to each ISP after receiving the transmission from the mobile terminal. Can be promptly returned at the stage of receiving the connection availability inquiry information. In addition, since the connected information of the mobile terminal once authenticated to the ISP is shared with the adjacent AP, the mobile terminal authenticates again to the ISP server when entering the wireless LAN area of the next adjacent AP. Without making a request and waiting for a response, it is possible to use the wireless LAN of the adjacent AP as already connected, so the time lag for the actual connection is close to 0, and a seamless wireless LAN connection can be continued bodily. .

  In addition, the access point according to the present invention enumerates identification information such as the radio field strength and MAC address of the adjacent AP in a seamless connection order, and sends the information to the mobile terminal in advance. It is possible to search and display routes that can use the wireless LAN connection seamlessly.

  According to the present invention, a user of a portable terminal who walks across a plurality of access points can automatically use the next adjacent AP with almost no time lag when transferring between access points. As a result, even when off-loading from the mobile phone network, it is possible to ensure the possibility of movement close to the use of the mobile phone network. Can be improved.

Schematic diagram of an embodiment of a wireless LAN system using an access point according to the present invention Functional block example diagram of an access point according to the present invention Example of contents of AP information database Example of contents of AP route database Example of authentication result database The sequence diagram which is embodiment of the system concerning this invention Flowchart when the access point acquires GAS information (A) Example flowchart when the mobile terminal directly connects to the access point, (b) Example flowchart when the connection permission inquiry information is relayed to the adjacent access point (A) Example flowchart when authenticating an access point to which a mobile terminal is directly connected, (b) Example flowchart when an adjacent access point relays connected information

Hereinafter, embodiments of the present invention will be described in detail.
The present invention is a system in which a plurality of access points corresponding to passpoints and a plurality of access points that are wirelessly communicable with each other can share information indicating that the portable terminal has been authenticated.

A schematic diagram of an embodiment of a wireless LAN system using an access point according to the present invention is shown in FIG.
Each of the access points 11a, 11b, 11c, 11d... Has a wireless LAN area 12a, 12b, 12c, 12d..., And each area includes the location where the adjacent access point 11 is installed. Adjacent access points 11 can communicate with each other. However, in this figure, the access points 11a and 11b and 11b and 11c can communicate with each other, but 11a and 11c cannot communicate with each other. A state in which the individual wireless LAN areas 12 have reached each other's installation locations in this way is referred to as “adjacent” in the following description.

  Each access point 11 can be connected to an individual ISP 16 via a carrier network 17 from a wired network. The ISPs 16a to 16c are assumed to be ISP <A>, ISP <B>, and ISP <C>. Specifically, when the mobile terminal 13 is a mobile phone, it corresponds to a network of individual mobile phone carriers whose communication should be offloaded by the system according to the present invention. In the following description, an example will be given in which each ISP 16 corresponds to an individual mobile phone carrier.

  The operator network 17 can be a 3GPP network or a non-3GPP network, and is managed by the operator providing the access point 11 and the system according to the present invention. An advertisement server 15 that transmits GAS information, which will be described later, is connected to the operator network 17 and can communicate with individual access points 11.

  The Advertisement server 15 transmits GAS information for connection authentication to a specific ISP in response to a request from each access point 11. This GAS information corresponds to GAS (Generic Advertisement Service) information defined by IEEE802.11u. This is connection information data of individual access points such as which network the access point is connected to, what authentication method is used, and where the access point is installed. Specifically, information indicating which ISP 16 can be authenticated is included. It is possible to manage to which ISP each access point is allowed to connect based on information when the advertisement server 15 delivers. As an authentication method, a method such as EAP-SIM, EAP-AKA, or EAP-TTLS is specified for each ISP 16.

  The operator network 17 is provided with an authentication proxy server 18 (abbreviated as “AAAProxy18” in the figure), and relays authentication when the access point 11 connects to the ISP 16 from the operator network 17. The ISP 16 includes an authentication server (not shown) for authenticating each ISP in accordance with the above authentication method.

  Note that the authentication proxy server 18 may be integrated with the advertisement server 15. By combining the functions, the number of installed servers and the operation cost can be reduced.

