JPH1070540A - Radio terminal authentication method for radio network, and radio network - Google Patents

Abstract

PROBLEM TO BE SOLVED: To authenticate a radio terminal without increasing time and labor and time for registering authentication information in a network constituted by connecting LANs having a radio network to a low-order network. SOLUTION: The network is composed of LANs 13, 14 and routers 10, 11 and a public network 12, and LANs 13 and 14 are connected to each other by the routers 10 and 11 through the public communication network 12. LAN 13 (14) is composed of a server 1 (2), a base station 3 (4) and radio terminals 5 to 7 (8 and 9). The radio terminals transmit a connection request consisting of the network address of a server authentication ID of a radio terminal, authentication data of the user of the radio terminal and the user of the radio terminal at the time of connecting to the network. When a server executing authentication in a connection request is its own server, the server directly executes authentication and when it is not its own server, the server asks authentication to a server to authenticate. At the time of receiving an authentication request from another server, the server executes authentication and returns the result of authentication.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to a plurality of LANs,
It is composed of a plurality of routers corresponding to each LAN and a public network. Each LAN is connected to each other via the public network by the corresponding router, and each LAN is connected to a server, a base station, and one.
The present invention relates to a wireless terminal authentication method in a wireless network including one or more wireless terminals.

[0002]

2. Description of the Related Art Conventionally, a LAN having a wireless network as a lower network has been used to eliminate the movement of cables and the like when a terminal moves, and to allow the terminal to move freely within the network.

For example, Japanese Patent Application Laid-Open No. 3-250820 discloses a technology for connecting a wireless terminal to an optimum wireless base station by using a broadcast function of a LAN in a LAN having a wireless network as a lower network. A technique for efficiently finding a communication partner is described.

In connection of a diskless workstation to a LAN, a method of connecting a terminal having no network address by temporarily assigning an address at the time of connection by a server that manages the address is used. .

[0005]

When the wireless terminal moves and attempts to authenticate when acquiring an IP address on the destination LAN, the user of the wireless terminal sends authentication information to all destination servers. You must register.

The reason is that the user usually has the right to connect to the LAN depending on whether the authentication information transmitted by the wireless terminal is included in the authentication information registered in advance in the server to which the IP address is assigned. This is because it is determined whether or not it is.

An object of the present invention is to provide a method and a network for authenticating a wireless terminal without increasing the trouble of registering authentication information in a network configured by connecting LANs having a wireless network as a lower network. It is.

[0008]

According to the present invention, there is provided a method for authenticating a wireless terminal in a wireless network, comprising the steps of: when connecting to a network, a wireless terminal identifying an ID of the wireless terminal and a user of a user of the wireless terminal; A connection request including authentication data including a name and a password and a network address of a server performing authentication of a user of the wireless terminal is transmitted. The server receives the connection request transmitted by the wireless terminal and relayed by the base station. If the server performing the authentication during the connection request is its own server, it performs direct authentication, returns a connection response as an authentication result to the wireless terminal via the base station, and performs the authentication during the connection request. If the server is not its own server, it relays the authentication data in the connection request to the server performing authentication, the network address of the server performing authentication, and the connection request. Requests authentication by transmitting an authentication request including the network address of the local station, and when receiving an authentication request from another server, performs authentication by itself, and transmits the ID of the wireless terminal, the authentication result, and the connection request. An authentication response including the network address of the relayed base station is returned to the server that has requested authentication, and the server that has received the authentication response returns a connection response to the wireless terminal via the base station as an authentication result.

When a wireless terminal connects to a network,
Specify the server that authenticates the user. When a server other than the specified server receives a connection request from the wireless terminal, the wireless server user requests authentication from the specified server. You do not need to register.

In addition to the present invention, a wireless terminal authentication method in a wireless network is characterized in that each server has an authentication data including an IP address of its own server, an IP address of another server, a user name and a password of a user of the wireless terminal. Each base station previously stores the IP address of a server in its own LAN and the MAC address of a router connected to its own LAN. When a password is input, a connection request including authentication data including the IP address of the server performing authentication, the ID of the wireless terminal, the user name and the password is created, and transmitted to a base station in the own LAN. Then, when each base station receives the connection request, the received connection request is used as return data, and the IP address of the server to which the IP address is assigned is transmitted to the destination address. Create an IP packet as less,
Send to the server of own LAN, and each server sends the IP
When a packet is received, the IP address of the server performing authentication in the packet is compared with the IP address of the server itself. If the server performing authentication specified by the wireless terminal is the server itself, authentication data stored in advance is stored. Is checked to see if there is a match with the authentication data in the IP packet, and if there is a match, it is determined that the user of the wireless terminal has the right to use the network, Assign an IP address,
A connection response comprising an address, an ID of the wireless terminal, and a use permission message is used as transmission data, and the IP of the base station is transmitted.
An IP packet is created using the address as the destination IP address and transmitted to the wireless terminal. If there is no authentication data stored in advance that matches the authentication data in the IP packet, the wireless terminal Create a connection response consisting of an ID and a message of denial of use, send it to the base station that sent the connection request, and if the server specified by the wireless terminal is not its own server, the ID of the wireless terminal, the user name and , Password, and I of the base station that sent the connection request
Creates an authentication request data composed of a P address, uses the data as transmission data, creates and transmits an IP packet using the IP address of a server performing authentication in the data of the connection request as an IP address of a transmission destination, and transmits the authentication request. Is received from another server, it is checked whether or not there is any authentication data stored in advance that matches the authentication data in the authentication request. If there is no match between the ID, the IP address of the base station requesting the authentication, and the authentication response including the use permission message, the ID of the wireless terminal and the IP address of the base station requesting the authentication are determined. An authentication response including an address and a message of denial of use is created, and an IP packet having the server that sent the authentication request as a destination and the authentication response as transmission data is generated. When the authentication response includes the message of denial of use, a connection response including the ID of the wireless terminal and the message of denial of use is created, and the connection request is transmitted. The connection request is transmitted to the base station, and if the authentication response includes a use permission message, a connection response including the wireless terminal ID and the use permission message is created and transmitted to the base station that transmitted the connection request.

