KR20040001347A - User information encrypted access method for public wireless LAN service - Google Patents

Abstract

PURPOSE: A public wireless LAN access device for encoding user access information is provided to connect an user's wireless LAN card to internet in a service area including an AP(Access Point) by receiving an EAP(Extensible Authentication Protocol) and permitting a network access process. CONSTITUTION: A public wireless LAN access device for encoding user access information includes a controller(33), an user information storage unit(35), a packet generation unit, and a packet transmission unit. The controller(33) controls a network access authentication operation. The user information storage unit(35) stores the user information to perform the network access authentication operation. The packet generation unit generates a network access authentication request message by encoding the user information by means of an EAP-MDA(Message Digest Algorithm) method according to a control operation of the controller(33). The packet transmission unit transmits the network access authentication request message to an AP.

Description

Public wireless LAN access device that encrypted user access information and method thereof {User information encrypted access method for public wireless LAN service}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a public wireless LAN access device in which user access information is secreted, and a method and a computer readable recording medium storing a program for realizing the method. In particular, a notebook or a portable information terminal (PDA) Public wireless LAN access device that has received user name and password from a wireless terminal such as Personal Digital Assistants) and transmits it to a wireless access point (AP) to request network access, and a public wireless LAN access device having the same A method and a computer readable recording medium having recorded thereon a program for realizing the method.

In order to use a wireless LAN service that provides Internet service using a frequency of 2.4 GHz band, a user wirelessly connects using a laptop or PDA in an area where a wireless LAN access device (AP) is installed. In general, in order to check whether a terminal of a registered user who can use a wireless LAN service is used, a method of checking whether a terminal is registered by looking at a media access control (MAC) address of the terminal is used.

However, this method may cause inconvenience in accessing a normal service subscriber when the MAC address of the WLAN card is duplicated and used. In order to solve this problem, a method of providing a service by registering a user ID (ID) and a password in a server and checking the ID and password transmitted through the AP in the WLAN terminal has been proposed. However, this method also has the disadvantage that the user password is exposed on the wireless network. Therefore, the IEEE (Institute of Electrical and Electronics Engineers) established the 802.1x standard to apply various encryption algorithms. I made it.

Therefore, in order to apply this, a method capable of delivering a user ID and password based on an EAP (Extensible Authentication Protocol) standard is required.

The present invention has been proposed in order to meet the above-described demands, and is provided in a terminal such as a laptop or a portable information terminal, and a user who wants to use a wireless LAN service can access the Internet in a service area where an access point (AP) is installed. Public wireless LAN access device and the method and the program for realizing the user access information that allows secure and easy access regardless of the user's OS environment or the type of wireless LAN card in use. Its purpose is to provide a computer readable recording medium having recorded thereon.

1 is an exemplary configuration diagram of a public wireless LAN access system to which the present invention is applied.

2 is a structural diagram of an embodiment of an Internet access program according to the present invention;

3 is an exemplary configuration diagram of a public wireless LAN access device that secretizes user access information according to the present invention.

4 is a flowchart illustrating an embodiment of a method for accessing a public wireless LAN using the user access information according to the present invention.

Figure 5 is a configuration diagram of an upper module of the main processing unit of the public wireless LAN access apparatus according to the present invention.

Figure 6 is a configuration diagram of an embodiment of a lower module of the main processing unit of the public wireless LAN access apparatus according to the present invention.

Figure 7 is a detailed configuration diagram of an embodiment of the EAPoL packet processing unit of the public wireless LAN access apparatus according to the present invention.

* Explanation of symbols for the main parts of the drawings

31: memory 32: adapter information storage unit

33: main processing unit 34: EAPoL packet processing unit

35: user information storage unit 36: packet processing unit

According to an aspect of the present invention, there is provided a public wireless LAN access device that secretizes user access information applied to a public wireless LAN access system, comprising: control means for performing network access authentication related control; User information storage means for storing user information for network access authentication; Packet generation means for generating a network access authentication request message (EAP packet) by encrypting the user information under EAP (Extensible Authentication Protocol) -MD5 (Message Digest Algorithm) method under the control of the control means; And a packet transmission means for transmitting the network access authentication request message to an AP under the control of the control means.

In addition, the present invention is a public wireless LAN access method in which the user access information applied to the public wireless LAN access system, EAP (Extensible Authentication Protocol)-MD5 (Message Digest Algorithm) A first step of generating a network access authentication request message by encrypting the same and then transmitting the same to the AP; A second step of the AP transmitting the network access authentication request message to an authentication server; And comparing, by the authentication server, the MD5 hashed user password of the network access authentication request message with a pre-stored hash value and sending a message to the terminal through the AP to inform the access permission if they match each other. Characterized in that made.

