JP6503420B2 - Wireless communication terminal authentication control device, wireless communication terminal authentication control system, wireless communication terminal authentication control method, and program - Google Patents

Description

  The present invention relates to a wireless communication terminal authentication control device, a wireless communication terminal authentication control system, a wireless communication terminal authentication control method, and a program.

  In recent years, public wireless LAN services have already been known which provide an environment in which a wireless LAN can be used to connect to the Internet. This system places a wireless LAN access point (hereinafter referred to as "AP") connected to the Internet, for example, at a restaurant, a hotel, a station, or an airport, and a wireless communication terminal such as a laptop computer having a wireless LAN function Connection is possible.

  Also, in the above public wireless LAN service, authentication is performed to ensure the existence, reliability, and legitimacy of the user who uses the wireless communication terminal attempting to connect to the access point of the wireless LAN, and the user authentication is performed. At the same time, a method using a SIM (Subsciber Identity Module) card mounted on a wireless communication terminal is already known.

  In authentication using a SIM card (hereinafter referred to as "SIM authentication"), a subscriber identification number (International Mobile Subsidiary Identity, hereinafter referred to as "IMSI") held in a SIM card mounted on a wireless communication terminal is referred to as "IMSI". The subscriber identifies someone by using it.

  The IMSI usually consists of a 15-digit number, the first three digits representing a country, the MCC (Mobile Country Code), the second three digits representing the wireless carrier's identification number, and the remaining MNC (Mobile Network Code) The MSN (Mobile Station Identification Number) represents the identification number identifying the individual.

  An authentication technique using the above-described SIM authentication is described, for example, in Patent Document 1 and Patent Document 2.

JP, 2013-149096, A Patent No. 3897034

  By the way, in recent years, a virtual mobile telecommunications carrier (Mobile Virtual Network) that borrows from a carrier (Mobile Network Operator, hereinafter referred to as "MNO") that provides wireless communication infrastructure such as mobile phones and provides its own communication service. Operator, hereinafter referred to as "MVNO".

  And MVNO purchases SIM card for using a smart phone etc. from MNO, and sells this to a user. The user inserts the SIM card purchased from the MVNO into his smartphone, and uses the smartphone under the wireless communication infrastructure borrowed from the MNO by the MVNO.

  Here, it goes without saying that SIM authentication is also required when receiving the provision of public wireless LAN service using the SIM card provided by the MVNO. Then, since the SIM card provided by the MVNO includes the MCC and the MNC indicating the MNO, the authentication request is sent to the authentication server managed by the MNO. However, in the case where the MVNO borrows infrastructure equipment for providing public wireless LAN service from other public wireless LAN operators other than the MNO providing SIM cards, between the other operator and the MNO If there is no contract relationship, even if you try to use the wireless communication with the public wireless LAN equipment provided by other operators than the MNO using the SIM card provided by the MNO, from the viewpoint of the public wireless LAN operator, the contract relationship Because it looks like a user with no MNO is making an authentication request, it has to refuse the authentication request. Therefore, even if there is a contract between the MVNO and the public wireless LAN company, SIM authentication by the terminal fails, and the terminal is not permitted to connect to the public wireless LAN.

  The present invention has been made in view of such circumstances, and a contract for using a public wireless LAN infrastructure is different from a business (such as MNO) indicated by MCC / MNC recorded on a SIM card. An object of the present invention is to allow a user to easily perform user authentication of a public wireless LAN infrastructure using a SIM card even when a person (MVNO or the like) has one.

  In order to solve the above problems, the wireless communication terminal authentication control device of the present invention controls user authentication of a wireless communication terminal connected to a network using an authentication medium provided by a virtual mobile communication carrier. It is a control apparatus, The authentication information management means which memorize | stores the user identification information of the wireless communication terminal which permits connection to a network, The user identification information contained in the authentication medium mounted in the wireless communication terminal is authentication information management means Control means for permitting connection of the wireless communication terminal to the network when it is determined that the user identification information is stored in the authentication information management means. I assume.

  According to the present invention, in the case where the operator (MVNO etc.) other than the operator (MNO etc.) indicated by the MCC / MNC recorded in the SIM card has a contract for using the public wireless LAN infrastructure. Even if it exists, the user can easily perform user authentication of the public wireless LAN infrastructure using the SIM card.

It is a schematic block diagram of the radio | wireless communication control system containing the radio | wireless communication terminal authentication control apparatus in 1st Embodiment of this invention. It is a functional block diagram of the radio | wireless communication terminal authentication control apparatus in 1st Embodiment of this invention. It is an example of the database which memorize | stores IMSI in 1st Embodiment of this invention. It is a schematic diagram which shows the information managed by the session management part of the access point in 1st Embodiment of this invention. It is a flowchart which shows the general | schematic procedure from the radio | wireless communication connection request | requirement of the terminal in embodiment of this invention to communication permission. It is a flowchart which shows the process sequence in 1st Embodiment of this invention. It is a general | schematic process sequence in 1st Embodiment of this invention. It is a functional block diagram of the radio | wireless communication terminal authentication control apparatus in 2nd Embodiment of this invention. It is a flowchart which shows the process sequence in 2nd Embodiment of this invention. It is a general | schematic process sequence in 2nd Embodiment of this invention. It is a functional block diagram of the radio | wireless communication terminal authentication control apparatus in 3rd Embodiment of this invention. It is an example of the database which makes IMSI and the destination information of MVNO correspond, and is stored in 3rd Embodiment of this invention. It is an example of the terminal | end database which memorize | stores IMSI in 3rd Embodiment of this invention. It is a flowchart which shows the process sequence in 3rd Embodiment of this invention. It is a general | schematic processing sequence in 3rd Embodiment of this invention. It is a functional block diagram of the radio | wireless communication terminal authentication control apparatus in 4th Embodiment of this invention. It is an example of the entrepreneur database which memorizes entrepreneur information in a 4th embodiment of the present invention. It is a flowchart which shows the process sequence in 4th Embodiment of this invention. It is a general | schematic process sequence in 4th Embodiment of this invention. It is a functional block diagram of the radio | wireless communication terminal authentication control apparatus in 5th Embodiment of this invention. It is an example of the database which matches and memorize | stores IMSI, a user ID, and an authentication password in 5th Embodiment of this invention. It is a flowchart which shows the process sequence in 5th Embodiment of this invention. It is a general | schematic processing sequence in 5th Embodiment of this invention. It is a functional block diagram of the radio | wireless communication terminal authentication control apparatus in 6th Embodiment of this invention. It is an example of the database which matches and memorize | stores a part of IMSI and the destination information of MVNO in 6th Embodiment of this invention. It is a flowchart which shows the process sequence in 6th Embodiment of this invention. It is a functional block diagram of the radio | wireless communication terminal authentication control apparatus in 7th Embodiment of this invention. It is an example of the database which matches and memorize | stores IMSI and utilization restriction information in 7th Embodiment of this invention. It is a schematic diagram which shows the information managed by the session management part in which the utilization restriction | limiting information in 7th Embodiment of this invention was reflected. It is a functional block diagram of the radio | wireless communication terminal authentication control apparatus in 8th Embodiment of this invention. It is a flowchart which shows the process sequence in 8th Embodiment of this invention. It is a general | schematic processing sequence in 8th Embodiment of this invention.

