KR100549918B1 - Roaming service method for public wireless LAN service - Google Patents

Abstract

1. TECHNICAL FIELD OF THE INVENTION

The present invention relates to a roaming service method between wireless LAN access devices for a public wireless LAN service, and a computer-readable recording medium recording a program for realizing the method.

2. The technical problem to be solved by the invention

The present invention, by performing authentication and accounting to support roaming in a public wireless LAN service and open a session before re-authentication for the roaming terminal, to provide roaming between APs in the authentication environment to prevent duplicate login and user communication session when roaming To provide a roaming service method between APs for public WLAN services to provide continuity of a computer, and a computer-readable recording medium recording a program for realizing the method.

3. Summary of Solution to Invention

The present invention relates to a roaming service method between WLAN access devices for a public WLAN service applied to a public WLAN roaming system, wherein a wireless terminal logs in from a first WLAN access point AP1 and connects to a network. When moving to a neighboring second WLAN access point (AP2) area on the subnet and requesting a network connection, the second WLAN access point establishes a wireless link, and a roaming information request message is sent to the first WLAN access point. Transmitting the roaming information request message including a MAC address of a terminal attempting to access the roaming information request message ; When the roaming information request message is received, when the first WLAN access device has a session for the corresponding medium access control (MAC), a roaming information response message is returned to the second WLAN access device, and network access management is performed. Sending an accounting termination message to the device to delete the session for the user; Establishing a session and performing MAC authentication when the second WLAN access device receives a roaming information response message; Maintaining, by the second WLAN access point, a session upon successful MAC authentication, and transmitting an ID request message to the wireless terminal when the session fails; If the second wireless LAN access device does not receive an ID response message from the wireless terminal, the session is released. If the second wireless LAN access device receives an ID response message, the second wireless LAN access device transmits an ID response message to the network access management device. Performing extension authentication protocol (EAP) authentication by checking a duplicate login at the device; And allowing the second WLAN access device to maintain a session upon successful EAP authentication, to send an accounting start message to the network access management device, to register a session for the corresponding user, and to release the session when it fails.

4. Important uses of the invention

The present invention is used in public WLAN roaming system.

Wireless terminal, Wireless LAN access point, Redundant login, EAP, MAC

Description

Roaming service method between wireless LAN access devices for public wireless LAN service {Roaming service method for public wireless LAN service}             

1 is an exemplary configuration diagram of a public wireless LAN roaming system to which the present invention is applied.

2A and 2B are flowcharts illustrating an embodiment of a network access and authentication process in an inter-AP roaming service method for a public WLAN service according to the present invention;

* Explanation of symbols for the main parts of the drawings

11: wireless terminal 12: wireless LAN access device 1 (AP1)

13: Wireless LAN access device 2 (AP2) 14: Network access management device

The present invention relates to a roaming service method between wireless LAN access points (AP) for public wireless LAN service and a computer-readable recording medium recording a program for realizing the method, particularly in a public wireless LAN service. By performing authentication and accounting to support roaming and opening sessions before re-authentication for roaming terminals, public wireless LANs provide roaming between APs in authentication environments that prevent duplicate logins and provide continuity of user communication sessions when roaming. The present invention relates to a roaming service method between APs for a service and a computer-readable recording medium storing a program for realizing the method.

As wireless communication services for ISM (Industrial Scientific Medical (frequency band)) bands are licensed, wireless Internet services using wireless LANs are enabled. Wireless LAN, that is, IEEE 802.11, uses the web (WEP) as an authentication and security method.

Web (WEP) is a wireless LAN security scheme that encrypts terminal authentication and wireless section data using a shared secret key called a WEP key between a wireless terminal equipped with a LAN card and a wireless LAN access device (AP). In addition, a method of registering a medium access control (MAC) address of a LAN card in a wireless LAN access device (AP) in advance and allowing access to the AP only for a wireless terminal having a registered MAC address. However, these methods are suitable in the wireless LAN environment, which is the original use of the wireless LAN, but may not be suitable in public wireless LANs.

That is, in the wireless LAN environment, the number of users is limited and it is easy to manage the MAC address list of the AP or set the WEP key. Thus, the above-described method may be used, but the public wireless LAN used by unspecified users in public places In this case, when users use the same WEP, the meaning of authentication and security is lost, and even when authentication is performed through MAC address list management, there is a difficulty in registering MAC addresses of all users for each AP.

Considering the characteristics of public WLAN service, two methods of network access authentication can be used at present. One is the MAC authentication method that authenticates the MAC address delivered in the wireless terminal network access by registering the MAC address list of the AP to the backend server managing the entire service subscribers, not the AP. The other is the port of IEEE 802 LAN. This is an EAP authentication method supported by IEEE 802.1x, a standard for star authentication and security.