In addition, the present invention, in the public wireless LAN access system having a processor, the terminal encrypts the user information for network access authentication in the EAP (Extensible Authentication Protocol) -MD5 (Message Digest Algorithm) method to the network access authentication request message Generating and transmitting the first function to the AP; A second function of the AP transmitting the network access authentication request message to an authentication server; And comparing, by the authentication server, the MD5 hashed user password of the network access authentication request message with a pre-stored hash value, and if the match is identical, sending a message indicating access permission to the terminal through the AP. A computer readable recording medium having a program recorded thereon is provided.

The present invention is installed in a wireless terminal such as a laptop or PDA, and when a NESPOT subscriber tries to access the Internet in a service area where an AP is installed, the present invention is safe and easy regardless of the user's O / S environment or the type of wireless LAN card being used. Internet access program that can connect. In providing the wireless LAN service, two types of wireless LAN access authentication methods have been used, namely MAC authentication and EAP-MD5 (Message Digest Algorithm) authentication, depending on whether the O / S supports the authentication method. In addition, many obstacles exist in the development of new services such as unified subscriber management or on-site registration.

Therefore, the access method proposed in the present invention not only overcomes all these problems but also provides status information such as network information and usage data amount access time in real time, thereby providing convenience to subscribers in using the service. There is a characteristic.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is an exemplary configuration diagram of a public wireless LAN access system to which the present invention is applied.

As shown in FIG. 1, the public WLAN access system to which the present invention is applied includes a wireless terminal 101 equipped with a WLAN card, a WLAN access point (AP) 102, and an authentication server 103.

As the wireless terminal 101, a laptop or a PDA equipped with a LAN card may be used. The wireless terminal 101 uses the EAP-MD5 method as an authentication method supported by IEEE 802.1x, which is a standard for port-specific authentication and security in the IEEE 802 LAN to secrete a user name and a password.

First, the wireless terminal 101 transmits a message indicating the start of the EAP (104), and the wireless LAN access point 102 sends a response indicating that the wireless terminal 101 is who (105). The wireless terminal 101 transmits an ID directly input by the user to the wireless LAN access point 102 (106), and in the wireless LAN access point 102, the authentication server 103 using the ID received from the wireless terminal 101. The connection is attempted to (107). The authentication server 103 requests the MD5 attempt through the WLAN access point 102 (108, 109), and the wireless terminal 101 transmits the MD5 hashed user password through the WLAN access point 102 through the authentication server 103. (110, 111). The authentication server 103 compares the value stored in the server with the hashed value, and if it matches with each other, sends a message indicating the access permission to the WLAN access point 102 (112) and the WLAN access point 102 Terminal access is allowed (113).

2 is a structural diagram of an embodiment of an Internet access program according to the present invention.

As shown in FIG. 2, the Internet access program according to the present invention is a Windows operating system hardware / software structure, and a part indicated by 201 is a program part proposed by the present invention.

As illustrated in FIG. 2, each component will be described in parts, and the main processing unit 203 is a part for integrated management of each module of a program, and manages whether to grasp the state of each module or exchange input / output data with each other without any problem. If an error occurs, perform the corresponding operation.

In addition, the user interface 202 serves to exchange commands between a user and a program. That is, it allows the user to process the value of the data input by the user and to perform a predetermined task upon mouse click.

In addition, the EAPoL packet processing unit 204 generates and transmits an EAPoL packet for MAP-MD5 authentication described in FIG. 1 or receives a packet generated from an AP, and the packet processing unit 205 communicates general packet data with the AP. It is responsible for transmitting and receiving. The user / adapter information 206 is stored in the form of a file as identification information of the WLAN card to be connected with the information on the current user name and password.

3 is an exemplary configuration diagram of a public wireless LAN access device that secretizes user access information according to the present invention.

As shown in FIG. 3, the public wireless LAN access device that secretizes the user access information according to the present invention may determine whether the terminal is in a state of inputting a user name or password from a user or a state for communicating with an AP. The ability to change or manage the status information, to call the corresponding EAP packet processing function according to each step of the EAP-MD5 authentication scenario, the status window of the program so that the user can know the status of authentication attempts, progress, and results. User interface such as user name / password input function, user's name / password input function, etc., transmit / receive byte count, access time display and calculated value of send / receive speed are displayed on status information window, network status (transmit / receive status, Receiving sensitivity) Main processing unit 33 (these functions proceed with the connection scenario of FIG. 4) to perform functions such as information display and other network information display such as IP address. Is performed as needed.), And it performs the task of receiving and responding to EAPoL message transmitted from AP through Windows library function call while resident in Windows memory while executing program. Acquisition and initialization of WLAN card installation information, and transmission / reception path with user application (IEEE 802.1x terminal-side state transition) by distinguishing EAP type message from other messages among IEEE 802.3 frames through WLAN interface card driver EAPoL packet for performing a prescribed operation while transmitting and receiving a wireless packet with the AP and the packet processing unit 36 for providing a, that is to encrypt the user password securely using the Message Digest Algorithm (MD5) Processing unit 34 and adapter identification information of the wireless LAN card Is a file that stores the information, the adapter information storage unit 32 for storing and managing in memory as a separate data structure read from the main processing unit 33, and stores the user name, password and adapter information previously used It is a file, which is read by the main processing unit and reads when the connection screen is activated, and is output to the screen. When the user presses the [Connect] button, the user information storage unit 35 is configured to store the changed information in a file.

