KR20040001343A - Wireless LAN connection apparatus and method for net connection certification in public wireless LAN system - Google Patents

Abstract

PURPOSE: A wireless LAN access apparatus for network access authentication in a public wireless LAN system and a method therefor are provided to access various APs(Access Points), which a plurality of service providers provide, through a single program. CONSTITUTION: A wireless LAN access apparatus for network access authentication comprises a user interface part(61), an IEEE802.1x access processing part(62), an HTTP processing part(63), and a network interface part(64). The user interface part(61) provides an interactive interface for a user. The IEEE802.1x access processing part(62) executes IEEE802.1x authentication procedures in case that IEEE802.1x authentication is required. The HTTP processing part(63), if a DHCP(Dynamic Host Configuration Protocol)_Offer message is received, executes web-based authentication, as judged that IEEE802.1x authentication is not required.

Description

Wireless LAN connection apparatus and method for network connection authentication in public wireless LAN system {Wireless LAN connection apparatus and method for net connection certification in public wireless LAN system}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a wireless LAN access device for network access authentication in a public wireless LAN system, and a method and a computer readable recording medium storing a program for realizing the method. The present invention relates to a wireless LAN access device for accessing an access point of a public WLAN service provided by a plurality of service providers, and a method thereof and a computer-readable recording medium recording a program for realizing the method.

A wireless LAN is a network service provider that establishes a wireless LAN access point (AP) and access network in public places, densely populated areas, homes, offices, and users. ) Is a service that accesses the Internet through a wireless LAN access point installed by a service provider with a password and password. In particular, these services are not limited to one access point, but can be accessed in all regions where the same service provider provides the services.

Recently, each telecommunication service provider has been installing wireless LAN access points competitively at subway stations, fast food restaurants, cafes, and government offices to promote public wireless LAN projects, and there is a possibility of sharing these access points among operators in the future. However, because each service provider is different in the way of authenticating the user and allowing access, if the user wants to access the access point of another service provider, the user must install a dedicated access program of each company and follow the corresponding authentication procedure.

For public wireless LAN access, the user's ID and password should be transmitted to the network access control device according to the authentication procedure provided by each service provider. The network access control apparatus sends the ID and password received from the user to the authentication server to check whether the user is a legitimate user, and then allows or denies the user's network access according to the result. This user authentication process can be performed in various ways depending on the implementation method, but public WLAN access authentication mainly uses two methods.

That is, the IEEE802.1x based method for determining access based on a port in a WLAN access point and the user ID / password transmission method through a web page provided on a web in a router or a gateway.

These methods are used differently for each public WLAN provider, and thus there is an inconvenience in that users must use different access clients according to different access methods when sharing WLAN access points between operators.

The present invention has been proposed to solve the above problems, and a WLAN access device and method for accessing an access point (AP) of public WLAN services provided by a plurality of service providers with one program. And a computer readable recording medium having recorded thereon a program for realizing the above method.

1 is a conceptual view of a public wireless LAN service network to which the present invention is applied.

2 is a conceptual view of a public WLAN service providing function element to which the present invention is applied.

Figure 3 is a public wireless LAN access procedure of the IEEE802.1x method related to the present invention.

4 is a public wireless LAN access procedure diagram of a web-based authentication method related to the present invention.

5 is an IEEE802.1x and Web-based simultaneous authentication procedure according to the present invention.

Figure 6 is a configuration diagram of an embodiment of a WLAN access point for network access authentication in a public WLAN system according to the present invention.

7 is a flowchart illustrating a wireless LAN access method for network access authentication in a public wireless LAN system according to the present invention.

* Explanation of symbols for the main parts of the drawings

61: user interface unit 62: IEEE802.1x connection processing unit

63: HTTP processing unit 64: network interface unit

In accordance with another aspect of the present invention, there is provided a wireless LAN access device for network access authentication in a public wireless LAN system. The user access means for receiving user information for network access authentication, and showing an authentication process and a result. ; In order to detect an authentication scheme provided by an AP (Access Point) network, a first network access authentication request message is transmitted to the AP, and according to the first network access authentication response message from the AP, IEEE802. First authentication means for performing .1x based network access authentication; In order to detect an authentication scheme provided by the AP side network, a second network access authentication request message is transmitted to the AP side, and the web-based network access of the user information is performed according to the second network access authentication response message from the AP side. Second authentication means for performing authentication; And network connection means for accessing a network and transmitting and receiving authentication-related messages of the first and second authentication means.