[0011] In the wireless network according to the present invention, the wireless terminal has a connection comprising an ID of the wireless terminal, authentication data including a user name and a password of a user of the wireless terminal, and an IP address of a server performing authentication. Connection request transmission means for transmitting a request to the base station; a connection response comprising, in response to the connection request, an ID of the wireless terminal, a message indicating whether a network can be used, and an IP address assigned to the wireless terminal; Has connection response receiving means for receiving
The base station is included in the same LAN as the base station, and a storage device that stores in advance an IP address of a server that assigns an IP address to the wireless terminal, a MAC of a router connected to the LAN, Transmitting the connection request received from the server to the server for assigning an IP address,
The server has connection request relay means for transmitting a connection response received from the router to the wireless terminal, wherein the server has a user name, a password, and an IP address assigned to the wireless terminal for which the server itself directly authenticates; And a storage device in which the IP addresses of the own server and the other server are stored in advance, and when notified that the own server is not a server performing authentication, the authentication data in the connection request and the network address of the server performing authentication are notified. Authentication request transmitting means for requesting transmission of an authentication request comprising a network address of a base station relaying the connection request to a server performing authentication in the connection request; and an ID of the wireless terminal and the base station. An authentication result transmitting means for requesting transmission of an IP address and a message indicating permission or denial of use to a source of the authentication request; Upon receiving the address assignment request, one of the IP addresses to be assigned to the wireless terminal stored in the storage device is assigned to the wireless terminal, and the assigned IP address, wireless terminal ID, and usage permission message are assigned. IP address assigning means for requesting transmission of the connection response to the base station which transmitted the connection request, and receiving the notification that the server itself is a server for performing authentication, It checks whether the user name and password in the connection request are included in the user name and password, and if so, requests the IP address allocating means to allocate an IP address. Request for transmission of the connection response to the base station that transmitted the connection request, and an authentication request. When notified of the reception, it is checked whether there is any of the user name and password stored in the storage device that matches the user name and password in the authentication request, and the result is transmitted as the authentication result. Means for notifying the authentication data comparing means, and when notified that the connection request has been received, the IP address of the server performing authentication in the connection request data is compared with the IP address of its own server. An IP that notifies the data comparison means that the server is an authentication server and, if not equal, notifies the connection request sending means that the server is not an authentication server.
Address comparison means for receiving an IP packet,
When notified of the reception of the authentication result, the communication means for transmitting the packet determines whether or not use is permitted. If the use is permitted, the IP address assignment means is requested to allocate an IP address. For example, an authentication result accepting unit for creating a connection response including an ID of the wireless terminal and a message of denial of use, and requesting transmission of the connection response to the base station that transmitted the connection request, and data from the received IP packet. If the data is a connection request, the IP address comparison means is notified that the connection request has been received, and if the data is an authentication result, the authentication result reception means is notified that the authentication result has been received. In addition, when data transmission is requested from the authentication request transmitting means, the IP address allocating means, the authentication result receiving means, or the authentication result transmitting means, Creating a packet and a communication control means for transmitting from said communication means.

According to an embodiment of the present invention, the wireless terminal further includes input means for inputting a communication start, a user name of a user of the wireless terminal, and a password, and the connection response receiving means includes: In the received connection response, the message of availability is checked, and if the use is rejected, the fact that the use of the network has been rejected is notified to the input / output means, and if the use is permitted, the IP address has been assigned. Is notified to the input / output means.

According to another embodiment of the present invention, the server transmits a connection request, an authentication request,
When notified that data other than the authentication result has been received,
There is further provided service providing means for performing processing specified by the received data, creating response data, and notifying the notification control means of transmission of the response data.