Referring to the operation of the public WLAN access device that secretized the user access information according to the present invention having the structure as described above in detail as follows.

When the program is executed for the first time, the main processor 33 is executed, and the user input wait state. When the user enters his / her username and password and presses the access button, the program transmits a packet (EAPoL-Start in FIG. 1) requesting authentication to the AP, and the module that makes the EAPoL-Start packet is EAPoL. The packet processing part 34 is a packet processing part 36 which transmits an actual packet. In the AP that receives the packet, an EAP-Request / Identify packet is created and sent to the terminal. The data is received by the packet processor 36 and sent to the EAPoL packet processor 34, and the EAPoL packet processor 34 interprets the packet. It sends the EAPoL-Request Identify message to the AP with the user's ID from the main program to send the next packet. In this manner, the AP and the AP exchange information, and the AP, which is confirmed to be a normal subscriber, opens an Internet port to the terminal requesting access, so that the user uses the Internet service. From now on, the main processing unit monitors the packet processing unit, displays the number of packets sent and received in the status information window, and waits for the packet transmission and reception status until the user disconnects. When the user disconnects, send the connection termination message to the AP and wait until the user presses the connect button again.

4 is a flowchart illustrating an embodiment of a method for accessing a public wireless LAN using the user access information according to the present invention.

As shown in Fig. 4, when the program is first started, the state machine is initialized so that the state value becomes a state of 'failure' (401).

The program is registered as an icon in the tray of the window (402). If the user double-clicks the icon, it determines whether the status value is successful (403). If it is successful, the connection status information window appears (407). The status value has a value of 'failure' as it is and a screen for accessing is displayed (404).

Subsequently, if the AP grants access by clicking the access button (405), the IP address of the terminal is updated and the status value is changed to 'success' (406). Through this process, users can use the Internet freely. If the user moves the mouse to the tray icon and presses the right button, the menu is displayed (408). If the [Connect] button is pressed, the service connection screen goes back to the service (404). If the [Disconnect] button is pressed, the connection termination window is displayed. In step 410, the user disconnects when the user presses the [OK] button. In addition, when the [Network Settings] menu is pressed, the connection status information window is displayed on the screen (407) to display or change the current network settings. To exit the program, select the [Exit] menu and end the program.

FIG. 5 is a diagram illustrating an embodiment of an upper module of a main processor of an apparatus for accessing a public wireless LAN according to the present invention.

As shown in FIG. 5, the state transition unit 502 is a state transition unit that performs a series of authentication processes according to the IEEE 802.1x authentication scheme. It determines the validity according to the status, performs the state transition according to each message type, and performs the function of allocating the IP by executing the IP address reassignment command when transmitting the EAP-success message.

The monitoring and communication thread 501 is a thread that is executed independently of the state transition, and receives the EAP message from the packet processing unit, and the received EAP message is stored in the connection list queue class 503 composed of the connection list. 502) to inform the current occurrence of the event, the state transition is responsible for the function of obtaining the EAP message from the queue.

When the authentication request is successful in the state transition, the IP re-request thread 504 is assigned an IP for normal WLAN service use, and when the IP allocation fails, the IP re-request thread 504 is a state transition. It is responsible for transmitting the current session to the AP to terminate the current session.

FIG. 6 is a diagram illustrating an embodiment of a lower module of a main processor of an apparatus for accessing a public wireless LAN according to the present invention.

As shown in FIG. 6, the failed state 602 is an unused state that has not yet connected to a service, displaying a tray icon on the tray bar, initializing user information, and initializing authentication when the user presses the [connect] button of the NESPOT connection window. A transition is made to the authentication start state, which is a step.

On the other hand, the authentication start state 601 is an initial step of performing the authentication process, after storing the user name and password in the memory, and delivers the "EAPoL Start" to the AP through the packet transmission function of the packet processing unit, at this time using the WLAN card It checks the availability status and displays the message accordingly when an error occurs and plays a role to move to the failure status. In addition, when the "EAP Request-Identity" is received from the AP, it moves to the "State-Response-Identity" state 603 which is the next state of the state transition.