  The wireless communication terminal authentication control apparatus according to the embodiment of the present invention will be described below with reference to the drawings. In the drawings, the same or corresponding parts are denoted by the same reference numerals, and the redundant description will be appropriately simplified or omitted. The authentication process of the wireless communication terminal in the present embodiment will be described taking authentication process in wireless LAN communication as an example, but is not limited to wireless LAN communication, and is used for mutual connection of devices via a wireless network. It may be applied to other authentication processes. Note that each device in the embodiment described below has hardware configuration such as CPU, RAM, ROM, HDD, various interfaces, wireless communication antenna, etc., as necessary, as necessary, in order to realize the function. Needless to say,

First Embodiment
An outline of a wireless communication control system including a wireless communication terminal authentication control device in the first embodiment of the present invention will be described with reference to FIG. The present system comprises a wireless communication terminal 10, an AP 20, a wireless communication terminal authentication control device 30, an authentication information management device 40, and a shipping system 50. The wireless communication terminal 10 is a device that connects to the AP 20 using wireless LAN communication, and connects to the Internet via the AP 20 after authentication control described later. Although one wireless communication terminal 10 is connected to the AP 20 in FIG. 1, a plurality of wireless communication terminals 10 may be connected. The AP 20 is an access point that connects to the wireless communication terminal 10 using wireless LAN communication, and connects the wireless communication terminal 10 to the Internet. Although one AP 20 is connected to the wireless communication terminal authentication control apparatus 30 in FIG. 1, there may be a plurality of APs.

  The wireless communication terminal 10 includes a terminal wireless communication unit 11, a terminal authentication request unit 12, a SIM card 13 as an authentication medium, and an application execution unit 14.

  The terminal wireless communication unit 11 connects to the AP wireless communication unit 21 via a wireless network, and after terminal authentication, acquires data to be processed by the application execution unit 14 from the Internet via the AP wireless communication unit 21.

  The terminal authentication request unit 12 acquires IMSI as user identification information stored in the SIM card 13 for terminal authentication, and a MAC address unique to the wireless communication terminal 10 and passes it to the terminal wireless communication unit 11. The SIM card 13 is inserted into the SIM slot of the radio communication terminal 10 when the MVNO is purchased from the MNO. The authentication medium in the present invention is not limited to the SIM card, but may be any medium that can store user identification information.

  The AP 20 includes an AP wireless communication unit 21, a terminal authentication server 22, a connection authentication request unit 23, and a session management unit 24. The AP wireless communication unit 21 acquires the IMSI and the MAC address from the wireless communication terminal 10 via the terminal wireless communication unit 11. The terminal authentication server 22 manages the IMSI acquired via the terminal wireless communication unit 11. The connection authentication request unit 23 transmits a connection authentication request to the wireless communication terminal authentication control device 30 in response to the terminal authentication server 22 acquiring the IMSI. The session management unit 24 acquires a MAC address via the AP wireless communication unit 21 and stores a communication permission flag indicating whether the wireless communication terminal 10 can communicate, in association with the MAC address. The session management unit 24 permits the wireless communication terminal 10 of the MAC address to connect to the Internet by the AP 20 until the MAC address is stored in the management information and the communication permission flag becomes “1”. do not do.

  For example, the wireless communication terminal authentication control device 30 represented by Radius Proxy controls authentication of a user who uses the wireless communication terminal 10. Although the details will be described later with reference to FIG. 2, the connection authentication request is received from the connection authentication request unit 23 of the AP 20, and the authentication result received from the predetermined authentication server is sent back to the connection authentication request unit 23 of the AP 20. Also, it has a role of distributing the connection authentication request to the authentication control management device of the telecommunications carrier specified by the destination included in the connection authentication request. The connection authentication request includes user identification information, and the user identification information includes IMSI.

  The authentication information management device 40 is authentication information management means for managing authentication information used for user authentication of the wireless communication terminal, and functions as a storage unit for storing IMSI. The authentication information management device 40 preferably stores the IMSI stored in the SIM card 13 at least before the SIM card 13 is provided to the user. Specifically, it is preferable that the authentication information management apparatus 40 stores the SIM card 13 by the shipping system 50 substantially at the same time as shipping to the user.

  The shipping system 50 is a system for shipping a SIM card to a user or a SIM card store, and registers the IMSI assigned to the SIM card in the authentication information management device 40 when the SIM card is shipped.

  Next, the wireless communication terminal authentication control device 30 in the first embodiment will be described with reference to FIG. The wireless communication terminal authentication control device 30 determines whether the user identification information of the wireless communication terminal 10 is stored in the authentication information management device 40, and the user identification information is stored in the authentication information management device 40. When it is determined, the connection of the wireless communication terminal 10 to the wireless network is permitted.

  When the wireless communication terminal authentication control device 30 determines that the user identification information IMSI is stored in the authentication information management device 40, it authenticates the connection permission message for permitting connection of the wireless communication terminal 10 to the wireless network. The request is sent to the AP 20 via the request unit 23. On the other hand, when the wireless communication terminal authentication control device 30 determines that the IMSI is not stored in the authentication information management device 40, the connection authentication request unit 23 rejects the connection rejection message for rejecting the connection of the wireless communication terminal 10 to the wireless network. To the AP 20 via

  Next, an example of the IMSI stored in the authentication information management device 40 in the first embodiment will be described with reference to FIG. Here, for example, “429011234567890”, “310150123456789”, “310410736067599”, and “440101234567890” are stored in the authentication information management device 40 as IMSI. The wireless communication terminal authentication control device 30 determines whether or not the user identification information included in the connection authentication request matches the IMSI stored in the authentication information management device 40.

  Next, an example of management information managed and stored by the session management unit 24 in the first embodiment will be described with reference to FIG. The session management unit 24 stores the MAC address, which is a number unique to the wireless communication terminal 10, the internal process ID, and the communication permitted state in association with each other. The internal process ID is a unique arbitrary character string issued each time the connection authentication request unit 23 makes a connection authentication request. The communication permission state is represented by “1” or “0”, “1” indicates that the inquiry of the wireless communication terminal 10 is completed and communication is permitted, “0” indicates that the inquiry is being accepted or communication is rejected It shows the status of being In addition, it is preferable to hold the state of "0" for several minutes, for example, when communication is refused. This makes it possible to prevent concentration of a plurality of inquiries by the wireless communication terminal 10.

  Here, the communication permission for the upper MAC address “00004c001234” and the PID is “1” is “1”, and the communication permission for the middle MAC address “abcdef123456” and the PID “23456” is “0”. Although the communication permission for the lower MAC address “123456abcdef” and the PID “34567” is “0”, it goes without saying that this is an example.

  Next, a schematic procedure from the wireless communication connection request to the Internet of the wireless communication terminal 10 in the present embodiment to the communication permission will be described with reference to FIG.

  The wireless communication terminal 10 makes a wireless communication connection request including the MAC address of the own terminal to the AP 20 via the terminal wireless communication unit 11 (step S01).

  The AP 20 acquires the MAC address of the wireless communication terminal 10 contained in the wireless communication connection request, confirms whether the MAC address is registered in the stored management information (step S 02), and permits the management information as communication permission If it is registered (YES in step S02), the wireless communication terminal 10 is connected to the Internet (step S03). Also, if not registered (step S02, NO), the AP 20 acquires SIM card information including user identification information from the wireless communication terminal 10 (step S04), and a connection authentication request including user identification information to the wireless communication terminal It transmits to the authentication control apparatus 30 (step S05).

  The wireless communication terminal authentication control device 30 determines whether the user identification information included in the connection authentication request includes “wlan” or whether the IMSI is stored in the DB (step S06). Control processing related to authentication is performed, and based on the result of the authentication processing, a message of the connection availability determination result is returned. For example, when "wlan" is included in the user identification information and IMSI is stored in the DB, or the authentication result by the domain to which the user identification information does not include "wlan" and the request is transferred is authentication OK If YES in step S06, it is determined that connection is possible (YES in step S06), and a connection permission message is returned (step S07). On the other hand, when “wlan” is included in the user identification information and IMSI is not stored in the DB, or the authentication result by the domain to which the user identification information does not include “wlan” and the request is transferred is authentication NG If it is, it is determined that connection is not possible (step S06, NO), and a connection rejection message is returned (step S08). The control process related to authentication and the determination of connection availability based on it will be described in detail with reference to FIG.

  The AP 20 permits or refuses the communication of the wireless communication terminal 10 with the Internet based on the result of the connection determination (step S09). When the AP 20 receives the connection permission message, the AP 20 registers the MAC address of the wireless communication terminal 10 of the management information as the communication permission (step S011).