  On the other hand, the portable terminal 13 using the system having the access point 11 has connection information based on an authentication method that can be connected to at least one ISP, and the authentication server 18 passes through the authentication proxy server 18. Can be authenticated. Naturally, it also has a function for wireless LAN communication such as IEEE802.11a, b, g, n, and ac for wireless communication with the access point 11.

  FIG. 2 shows a functional block diagram of the access point 11 according to the present invention. Note that the units and means in the following description are all realized by software, and may include the behavior of hardware operated by the software. The means is further executed as a part of the function among the small classifications of the functions bundled as a part. Furthermore, in executing them, although not shown, it naturally depends on the existing CPU and storage device.

  First, it has an AP search function unit 111 that searches for another access point 11 capable of wireless communication with each other by direct reception of radio waves. Specifically, a scan function unit 112 that receives a beacon transmitted by each access point 11 and obtains information such as radio wave intensity (RSSI), SSID, and MAC address from the beacon, and an AP that records the information And an information database 113.

  An example of the contents of the AP information database 113 is shown in FIG. The next AP MAC address is the MAC address of each adjacent access point that can be received. An SSID (Service Set Identifier) is an identifier that can be arbitrarily set by each access point 11 for each wireless LAN area 12, but the ISP 16 corresponding to the mobile carrier providing the service for offloading has its own ISP. A common SSID may be assigned to the wireless LAN area connectable to the network. RSSI is a signal strength expressed in decibels, and if it is too small, the connection may be cut off halfway. Therefore, a predetermined numerical value may be used as a threshold value, and cooperation by a function described later may be performed only when it is more than that. The lower limit of CSMA / CA in IEEE802.11 is -82 dBm, and in this environment, there is always an overlap with the wireless LAN area by other access points, so a threshold value is set in the range of -80 dBm to -75 dBm. Good.

  In addition, if one access point 11 uses a multi-SSID having a plurality of SSIDs, there is a possibility that one adjacent access point 11 may be mistaken as a plurality of access points 11 by a plurality of SSIDs. A step is required. For this reason, it is desirable to operate the access point according to the present invention with a single SSID. In this case, distribution when communicating with each ISP 16 may be performed, for example, by referring to the MAC address and authentication information of the mobile terminal 13 at a gateway higher than the access point 11 (such as an authentication proxy server 18 described later). it can. However, when a part of the functions of the access point 11 for personal use is opened to the public, it is common to use a multi-SSID. When such a multi-SSID access point 11 is used in the present invention, it is only necessary to add some procedure such as selecting and communicating only a specific SSID.

  In addition, as a function according to the Passpoint standard and a Passpoint function unit 121 that extends the function, a GAS information acquisition function unit 122, an advertisement server function unit 123, an ANQP function unit 124, an ANQP function cooperation unit 125, and an AP route database 126 are provided.

  Among these, the GAS information acquisition function unit 122 inquires of the Advertisement server 15 and holds the GAS information for authenticating connection to a specific ISP 16 in advance. The term “in advance” refers to a time before a request is received from the mobile terminal 13. For example, when the access point 11 is installed or periodically thereafter, the GAS information to be held is updated. In other words, the GAS information is also information for determining the ISP 16 to which the access point 11 can be connected.

  The advertisement server function unit 123 determines whether or not it can connect to one of the ISPs 16 from the next ANQP function unit 124 according to the GAS information received and held in advance by the GAS information acquisition function unit 122. It functions as a server that answers inquiries.

  The ANQP function unit 124, as an ANQP (Access Network Query Protocol) query specified in IEEE 802.11u, inquires whether connection is possible to one of the ISPs 16 (GAS Initial Request). ) Is received from the portable terminal 13, the query is passed to the above-described Advertisement server function unit 123. The Advertisement server function unit 123 refers to the GAS information acquired and held by the GAS information acquisition function unit 122 in advance, and can communicate with the ISP 16 (for example, a mobile carrier) requested by the query as a response to the query. Is returned to the ANQP function unit 124. In response to this response, the ANQP function unit 124 returns the available ISP 16 and information for authentication to the portable terminal 13. In other words, in response to a query which is connection availability inquiry information (GAS Initial Request) as to whether or not connection to the requested ISP is possible, connection availability termination information (GAS Initial Response) as a response is returned. To do.