Since the existing IEEE 802.11 WLAN AP does not have the function of delivering the MAC address of the wireless terminal to the backend server for MAC authentication, the MAC using the Remote Authentication Dial In User Service (RADIUS) protocol is used for this purpose. Authentication function must be implemented.

EAP authentication is currently a standardized authentication method, which includes EAP-MD5 for authenticating user ID and password and EAP-TLS based on public key. In order to use EAP-MD5 or EAP-TLS authentication, a wireless terminal user must have an access program for this.

delete

Public WLAN service can be used not only notebook but also PDA (Personal Digital Assistants), which is highly mobile. Therefore, roaming service should be provided to maintain the connection even after moving to another AP area. In addition, in order to prevent illegal use by ID theft, simultaneous access to the same user ID should not be allowed.

Therefore, in order to provide a smooth roaming service, a reauthentication procedure should be performed when roaming in consideration of an authentication environment provided with such duplicate login prevention, and there should be no disconnection of sessions when roaming to provide continuity of a communication session of a user.

The present invention has been proposed to solve the above problems, by performing authentication and accounting to support roaming in a public wireless LAN service, by opening a session before re-authentication for the roaming terminal, authentication to prevent duplicate login To provide a roaming service method between APs for public wireless LAN service to provide roaming between APs in an environment and to provide continuity of user communication sessions when roaming, and a computer-readable recording medium recording a program for realizing the method. The purpose is.

In order to achieve the above object, the present invention provides a roaming service method between WLAN access devices for a public WLAN service applied to a public WLAN roaming system, wherein a wireless terminal logs in from a first WLAN access point AP1. After accessing the network, when the network access request is made to the adjacent second WLAN access point (AP2) area on the same subnet, the second WLAN access device establishes a wireless link, and then goes to the first WLAN access device. Transmitting a roaming information request message, wherein the roaming information request message includes a MAC address of a terminal attempting to access the roaming information request message ; When the roaming information request message is received, when the first WLAN access device has a session for the corresponding medium access control (MAC), a roaming information response message is returned to the second WLAN access device, and network access management is performed. Sending an accounting termination message to the device to delete the session for the user; Establishing a session and performing MAC authentication when the second WLAN access device receives a roaming information response message; Maintaining, by the second WLAN access point, a session upon successful MAC authentication, and transmitting an ID request message to the wireless terminal when the session fails; If the second wireless LAN access device does not receive an ID response message from the wireless terminal, the session is released. If the second wireless LAN access device receives an ID response message, the second wireless LAN access device transmits an ID response message to the network access management device. Performing extension authentication protocol (EAP) authentication by checking a duplicate login at the device; And allowing the second WLAN access device to maintain a session upon successful EAP authentication and to send an accounting start message to the network access management device to register a session for the corresponding user, and releasing the session upon failure. It is characterized by.

Meanwhile, the present invention relates to a public WLAN roaming system equipped with a processor, when a network connection request is made from a wireless terminal, the wireless terminal logs in from the first WLAN access point AP1 and accesses the network. adjacent the second WLAN access point (AP2) at the time of wireless connection request to move to the area, and the second wireless LAN connection device is set up a radio link, the first wireless LAN access point to the roaming request message - this time, the roaming The information request message includes a MAC address of a terminal attempting to access the service ; When the roaming information request message is received, when the first WLAN access device has a session for the corresponding medium access control (MAC), a roaming information response message is returned to the second WLAN access device, and network access management is performed. Sending an accounting termination message to the device to delete the session for that user; Establishing a session and performing MAC authentication when the second WLAN access device receives a roaming information response message; A function of the second WLAN access device to maintain a session upon successful MAC authentication and to transmit an ID request message to the wireless terminal in case of failure; If the second wireless LAN access device does not receive an ID response message from the wireless terminal, the session is released. If the second wireless LAN access device receives an ID response message, the second wireless LAN access device transmits an ID response message to the network access management device. Performing extension authentication protocol (EAP) authentication by checking a duplicate login at the device; And the second WLAN access device maintains a session upon successful EAP authentication and transmits an accounting start message to the network access management device to register a session for the corresponding user, and releases the session in case of failure. A computer readable recording medium having recorded a program is provided.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is an exemplary configuration diagram of a public WLAN roaming system to which the present invention is applied.

As shown in FIG. 1, a public wireless LAN roaming system to which the present invention is applied includes a wireless terminal 11 equipped with an IEEE 802.11 wireless LAN card, an AP1 12, an AP2 13, and a hub 14. And a router 15 and a network connection management device 16.