  Next, a processing procedure until the wireless communication terminal authentication control device 30 in the first embodiment receives a connection authentication request and transmits a message of the connection determination result will be described with reference to FIG. First, the wireless communication terminal authentication control device 30 receives user identification information along with a connection authentication request from the connection authentication request unit 23 of the AP 20 (step S1).

  Next, the wireless communication terminal authentication control device 30 checks whether or not “wlan” is written at the beginning of the domain name shown after “@” of the user identification information included in the connection authentication request (step S2). .

  The wireless communication terminal authentication control device 30 extracts IMSI from the user identification information included in the connection authentication request, when it is confirmed that “wlan” is written at the beginning of the domain name (step S2, YES) ( Step S3). On the other hand, when the wireless communication terminal authentication control device 30 confirms that the first part of the domain name does not have the word "wlan" (step S2, YES), the wireless communication terminal authentication control device 30 displays the domain name not including the word "wlan" at least. The connection authentication request is transferred to the destination (a predetermined communication carrier such as an MNO managing user authentication control) (step S6).

  From step S3 onwards, the wireless communication terminal authentication control device 30 next extracts the extracted IMSI as the authentication information management device 40 ("DB" for convenience of illustration. The same applies to each drawing showing the processing procedure shown in Fig. 5 and subsequent figures) It is checked whether or not it is stored in (step S4). When the wireless communication terminal authentication control device 30 determines that the extracted IMSI is stored in the authentication information management device 40 (YES in step S4), the wireless communication terminal authentication control device 30 transmits a connection permission message to the connection authentication request unit 23 (step S5). On the other hand, when the wireless communication terminal authentication control device 30 determines that the extracted IMSI is not stored in the authentication information management device 40 (step S4, NO), it transmits a connection rejection message to the connection authentication request unit 23 (step S7).

  Next, a schematic procedure from the wireless communication connection request to the Internet of the wireless communication terminal 10 in the present embodiment to the communication permission will be described with reference to FIG. Here, the IMSI of the SIM card 13 shipped to the user by the shipping system 50 is stored in advance in the authentication information management device 40, and the management information stored in the session management unit 24 of the AP 20 includes the wireless communication terminal 10 It is assumed that the MAC address of has not been registered. First, the wireless communication terminal 10 makes a wireless communication connection request including the MAC address of the own terminal to the AP 20 via the terminal wireless communication unit 11 [1].

  Next, when the AP 20 receives a wireless communication connection request to the AP wireless communication unit 21, the session management unit 24 of the AP 20 transmits the wireless communication terminal 10 included in the wireless communication connection request via the AP wireless communication unit 21. The MAC address is acquired, and it is confirmed whether the MAC address is registered as the communication permission in the stored management information. The session management unit 24 connects the wireless communication terminal 10 to the Internet if the MAC address of the wireless communication terminal 10 is registered in the management information, and uses SIM card information for the connection authentication request unit 23 if the MAC address is not registered. Ask for certification. Here, since the MAC address is not registered in the management information, the session management unit 24 issues the internal process ID described in FIG. 4 and registers it in association with the MAC address of the wireless communication terminal 10 in the management information. Further, at this time, since the session management unit 24 has not yet permitted the communication of the wireless communication terminal 10, the communication permission state is set to “0”, and the MAC address of the wireless communication terminal 10 is associated with the internal process ID as described above. Register in the management information. Then, the session management unit 24 asks the connection authentication request unit 23 for authentication together with the issued internal process ID.

  The connection authentication request unit 23 requests the terminal authentication server 22 for authentication. The terminal authentication server 22 transmits a request for acquisition of SIM card information (for example, EAP-Request / Identity) to the wireless communication terminal 10 via the AP wireless communication unit 21. When the terminal wireless communication unit 11 receives the SIM card information acquisition request, the terminal authentication request unit 12 of the wireless communication terminal 10 performs communication for specifying the IMSI and the communication carrier from the SIM card 13 mounted on the wireless communication terminal 10 User identification information obtained by combining provider information etc. and combining IMSI and domain name indicating carrier information (example: 1440101234567890@wlan.mnc10.mcc440.3gppnetwork.org "440101234567890" is an example of IMSI, "440" Is an example of MCC, "10" is an example of MNC, "1234567890" is an example of a subscriber number, and "3gppnetwork.org" is an example of a standard domain name in the case of using SIM authentication defined in 3GPP standards). It generates SIM card information including user identification information and transmits it to the AP wireless communication unit 21 via the terminal wireless communication unit 11. The user identification information is transmitted from the wireless communication terminal 10 to the AP 20 as a message such as a User-Name attribute, an EAP-Response / Identity attribute, or an EAP-Response / SIM / Start attribute.

  When the AP wireless communication unit 21 of the AP 20 receives the SIM card information including the user identification information from the terminal wireless communication unit 11, it passes it to the terminal authentication server 22. The terminal authentication server 22 passes these pieces of information to the connection authentication request unit 23. The connection authentication request unit 23 transmits a connection authentication request including the user identification information included in the acquired SIM card information to the wireless communication terminal authentication control device 30 [2].

  Upon receiving the connection authentication request, the wireless communication terminal authentication control device 30 extracts IMSI from the user identification information included in the connection authentication request, and inquires whether the IMSI is stored in the authentication information management device 40 [3]. The authentication information management device 40 sends back to the radio communication terminal authentication control device 30 the determination result as to whether or not the IMSI is stored. Here, since the IMSI of the wireless communication terminal 10 is stored in the authentication information management device 40, the determination result of the storage presence is returned to the wireless communication terminal authentication control device 30 [4]. The wireless communication terminal authentication control device 30 returns a message of the connection availability determination result to the AP 20 based on the inquired determination result. Here, based on the determination result of storing, the connection permission message is returned [5].

  The connection authentication request unit 23 of the AP 20 receives, as a response to the connection authentication request, a message of the connection availability determination result from the wireless communication terminal authentication control device 30. Here, since the IMSI of the wireless communication terminal 10 is stored in the authentication information management device 40, the connection authentication request unit 23 receives a connection permission message indicating that the connection of the wireless communication terminal 10 to the Internet is permitted.

  When receiving the connection permission message, the session management unit 24 changes and registers the communication permission state corresponding to the internal process ID included in the connection permission message as “1” in the management information, and sets the communication permission state to “1”. For the wireless communication terminal 10 with the MAC address, transmission and reception of communication between the Internet and the wireless communication terminal 10 are permitted [6]. When the session management unit 24 receives, from the connection authentication request unit 23, a connection refusal message indicating that the connection of the wireless communication terminal 10 to the Internet is rejected, the communication permission state of the management information is “0”. The connection rejection is notified to the wireless communication terminal 10 via the AP wireless communication unit 21 as it is.

  Thereafter, the wireless communication terminal 10 starts wireless communication to the Internet via the AP 20 [7].

  As described above, according to the first embodiment, a provider (MVNO, etc.) different from the one (MCNO, etc.) shown by the MCC / MNC recorded in the SIM card has a contract for using the public wireless LAN infrastructure. Even in the case where the wireless communication carrier MNO is the providing source stores the user identification information (IMSI) of the SIM card in the authentication information management device 40 and connects the stored IMSI and AP2 to the Internet By collating with the IMSI acquired from the wireless communication terminal 10 which requests the user, the user can easily perform the user authentication.

Second Embodiment
Next, a schematic configuration of a wireless communication control system including a wireless communication terminal authentication control device 30 according to a second embodiment of the present invention will be described with reference to FIG. The description of the same configuration as that of the first embodiment is omitted, and the configuration appearing for the first time in the second embodiment will be mainly described.

  In the second embodiment, the subsequent processing when the wireless communication terminal authentication control device 30 determines that the IMSI is not stored in the authentication information management device 40 is different from that of the first embodiment. That is, in the second embodiment, when the wireless communication terminal authentication control device 30 determines that the IMSI is not stored in the authentication information management device 40, it is determined that the IMSI is not stored in the authentication information management device 40. The connection authentication request is transferred to an authentication control management device of a predetermined telecommunications carrier such as an MNO that manages user authentication control indicated by the domain name of the original user identification information included in the connection authentication request.