  However, in the present invention, the ANQP function unit 124 does not immediately reply to the request from the portable terminal 13, but this connection availability inquiry information (GAS Initial Request) is stored in the AP information database 113 with the MAC address or the like. It is executed in cooperation with the ANQP function linkage unit 125 that relays this connection permission / inquiry information (GAS Initial Request) to the recorded adjacent access point 11 until the end satisfying a predetermined condition, and also relays the response. .

  As a specific procedure, connection possibility inquiry information for inquiring whether one of the ISPs is connectable from the mobile terminal 13 wirelessly connected to the access point 11 or another adjacent access point 11. When (GAS Initial Request) is received, the inquiry information relay means 124a for relaying to the adjacent access point 11 recorded in the AP information database 113 is executed. That is, even if the transmission source is the mobile terminal 13 or another access point 11, it relays as much as possible.

  However, at this time, when the connection possibility inquiry information received by the access point 11 does not correspond to the GAS information already acquired by the access point 11, that is, the connection request to the ISP 16 that cannot be authenticated by the access point 11. The first inquiry termination notifying means 124b for responding to the mobile terminal 13 that is the transmission source or the adjacent access point 11 with the response that the connection is impossible. Run. In addition, when the access point 11 does not have information on the access point 11 that can be communicated in the AP information database 113 other than the adjacent access point 11 that is the direct transmission source, it is not possible to relay any more. Therefore, the second inquiry termination notifying means 124c is sent back to the adjacent access point 11 that is the direct transmission source, with the connection termination information including the information indicating that it is terminated there.

  Further, the inquiry termination relay means 124d for returning the connectability termination information returned from the termination by the inquiry termination notification means 124b and 124c to the original transmission source in order is executed. The access point 11 a that has received the connection permission / inquiry information records the route to the access point that is the termination in the AP route database 126, and then returns a response to the query (GAS Initial Response) to the mobile terminal 13.

  An example of the AP route database 126 is shown in FIG. The “nextAPDB number” corresponds to the No. in the AP information database 113. That is, any one of the access points 11 adjacent to the access point 11 is shown. Each record of “AP and subsequent AP MAC addresses n” (n is a natural number after 1) lists the MAC address and communication strength of the next adjacent access point 11 in order for each adjacent access point 11. When there are two or more access points 11 that can be connected to one access point 11 except for the access point 11 that is the transmission source, the number of records having different data increases thereafter. In the case of FIG. 1, the access point 11b can communicate with the access point 11c and the access point 11d. Then, two records of an access point 11c whose APMAC address 1 is XXXA and an access point 11d which is XXXB are generated. Although not shown, the MAC addresses of the access points 11x adjacent to each access point 11 are sequentially connected.

  If a sufficient number of access points 11 are installed, a relay loops between the same access points 11 or a response to the mobile terminal 13 is extremely delayed. For this reason, it is desirable to set an upper limit on the number of access points 11 that relay connection availability information. In that case, the number n of MAC addresses recorded in one record recorded in the AP route database 126 corresponds to the upper limit.

  As a specific packet exchange at the time of performing such a route search, it is preferable to use a Vender Specific part in which a vendor can define the inside of a GAS Initial Request packet defined in IEEE802.11u. Specifically, the information to be included is “AP route information”, which is an identification keyword indicating that it is desired to obtain a response to the connection availability inquiry information (GAS Initial Request) that is the route information of the AP, and the connection availability question “Source information” indicating whether the direct transmission source of the combined information is the mobile terminal 13 itself or the relayed access point 11. Management information “ISP identification realm”, “authentication method” that can be used by the mobile terminal 13 such as EAP-SIM and EAP-AKA, “relay number upper limit value” that is the maximum number of access points 11 to be relayed, For example, “number of relays” that is the number of relayed access points 11 may be used.

  On the other hand, in the case where the path information determined as the path up to that point is included in the connectable / unusable termination information (GAS Initial Response), which is a response after the termination, the GAS Initial Response defined in IEEE802.11u is similarly applied. Among the packets, it is preferable to use a Vender Specific portion in which the vendor can define the inside. Specifically, the information to be included first defines the access point 11 received from the mobile terminal 13 as AP1, the access point 11 relayed thereafter as AP2, AP3,... It is desirable to list the values of the radio wave intensity (RSSI) of each access point 11 measured from the adjacent access point 11 on the near side in parallel. The connection permission / prohibition termination information starts with the access point 11 serving as the termination and sequentially adds the MAC address and RSSI in the process of returning to the transmission source.