[0014]

Next, embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is an explanatory diagram of a network according to an embodiment of the present invention. The network of this embodiment is LAN1
3, LAN 14, router 10, router 11, and public network 12
And the LAN 13, the router 10, and the LAN 14.
And the router 11 are connected to each other via a public network 12. The LAN 13 includes the server 1, the base station 3, the wireless terminal 5, the wireless terminal 6, and the wireless terminal 7. Also, LAN
Reference numeral 14 denotes the server 2, the base station 4, the wireless terminal 8, and the wireless terminal 9.
Consists of

FIG. 2 is a block diagram showing the configuration of the wireless terminals 5 to 9 constituting the network of FIG. Each of the wireless terminals 5 to 9 includes a wireless communication unit 21, a communication control unit 22, a connection response receiving unit 23, a connection request transmitting unit 24, an input / output control unit 25, an input / output unit 26, and a storage device 27.

The storage device 27 stores in advance the ID of the wireless terminal and the IP address of a server that authenticates the user of the wireless terminal.

When the communication start, the user name, and the password are input from the input / output means 26, the input / output control means 25 writes these in the storage device 27, notifies the connection request transmitting means 24, and sends the connection response. When notified that the use of the network has been refused by the receiving means 23, the user is prompted again to start communication, and to input a user name and a password. The input / output control unit 25 writes the data input from the input / output unit 26 into the storage device 27,
The received data written in the storage device 27 by the communication control means 22 is read out and output from the input / output means 26.

When notified of the start of communication from the input / output control means 25, the connection request transmitting means 24 sends the ID of the wireless terminal, authentication data including the user name and password of the wireless terminal, I of the server that authenticates the user
A connection request including a P address is created, and the wireless communication unit 2
Send from 1.

When the connection response receiving unit 23 receives the connection request from the wireless communication unit 21 of the connection response including the ID of the wireless terminal, a message indicating whether the network can be used, and the IP address assigned to the wireless terminal, , Determine whether the network can be used, and if the use is denied,
The input / output control unit 25 is notified that the use of the network has been refused. If the use is permitted, the IP address assigned to the wireless terminal is stored in the storage device 27, and the communication that the IP address has been assigned is communicated. The control unit 22 and the input / output control unit 25 are notified.

The communication control means 22 includes an input / output control means 25
An IP packet is created from the transmission data written in the storage device 27 and the IP address of the transmission destination, and the IP packet is transmitted from the wireless communication unit 21.
If received, the data is extracted from the IP packet and written to the storage device 27.

FIG. 3 is a block diagram showing the configuration of the base stations 3 and 4 constituting the network of FIG. Base stations 3, 4
Comprises a communication control means 31, a wireless communication means 32, a wired communication means 33, a storage device 34, and a connection request relay means 35.

The storage device 34 previously stores the IP address of the base station itself, the IP address of a server connected to the same LAN as the base station and assigning an IP address to the wireless terminal, and the MAC address of the router. .

The communication control means 31 transmits the IP packet received from the wireless communication means 32 by the wired communication means 33, and transmits the IP packet received by the wired communication means 33 from the wireless communication means 32.

The connection request relaying means 35 is
2. The connection request received by the communication device
The connection request is transmitted to the server that performs address assignment, and the response to the connection request received by the wired communication unit 33 is transmitted from the wireless communication unit 32 to the wireless terminal.

FIG. 4 is a block diagram showing a configuration of the server 1 and the server 2 which constitute the network of FIG.
The server 1 and the server 2 include a communication unit 41, a communication control unit 42, an IP address comparison unit 43, and a connection request transmission unit 4
4 and authentication data comparing means 45 and IP address allocating means 4
6, an authentication result receiving means 47, a storage device 48, an authentication result transmitting means 49, and a service providing means 50.

The storage device 48 stores, in advance, the user name, password, IP address assigned to the wireless terminal, IP address of the server 1 and IP address of the server 2 for the user who directly authenticates the server. It is remembered.

The communication control means 42 extracts data from the IP packet received by the communication means 41 and writes the data and the source IP address in the recording device 48.
If the received data is a connection request, it notifies the IP address comparison means 43 that the connection request has been received, and if it is an authentication request, notifies the authentication data comparison means 45 that the authentication request has been received, In the case of the authentication result, the fact that the authentication result has been received is notified to the authentication result receiving means 47, and in the case of other data, the service providing means 50 is notified.
Further, the communication control means 42 includes a connection request transmitting means 44, an IP address allocating means 46, or an authentication result receiving means 4
When a request for data transmission is made from the authentication result transmitting means 49 or the service providing means 50, the transmission destination address and the transmission data are read from the storage device 48, an IP packet is created and transmitted from the communication means 41.

When notified that the connection request has been received from the communication control means 42, the IP address comparing means 43 reads the connection request data from the storage device 48, and reads the IP address of the server which performs authentication in the data of the connection request. Is compared with the IP address of the own server. If the addresses are equal, the authentication data comparing means 45 is notified that the server is a server for performing authentication. If not equal, the own server is notified to the connection request transmitting means 44. Notify that the server is not an authenticating server.