  In FIG. 8, the company A authentication server 61 and the company A authentication database 62 (hereinafter referred to as "company A authentication DB"), the company B authentication server 71 and the company B authentication database 72 (hereinafter referred to as "company B authentication DB"). It corresponds to an authentication control management device of a predetermined telecommunications carrier. Hereinafter, in each name of the constituent element including the "database", it will be written in the abbreviation "DB" which is the abbreviation.

  A processing procedure until the wireless communication terminal authentication control device 30 in the second embodiment receives a connection authentication request and transmits a message of the connection availability determination result will be described with reference to FIG. The description of the same steps as those described in FIG. 6 of the first embodiment will be omitted. That is, in the second embodiment, when the wireless communication terminal authentication control device 30 determines in step S4 that the IMSI is not stored in the authentication information management device 40 (step S4, NO), the processing after the first is the first This is different from the embodiment, and in this case, the connection authentication request is transferred to the company A authentication server 61 or the company B authentication server 71 indicated by the domain name of the user identification information included in the connection authentication request (step S16).

  Next, a schematic procedure of wireless communication processing in the second embodiment will be described with reference to FIG. The description of the same steps as the steps shown in FIG. 7 of the first embodiment will be omitted. That is, here, unlike the case described in the first embodiment, it is assumed that the IMSI is not stored in the authentication information management device 40. The second embodiment is different from the first embodiment in the procedure after [4] in which the authentication information management device 40 returns the determination result as to whether the IMSI is stored or not to the wireless communication terminal authentication control device 30.

  First, since the IMSI of the wireless communication terminal 10 is not stored, the authentication information management device 40 returns the determination result of no storage to the wireless communication terminal authentication control device 30. When the wireless communication terminal authentication control device 30 receives the determination result that there is no storage, it transfers the connection authentication request to the company A authentication server 61 or the company B authentication server 71 indicated by the domain name of the user identification information included in the connection authentication request. And ask for a decision [11]. Then, the company A authentication server 61 or the company B authentication server 71 makes an inquiry to the company A authentication DB 62 or the company B authentication DB 72, performs an authentication process based on the user identification information included in the connection authentication request [12], the company A authentication The determination result of the authentication is received from the DB 62 or the company B authentication DB 72 [13], and the determination result is returned to the wireless communication terminal authentication control device 30 [14]. The wireless communication terminal authentication control device 30 responds to the AP 20 with a message of the connection possibility determination result based on the inquired determination result [5]. The procedure after this is the same as [6] or later of FIG. 7 of the first embodiment.

  As described above, according to the second embodiment, even if the IMSI is not stored in the authentication information management device 40, the authentication process is performed in the MNO, so the usage contract between the public wireless LAN operator and the MVNO operator Even if there is no usage contract, if there is a usage contract between the public wireless LAN operator and the MNO operator, it is possible to avoid a situation where the user can not receive the wireless communication service without performing user authentication. .

Third Embodiment
Next, a schematic configuration of a wireless communication control system including a wireless communication terminal authentication control device 30 according to a third embodiment of the present invention will be described with reference to FIG. The description of the same configuration as that of the first embodiment and the second embodiment will be omitted, and the configuration appearing for the first time in the third embodiment will be mainly described.

  The third embodiment is characterized in that the role of the authentication information management device 400 is different from that of the first embodiment and the like, and that the authentication processing is performed by the MVNO terminal authentication control management device. That is, the authentication information management device 400 stores the destination information of the terminal authentication control management device managing the user authentication control by the MVNO in correspondence with the user identification information stored in the SIM card.

  Further, when the wireless communication terminal authentication control device 30 determines that the IMSI is stored in the authentication information management device 400, the wireless communication terminal authentication control device 30 determines a connection authentication request including the IMSI determined to be stored in the authentication information management device 400. Transfer to the terminal authentication control management device indicated by the destination information stored corresponding to IMSI. The C company authentication server 83, the terminal DB 82 and the shipping system 81, the D company authentication server 93, the terminal DB 92, and the shipping system 91 shown in FIG. 11 correspond to the terminal authentication control management device.

  Next, an example of the correspondence between the IMSI and the destination information stored in the authentication information management apparatus 400 in the third embodiment will be described with reference to FIG. Here, the destination "MVNO-C" is stored corresponding to the IMSI "440101234567890", the destination "MVNO-D" is stored corresponding to the IMSI "440100123456789", and the destination "MVNO" corresponding to the IMSI "4401007360667599". “D” is stored, and the destination “MVNO-C” is stored corresponding to the IMSI “440101234567890”. That is, the wireless communication terminal authentication control device 30 may specify the destination corresponding to the IMSI with reference to these, and transfer the connection authentication request to the end authentication control management device of the MVNO indicated by the specified destination.

  Next, an example of the IMSI stored in the end DB 82 or the end DB 92 in the third embodiment will be described with reference to FIG. Although the end DB 82 and the end DB 92 in the third embodiment have the same function as the authentication information management device 40 in the first embodiment, the end DB 82 and the end DB 92 in the first embodiment have their installation places It is different. That is, the third embodiment is largely different from the first embodiment in that it is installed in the MVNO. In addition, since the example of IMSI in FIG. 13 is the same as that of IMSI of FIG. 3 demonstrated in 1st Embodiment, description is abbreviate | omitted.

  Next, the processing procedure in the third embodiment will be described with reference to FIG. The description of the same steps as the processing steps described in FIG. 6 of the first embodiment and FIG. 9 of the second embodiment will be omitted. That is, in the third embodiment, the procedure after the wireless communication terminal authentication control device 30 determines that the IMSI is stored in the authentication information management device 400 in step S4 (step S4, YES) corresponds to the first embodiment etc. It is different from

  After that, the wireless communication terminal authentication control device 30 transfers the connection authentication request to the MVNO terminal authentication control management device indicated by the destination stored corresponding to the IMSI determined to be stored in the authentication information management device 400. (Step S21).

  Thereafter, each company authentication server determines whether IMSI is stored in each company terminal DB in the terminal authentication control management apparatus (step S22), and determines that IMSI is stored in each company terminal DB (step S22, YES), each company authentication server transmits a connection permission message to the wireless communication terminal authentication control apparatus 30 (step S23). On the other hand, when it is determined that the IMSI is not stored in the end company DB (step S22, NO), the company authentication server transmits a connection rejection message to the wireless communication terminal authentication control apparatus 30 (step S24).

  Next, a schematic procedure of wireless communication processing in the third embodiment will be described with reference to FIG. The description of the same steps as the steps shown in FIG. 7 of the first embodiment will be omitted. That is, here, the procedure after [4] after the wireless communication terminal authentication control device 30 has been notified that IMSI is stored in the authentication information management device 400 is different from the first embodiment. Although the company A authentication server 61 and the company A authentication DB 62, and the company B authentication server 71 and the company B authentication DB 72 shown in FIG. 10 are omitted in this figure, this is for convenience of illustration. The third embodiment does not mean that these configurations are not included. Here, it is assumed that IMSI of the wireless communication terminal 10 that has transmitted the wireless communication connection request is stored in the terminal DB 82 of company C or the terminal DB 92 of company D.

  The wireless communication terminal authentication control device 30 performs connection authentication to the C company authentication server 83 or the D company authentication server 93 included in the terminal authentication control management device specified by the destination information corresponding to the IMSI stored in the authentication information management device 400. Forward the request [21]. The company C authentication server 83 or the company D authentication server 93 determines whether the IMSI is stored in the end DB 82 or the end DB 92 [22], and obtains the determination result [23]. Here, since the IMSI of the radio communication terminal 10 is stored in the end DB 82 or the end DB 92, the determination result of the authentication OK is obtained. Thereafter, the company C authentication server 83 or the company D authentication server 93 returns the obtained judgment result of the authentication OK to the wireless communication terminal authentication control apparatus 30 [24]. Based on the determination result, the wireless communication terminal authentication control device 30 returns a message of the connection availability determination result to the AP 20 [5]. Here, based on the determination result of authentication OK, a connection permission message is returned to the AP 20. The procedure after this is the same as [6] or later of the first embodiment.