  Further, as illustrated in FIG. 2, the access point 11 includes an authentication function unit 131 that handles authentication information when the mobile terminal 13 connects to the ISP 16. The authentication function unit 131 includes at least an authentication relay function unit 132 that relays connection authentication to the ISP 16 requested from the mobile terminal 13. The authentication relay function unit 132 determines whether or not the connection request sent from the mobile terminal 13 is a connection request to the ISP 16 that is permitted for the access point 11 in the GAS information received from the advertisement server 15 in advance. If it is permitted, the request is relayed to the ISP 16. At this time, since the access point 11 has already received the GAS information from the advertisement server 15, it is possible to immediately relay connection authentication to the ISP 16 without inquiring whether the ISP 16 can be connected. The time required for authentication can be shortened compared to the conventional method.

  If not permitted, the filter 141 filters the packets so as to refuse communication. However, the relay packet for connection authentication to the ISP 16 by the authentication relay function unit 132 and the reply packet from the ISP 16 are naturally set to pass.

  Communication between the WAN interface (abbreviated as “WAN IF”) 151 of the access point 11 and the ISP 16 via the carrier network 17 and the AAA proxy 18 is common in PPPoE, VPN, IPoE, and the like. Can be authenticated by the connection method used for authentication. Upon receiving the authentication result at the ISP 16, the authentication relay function unit 132 sends the information to the mobile terminal 13 and records it in the authentication result database 134. Then, the authentication information sharing function unit 133 records the connected information, which is information indicating that the portable terminal 13 has been authenticated by the ISP 16, in the AP route database 126. The connected information transmitting means for transmitting to the adjacent access point 11 is executed.

At this time, the destination to which the connected information is transmitted may simply specify only the adjacent access point 11 recorded in the AP information database 113, or the destination of the route information recorded in the AP route database 126. You may designate and transmit each adjacent access point 11 by the number.
In the former case, an adjacent access point that has received the connected information so that the upper limit number of access points 11 that relay this and the count number of access points 11 that relayed so far are included in the packet of connected information. 11 increments the count by +1, and repeats the work of transmitting to the adjacent access point 11 recorded in its own AP information database 113 until the upper limit is reached. Since each access point 11 spreads according to branching, the number of packets transmitted by the access point 11 directly connected to the mobile terminal 13 can be reduced, but the prior connection enable / disable termination information cannot be used as it is. Packet loss increases. In order to prevent this, each access point 11 records the above-mentioned connection enable / disable end information in advance, and when specifying the access point 11 to be transferred, since the GAS information corresponding to the ISP 16 is not included, The process of excluding the access point 11 that has been performed is performed.
In the latter case, the connected information specified to follow each route is transmitted by the number of cases recorded in the AP route database 126. Directly, a packet is transmitted to the adjacent access point 11 corresponding to the “nextAP DB number”, and each adjacent access point 11 receiving this packet transmits the next access recorded in the route information included in the packet. This is transmitted to the point 11. Although the number of packets initially transmitted by the access point 11 is relatively large, packet loss can be suppressed because the route information examined in advance can be used.

  An example of the authentication result database 134 is shown in FIG. “Mobile terminal MAC” is the MAC address of the mobile terminal 13 that performs authentication, and there is a record for each. The “authentication result” is an authentication result returned from the authentication request to the ISP 16. The “connection destination realm information” is identification information indicating which ISP 16 is authenticated under which conditions. For example, the type of offload service of each mobile carrier is described. The “encryption scheme” is an encryption scheme that is selected when the mobile terminal 13 communicates with the access point 11 and needs to be compatible with both. The encryption key is a password corresponding to the encryption method that is registered in advance by the mobile terminal 13 and automatically transmitted when connecting to the access point 11.

  The information described in the authentication result database 134 includes not only the mobile terminal 13 directly connected to the access point 11 but also the authenticated information transmitted from the other access point 11 by the connected information transmitting means. A record for a mobile terminal 13 is also included. Note that the information about the mobile terminal 13 whose authentication is rejected does not need to be relayed to another access point 11.

  When the authentication information sharing function unit 133 receives the connected information from the adjacent access point 11, the authentication information sharing function unit 133 executes connected information recording means for recording the information in its own authentication result database 134.