The present invention also provides a wireless LAN access method for network access authentication applied to a public wireless LAN system, comprising: a first step of receiving, by a terminal, user information after establishing a connection with an access point (AP); A second step of transmitting, by the network access program of the terminal, a network access authentication request message to the AP to detect an authentication scheme provided by the network of the AP; And a third step of accessing the network through IEEE802.1x based network access authentication or web based network access authentication of the user information according to the network access authentication response message from the AP side.

The present invention also provides a public wireless LAN system including a processor, comprising: a first function of receiving user information after a terminal establishes a connection with an access point (AP); A second function of transmitting, by the network access program of the terminal, a network access authentication request message to the AP to detect an authentication scheme provided by the AP side network; And a program for realizing a third function for accessing the network through IEEE802.1x based network access authentication or web based network access authentication of the user information according to the network access authentication response message from the AP side. Provides a record medium that can be.

On the other hand, the access control and authentication method for public wireless LAN access is represented by a web authentication method using a port-based authentication method proposed by IEEE802.1x and a separate connection control server. The net-based authentication method controls the user's network access at the port, which is the user access point, and the web authentication method controls the network access at the gateway or router. In addition, these methods differ in the method of exchanging authentication related information with a user because the location and method of access control are different.

Therefore, the method proposed in the present invention is characterized by performing an authentication procedure suitable for the corresponding access method by determining what the authentication method provided by the access point or the network to access from the user's access program. However, the user is not aware of what each type of connection is.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a conceptual diagram of a public wireless LAN service network to which the present invention is applied.

As shown in FIG. 1, a service provider establishes an access network using a dedicated line 11, an xDSL 12, and the like, and installs an access point 13 for accessing a wireless LAN at an end thereof. User network access control is performed in an access control device configured in the form of an access point or a router or a gateway.

An access point that performs access control based on IEEE802.1x restricts network access to a corresponding subscriber, requests an ID and password information from the user for verification, and delivers the authentication client 16 to the authentication server 16. This is included.

The user attempts to access the network through authentication by transmitting the ID / password to the authentication client through the access program of the user terminal 15. The authentication server 16 processes the authentication request delivered by the authentication client of the access point 13 and transmits the result to the authentication client, and the authentication client determines whether to allow the network connection according to the result. Detailed processing procedures for this will be described with reference to FIG. 3.

On the other hand, network access control through the access control device 14 uses a web browser as a medium for ID and password transmission. In this method, first, the user terminal 15 is assigned an Internet Protocol (IP) address through a Dynamic Host Configuration Protocol (DHCP) and a network connection is made, but the access controller 14 blocks communication with the outside. When the user starts the web browser, the access control device 14 intercepts the http request of the web browser and delivers the authentication page to the user instead of the original request page. The user transmits his ID and password through the authentication page displayed in his browser, and the access control device 14 performs authentication in a manner similar to the access point 13. A detailed processing procedure thereof will be described with reference to FIG. 4 to be described later.

FIG. 2 is a conceptual view of a public WLAN service providing function element to which the present invention is applied, and illustrates functional elements required at a user side and a network side for a public WLAN service.

As shown in FIG. 2, in order to provide a public WLAN service and to use the user, functions related to an access service and an AAA (authorization / authentication / billing) service to user equipment and network elements should be distributed and accommodated in an appropriate location. do.

The user-side function unit 21 including a mobile access function (DHCP), a DHCP service client function (DHCPClientF), EAPF, and a mobile web browsing function (WEBBrowserF) enables the user to associate with an access point through a wireless LAN. It must be able to make a connection, transmit user ID / password for network access authentication (EAP and WEB HTTP), and request a DHCP server for IP assignment and receive an assignment.

The access service function unit 22 including Mobile Access Function (MobileAccessF), Network Management Service Function (NMSF), AccountingF, DHCP Service Server Function (DHCPServerF), Authorization Service Client Function (ASClientF), and WEBServerF is provided by the network operator. Authentication client for restricting indiscriminate user access at the access point, processing authentication request for effective user identification, mechanism for exchanging authentication related information with subscriber terminal (web, EAP, etc.), billing processing according to usage history It should accommodate the accounting function and the allocation and retrieval of network resources.

