KR20050002292A - Internet connection system having connection restricting function in wireless local area network and method thereof - Google Patents

Abstract

PURPOSE: A system and a method for selectively connecting a user terminal to the Internet through the wireless LAN having a connection restriction function are provided to restrictedly offer a connection service through the wireless LAN while minimizing network/system load, and offer the connection service customized to user's needs for connecting to only the specified site. CONSTITUTION: A certification processor(210) performs user certification by providing certification information received from the user terminal(100) connected through the wireless LAN to a certification server(500). A storing part(220) stores connection request information, which is the ID information of sites(701-70n) wanted from the user, provided to the certified user terminal from the certification server. A connection controller(230) connects the user terminal to the site corresponding to destination information in case that the destination information is identical with the connection request information by comparing the destination information of a data packet provided from the user terminal with the connection request information stored in the storing part.

Description

Internet connection system having connection restricting function in wireless local area network and method

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a wireless local area network (WLAN), hereinafter referred to as a " wireless LAN ", and more particularly, to an internet access system and a method through a wireless LAN.

In general, a wireless LAN refers to a wireless LAN that transmits and receives data between a computer and a computer or between a computer and other communication devices by using radio frequency (RF) or light. It was developed according to the rapid development of technology. It is mainly installed in places where a wired network is not easy to build or a large floating population such as a large office or a distribution center, and its use is rapidly increasing due to the convenience of no wire and the ease of maintenance.

When accessing the Internet using such a wireless LAN, a user's terminal is generally a wired network (for example, a hub, a switch, a router, etc.) via a wireless access point. It is then connected to the network operator's server via the Internet. After that, the user terminal receives various Internet services from the server of the network operator.

Such a conventional Internet access service through a wireless LAN provides a service that can be accessed to all sites without restriction of the sites that can be accessed, such as a wired LAN service.

However, wireless LAN users of a certain layer often use the wireless LAN for the purpose of accessing a specific site such as checking e-mail or reading a newspaper or news.

In addition, as in the wired LAN, there is a demand for a method of blocking access to a harmful site when accessing the Internet through a wireless LAN.

Therefore, the technical problem to be achieved by the present invention is to provide a limited access service through a wireless LAN.

In addition, the technical problem to be achieved by the present invention is to provide an access service that meets the needs of users who want to access only a specific site.

In addition, the technical problem to be achieved by the present invention is to provide a connection restriction function while minimizing the load on the network and system.

In addition, the technical problem to be achieved by the present invention is to restrict the access to a specific site for specific wireless LAN users.

1 is a network structure diagram of an Internet access system through a wireless LAN according to an embodiment of the present invention.

2 is a detailed structural diagram of an Internet access system via a wireless LAN according to a first embodiment of the present invention.

3 is a flowchart illustrating an internet access process through a wireless LAN according to a first embodiment of the present invention.

4 is an exemplary view illustrating a service subscription processing concept for accessing the Internet through a wireless LAN according to a second embodiment of the present invention.

5 is a flowchart illustrating a subscription process according to FIG. 4.

6 and 7 are exemplary diagrams illustrating an internet access concept through a wireless LAN according to a second embodiment of the present invention.

8 is a flowchart illustrating a process of connecting to the Internet through a wireless LAN according to a second embodiment of the present invention.

The Internet access system according to a feature of the present invention for achieving the technical problem is a system that is connected to the authentication server and the user terminal through a network, and performs the Internet access using a wireless LAN of the user terminal. Specifically, the authentication processing unit for providing the authentication information provided from the user terminal connected through the wireless LAN to the authentication server to perform user authentication; A storage unit storing access request information provided from the authentication server with respect to the authenticated user terminal-identification information of sites requested by the user to connect; And comparing the destination information of the data packet provided from the user terminal with the connection request information stored in the storage unit, and when the destination information matches the connection request information, the user terminal on the Internet corresponding to the destination information. And a connection controller for connecting to the site.