When notified that the server itself is not the server performing the authentication, the connection request transmitting means 44 transmits the user name of the wireless terminal, the password, the ID of the wireless terminal, and the connection request as transmission data. The IP address of the base station is written into the storage device 48, the IP address of the server that performs authentication in the connection request data is written as the IP address of the transmission destination, and a request is made to the communication control means 42 for data transmission.

When the authentication data comparison means 45 is notified by the IP address comparison means 43 that the server itself is a server for performing authentication, the connection request is stored in the user name and password stored in the storage device 48 in advance. Check if there is a user name and password in, and if so,
A request for IP address assignment is made to the IP address assigning means 46. If there is no IP address assignment request, a connection response including the wireless terminal ID and a use rejection message is created as transmission data and written in the storage device 48, and the IP address of the transmission destination is written. The IP address of the base station that has transmitted the connection request is written as the address, and the communication control unit 42 is requested to transmit data. When the communication control unit 22 notifies the authentication data comparison unit 45 that the authentication request has been received, the storage device 48
Check if there is a user name and password stored in advance that match the user name and password in the authentication request.
If not, a storage denial message is stored in the storage device 48.
To the authentication result transmitting means 49.

When receiving an IP address allocation request from the authentication data comparing unit 45 or the authentication result receiving unit 47, the IP address allocating unit 46 stores the IP address for allocation to the wireless terminal stored in the storage unit 48 in advance. Is assigned to the wireless terminal, and the assigned IP address and the ID of the wireless terminal are written in the storage device 48. Further, the connection response including the IP address assigned as the transmission data, the ID of the wireless terminal, and the use permission message is written in the storage device 48, and the IP address of the base station that transmitted the connection request as the transmission destination IP address is written. It writes the data and requests the communication control means 42 to transmit data.

The authentication result receiving means 47 is a communication control means 4
2 is notified that the authentication result has been received, determines whether or not use is permitted. If the use is permitted, requests the IP address allocating means 46 to allocate an IP address. A connection response composed of a message of denial of use is created and written in the storage device 48, and the IP address of the base station that has transmitted the connection request is written as the IP address of the transmission destination, thereby requesting the communication control means 42 to transmit data.

Upon receiving the notification from the authentication data comparing unit 45, the authentication result transmitting unit 49 sets the ID of the wireless terminal,
The IP address of the base station and the use permission or refusal message written in the storage device 48 are written in the storage device 48 as transmission data, and the IP address of the source of the authentication request is written in the storage device 48 as the destination address for communication. It requests the control means 42 to transmit data.

The service providing means 50 includes the communication control means 4
When notified that the data has been received from 2, the processing specified by the received data is performed, response data is created, and the communication control unit 42 is notified.

Next, the operation of this embodiment will be described with reference to FIG. 1, FIG. 2, FIG. 3, FIG. 4, FIG. FIG. 5 is a flowchart illustrating the operation of the server that receives the connection request, and FIG. 6 is a flowchart illustrating the operation of the server that receives the authentication request.

When communication start, a user name and a password are input from the input / output means 26, the input / output control means 25 writes these in the storage device 27. Connection request transmitting means 24
Transmits a connection request including an IP address of a server that performs authentication stored in the storage device 27 in advance, an ID of a wireless terminal, a user name written in the storage device 27 by the input / output control unit 25, and a password. It is created and transmitted from the wireless communication means 21.

When the wireless communication means 31 receives the connection request transmitted by the wireless terminal, the connection request relay means 35 of the base station uses the received connection request as transmission data and converts the IP address stored in the storage device 34 in advance. An IP packet is created using the IP address of the server to be assigned as the destination address, and transmitted from the wired communication unit 33.

The communication control means 42 of the server stores the connection request data received by the communication means 41 and the IP address of the base station which transmitted the connection request data in the storage device 48 (step 501).

The IP address comparing means 43 compares the IP address of the server performing the authentication in the data of the connection request with the IP address of the own server (step 502). It is determined whether or not (step 503).

When the IP address comparing unit 43 determines that the server that performs the designated authentication of the wireless terminal is its own server, the authentication data comparing unit 45 stores it in the storage unit 48 in advance.
It is checked whether or not there is any authentication data stored in the connection request that matches the authentication data in the connection request (step 51).
0) If there is a match, it is determined that the user of the wireless terminal has the right to use the network. If there is no match, the wireless terminal ID and the use refusal message are included as transmission data. A connection response is created and written in the storage device 48, and the IP address of the base station that has transmitted the connection request is written as the IP address of the transmission destination, thereby requesting the communication control means 42 to transmit data (step 50).
9).

If it is determined that the user of the wireless terminal has the right to use the network, the IP address assigning means 46 assigns an IP address to the wireless terminal (step 5).
07), assigned IP address and wireless terminal ID
Is stored in the storage device 48, and the ID of the wireless terminal, the IP address assigned to the wireless terminal, and the data of the connection response including the use permission message are written in the storage device 48 as transmission data, and the IP address of the transmission destination is written. And writes the IP address of the base station into the storage device 48. The communication control unit 42 creates an IP packet from the transmission data written in the storage device 48 and the destination IP address, and transmits the IP packet from the communication unit 41 (step 508).