The AAA service function unit 23 including the NMSF (Network Management Service Function), AccountingF, DBMF (Database Management Function), ASServerF (Authorization Service Server Function), SubsciberMF (Subscriber Management Function), and WEBHostingF (Web Hosting Function) are subscribers. It performs functions such as management, authentication, and billing.

3 is an IEEE802.1x public WLAN access procedure diagram related to the present invention. Among the functions of the access service function unit 22 for subscriber authentication, IEEE802 which can exchange authentication related information with a subscriber station related to the present invention This is a procedure diagram of .1x based EAP-MD5 method. This flowchart describes the IEEE802.1x based procedure, which is one of the methods for authenticating a user's network access.

IEEE802.1x is a method to block the port connection itself, which is the first step for the user to connect to the network, and to allow access to only valid and verified users. This protocol transfers user ID and password based on EAP between user and access control subject and uses MD5 hashing function to secure user information.

4 is a public wireless LAN access procedure diagram of a web-based authentication method according to the present invention. Among the functions of the access service function unit 22 for subscriber authentication, it is possible to exchange authentication related information with a subscriber station related to the present invention. The following shows the web authentication method.

5 is an IEEE802.1x and Web-based simultaneous authentication procedure according to the present invention. The IEEE802.1x-based network access authentication and the web-based network access authentication according to FIGS. 3 and 4 illustrate a single access program. It shows the procedures for the functions that can be performed.

As shown in FIG. 5, the user does not have to be aware of the access point to be connected and the network connection method required by the network. The user starts a single access program and inputs his ID and password to the network. Connect. The access program performs appropriate processing by using a mechanism for identifying information and authentication scheme provided by the user. The processing procedure of this performance method will be described in FIG. 7 to be described later.

6 is a configuration diagram of a wireless LAN access device for network access authentication in a public wireless LAN system according to the present invention.

As shown in FIG. 6, in the WLAN access apparatus for network access authentication according to the present invention, the user interface unit 61 for providing an interactive interface with a user, and the access point to be connected are IEEE802.1x authentication. If the request is received, the IEEE802.1x access processing unit 62 for performing the authentication procedure for this, and when receiving the DHCP_Offer message, it is determined that the access point does not require IEEE802.1x authentication, and performs the web-based authentication An HTTP processing unit 63 and a network interface unit 64 are included.

Here, the user interface unit 61 is a user ID / password input unit 611 for allowing the user to input his or her ID and password for network access authentication, and the user may take appropriate measures when the authentication procedure is not automatically processed. And a web page display unit (browser function) 612 for displaying the received contents so as to take the information, and an access program message display unit 613 for displaying information such as an authentication process, a result, and a usage history.

In addition, the HTTP processing unit 63 analyzes the page in the HTTP response received in response to the HTTP request, and determines whether the page requires a user authentication for network access. Existing judgments are based on predefined protocols or using document analyzers. The Html analyzer 632 is used to separate the common gateway interface (CGI), which is displayed on the web page display (browser function) 612 or processed by itself. If the Html analyzer 631 fails to classify the document, the error processor 633 displays the content of the received document on the screen of the web page display unit 612 or starts a separate web browser.

7 is a flowchart illustrating a wireless LAN access method for network access authentication in a public wireless LAN system according to the present invention.

As shown in FIG. 7, first, a user starts a terminal equipped with a WLAN card and establishes an association with an access point (701). When the connection with the access point is made, a user ID and password to be used in the subsequent authentication process are input in the access window (702).

Subsequently, after the user inputs all necessary information, the access program transmits a DHCP_Discover message and an EAPoL_Start message to detect an authentication method provided by the connected access point network (703). At this time, the counter of the specified time is operated, and it is checked whether a valid response message is received within a predetermined time (704).

As a result of the check (704), if it does not receive a response message (Time-out) and terminates with an error (712), and receives a response message (EAP_Request), the access program is said that the currently connected access point is an access point based on IEEE802.1x authentication. It determines that it is, and performs the processing accordingly. That is, the access program carries its ID on the received response message (EAP_Request) and transmits it (705), and receives the EAP_Request / MD5 Challenge message (706).