In addition, the Internet access system according to another aspect of the present invention is connected to a plurality of sites through the Internet, a system for controlling the Internet access of the user terminal via a wireless LAN. Specifically, when the subscription information of the user who requested the limited access service from one site is transmitted, a subscription server for generating and assigning a portal ID to the user; An authentication server corresponding to the portal ID and storing subscriber information and access request information which is identification information of the site in correspondence; An authentication processing unit for providing user authentication information including user ID provided from a user terminal connected through the wireless LAN to the authentication server, and access provided from the authentication server to the authenticated user terminal A storage unit for storing request information, and a connection for connecting the user terminal to a site on the Internet corresponding to the destination information when the destination information of the data packet provided from the user terminal and the connection request information stored in the storage unit are identical. It includes an access point including a control unit. Here, when the user ID included in the authentication information provided from the access point is a portal ID, the authentication server provides the access point with access request information corresponding to the portal ID.

The Internet access system of the present invention having such a feature may further include a domain management server providing an IP address of each site. In this case, when the destination information of the packet is a domain name, the access controller receives an IP address for the domain name from the domain management server, and then determines whether the IP address of the destination information matches the access request information. Accordingly, the Internet connection of the user terminal is controlled. At this time, the access request information is the IP address of the site.

In addition, the Internet access method according to another aspect of the present invention, is connected to the authentication server and the user terminal through a network, a method for providing an Internet connection using a wireless LAN of the user terminal.

Specifically, a) providing the authentication information provided from the user terminal connected through the wireless LAN to the authentication server to perform user authentication; b) receiving and storing access request information provided from the authentication server, for example, identification information of sites that the user requests to connect to the authenticated user terminal; And c) connecting the user terminal to a site on the Internet corresponding to the destination information when the destination information of the data packet provided from the user terminal matches the connection request information.

In addition, the Internet access method according to another aspect of the present invention, a) providing the authentication information provided from the user terminal connected via the wireless LAN to the authentication server to perform a user authentication; b) receiving and storing access blocking information provided from the authentication server for the authenticated user terminal-identification information of sites for which the user has requested access blocking; And c) blocking access to a site on the Internet corresponding to the destination information of the user terminal when the destination information of the data packet provided from the user terminal matches the connection blocking information.

In addition, the Internet access method according to another aspect of the present invention is connected to a plurality of sites through the Internet, a method of controlling the Internet access of the user terminal via a wireless LAN using an access point. Specifically, a) if the subscription information of the user who requested the limited access service from the site is transmitted, generating and assigning a portal ID to the user; b) storing subscriber information and access request information, which is identification information of the site, in correspondence with the portal ID; c) if authentication information including a user ID of a user terminal connecting through the wireless LAN is provided from the access point, performing user authentication based on the authentication information; d) determining whether the authenticated user ID is a portal ID; e) when the user ID is a portal ID, transmitting access request information corresponding to the portal ID to the access point; f) extracting, by the access point, destination information included in the data packet when the data packet is transmitted from the user terminal and comparing the connection request information with the connection request information; And g) connecting the user terminal to a site corresponding to the destination information when the destination information of the data packet matches the connection request information.

Here, the portal ID may include a user ID, a separator, and site information. In this case, step d) determines that the user ID is a portal ID when the user ID provided from the access point includes a separator.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention.

1 schematically shows a network structure to which an Internet access system via a wireless LAN according to an embodiment of the present invention is applied.

As shown in FIG. 1, a plurality of user terminals 100 are connected to the access point 200, and the access point 200 is connected to the Internet 400 through the connection device 300, thereby providing an authentication server. 500 and the subscription server 600. In addition, the access point 200 is connected to various sites 701 to 70n on the Internet 400 through the connection device 300, and in addition to the domain management server 800 and the Dynamic Host Configuration Protocol (DHCP) server 900 )

In an embodiment of the present invention, the access information generated from the user terminal 100 is first provided to the access point 200, and the user ID included in the access information provided by the authentication server 500 through the access point 200 and Authentication is performed based on a password (integration of ID and password, called authentication information), and after authentication, information of the site (for example, a uniform resource locator (URL)) requested by the user based on the user's ID is obtained. To the access point 200. Accordingly, the access point 200 controls the site access of the user terminal 100 based on the provided information. For example, if the destination information included in the packet provided from the user terminal 100 corresponds to the address provided from the authentication server 500, the packet is provided to the site corresponding to the destination information, and the destination information is provided to the authentication server ( If the address does not correspond to the address provided by 500), the packet is ignored or redirected to another designated address. Here, the destination information is information on where the packet is delivered, and may be an address such as an IP address, a URL, or the like, and may be another value capable of identifying a destination.