If the IP address comparing means 43 determines that the server performing the authentication designated by the wireless terminal is not its own server, the authentication request transmitting means 44 sends the wireless terminal ID, user name, password And the authentication request data including the IP address of the base station that transmitted the connection request is written into the storage device 48 as transmission data, and the IP address of the server performing authentication in the connection request data as the destination IP address is stored in the storage device. Write to 48.
The communication control unit 42 creates an IP packet from the transmission data written in the storage device 48 and the destination IP address, and transmits the IP packet from the communication unit 41 (step 504).

The communication control means 42 of the server which has received the authentication request writes the received authentication request into the storage device 48 (step 601). The authentication data comparison unit 45 checks whether the user name and password of the wireless terminal in the authentication request are included in the user name and password stored in the storage device 48 in advance (step 602). Writes the user permission message to the storage device 48 if there is no user permission message. The authentication result transmitting means 49 creates an authentication response including the ID of the wireless terminal, the IP address of the base station in the authentication request, and a message indicating whether or not the authentication is available, and writes it in the storage device 48. An IP packet with the server that has transmitted the request as the destination and the authentication response as the transmission data is created and transmitted from the communication means 41 (steps 604 and 605).

Upon receiving the authentication response, the communication control means 42 of the server writes the authentication response including a message indicating whether or not use is possible in the storage device 48 (step 505). The authentication result accepting unit 47 determines whether or not the use is permitted. If the use is rejected, the connection response including the wireless terminal ID and the use rejection message is created as transmission data, written in the storage device 48, and the IP address of the destination is transmitted. As a result, the IP address of the base station that transmitted the connection request is written, and a request for data transmission is made to the communication control means 42 (step 509). If the use is permitted, the IP address assignment means 46 is requested to assign an IP address. . IP address assigning means 46
Assigns, to the wireless terminal, one of the IP addresses to be assigned to the wireless terminal, which is stored in the storage device 48 in advance, and writes the assigned IP address and the ID of the wireless terminal to the storage device 48 as transmission data. Assigned i
The connection response including the P address, the ID of the wireless terminal, and the use permission message is written in the storage device 48, and the IP address of the base station that transmitted the connection request as the destination IP address
It writes the address and requests the communication control means 42 to transmit data (step 508).

Upon receiving the connection response from the wired communication unit 33, the communication control unit 31 of the base station transmits the received connection response to the wireless terminal through the wireless communication unit 32.

When the connection response receiving means 23 of the wireless terminal receives the connection response from the communication means 21, it determines whether or not the network can be used. Notifies the control means 25, and if the use is permitted, the I
The P address is stored in the storage device 27, the IP address to which the IP address is assigned is stored in the storage device 27,
The communication control means 22 and the input / output control means 25 are notified that the P address has been assigned.

Thereafter, when the transmission data and the IP address of the transmission destination are written into the storage device 27 by the input / output control unit 25, the communication control unit 22 of the wireless terminal creates an IP packet and transmits it from the wireless communication unit 21. .

The communication control means 31 of the base station transmits the IP packet received from the wireless communication means 32 from the wired communication means 33. At this time, if the transmission destination of the IP packet is outside the LAN to which the base station is connected, the wired communication unit 33 sends the IP address to the router MA stored in the storage device 34 in advance.
The C address is read and an IP packet is transmitted to the router.

Upon receiving the IP packet from the communication means 41, the communication control means 42 of the server receives the received data in the IP packet and the IP address of the wireless terminal of the source of the IP packet.
The address is written into the storage device 48 and the service providing means 50 is notified. The service providing unit 50 performs a process specified by the received data, creates response data, and notifies the communication control unit 42 of the response data. The communication control unit 42 creates an IP packet from the response data and the IP address of the wireless terminal, and transmits the IP packet from the communication unit 41.

The communication control means 31 of the base station receives the IP packet containing the response data from the wired communication means 33,
It is transmitted from the wireless communication means 32.

When the communication control means 22 of the wireless terminal receives the IP packet containing the response data from the wireless communication means 21, it extracts the response data from the IP packet and writes it in the storage device 27. The input / output control unit 25 reads the response data from the storage device 27 and outputs the response data from the input / output unit 26.

In this embodiment, when connecting to the network, the wireless terminal specifies a server for user authentication, and when a server other than the specified server receives a connection request from the wireless terminal, Since the specified server requests authentication, the user of the wireless terminal does not need to register the authentication data in the servers of all networks to be moved.

FIG. 7 is a sequence diagram showing the operation of the present embodiment.

In the network shown in FIG. 1, for example, when the authentication data of the user of the wireless terminal 5 is registered in the server 2 and the wireless terminal 5 is connected to the LAN 13,
First, the user of the wireless terminal 5 starts communication and outputs the user name and password from the input / output unit 26. The input / output control unit 25 stores the input user name and password in the storage device 2
7 and notifies the connection request transmitting means 24. The connection request transmitting unit 24 transmits a connection request including the IP address of the server 2 that performs authentication, the ID of the wireless terminal 5, the user name of the wireless terminal 5, and a password to the base station 3 (Step 701).