  As described above, according to the third embodiment, the wireless communication terminal authentication control device 30 identifies the MVNO terminal authentication control management device corresponding to the IMSI included in the connection authentication request, and connects to the identified terminal authentication control management device. Since the authentication request is distributed and authentication control is performed based on the IMSI included in the connection authentication request received by the terminal authentication control management device, the MVNO can perform reliable and easy authentication processing, and wireless communication terminal authentication control The device 30 only needs to assign the transfer destination of the connection authentication request, which has the advantage of reducing the processing load.

  In the third embodiment, the IMSI is stored in the authentication information management device 400 and the terminal DB 82 and the terminal DB 92. However, the IMSI may not be stored on the terminal DB side. For example, the usage restriction process on the MVNO side can be easily performed by not storing in the terminal DB the IMSI assigned to the user subjected to the usage restriction such that the upper limit of the usage charge and the allowable communication data amount etc. are set. Is possible. In addition, for example, it is possible to quickly and easily perform temporary use restriction when the user loses the wireless communication terminal or is stolen.

Fourth Embodiment
Next, a schematic configuration of a wireless communication control system including a wireless communication terminal authentication control device 30 according to a fourth embodiment of the present invention will be described with reference to FIG. In addition, the description which overlaps with 1st Embodiment etc. is abbreviate | omitted, and the structure which appears for the first time in 4th Embodiment is mainly demonstrated.

  The fourth embodiment is characterized in that the provider DB 41 is added to the configuration of the second embodiment. That is, in the fourth embodiment, the business entity DB 41 is further provided as business operator identification information storage means for storing business operator identification information for identifying a predetermined telecommunications carrier. Then, when the carrier identification information included in the IMSI is stored in the provider DB 41, the wireless communication terminal authentication control device 30 determines whether the IMSI is stored in the authentication information management device 40.

  An example of the business entity identification information stored in the business entity DB 41 will be described with reference to FIG. Here, a character string consisting of five to six digits representing “MCC” and “MNC” is employed as business entity identification information. For example, “44010” on the upper side indicates “440” indicates MCC and “10” indicates a predetermined business entity. Further, in the lower part "310410", "310" indicates MCC and "410" indicates a predetermined business operator. When extracting the IMSI, the wireless communication terminal authentication control device 30 first refers to the provider DB 41 to check whether it is necessary to determine whether the IMSI is stored in the authentication information management device 40 or not. Do.

  Next, the processing procedure in the fourth embodiment will be described with reference to FIG. The description of the same steps as those described in FIG. 9 of the second embodiment will be omitted. That is, in the fourth embodiment, the procedure after extracting the IMSI in step S3 is different from that of the second embodiment.

  The wireless communication terminal authentication control device 30 determines whether the character string composed of “MCC” and “MNC” included in the extracted IMSI is stored in the provider DB 41 (step S31). Then, when the wireless communication terminal authentication control device 30 determines that the character string consisting of “MCC” and “MNC” is stored in the business operator DB 41 (YES in step S31), IMSI stores the information in the authentication information management device 40. It is determined whether it is set (step S32).

  When the wireless communication terminal authentication control device 30 determines that the IMSI is stored in the authentication information management device 40 (YES in step S32), the connection permission message is transmitted to the AP 20 (step S33). On the other hand, when the wireless communication terminal authentication control device 30 determines that the character string consisting of "MCC" and "MNC" included in the extracted IMSI is not stored in the provider DB 41 (step S31, NO), the wireless communication terminal The authentication control device 30 transfers the connection authentication request to the company A authentication server 61 or the company B authentication server 71 indicated by the domain name included in the connection authentication request (step S34).

  An outline procedure of wireless communication processing in the fourth embodiment will be described with reference to FIG. The description of the same steps as the steps shown in FIG. 10 of the second embodiment will be omitted. That is, the procedure after [2] from which the wireless communication terminal authentication control apparatus 30 extracted IMSI is different from the second embodiment. Here, unlike the case described in the second embodiment, the IMSI of the wireless communication terminal 10 is stored in the authentication information management device 40, and the provider identification information “44010” extracted from the IMSI is stored in the provider DB 41. It is assumed that Here, the company A authentication server 61 and the company A authentication DB 62, and the company B authentication server 71 and the company B authentication DB 72 are omitted for convenience of illustration.

  The wireless communication terminal authentication control device 30 determines whether the carrier identification information “MCC = 440” and “MNC = 10” extracted from the IMSI are stored in the carrier DB 41 [31]. Here, since the business entity identification information “MCC = 440” and “MNC = 10” are stored in the business entity DB 41, it is determined that the business entity identification information is present. After obtaining the determination result [32], the wireless communication terminal authentication control device 30 determines whether or not the IMSI is stored in the authentication information management device 40 because the determination result indicates the presence of the provider identification information. [33]. Here, since the IMSI of the wireless communication terminal 10 is stored in the authentication information management device 40, the wireless communication terminal authentication control device 30 obtains the determination result of storage [34]. The procedure after obtaining the determination result of this memory existence is the same as [5] or later of FIG. 7 of the first embodiment.

  As described above, according to the fourth embodiment, the wireless communication terminal authentication control device 30 first confirms the operator identification information “MCC” and “MNC” among the extracted IMSIs, and whether or not this is stored in the operator DB 41 To determine whether the IMSI is stored in the authentication information management device 40 only when the carrier identification information "MCC" and "MNC" are stored in the carrier DB 41, and the carrier identification When it is determined that the information “MCC” and “MNC” are not stored in the provider DB 41, the processing shown in the connection authentication request is not performed to the destination indicated by the domain name contained in the connection authentication request. Since the connection authentication request is transferred, it is not necessary for the subscriber stored in the authentication information management device 40 to constantly check hundreds of thousands of IMSI full digits, thus reducing the search load. It is possible.

Fifth Embodiment
Next, a schematic configuration of a wireless communication control system including a wireless communication terminal authentication control device 30 according to a fifth embodiment of the present invention will be described with reference to FIG. In addition, the description which overlaps with 3rd Embodiment etc. is abbreviate | omitted, and the structure which appears for the first time in 5th Embodiment is mainly demonstrated. In the fifth embodiment, the E company authentication server 201 and the E company authentication DB 202, and the F company authentication server 301 and the F company authentication DB 302 are added as an authentication control management device of MVNO. For convenience of illustration, the company A authentication server 61, the company A authentication DB 62, and the company B authentication server 71 and the company B authentication DB 72 are omitted.

  While the authentication information management device 40 according to the third embodiment stores IMSI and corresponding destination information, the authentication information management device 410 according to the fifth embodiment includes the IMSI and so forth. Correspondingly, it is characterized in that a user ID and an authentication password used for authentication in the MVNO terminal authentication control management device are stored.

  That is, based on the IMSI stored in the SIM card, the authentication information management device 410 in the fifth embodiment generates a user ID and an authentication password used for user authentication in the terminal authentication control management device that manages user authentication control by MVNO. And store the generated user ID and authentication password in association with the IMSI. Then, when the wireless communication terminal authentication control device 30 determines that the extracted IMSI is stored in the authentication information management device 410, the user ID and the authentication corresponding to the extracted IMSI stored in the authentication information management device 410 The password is transferred to the MVNO terminal authentication control management device indicated by the destination information included in the user ID.

  Next, an example of the IMSI stored in the authentication information management device 410 in the fifth embodiment and a user ID and an authentication password corresponding to the IMSI will be described with reference to FIG.