  In addition, when the mobile terminal 13 enters the wireless LAN area 12 of the access point 11 that has received the connected information and tries to connect to the access point 11, the access point 11 connects to the same ISP 16 in advance. If the GAS information (corresponding to “connection destination realm information”) is received and connection to the ISP 16 is possible, the connection request for the portable terminal 13 is not relayed to the ISP 16 again. The connection information cooperation means for allowing the wireless LAN area 12 to be used is executed. As a result, the access point 11 can omit the time for relaying the authentication to the ISP 16 and waiting for a response, so that the mobile terminal 13 can use the wireless LAN area 12 in a sufficiently shorter time than the conventional one, and the experience can be experienced. It is possible to cross the wireless LAN area 12 seamlessly.

  When moving across the wireless LAN area 12, the condition for switching the connection destination within the overlapping range of the wireless LAN area 12 depends on the wireless connection setting of the mobile terminal 13. In the case of a normal Wi-Fi compatible terminal, when the radio field strength of another access point 11 having the same SSID becomes stronger than the access point 11 connected so far, the access point 11 to be directly connected is switched. .

  The filter 141 mounted on the access point 11 not only passes the authentication packet for the mobile terminal 13 before authentication, but basically allows the packet to pass for the authenticated mobile terminal 13. The mobile terminal 13 that passes this packet is not limited to the one authenticated by the access point 11, but another access point in which “authentication result” is recorded as OK in the authentication result database 134 by the authentication information sharing function unit 133. 11 also includes a portable terminal 13 to which the connected information is relayed from 11. In addition, for the mobile terminal 13 to which the connected information is relayed from another access point 11, not only the filter 141 is transmitted, but also PPPoE, VPN, GRE, IPoE, etc. between the WAN interface 151 and the ISP 16 Link the connection method and open the port if necessary. These connection formulas and port numbers are shared as part of the connected information.

  A plurality of access points 11 having these functional units are arranged so that the wireless LAN area 12 includes adjacent access points 11, each of which receives GAS information from the advertisement server 15 in advance and reduces the time required for authentication. Further, by exchanging the above-mentioned connected information with each other, a system that can simplify the authentication necessary for connecting an authenticated terminal is constructed. An embodiment of this system will be described with reference to the sequence diagram of FIG.

  First, each of the access points 11a, 11b, and 11c executes the GAS information acquisition function unit 122, and individually requests the advertisement server 15 for GAS information for connection authentication to each ISP 16 (S111 to S113). ). Each access point 11 receives the GAS information for the ISP 16 that is permitted to connect and records it (S121 to 123).

  Before and after this, the AP search function unit 111 of the access point 11 receives adjacent beacons and scans the adjacent access points that can communicate with each other by the scan function unit 112 that checks the radio field strength, SSID, MAC address, and the like. And is recorded in the AP information database 113 (S131). The order of S111 to S123 and S131 may be reversed.

  The settings performed in the steps so far may be set in advance for the ISP 16 which is a major communication carrier. That is, from the stage of installation of the access point 11, the GAS information for the ISP 16 has already been registered in the database, the positions of the adjacent access points 11 have already been arranged, and each MAC address has been registered. May be. For example, a system in which access points 11 are continuously installed along the street can be cited.

  In addition, when the mobile terminal 13 carried by the user enters the wireless LAN area 12 of the access point 11 as the user moves, the mobile terminal 13 receives a beacon emitted by the access point 11 (S141). . The mobile terminal 13 that has received the beacon sends a Probe request (S142), and the received access point 11 returns its Response (S143). After confirming this, the mobile terminal 13 sends connectability inquiry information (GAS initial Request) to the access point 11a (S151). The access point 11a that has received this executes inquiry information relay means for relaying to the adjacent access point 11 (here 11b) (S152). The received access point 11b relays to the adjacent access point 11c (S153). The access point 11c that does not have an adjacent access point 11 other than the transmission source 11b terminates there, and returns connection enable / disable termination information (GAS initial Response) (S161). The access point 11b that has received the connectability termination information adds its own information and transmits it to the access point 11a that is the source of the connectability query information (S162). The access point 11a records information added up to that point in the AP route database 126 and returns a response to the mobile terminal 13 (S163).