Here, the wireless terminal 11 may be a laptop or portable information terminal (PDA) equipped with a LAN card. The wireless terminal 11 may use MAC authentication or EAP authentication as a network access authentication method. MAC authentication is an authentication method for determining whether to permit access by checking the MAC address of a LAN card transmitted for establishing a wireless link with AP2 13 when a LAN card is inserted into the wireless terminal 11. EAP authentication is an authentication method supported by IEEE 802.1x, a standard for port-specific authentication and security in IEEE 802 LAN, and includes EAP-MD5 for authenticating user ID and password, and EAP-TLS based on public key. .

In public WLAN, network access login and logoff are performed using a network access program that supports the EAP authentication protocol. When roaming to another AP1 (12) while the wireless terminal (11) is logged in, re-authentication should be performed. At this time, the access program of the terminal uses the login information input by the first user without user intervention. Perform reauthentication.

The AP2 13 establishes a wireless link when a network connection request is received from the wireless terminal 11, and transmits and receives a roaming information request message whether the wireless terminal 11 attempts to connect for the first time or whether it has moved from an adjacent AP1 (12). Find out through. The roaming information request message is broadcasted through the Ethernet port of AP2 13, and is processed at the MAC layer so that it cannot be transmitted outside the subnet.

Thus, roaming is done only within the subnet. When the AP2 13 receives the roaming information response from the neighboring AP1 12, the AP2 13 determines the wireless terminal 11 attempting to connect as the roaming terminal to open the session before authentication in order to provide continuity of the session.

The network access management device 16 processes MAC authentication or EAP authentication for the authentication request from AP2 13. At this time, in order to prevent simultaneous use of the same ID, duplicate logins are checked during EAP authentication. When the user logs in using the access program, upon authentication success, the AP sends an accounting start message to the network access management device 16. When the network access management device 16 receives the accounting start message, it registers a session for the corresponding user ID. Subsequently, attempting to log in with the same user ID will fail because the session already exists. When the user logs off the network connection, the AP sends an accounting termination message to the network access management device 16. The network access management device 16 deletes the corresponding user session upon receiving the accounting end message.

2A and 2B are flowcharts illustrating an embodiment of a network access and authentication process in an inter-AP roaming service method for a public wireless LAN service according to the present invention.

As shown in FIGS. 2A and 2B, the wireless terminal 11 logs in from the AP1 12 area and accesses the network, and then moves to the adjacent AP2 13 area (AP1 12 and AP2 13). Are adjacent to each other and are in the same subnet) When a network connection request is made to AP2 13 (201), AP2 13 establishes a link (202) and a roaming information request message is sent to AP1 (12) through an Ethernet port. Brodcast (203). The roaming information request message includes the WLAN card MAC address of the wireless terminal 11 attempting to connect.

AP2 13 then operates the timer (204). In this way, the neighboring AP1 (12) receiving the roaming information request message checks whether there is a session for the corresponding MAC address (205), and if there is an accounting termination message to the network access management device (16) (206), roaming The information response message is sent to the AP2 13 (207). If there is no session for the MAC address, no response message is sent (208).

Accordingly, the network access management device 16 receiving the accounting termination message deletes the session for the user (209). On the other hand, AP2 (13) checks whether or not received a roaming information response message (210), if received, establishes a session for the MAC address (211), and sends a MAC authentication request message to the network access management device 16 (213) ). If the roaming information response message is not received, after the timer expires (212), the MAC authentication request message is sent to the network access management device (16) (213).

Then, the network access management device 16 checks whether the corresponding MAC address is registered in the authentication table (214) and sends the result to the AP2 (13) (215). If the MAC authentication result of the AP2 13 is successful (216), the session is maintained (217), and if it is unsuccessful, the ID request message is sent to the wireless terminal 11 (218).

Subsequently, the wireless terminal 11 receiving the ID request message automatically sends the ID response message to the AP2 13 without user intervention (219). If the AP2 13 does not receive the ID response message (220), the AP releases the session (221) and receives the ID response message to the network access management device (16) (222).

Accordingly, when the network access management device 16 receives the ID response message, the network connection management apparatus 16 checks whether the corresponding ID is registered in the current session (223).

As a result of the check, if a session is already registered, it is determined as a duplicate login and an authentication failure message is sent to the AP2 13 (224). If the session is not registered, an EAP challenge message is sent to the AP2 13 (225). . AP2 13 transmits it to wireless terminal 11 (226) and wireless terminal 11 generates an EAP authentication response and sends it to AP2 13 (227).