  Here, user ID “440101234567890@MVNO-E.jp” and authentication password “vwxyz12345” are stored corresponding to IMSI “440101234567890”, and user ID “0123456789@MVNO-F.jp” corresponding to IMSI “440100123456789”. And the authentication password “Abcd12345” are stored, the user ID “736067599@MVNO-F.jp” and the authentication password “98765asdfg” are stored corresponding to IMSI “4401007360667599”, and the user ID corresponding to IMSI “440101234567890” "4401011234567891@MVNO-E.jp" and authentication password "qwertyuiop" Stored in the device 410. Needless to say, these are examples. The wireless communication terminal authentication control device 30 transfers the connection authentication request to the end authentication control management device of the MVNO identified based on these pieces of information stored in the authentication information management device 410.

  Next, the processing procedure in the fifth embodiment will be described with reference to FIG. The description of the same procedures as those of the third embodiment described with reference to FIG. 14 will be omitted. That is, in the fifth embodiment, the procedure after the wireless communication terminal authentication control device 30 determines that IMSI is stored in the authentication information management device 410 in step S4 is different from that in the third embodiment. Here, it is assumed that a user ID and an authentication password corresponding to the user (or IMSI) using the wireless communication terminal 10 that has transmitted the wireless communication connection request are stored in the E company authentication DB 202 or the F company authentication DB 302. .

  The wireless communication terminal authentication control device 30 converts the user identification information included in the connection authentication request into the user ID stored corresponding to the IMSI by the authentication information management device 410 (step S41). Then, the wireless communication terminal authentication control device 30 transfers the connection authentication request including the user ID to the end authentication control management device of the MVNO specified by the destination information indicated by the domain name included in the converted user ID (step S42).

  An outline procedure of wireless communication processing in the fifth embodiment will be described with reference to FIG. The description of the same steps as the steps shown in FIG. 15 of the third embodiment will be omitted. That is, here, the procedure after [2] in which the wireless communication terminal authentication control device 30 has extracted IMSI is different from the third embodiment.

  After the wireless communication terminal authentication control device 30 determines that the IMSI is stored in the authentication information management device 410 [41], the user stored in the authentication information management device 410 corresponding to the IMSI of the wireless communication terminal 10 Receive an ID and authentication password [42]. The wireless communication terminal authentication control device 30 converts the user identification information into a user ID in the E company authentication server 201 or the F company authentication server 301 specified by the destination information indicated by the domain name included in the received user ID, The connection authentication request including the user ID and the authentication password is transferred together with the user ID and the authentication password [43].

  The E company authentication server 201 or the F company authentication server 301 refers to the E company authentication DB 202 or the F company authentication DB 302, and transmits a wireless communication connection request using the user ID and the authentication password included in the transferred connection authentication request. User authentication of the user who uses the wireless communication terminal 10 is performed [44], and the determination result of the authentication is obtained [45]. Here, since the user ID and the authentication password are stored in the E company authentication DB 202 or the F company authentication DB 302, the determination result of the authentication OK is obtained. Thereafter, the company E authentication server 201 or the company F authentication server 301 returns the authentication result of authentication OK to the wireless communication terminal authentication control apparatus 30 [46]. Based on the determination result of the connection authentication request, the wireless communication terminal authentication control device 30 returns a message of the connection availability determination result to the AP 20 [5]. Here, based on the determination result of authentication OK, a connection permission message is returned to the AP 20. The subsequent steps are the same as in FIG. 15 of the third embodiment.

  As described above, according to the fifth embodiment, the authentication information management device 40 transfers the user ID and the authentication password converted from IMSI to the MVNO terminal authentication control management device together with the connection authentication request, and the MVNO terminal authentication control management device In order to perform user authentication control using the transferred user ID and authentication password, the MVNO operator uses the conventional authentication control management device using the ID and password without being aware of the presence of the SIM card. And user authentication can be easily performed.

Sixth Embodiment
Next, a schematic configuration of a wireless communication control system including a wireless communication terminal authentication control device 30 according to a sixth embodiment of the present invention will be described with reference to FIG. In addition, the description which overlaps with 3rd Embodiment etc. is abbreviate | omitted, and the structure which appears for the first time in 6th Embodiment is mainly demonstrated.

  While the authentication information management apparatus 40 in the third embodiment stores all the digits constituting IMSI, in the sixth embodiment, the authentication information management apparatus 420 stores several digits constituting the IMSI. It is characterized by the point to memorize.

  That is, the authentication information management device 420 in the sixth embodiment corresponds the destination information of the terminal authentication control management device managing the user authentication control by the MVNO to a part of character strings included in the IMSI stored in the SIM card. Let me remember. When the wireless communication terminal authentication control device 30 determines that a part of the character string included in the extracted IMSI is stored in the authentication information management device 420, the wireless communication terminal authentication control device 30 determines that the character string is stored in the authentication information management device 420. The connection authentication request including the IMSI including the specified character string is transferred to the MVNO terminal authentication control management device indicated by the destination information stored corresponding to the character string.

  Next, a part of IMSI and an example of destination information stored in the authentication information management device 420 in the sixth embodiment will be described with reference to FIG. In addition, although a part of IMSI is made into seven digits or eight digits of "the first 2 digits of MCC + MNC + MSIN" here, it is not limited to this.

  Here, destination information "MVNO-C" is stored corresponding to part "4401005" of IMSI, destination information "MVNO-D" is stored corresponding to part "4401004" of IMSI, and one of IMSI is stored. Destination information "MVNO-D" is stored corresponding to part "4401004", and destination information "MVNO-C" is stored corresponding to part "4401005" of IMSI. Needless to say, these are examples.

  Next, the processing procedure in the sixth embodiment will be described with reference to FIG. The description of the same procedures as those of the third embodiment described with reference to FIG. 14 will be omitted. That is, in the sixth embodiment, the procedure after the wireless communication terminal authentication control device 30 extracts the IMSI in step S3 is different from that in the third embodiment.

  The wireless communication terminal authentication control device 30 determines whether part of the extracted IMSI is stored in the authentication information management device 420 (step S51). When the wireless communication terminal authentication control device 30 determines that part of the IMSI is stored in the authentication information management device 420 (YES in step S51), destination information stored corresponding to part of the IMSI is displayed. The connection authentication request is transferred to the terminal authentication control management device of the MVNO (step S52). On the other hand, when the wireless communication terminal authentication control device 30 determines that part of the IMSI is not stored in the authentication information management device 420 (step S51, NO), destination information indicated by the domain name included in the connection authentication request The connection authentication request is transferred to the authentication control management device of the MNO identified in (step S53). The procedure after step S52 is the same as step S22 of FIG. 14 of the third embodiment. The outline procedure of the wireless communication process in the sixth embodiment is the same as the procedure in FIG. 14 described in the third embodiment, and thus the illustration and the description thereof will be omitted.

  As described above, according to the sixth embodiment, the authentication information management device 420 does not need to check all digits constituting IMSI for several hundreds of thousands, so that the search load can be reduced.

Seventh Embodiment
Next, a schematic configuration of a wireless communication control system including a wireless communication terminal authentication control device 30 according to a seventh embodiment of the present invention will be described with reference to FIG. In addition, the description which overlaps with 1st Embodiment etc. is abbreviate | omitted, and the structure which appears for the first time in 7th Embodiment is mainly demonstrated.

  The seventh embodiment is different from the first embodiment and the like in that the authentication information management device 430 stores not only IMSI but also usage restriction information for restricting the use of a wireless communication terminal under predetermined conditions.

  That is, the authentication information management device 430 in the seventh embodiment includes the IMSI stored in the SIM card, and the use restriction information for restricting the use of the communication service via the wireless network of the wireless communication terminal 10 using the SIM card. Make them correspond and store them. Then, when the IMSI of the wireless communication terminal 10 included in the connection authentication request is stored in the authentication information management device 430, the wireless communication terminal authentication control device 30 in the seventh embodiment corresponds to the AP 20 in response to the IMSI. The usage restriction information stored in the authentication information management device 430 is transmitted.