  The mobile terminal 13 that has received the response has confirmed that the access point 11 can be connected to the ISP 16, and performs EAP authentication through the access point 11a (S171). The access point 11a relays this to the authentication proxy server 18 (S172), and the authentication proxy server 18 sends this authentication information to the authentication server (AAA) of the ISP 16 (S173). If the authentication is successful, the access point 11 can thereafter connect to the Internet through the ISP 16 (S175).

  On the other hand, the access point 11a notifies the connected information to the adjacent access point 11b (S181), and the access point 11b further relays it to the adjacent access point 11c according to the route of S153 and S161 (S182). . The number of access points 11 to be relayed may be designated in advance by the access point 11a, or relays may be limited by setting separate conditions. In any case, the access points 11b and 11c that have received them record the information in the authentication result database 134. After that, when the mobile terminal 13 moves and enters the wireless LAN area 12 of the access point 11b, the Internet connection via the ISP 16 is established under the same conditions as the connection made by the access point 11a according to the information in the authentication result database 134. Allow (S191).

  The operation flow of the access point 11 at each timing will be described in order. First, an example of a flowchart when the GAS information acquisition function unit acquires GAS information in advance from the Advertisement server 15 is shown in FIG. First (S211), the timing of starting this inquiry may be spaced once every day or periodically every few minutes. However, since communications from a large number of access points 11 are concentrated on the advertisement server 15, it is preferable to leave an interval of about one day if the load is distributed. In addition, it is preferable to make an initial inquiry when the access point 11 is activated, since it becomes possible to deal with it promptly thereafter.

  The operation at the time of execution is as follows. First, an inquiry about GAS information is sent to the advertisement server 15 (S212, S111 to S113). When GAS information is sent from the advertisement server 15 (S213, S121 to S123), it is confirmed that the GAS information is included (S214), and the GAS information is accommodated inside (S215).

  Next, a flowchart example when the mobile terminal 13 connects to the access point 11 is shown in FIGS. FIG. 8A shows the operation of the access point 11 to which the mobile terminal 13 is directly connected, and FIG. 8B shows the operation of the access point 11 to be relayed.

  First (S311 and S131), the access point 11 searches for adjacent access points 11 at regular intervals (S312). The timing for repeating this is arbitrary. In most cases, the location of the access point 11 is not updated frequently, so that it is not necessary to search many times a day. It is preferable to perform it about once a day during a time when the number of users is reduced. This search is performed in parallel with the procedure of S211 to S216.

  In addition, as a basic operation defined in IEEE 802.11u of the access point 11, beacons are transmitted at regular intervals (S313, S141). This interval can be individually set by the access point 11, but it is preferable to transmit at least once every 0.1 seconds in order to quickly detect that the mobile terminal 13 has entered the wireless LAN area. Then, the mobile terminal 13 waits for connection availability inquiry information (GAS initial request) to be transmitted after receiving the beacon (S314 → No). When the connection availability inquiry information is received (S314 → Yes, S151), the connection availability inquiry information is transferred to the adjacent access point 11 (S315, S152, S153). After that, it waits for the connection permission / inhibition termination information to be returned from the transferred access point 11 (S316 → No). When the connection possibility termination information is received (S316 → Yes), the information is registered in the AP route database 126 (S317), and the connection possibility termination information is transmitted to the portable terminal 13 (S318). Note that the order of S317 and S318 may be reversed. In addition, since the number of connection enable / disable termination information transmissions is increased not only by the connection enable / disable inquiry information transmission destination but also by subsequent branches, the process returns to S316 after S318 and waits. Note that the authentication process shown in FIG. 9 may be started during this standby.

  Although not shown, when there is no adjacent access point 11, the terminal transmits the connection permission / inhibition termination information to the mobile terminal 13 without transmitting the connection permission / inquiry inquiry information (S315 to S317 are omitted) (S318).