The "State-Response-Identity" state 603 is a state in which a "Request-Identity" message is received from the AP. The "State-Response-Identity" state 603 delivers a user name stored in memory to the AP in the form of an EAP message (response-identity), and the " When the EAP Request-MD5-Challenge "message is delivered, it moves to the next state of the state transition," State-Response-MD-5 ". If no response is received from the AP for 10 seconds, the authentication process is treated as a failure. Winning is responsible for the ability to be initialized.

The "State-Response-MD-5" state 604 obtains a hash key through the received message as a state of receiving a "Request-MD5-Challenge" message from the AP, and the "MD-5 Challenge" frame indicates this hash key. And generated by the EAPoL packet processing unit using the user name and password stored in the memory, and transferred to the AP through the EAP-message, and when the EAP-success message is received from the AP, it moves to the authentication success state (605). .

In addition, if an "EAP-Fail" message is received or there is no response from the AP for 10 seconds, the authentication failure is processed, and the state transition is initialized. The authentication success status 605 is a wireless LAN service available status and is assigned an IP, and when the [disconnect] command is executed, a "EAPOL-logoff" message is sent to the AP to terminate service usage. Will be initialized and moved to the failed state.

FIG. 7 is a detailed configuration diagram of an EAPoL packet processing unit in a public wireless LAN access device according to the present invention, which generates an EAP packet frame and an “MD5-Challenge” frame, and encrypts and stores a user password as a file. The decryption function is supported by the main processing unit (main execution program) 701 in the form of a dynamic link library.

The interface processing unit 702 generates a packet frame according to the EAP type for generating the EAP-message, delivers it to the main processing unit 701, and performs an access role for encryption / decryption processing for encrypting and storing a user password as a file. To perform.

The encryption key encryption / decryption processing unit 703 encrypts and returns a password input by the user, and decrypts the encrypted character string using a decryption function.

The EAP-MD5 processing unit 704 generates each EAP-message and generates a "MD5-Challenge" packet using a user password and a hash key.

The method of the present invention as described above may be implemented as a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.).

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

The present invention as described above, by allowing the EAP authentication in the public wireless LAN service to allow network access, to provide a convenient service with a single click to subscribers owning a terminal equipped with a wireless LAN card. It can be effective.

Claims (5)

A public wireless LAN access device that secretizes user connection information applied to a public wireless LAN access system, Control means for performing network connection authentication related control; User information storage means for storing user information for network access authentication; Packet generation means for generating a network access authentication request message (EAP packet) by encrypting the user information under EAP (Extensible Authentication Protocol) -MD5 (Message Digest Algorithm) method under the control of the control means; And Packet transmission means for transmitting the network access authentication request message to an AP under the control of the control means Public wireless LAN access device that secretized the user access information comprising a. The method of claim 1, The AP, The network access authentication request message is transmitted to an authentication server, and the authentication server compares the MD5 hashed user password of the network access authentication request message with a previously stored hash value to inform the access permission of the AP. Public wireless LAN access device that secreted the user access information, characterized in that sent to the terminal via. In a public WLAN access method that secretizes user access information applied to a public WLAN access system, A first step of the terminal encrypting user information for network access authentication by using an EAP (Extensible Authentication Protocol) -MD5 (Message Digest Algorithm) method to generate a network access authentication request message and then transmitting it to the AP; A second step of the AP transmitting the network access authentication request message to an authentication server; And A third step in which the authentication server compares the MD5 hashed user password of the network access authentication request message with a pre-stored hash value and sends a message to the terminal through the AP to inform the access permission if they match each other; Public wireless LAN access method that secretizes the user access information comprising a. The method of claim 3, wherein The AP, The network access authentication request message is transmitted to the authentication server, and the authentication server compares the MD5 hashed user password of the network access authentication request message with a previously stored hash value and informs the access permission if the AP is matched with each other. Public wireless LAN access method of secreting the user access information, characterized in that sent to the terminal via. In a public wireless LAN access system having a processor, A first function of the terminal encrypting user information for network access authentication by using an EAP (Extensible Authentication Protocol) -MD5 (Message Digest Algorithm) method to generate a network access authentication request message, and then transmitting the same to the AP; A second function of the AP transmitting the network access authentication request message to an authentication server; And A third function of comparing the MD5 hashed user password of the network access authentication request message with a pre-stored hash value in the authentication server and transmitting a message indicating access permission to the terminal through the AP if they match each other; A computer-readable recording medium having recorded thereon a program for realizing this.