  Next, the IMSI and usage restriction information stored in the authentication information management device 430 will be described with reference to FIG. Here, “maximum speed”, “time zone”, “data amount”, “line type” and “application type” when using the wireless communication terminal 10 are adopted as the usage restriction information, but other than these It may be the use restriction information of Note that "ALL" in FIG. 27 means that there is no restriction.

  In FIG. 28, from the top, all usage restriction information is stored as "ALL" corresponding to IMSI "440101234567890", and maximum speed "1.0 Mbps" and time zone "14" corresponding to IMSI "440100123456789". “16”, data amount “2.5 Gb”, line type “WPAonly”, application type “moving picture site prohibition” are stored, maximum speed “ALL” corresponding to IMSI “4401007360667599”, time slot “9-11 / 10” 14-17 ”, data amount“ ALL ”, line type“ ALL ”, application type“ ALL ”are stored, maximum speed“ 10.0 Mbps ”corresponding to IMSI“ 440101234567890 ”, time slot“ ALL ”, data amount "ALL", line type "EAPonly", application type "SNS "It is stored. When the wireless communication terminal authentication control device 30 receives the connection authentication request from the AP 20, if the IMSI extracted from the user identification information included in the connection authentication request is stored in the authentication information management device 430, the wireless communication terminal authentication control device 30 corresponds to the IMSI. The usage restriction information is transmitted to the AP 20.

  Next, an example of management information managed by the session management unit 24 of the AP 20 will be described with reference to FIG. This figure is the one in which the usage restriction information transmitted from the wireless communication terminal authentication control device 30 is added to the MAC address of the corresponding wireless communication terminal 10 in FIG. 4 of the first embodiment. The description is omitted. That is, in response to the MAC address assigned to the wireless communication terminal 10 that has made the connection authentication request, the AP 20 controls wireless communication terminal authentication using the usage restriction information stored corresponding to the IMSI extracted from the connection authentication request. Receive from device 30 and store.

  As described above, according to the seventh embodiment, the AP 20 receives the usage restriction information from the wireless communication terminal authentication control device 30 at the time of authentication control, and stores the information in the session management unit 24 so that only the user authentication can be performed. Instead, it becomes possible to apply usage restrictions individually to each user.

Eighth Embodiment
Next, a schematic configuration of a wireless communication control system including a wireless communication terminal authentication control device 30 according to an eighth embodiment of the present invention will be described with reference to FIG. In addition, the description which overlaps with 3rd Embodiment etc. is abbreviate | omitted, and the structure which appears for the first time in 8th Embodiment is mainly demonstrated.

  The eighth embodiment is characterized in that both an MVNO terminal authentication control management device and an MNO authentication control management device are used in authentication control. FIG. 30 corresponds to FIG. 11 of the third embodiment except that the A company authentication server 61 and the A company authentication DB 62, and the B company authentication server 71 and the B company authentication DB 72 are added (however, these are the third embodiment). For the convenience of illustration. In the eighth embodiment, the wireless communication terminal authentication control device 30 'has a function different from that of the wireless communication terminal authentication control device 30 in the third embodiment and the like.

  That is, the wireless communication terminal authentication control device 30 'performs the end authentication of the MVNO indicated in the destination information stored corresponding to the IMSI, of the connection authentication request including the IMSI determined to be stored in the authentication information management device 400. The IMSI transferred to the control management device and authenticated at the terminal authentication control management device is authenticated. Thereafter, the wireless communication terminal authentication control device 30 ′ performs connection authentication including the IMSI authenticated by the terminal authentication control management device to the MNO authentication control management device managing the user authentication control indicated by the destination information included in the connection authentication request. Forward the request

  The storage of the IMSI and the like in the authentication information management device 400 and the end DB in the eighth embodiment is the same as in the third embodiment, and thus the description thereof is omitted.

  Next, the processing procedure in the eighth embodiment will be described with reference to FIG. The description of the same procedures as those of the third embodiment described with reference to FIG. 14 will be omitted. That is, in the eighth embodiment, after the wireless communication terminal authentication control device 30 determines that the IMSI is stored in the authentication information management device 400 in step S21, the identification information is identified by the stored destination information corresponding to the IMSI. The procedure after the connection authentication request is transferred to the MVNO terminal authentication control management device is different from that of the third embodiment.

  The end authentication control management device of the MVNO specified by the destination information determines whether the authentication is OK or NG for the IMSI included in the connection authentication request (step S61). When the terminal authentication control management device determines that the authentication is OK (step S61, YES), the wireless communication terminal authentication control device 30, which has received the determination result, next determines the destination indicated by the domain name included in the connection authentication request. The connection authentication request is transferred to the authentication control management device of the MNO specified by the information (step S62). On the other hand, when the terminal authentication control management device determines that the authentication is not successful (step S61, NO), the wireless communication terminal authentication control device 30 transmits a connection rejection message to the AP 20 (step S65).

  On the other hand, the MNO authentication control management apparatus that has received the connection authentication request determines whether the authentication is OK or NG for the IMSI included in the connection authentication request (step S63). When the authentication control management apparatus determines that the authentication is OK (YES in step S63), the wireless communication terminal authentication control apparatus 30 transmits a connection permission message to the AP 20. On the other hand, when the authentication control management apparatus determines that the authentication is not successful (step S63, NO), the wireless communication terminal authentication control apparatus 30 transmits a connection rejection message to the AP 20 (step S65).

  An outline procedure of wireless communication processing in the eighth embodiment will be described with reference to FIG. The description of the same steps as the steps shown in FIG. 15 of the third embodiment will be omitted. That is, here, the procedure after the step [4] in which the wireless communication terminal authentication control device 30 determines whether the IMSI is stored in the authentication information management device 400 is different from the third embodiment and the like. Here, it is assumed that the IMSI of the wireless communication terminal 10 is stored in the company A authentication DB 62 or the company B authentication DB 72.

  When the wireless communication terminal authentication control device 30 determines that the IMSI is stored in the authentication information management device 400, the wireless communication terminal authentication control device 30 is a terminal authentication control management device of MVNO identified by the destination information corresponding to the stored IMSI. The connection authentication request is transferred to the company authentication server 83 or the D company authentication server 93 [51].

  The company C authentication server 83 or the company D authentication server 93 determines whether IMSI is stored in the company C end DB 82 or the company D end DB 92 [52], and obtains the determination result [53]. Thereafter, the company C authentication server 83 or the company D authentication server 93 returns the obtained determination result to the wireless communication terminal authentication control apparatus 30 [54]. Here, since the IMSI of the radio communication terminal 10 is stored in the end DB 82 or the end DB 92, the determination result of the authentication OK is obtained.

  Thereafter, when the wireless communication terminal authentication control device 30 receives the determination result of the authentication OK from the company C authentication server 83 or the company D authentication server 93, the company A authentication indicated by the domain name of the user identification information included in the connection authentication request The connection authentication request is transferred to the server 61 or the company B authentication server 71 [55]. Then, the company A authentication server 61 or the company B authentication server 71 performs authentication control based on the IMSI with reference to the company A authentication DB 62 or the company B authentication DB 72 [56], and receives an authentication result [57]. Here, since IMSI of the wireless communication terminal 10 is stored in the company A authentication DB 62 or the company B authentication DB 72, the company A authentication server 61 or the company B authentication server 71 controls the authentication result of the wireless communication terminal authentication control. Reply to device 30 [58]. Based on the determination result, the wireless communication terminal authentication control device 30 returns a message of the connection availability determination result to the AP 20 [5]. Here, based on the determination result of authentication OK, a connection permission message is returned to the AP 20. The subsequent steps are the same as in FIG. 15 of the third embodiment.

  As described above, according to the eighth embodiment, since both the end authentication control management device of the MVNO and the authentication control management device of the MNO are subjected to the authentication process, it is possible to improve the certainty of the personal authentication. In the description of the eighth embodiment described above, the end authentication control management device of the MVNO is made to perform the authentication process first, and then the authentication control management device of the MNO is made to authenticate, but it is not limited thereto. Alternatively, the authentication control management device of the MNO may be made to perform the authentication process first, and then the end authentication control management device of the MVNO may be made to perform the authentication process.