The AP2 13 transmits this to the network access management device 16 (228). The network access management device 16 checks the EAP authentication response (229) and sends the authentication result to the AP2 (13) (230). AP2 13 maintains the session (232) if the EAP authentication result is successful (231), and releases the session (232) if it fails. The AP2 13 sends an accounting start message to the network access management device 16 upon successful authentication (234), and the network access management device 16 receiving the registration registers a session for the corresponding user (235).

The method of the present invention as described above may be implemented as a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.).

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

As described above, the present invention provides authentication and accounting to support roaming between APs in a public WLAN service and provides continuity of communication sessions, thereby allowing a user to maintain a communication session between APs in a public WLAN service area. It has the effect of being able to move.

Claims (5)

A roaming service method between WLAN access devices for a public WLAN service applied to a public WLAN roaming system, When the wireless terminal logs in from the first WLAN access point AP1 to access the network and moves to an adjacent second WLAN access point AP2 area on the same subnet to request a network access, the second WLAN access point Setting a wireless link, and transmitting a roaming information request message to the first WLAN access device, wherein the roaming information request message includes a MAC address of a terminal attempting to access ; When the roaming information request message is received, when the first WLAN access device has a session for the corresponding medium access control (MAC), a roaming information response message is returned to the second WLAN access device, and network access management is performed. Sending an accounting termination message to the device to delete the session for the user; Establishing a session and performing MAC authentication when the second WLAN access device receives a roaming information response message; Maintaining, by the second WLAN access point, a session upon successful MAC authentication, and transmitting an ID request message to the wireless terminal when the session fails; If the second wireless LAN access device does not receive an ID response message from the wireless terminal, the session is released. If the second wireless LAN access device receives an ID response message, the second wireless LAN access device transmits an ID response message to the network access management device. Performing extension authentication protocol (EAP) authentication by checking a duplicate login at the device; And Maintaining the session when the EAP authentication succeeds and sending an accounting start message to the network access management device to register a session for the corresponding user; Roaming service method between wireless LAN access devices for a public wireless LAN service comprising a. The method of claim 1, The second wireless LAN access device, When a network connection request is made from the wireless terminal, it establishes a wireless link and determines whether the wireless terminal attempts to connect for the first time or whether the mobile terminal has moved from the first wireless LAN access device through transmission and reception of a roaming information request message. The message is broadcast through the Ethernet port of the second WLAN access point, and upon receiving the roaming information response from the first WLAN access point, the wireless terminal attempting to connect is determined as a roaming terminal to provide continuity of a session. In order to, roaming service method between wireless LAN access devices for a public wireless LAN service, characterized in that for opening the session before authentication. The method according to claim 1 or 2, The second wireless LAN access device, In order to prevent simultaneous use of the same ID, duplicate login checks are performed during EAP authentication, and when the user logs in using the access program and the authentication is successful, sending an accounting start message to the network access management device. Roaming service method between wireless LAN access devices for a public wireless LAN service characterized in that. The method of claim 3, wherein The network connection management device, In response to the authentication request from the second WLAN access point, MAC authentication or EAP authentication is processed, an accounting start message is received from the second WLAN access point, and a session is registered for the corresponding user ID. Roaming service method between WLAN access devices for public WLAN service. In a public wireless LAN roaming system having a processor, When the wireless terminal logs in from the first WLAN access point AP1 to access the network and moves to an adjacent second WLAN access point AP2 area on the same subnet to request a network access, the second WLAN access point Sets a wireless link, and transmits a roaming information request message to the first wireless LAN access device, wherein the roaming information request message includes a MAC address of a terminal attempting to connect ; When the roaming information request message is received, when the first WLAN access device has a session for the corresponding medium access control (MAC), a roaming information response message is returned to the second WLAN access device, and network access management is performed. Sending an accounting termination message to the device to delete the session for that user; Establishing a session and performing MAC authentication when the second WLAN access device receives a roaming information response message; A function of the second WLAN access device to maintain a session upon successful MAC authentication and to transmit an ID request message to the wireless terminal in case of failure; If the second wireless LAN access device does not receive an ID response message from the wireless terminal, the session is released. If the second wireless LAN access device receives an ID response message, the second wireless LAN access device transmits an ID response message to the network access management device. Performing extension authentication protocol (EAP) authentication by checking a duplicate login at the device; And The second WLAN access device maintains the session upon successful EAP authentication and transmits an accounting start message to the network access management device to register a session for the corresponding user, and releases the session in case of failure. A computer-readable recording medium having recorded thereon a program for realizing this.

Images