Upon receiving the connection request from the wireless communication means 32, the connection request relay means 35 of the base station 3 creates an IP packet in which the IP address of the server 1 is used as the destination IP address and the connection request is used as transmission data. Is transmitted from the wired communication means 33 (step 702).

Upon receiving the connection request from the communication means 41, the communication control means 42 of the server 1 stores the received connection request and the IP address of the base station 3 which transmitted the connection request in the storage device 48. The IP address comparing means 43 compares the IP address of the server performing authentication in the connection request with the IP address of the server 1 itself, and determines whether the server performing authentication specified by the wireless terminal 5 is the server 1 itself. In this case, since the IP address of the server that performs the authentication describes the IP address of the server 2, it is determined that the server 1 is not the server that performs the authentication, and the authentication request transmitting unit 44 determines the ID of the wireless terminal 5 and IP of base station 3
The authentication request including the address, the user name of the wireless terminal 5, and the password is written to the storage device 48 as transmission data. The communication control means 42 creates an IP packet and sends it to the server 2 (step 703).

Upon receiving the authentication request transmitted by the server 1, the communication control means 42 of the server 2 stores the received data and the IP address of the server 1 in the storage device 48 and notifies the authentication data comparison means 45. The authentication data comparing unit 45 checks whether or not the user name and password of the wireless terminal 5 in the received authentication request in the user name and password stored in the storage device 48 in advance.
In this case, since the user name and the password of the wireless terminal 5 are written in the storage device 48, the authentication data comparing unit 45 stores the use permission message in the storage device 48, and the authentication result transmitting unit 49 Notify. The authentication result transmitting means 49 stores the use permission message, the ID of the wireless terminal 5 and the IP address of the base station 3 as transmission data, and stores the IP address of the server 1 as a destination IP address in the storage device 48, and performs communication control. Then, the communication control means 42 creates an IP packet and transmits it from the communication means 41 (step 704).

Upon receiving the authentication response transmitted from the server 2 by the communication means 41, the communication control means 42 of the server 1 stores the received data in the storage device 48 and notifies the authentication result receiving means 47. The authentication result accepting unit 47 checks whether the use permission message in the authentication response is a use permission or a use rejection. In this case, since the use permission message is written, it is notified to the IP address assignment means 47. The IP address assigning means 47 assigns an IP address to the wireless terminal 5, stores a set of the assigned IP address and the ID of the wireless terminal 5 in the storage device 48,
D, a connection response composed of an IP address assigned to the wireless terminal 5 and a use permission message is stored in the storage device 48 as transmission data, and the IP address of the base station 3 is stored in the storage device 48 as a transmission destination address for communication control. The means 42 is notified. The communication control means 42 creates an IP packet and transmits it from the communication means 41 (step 705).

Upon receiving the connection response from the wired communication unit 33, the communication control unit 31 of the base station 3 transmits the received connection response to the wireless terminal 5 from the wireless communication unit 32 (Step 706).

Upon receiving the connection response from the communication unit 21, the communication control unit 22 of the wireless terminal 5 stores the received connection response in the storage device 48 and notifies the connection response receiving unit 23. The connection response receiving unit 23 checks whether the message indicating whether or not the connection is available in the connection response is permission or rejection. In this case, since the use permission message is used, the connection response receiving means 23 stores the IP address assigned by the server 1 in the storage device 27 and communicates with the input / output control means 25 that communication is possible. Notify the means 22.

When the IP address is assigned, the communication control means 22 of the wireless terminal 5 uses the input / output control means 25 to store the transmission data and the IP address of the server 2 in the storage device 27.
After that, an IP packet is created and transmitted from the wireless communication unit 21.

The communication control means 31 of the base station 3 transmits the IP packet received from the wireless communication means 32 to the wired communication means 33.
Send more. At this time, since the server 2 is outside the LAN 13 to which the base station 3 is connected, the wired communication unit 33 reads the MAC address of the router 10 stored in the storage device 34 in advance, and transmits an IP packet to the router 10.

Upon receiving the IP packet from the communication means 41, the communication control means 42 of the server 2 receives the received data of the IP packet and the IP address of the wireless terminal 5 which has transmitted the IP packet.
The address is written into the storage device 48 and the service providing means 50 is notified. The service providing unit 50 performs a process specified by the received data, creates response data, and notifies the communication control unit 42 of the response data. The communication control unit 42 creates an IP packet from the response data and the IP address of the wireless terminal, and transmits the IP packet from the communication unit 41.

The communication control means 31 of the base station 3 receives the IP packet containing the response data from the wired communication means 33 and transmits it from the wireless communication means 32.

When receiving the IP packet containing the response data from the wireless communication unit 21, the communication control unit 22 of the wireless terminal 5 extracts the response data from the IP packet and writes it in the storage device 27. The input / output unit 25 reads the response data from the storage device 27 and outputs the response data from the input / output unit 26.