  On the other hand, also in the adjacent access point 11 or the access point 11 that is further relayed and linked, the search for the access point 11 (S322), the beacon transmission (S323), and the like are the same operations as in FIG. When connection permission / inquiry information is received from the adjacent access point 11 instead of the mobile terminal 13 (S324 → Yes, S152), the access points 11 other than the access point 11 that is the transmission source of the connection permission / inquiry information are excluded. If there is an access point 11, connection permission / inquiry inquiry information is transmitted (S325, S153). After that, it waits for the connection permission / inhibition termination information to be returned from the transmitted access point 11 (S326 → No), and when it returns (S326 → Yes), the relaying access point 11 is included in the connection permission / inhibition termination information to be relayed. The route information is registered in the own AP route database 126 as required by the embodiment (S327). As a result, it is possible to share route information that other access points 11 are trying to check. However, if each access point 11 individually confirms route information, an embodiment in which S327 is omitted without registering in the AP route database 126 may be used. In any case, after adding information such as the MAC address of the access point 11 itself and the measured radio wave intensity of the previous access point 11 to the connection termination information, the sender of the original connection availability inquiry information is added. The data is transmitted to a certain access point 11 (S328). When the transmission is completed, it waits for the return of the next connectability termination information (S326).

  Although not shown in the figure, when the transmitted connection possibility inquiry information is a request for connection to an ISP 16 for which the access point 11 does not have GAS information, the access point 11 is in a connected state. Since it is not possible to participate in the cooperation, the connection permission / prohibition termination information indicating that it is terminated is transmitted to the access point 11 that is the transmission source without transferring the connection permission / inquiry inquiry information to the other access points 11. Further, similarly to the above, when there is no adjacent access point 11 other than the access point 11 that is the transmission source, connection enable / disable termination information indicating that there is no further destination is returned.

  Furthermore, (a) and (b) in FIG. 8 can proceed in parallel. The access point 11 performs the operation (a) when directly connected, while performing the operation (b) when communication is made from the adjacent access point 11. Accordingly, different operations can be executed in each standby element in the flowchart.

  Next, a procedure for sharing authentication information will be described with reference to FIGS. FIG. 9A shows the operation of the access point to which the mobile terminal 13 is directly connected, and FIG. 9B shows the operation of the access point 11 to be relayed.

  First, as shown in the above figure, in the procedure from the first wireless scan to the authentication relay (S412), the wireless scan is the same as the operation of S312 (S131) in FIG. The route search is the same as the operation of S313 to S318 (S141 to S163 in FIG. 6) in FIG. Then, the authentication request from the mobile terminal 13 is relayed (S413, S171 to S172). When the response indicating that the authentication request has passed is returned from the ISP 16 (directly the authentication proxy server 18) (S414, S173 → S172 → S171), the access point 11 The connected information is transmitted to the access point 11 that has reached the connection possibility inquiry information of the mobile terminal 13 and replied that the connection to the ISP 16 is possible by the GAS information (S415, S181). At this time, the number of relays for transferring the connected information may be specified, or a relay condition may be added. If there is no other adjacent access point 11, the process proceeds to the next step without transferring. After that, the condition of the filter 141 included in the access point 11 is changed to allow communication of the mobile terminal 13 (S416). The address of the mobile terminal 13 that passes through the filter 141 is registered in the authentication result database 134. Thereafter, Internet connection via the ISP 16 becomes possible. The communication method when passing through the operator network 17 at this time is not particularly limited, such as PPPoE or VPN.

On the other hand, when a wireless connection is permitted as the adjacent access point 11 according to the connected information of the portable terminal 13 authenticated by the other access point 11, the result is as shown in FIG. When the connected information is received from the adjacent access point 11, it is an adjacent access point 11 other than the access point 11 that is the transmission source, and it has the GAS information to the ISP 16 with the previous connection possibility termination information. The connected information is transmitted to the access point 11 that has made a response to that effect (S424, S182). However, if there is no other adjacent access point 11, the process proceeds to the next step without transferring.
After that, the condition of the filter 141 included in the access point 11 is changed to allow communication of the mobile terminal 13 (S425). The address of the mobile terminal 13 that passes through the filter 141 is registered in the authentication result database 134. Thereafter, Internet connection via the ISP 16 becomes possible. The communication method when passing through the operator network 17 at this time is not particularly limited, such as PPPoE or VPN.

  In the exchange of the above GAS information or the like, the protocol used when the Advertisement server 15 transmits is not particularly limited. For this reason, the Advertisement server 15 may also be used as the authentication proxy server 18. In this case, it is possible to distribute GAS information using the Radius protocol used for the authentication proxy server 18. For example, GAS information for a plurality of ISPs 16 can be listed in a form such as a comma delimiter in a vendor specific attribute in which Attribute can be arbitrarily described in the Radius protocol. For example, the server address of the ISP 16 and the authentication method are registered as a set. When included in a beacon or Probe Request, information is enumerated within the range of the size limit of the vendor specific attribute in the beacon, and in some cases, a plurality of vendor specific attributes are prepared.