Upon receiving the MD5 Challenge message, the access program hashes the user's password and delivers EAP_Response / MD5 Challenge / MD5 Value [password] (707). Subsequently, when authentication is successful by receiving the EAP_Success message from the network (708), the DHCP_Discover message is transmitted to receive an IP address through DHCP (709). Subsequently, upon receiving the DHCP_Offer message, the DHCP_Request message is transmitted (710). If the DHCP_Ack is received (711) and the IP address is assigned, the Internet can be accessed (720).

When the confirmation result 704 receives the response message (DHCP_Offer), it is assumed that the access point is not an IEEE802.1x access point and can be assigned an IP address through DHCP. Then, since the IP control message can be delivered, the DHCP_Request message is transmitted (713).

Subsequently, upon receiving DHCP_Ack and successfully assigning an IP address (714), an HTTP_Request message is transmitted (715) for web authentication or Internet access. In this case, a uniform resource locator (URL) address may be designated as arbitrary. The HTTP_Request message is delivered to the web server with the web authentication page through an access point or access control gateway or redirection proxy.

The web server receives and stores the request and delivers a web page to the requester for exchanging authentication information. When the access program receives this HTTP_Reply, the content is analyzed (716). If the page is a predefined page format for authentication and can identify a parameter capable of passing the ID and password, the ID and password obtained in step 702 are transferred (718). This information is sent to the web server where the authentication page is located and authentication is performed. If authentication is successful, the process proceeds to the process 720 of accessing the Internet, and if authentication fails, the process ends in error (712).

In other cases, a web browser may be launched (717) or a web document display function may be used to display the contents to the user so that the user can appropriately process the content. The access program is considered to have failed.

The method of the present invention as described above may be implemented as a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.).

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

As described above, the present invention has the effect of being able to access an access point of a public WLAN service provided by a plurality of service providers with one access program.

Claims (7)

A wireless LAN access device for network access authentication in a public wireless LAN system, User access means for receiving user information for network access authentication and showing an authentication process and a result; In order to detect an authentication scheme provided by an AP (Access Point) network, a first network access authentication request message is transmitted to the AP, and according to the first network access authentication response message from the AP, IEEE802. First authentication means for performing .1x based network access authentication; In order to detect an authentication scheme provided by the AP side network, a second network access authentication request message is transmitted to the AP side, and the web-based network access of the user information is performed according to the second network access authentication response message from the AP side. Second authentication means for performing authentication; And Network access means for accessing a network and transmitting / receiving authentication-related messages of the first and second authentication means Wireless LAN access device for network access authentication comprising a. The method of claim 1, The first network access authentication request and response message, Wireless LAN access device for network access authentication, characterized in that the EAPoL_Start message and EAP_Request message. The method of claim 1, The second network access authentication request and response message, Wireless LAN access device for network access authentication, characterized in that the DPCP_Discover message and DHCP_Offer message. In a WLAN access method for network access authentication applied to a public WLAN system, A first step of receiving, by the terminal, user information after establishing a connection with an access point (AP); A second step of transmitting, by the network access program of the terminal, a network access authentication request message to the AP to detect an authentication scheme provided by the network of the AP; And A third step of accessing the network through IEEE802.1x based network access authentication or web based network access authentication of the user information according to the network access authentication response message from the AP side; Wireless LAN access method for network access authentication comprising a. The method of claim 4, wherein The network access authentication request message is an EAPoL_Start message and a DPCP_Discover message. The network access authentication response message is a wireless access method for network access authentication, characterized in that the EAP_Request message and DHCP_Offer message. The method according to claim 4 or 5, The third step, Upon receiving the EAP_Request message, the access program determines that the currently connected AP is an IEEE802.1x authentication-based AP, and performs a process according to the WLAN access method. In a public wireless LAN system having a processor, A first function of receiving user information after the terminal establishes a connection with an access point (AP); A second function of transmitting, by the network access program of the terminal, a network access authentication request message to the AP to detect an authentication scheme provided by the AP side network; And A third function of accessing the network through IEEE802.1x based network access authentication or web based network access authentication of the user information according to the network access authentication response message from the AP side A computer-readable recording medium having recorded thereon a program for realizing this.