Although the above embodiment is for a case where there are two LANs, the present invention can be applied to a case where there are three or more LANs.

[0068]

As described above, according to the present invention, a user of an endless terminal specifies a server to be authenticated by a wireless terminal when connecting to a network, and the server performs the authentication in accordance with the designation of the terminal. If authentication data is registered in one server by requesting authentication, there is an effect that it is not necessary to register the authentication data in a server in a destination network.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of a network according to an embodiment of the present invention.

FIG. 2 is a block diagram showing a configuration of wireless terminals 5 to 9 in FIG.

FIG. 3 is a block diagram showing a configuration of base stations 3 and 4 of FIG.

FIG. 4 is a block diagram showing a configuration of servers 1 and 2 in FIG. 1;

FIG. 5 is a flowchart of an operation for receiving a connection request from servers 1 and 2 according to the embodiment of FIG. 1;

FIG. 6 is a flowchart of an operation of receiving an authentication request from servers 1 and 2 according to the embodiment of FIG. 1;

FIG. 7 is a sequence diagram showing an operation of the embodiment of FIG. 1;

[Explanation of symbols]

1, 2 server 3, 4 base station 5-9 wireless terminal 10, 11 router 12 public network 13, 14 LAN 21 wireless communication means 22 communication control means 23 connection response receiving means 24 connection request transmitting means 25 input / output control means 26 input Output unit 27 Storage device 31 Communication control unit 32 Wireless communication unit 33 Wired communication unit (LAN) 34 Storage device 35 Connection request relay unit 41 Wired communication unit (LAN) 42 Communication control unit 43 IP address comparison unit 44 Authentication request transmission unit 45 Authentication data comparing means 46 IP address allocating means 47 Authentication result receiving means 48 Storage device 49 Authentication result transmitting means 50 Service providing means 501-511, 601-605, 701-706
Steps

Claims (5)