  The embodiments described above are preferred embodiments of the present invention, and various modifications can be made without departing from the scope of the present invention. For example, each process in the above-described embodiment can be executed using hardware, software, or a combined configuration of both.

  In addition, when processing is performed using software, it is possible to install and execute a program in which a processing sequence is recorded in a memory in a computer incorporated in dedicated hardware. Alternatively, the program can be installed and executed on a general-purpose computer that can execute various processes.

10 wireless communication terminal 11 terminal wireless communication unit 12 terminal authentication request unit 13 SIM card 14 application execution unit 20 AP
21 AP wireless communication unit 22 terminal authentication server 23 connection authentication request unit 24 session management unit 30 wireless communication terminal authentication control device 40, 400, 410, 420, 430 authentication information management device 41 company DB
50 Shipping System 61 Company A Certification Server 62 Company A Certification DB
71 Company B authentication server 72 Company B authentication DB
81, 91 Shipping System 82, 92 Terminal DB
83 C company authentication server 93 D company authentication server 201 E company authentication server 202 E company authentication DB 202
301 F company authentication server 302 F company authentication DB

Claims (10)

Wireless communication for controlling authentication of a wireless communication terminal connected to a network from an access point of a wireless communication network different from the network of the communication carrier, using an authentication medium purchased from the communication carrier and provided by a virtual mobile communication carrier A terminal authentication control device,
The authentication information management apparatus stores user identification information of the wireless communication terminal that permits connection to the network, and the access point is included in an authentication medium installed in the wireless communication terminal acquired from the wireless communication terminal. and determining the control unit whether the user identification information is memorize,
Equipped with
The control means makes a connection authentication request including the user identification information transmitted from the access point when the terminal identification information of the wireless communication terminal requesting the connection to the network is not stored in the access point. When received, it is determined whether or not the user identification information contained in the received connection authentication request is stored in the authentication information management device , and the result of determining whether the wireless communication terminal can connect to the network A wireless communication terminal authentication control device characterized by transmitting a certain connection determination result to the access point. The control means
When it is determined that the user identification information is stored in the authentication information management device , a connection permission for permitting connection of the wireless communication terminal to the network is transmitted to the access point;
When the user identification information is determined not to be stored in the authentication information management apparatus, a connection authentication request user identification information is determined not to be stored in the authentication information management apparatus, included in the connection authentication request The wireless communication terminal is transferred to an authentication control management device of a predetermined communication carrier who manages user authentication control indicated by destination information, and based on the determination result of authentication received from the authentication control management device of the predetermined communication carrier. 2. The wireless communication terminal authentication control device according to claim 1, wherein the wireless communication terminal authentication control device according to claim 1, wherein the wireless communication terminal authentication control device transmits to the access point a wireless connection determination result that is a result of determining whether the wireless communication device can connect to the network. In the authentication information management device, the virtual destination information terminal authentication control management system for managing user authentication control by mobile operators, and the user identification information stored in the authentication medium is stored is correlated Yes ,
Wherein, when said user identification information is determined to be stored in the authentication information management apparatus, a connection authentication request including the user identification information is determined to be stored in the authentication information management apparatus, wherein It is transferred to the terminal authentication control management device indicated by the destination information stored corresponding to the user identification information, and based on the judgment result of the authentication received from the terminal authentication control management device, the wireless communication terminal transmits the information to the network. 2. The wireless communication terminal authentication control device according to claim 1, further comprising: transmitting to the access point a result of connection determination as a result of determination of connection. The control means, the operator identification information storage device for storing operator identification information that identifies the wireless service provider, when the operator identification information included in the user identification information is memorize, the user identification information radio communication terminal authentication control apparatus according to claim 1 or 2, characterized in that to determine whether it is stored in the authentication information management apparatus. In the authentication information management device, based on the user identification information stored in the authentication medium, the use in the user authentication in the terminal authentication control management system for managing user authentication control according to mobile virtual network operator user I D及 beauty authentication password is stored is correlated to the user identification information,
Wherein, when said user identification information is determined to be stored in the authentication information management device, stored in the authentication information management apparatus, a user ID and authentication password corresponding to the user identification information, the Transfer to the terminal authentication control management device indicated by the destination information included in the user ID, and based on the judgment result of the authentication received from the terminal authentication control management device, it is judged whether the wireless communication terminal can connect to the network 2. The wireless communication terminal authentication control device according to claim 1, wherein the wireless communication terminal authentication control device according to claim 1, wherein the wireless communication terminal authentication control device transmits the result of connection determination result to the access point. In the authentication information management device, destination information of the terminal authentication control management device that manages user authentication control by the virtual mobile communication carrier, and a part of character strings included in the user identification information stored in the authentication medium There are stored being correlated,
The character string determined to be stored in the authentication information management device when the control means determines that a part of the character string included in the user identification information is stored in the authentication information management device The connection authentication request including the user identification information including the information is transferred to the terminal authentication control management device indicated by the destination information stored corresponding to the character string, and the judgment result of the authentication received from the terminal authentication control management device The wireless communication terminal authentication control device according to claim 1, wherein the wireless communication terminal authentication control device according to claim 1, wherein the wireless communication terminal authentication control device transmits a connection availability determination result, which is a result of determining whether the wireless communication terminal can connect to the network. The authentication information management apparatus, user identification information stored in the authentication medium, the use restriction information for restricting the use of the communication services over the network of the wireless communication terminal using the authentication medium is correlated are stored Te,
The control means corresponds to the user identification information when the user identification information contained in the received connection authentication request is stored in the authentication information management device when the connection authentication request to the network is received. The wireless communication terminal authentication control device according to any one of claims 1 to 6, wherein use restriction information is transmitted to the access point. The terminal authentication control management device, wherein the control means indicates a connection authentication request including user identification information determined to be stored in the authentication information management device , by destination information stored corresponding to the user identification information. Control of the predetermined telecommunications carrier managing the user authentication control indicated by the destination information included in the connection authentication request after the transferred user identification information is authenticated in the terminal authentication control management device. The wireless communication terminal transfers the connection authentication request including the user identification information authenticated by the terminal authentication control management device to the management device, and based on the determination result of the authentication received from the authentication control management device of the predetermined communication carrier. 7. A connection availability determination result, which is a result of determining whether or not to connect to the network, is transmitted to the access point. Wireless communication terminal authentication control apparatus according to (1). Wireless communication for controlling authentication of a wireless communication terminal connected to a network from an access point of a wireless communication network different from the network of the communication carrier, using an authentication medium purchased from the communication carrier and provided by a virtual mobile communication carrier A control method of a terminal authentication control apparatus
The terminal identification information of the wireless communication terminal for requesting connection to the network is included in the authentication medium mounted on the wireless communication terminal acquired from the wireless communication terminal when the access point is not stored. Receiving from the access point a connection authentication request including user identification information;
Determining whether or not the user identification information included in the received connection authentication request is stored in an authentication information management device storing user identification information of the wireless communication terminal that permits connection to the network; ,
Transmitting, to the access point, a connection availability determination result that is a result of determining whether the wireless communication terminal can connect to the network.
A control method characterized by including. Wireless communication for controlling authentication of a wireless communication terminal connected to a network from an access point of a wireless communication network different from the network of the communication carrier, using an authentication medium purchased from the communication carrier and provided by a virtual mobile communication carrier A program to be executed by the terminal authentication control device,
The terminal identification information of the wireless communication terminal for requesting connection to the network is included in the authentication medium mounted on the wireless communication terminal acquired from the wireless communication terminal when the access point is not stored. Receiving a connection authentication request including user identification information from the access point;
A procedure of determining whether or not the user identification information included in the received connection authentication request is stored in an authentication information management device storing user identification information of the wireless communication terminal that permits connection to the network; ,
A procedure for transmitting to the access point a connection availability determination result that is a result of determining whether the wireless communication terminal can connect to the network;
A program characterized by including:

Images