  Further, in the connectability termination information (GAS initial response), the MAC address and RSSI of the relayed access point 11 can be enumerated by commas in the GAS item set as the vendor specific attribute.

11, 11a, 11b, 11c Access point 12, 12a, 12b, 12c Wireless LAN area 13 Mobile terminal 15 Advertisement server 16, 16a, 16b, 16c ISP
17 Carrier network (3GPP or non 3GPP)
18 Authentication proxy server (AAAProxy)
111 AP Search Function Unit 112 Scan Function Unit 113 AP Information Database 121 Passpoint Function Unit 122 GAS Information Acquisition Function Unit 123 Advertisement Server Function Unit 124 ANQP Function Unit 125 ANQP Function Cooperation Unit 126 AP Path Database 131 Authentication Function Unit 132 Authentication Relay Function Unit 133 Authentication Information Sharing Function Unit 134 Authentication Result Database 141 Filter 151 WAN Interface 152 WLAN Interface

Claims (3)

An access point for constructing a wireless LAN,
An AP search function unit for searching other access points capable of wireless communication with each other by direct reception of radio waves;
A GAS information acquisition function unit that receives GAS information for authenticating connection to a specific ISP in advance from the advertisement server;
Upon receiving connection permission / inquiry information for inquiring whether or not it is possible to connect to one of the ISPs from a mobile terminal wirelessly connected to the access point or another access point, the other access detected above Inquiry information relay means to relay to points,
Whether there is no other access point other than the transmission source to relay the above connection permission inquiry information, or whether the GAS information for connection authentication to the ISP requested by the received connection permission inquiry information has not been received. In the case of at least one of the above, inquiry termination notification means for transmitting connection availability termination information to the effect that relay of connection availability is terminated to a transmission source access point without relaying the connection availability inquiry information;
Inquiry termination relay means for returning the connection possibility termination information received from another access point to the transmission source when the connection possibility inquiry information is received;
An authentication relay function unit that relays connection authentication to the ISP requested from the mobile terminal;
Connected information transmitting means for transmitting connected information that is information indicating that the mobile terminal is authenticated and connected to the ISP to the other access point;
For the portable terminal that has received the connected information in advance and the access point has in advance the GAS information for the ISP requested by the portable terminal, the connection authentication to the ISP is separately performed. Connection information cooperation means for allowing wireless connection according to the connected information without,
With an access point.   A mobile phone in which a plurality of access points according to claim 1 are arranged so that adjacent access points are included in each other's wireless LAN area and wirelessly communicated to one access point according to the connected information. When a wireless connection request is made from a terminal to another access point adjacent to the access point, the other access point performs wireless connection with the portable terminal according to the connected information according to the connected information. LAN system. An access point having a wireless LAN interface and a wired LAN interface,
An AP search function unit for searching other access points capable of wireless communication with each other by direct reception of radio waves;
A GAS information acquisition function unit that receives GAS information for authenticating connection to a specific ISP in advance from the advertisement server;
Upon receiving connection permission / inquiry information for inquiring whether or not it is possible to connect to one of the ISPs from a mobile terminal wirelessly connected to the access point or another access point, the other access detected above Inquiry information relay means to relay to points,
Whether there is no other access point other than the transmission source to relay the above connection permission inquiry information, or whether the GAS information for connection authentication to the ISP requested by the received connection permission inquiry information has not been received. In the case of at least one of the above, inquiry termination notification means for transmitting connection availability termination information to the effect that relay of connection availability is terminated to a transmission source access point without relaying connection availability query information;
Inquiry termination relay means for returning the connection possibility termination information received from another access point to the transmission source when the connection possibility inquiry information is received;
An authentication relay function unit that relays connection authentication to the ISP requested from the mobile terminal;
Connected information transmitting means for transmitting connected information that is information indicating that the mobile terminal is authenticated and connected to the ISP to the other access point;
For the portable terminal that has received the connected information in advance and has the GAS information to the ISP in advance, the wireless connection according to the connected information is permitted without separately performing connection authentication to the ISP. A program for functioning as connection information cooperation means.

Images