[Claims] 1. A plurality of LANs, a plurality of routers corresponding to each LAN, and a public network, wherein each LAN is connected to each other via the public network by a corresponding router,
Each LAN is a method for authenticating a wireless terminal in a wireless network including a server, a base station, and one or more wireless terminals, wherein the wireless terminal, when connecting to the network, Authentication data including the user name and password of the user of the wireless terminal, and transmits a connection request consisting of a network address of a server that authenticates the user of the wireless terminal, the server is sent by the wireless terminal, Receiving the connection request relayed by the base station, if the server performing authentication in the connection request is its own server, perform direct authentication, and send a connection response as an authentication result to the wireless terminal via the base station. If the server performing the authentication during the connection request is not its own server, the authentication data during the connection request and the network of the server performing the authentication are transmitted to the server performing the authentication. Requesting authentication by transmitting an authentication request consisting of a network address and a network address of the base station that relayed the connection request, and when receiving an authentication request from another server, authenticates itself and performs Returning an authentication response including the ID, the authentication result, and the network address of the base station that relayed the connection request to the server that has requested the authentication,
A method for authenticating a wireless terminal in a wireless network, wherein the server receiving the authentication response returns a connection response as an authentication result to the wireless terminal via the base station. 2. A plurality of LANs, a plurality of routers corresponding to each LAN, and a public network, wherein each LAN is connected to each other by the corresponding router via the public network,
Each LAN is an authentication method of a wireless terminal in a wireless network including a server, a base station, and one or more wireless terminals. Each server has its own IP address, the IP address of another server, and the use of the wireless terminal. Authentication data including the user name and password of the user is stored in advance, and each base station stores the IP address of the server in its own LAN,
Each wireless terminal stores in advance the MAC address of a router connected to the wireless terminal. When communication is started and a user name and a password are input, each wireless terminal performs an authentication process based on an IP address of a server that performs authentication, an ID of the wireless terminal, Creates a connection request including authentication data including the user name and the password, and transmits the connection request to a base station in the own LAN.When each base station receives the connection request, the received connection request is used as transmission data, An IP packet is created using the IP address of the server to which the IP address is assigned as the destination address, and transmitted to the server in the own LAN. When each server receives the IP packet, the IP of the server that performs authentication in the packet is received. The wireless terminal compares the address with the IP address of its own server. If the server performing the authentication specified by the wireless terminal is its own server, it is stored in advance. The authentication data in the IP packet is checked to see if there is one that matches the authentication data, and if there is a match, it is determined that the user of the wireless terminal has the right to use a network; IP to the wireless terminal
An IP packet is created by assigning an IP address, a connection response comprising the IP address, the ID of the wireless terminal, and a use permission message as transmission data, and creating an IP packet using the IP address of the base station as a destination IP address. If the authentication data transmitted to the terminal and the authentication data stored in advance does not match the authentication data in the IP packet, a connection response including an ID of the wireless terminal and a message of denial of use is created, Send to the base station that sent the connection request, if the server specified by the wireless terminal is not its own server,
Create authentication request data including the ID of the wireless terminal, the user name, the password, and the IP address of the base station that sent the connection request, and use the data as transmission data, and perform authentication in the data of the connection request. When an IP packet is created and transmitted using the IP address of the server performing the authentication as the destination IP address, and the authentication request is received from another server, the authentication data included in the authentication request is stored in the authentication data stored in advance. Check if there is a match, and if there is a match, match the ID of the wireless terminal, the IP address of the base station in the authentication request, and the authentication response including the use permission message. If there is nothing to perform, an authentication response including the ID of the wireless terminal, the IP address of the base station requesting the authentication, and a message of denial of use is created, and the authentication is made. The server that has transmitted the request is a destination, creates and transmits an IP packet that uses the authentication response as transmission data, and, when receiving the authentication response, if the authentication response includes a message of denial of use, the wireless terminal I
Create a connection response consisting of D and a message of denial of use,
The connection request is transmitted to the base station that has transmitted the request, and if the authentication response includes a use permission message, a connection response including the wireless terminal ID and the use permission message is created, and the base station that transmits the connection request is transmitted. A method for authenticating a wireless terminal in a wireless network to be transmitted to a station. 3. A plurality of LANs, a plurality of routers corresponding to each LAN, and a public network. Each LAN is connected to each other via the public network by a corresponding router.
An AN in a wireless network including a server, a base station, and one or more wireless terminals, wherein the wireless terminal includes an ID of the wireless terminal, the authentication data including a user name and a password of a user of the wireless terminal, Connection request transmitting means for transmitting to the base station a connection request including an IP address of a server for performing authentication of a user of the wireless terminal; and an ID of the wireless terminal in response to the connection request.
And a connection response receiving unit for receiving a connection response message comprising a network availability message and an IP address assigned to the wireless terminal, wherein the base station is included in the same LAN as the base station. A storage device that stores in advance an IP address of a server that assigns an IP address to a wireless terminal, a MAC of a router connected to the LAN, and a server that assigns an IP address to a connection request received from the wireless terminal. And a connection request relay means for transmitting a connection response received from the router to the wireless terminal, wherein the server has a user name, a password, and a wireless terminal of a user who directly authenticates the server. IP to assign to
And a storage device that stores the IP address of the own server and the IP address of the other server in advance, and, when notified that the own server is not the server performing the authentication, the authentication data in the connection request and the network of the server performing the authentication. An authentication request transmitting unit for requesting transmission of an authentication request including an address and a network address of a base station that relays the connection request to a server performing authentication during the connection request; and an ID of the wireless terminal and the base station. An authentication result transmitting unit for requesting transmission of an IP address and a use permission or use rejection message to a destination of the authentication request, and a wireless device stored in the storage device when receiving a request for IP address assignment. One of the IP addresses to be assigned to the terminal
IP address assigning means for requesting transmission of a connection response including the assigned IP address, ID of the wireless terminal, and a use permission message to the base station that transmitted the connection request; When notified that the server is to perform authentication, it is checked whether the user name and password in the connection request are among the user names and passwords stored in the storage device. Requests the IP address assignment means to assign an IP address; if not, creates a connection response including the wireless terminal ID and a message of denial of use, and transmits the connection response to the base station that sent the connection request Request,
Further, when notified that the authentication request has been received, it is checked whether or not the user name and password stored in the storage device match the user name and password in the authentication request. An authentication data comparing unit for notifying the authentication result transmitting unit, and an IP of a server for performing authentication in the connection request data when notified that the connection request has been received.
The address is compared with the IP address of the server. If the addresses are equal, the authentication data comparing means is notified that the server is a server for authentication. If the addresses are not equal, the server is authenticated to the connection request transmitting means. Address comparison means for notifying that the server is not a server that performs
The communication means for receiving the P packet and transmitting the IP packet, and being notified that the authentication result has been received, judges whether the use is permitted or rejected. Requesting the allocation and, if the use is rejected, an authentication result receiving means for creating a connection response comprising the ID of the wireless terminal and the message of the use rejection, and requesting transmission of the connection response to the base station which transmitted the connection request; Extracting data from the received IP packet, notifying the IP address comparing means that the connection request has been received if the data is a connection request, and authenticating the authentication result receiving means if the data is an authentication result. Notifying that the result has been received, and transmitting data from the authentication request transmitting means, the IP address allocating means, the authentication result receiving means, or the authentication result transmitting means. When transmission is requested, the wireless network characterized by having a communication control means for transmitting from said communication means to create an IP packet. 4. The wireless terminal further includes an input / output unit for inputting a communication start, a user name of a user of the wireless terminal, and a password, and the connection response receiving unit receives the connection response during the connection response. In the case of use rejection, the message is notified to the input / output means, and in the case of use permission, the fact that an IP address has been assigned is notified to the input / output means. The wireless network according to claim 3, which notifies. 5. When the server is notified from the communication control means that data other than a connection request, an authentication request, and an authentication result has been received, the server performs a process instructed by the received data and generates response data. The wireless network according to claim 3, further comprising a service providing unit that notifies the notification control unit of transmission of the response data.