2 shows a specific structure of each component according to the first embodiment of the present invention for such a connection process.

First, referring to the structure of the authentication server 500, as shown in FIG. 2, the authentication server 500 includes an authentication database 510 in which information about a user who can receive an Internet access service through a wireless LAN is stored.

For example, the authentication database 510 may store a password for logging in corresponding to a user ID, and may store information such as a name, an e-mail address, and a contact. In addition, information on sites that a user requests to access in response to the user ID is stored. Hereinafter, for convenience of description, information of sites requesting access to receive access restriction service for each user is referred to as " access request information. &Quot; Here, the connection request information may be a URL or an IP address as identification information of the site, and may also be VLAN domain name information. In addition, it may be a specific character or a value determined to identify a site.

Meanwhile, the access point 200 which communicates with the authentication server 500 and relays the Internet connection of the user terminal 100 receives information provided from the user terminal 100 to which the user terminal 100 is connected, as shown in FIG. Based on the authentication processing unit 210 for requesting user authentication to the authentication server 500, the authentication request user's connection request information provided from the authentication server 500 corresponding to the address (for example, MAC address) of the user terminal is The storage unit 220 is stored, and the access control unit 230 relays a connection to a predetermined site on the Internet of the user terminal 100 based on the connection request information stored in the storage unit 220.

The storage unit 220 stores access request information corresponding to the user terminal address. In addition, a list of IP addresses corresponding to IP addresses for each site address may be stored. This IP address list may be IP addresses previously provided from the domain management server 800 according to the access relay of the access point.

The connection controller 230 analyzes the data packet provided from the user terminal 100 to find the packet destination information, and compares the destination information of the packet with the connection request information corresponding to the user terminal. The address determination unit 232 may include a connection relay unit 233 for providing a corresponding data packet to a corresponding site or discarding the data packet or redirecting to a setting site according to an address comparison result.

On the other hand, the subscription server 600 performs the wireless LAN service subscription processing of the user, and provides the subscription information according to the authentication server 500. In particular, when a user requests an access restriction service according to an exemplary embodiment of the present invention, the user provides the authentication request 500 with the user subscription information.

In addition, the user terminal 100 is a terminal for performing wireless Internet access using the wireless LAN card 110 mounted therein. For example, a notebook computer having a communication port or a PCI slot such as a PCMCIA port or a USB port is provided. Or a desktop computer or a personal digital assistant (PDA). The user terminal 100 is installed with an access program for accessing the Internet through a wireless LAN.

In addition, the connection device 300 for connecting the access point 200 to the Internet includes a router, a switch, a hub, and the like.

The domain management server 800 provides an IP address for the domain name according to the request of the access point 200, and the DHCP server 900 performs IP allocation for the user terminal.

Next, an operation of the Internet access system through the wireless LAN according to the first embodiment of the present invention having such a structure will be described.

In FIG. 3, the access process according to the first embodiment of the present invention is sequentially shown.

When the user terminal 100 enters a basic service set (BBS: Basic Service Set) provided with a wireless LAN service, a connection is established between the WLAN card 110 of the user terminal 100 and the access point 200 (S100 to S110). .

Then, when the user logs on using the access program, the user terminal 100 sends an authentication start message to the network. Upon receiving the authentication start message, the access point 200 sends an ID request message to the user terminal 100. In response, the user terminal 100 includes an ID input by the user and an ID including authentication information including a password. The response message is transmitted to the network (S120).

The access point 200 provides an ID response message to the authentication server 500 through the connection device 300 (S130). The authentication server 500 extracts a user ID from the authentication information included in the ID response message, and then performs authentication based on the user ID (S140). Authentication for the user terminal is made according to the IEEE 802.1x standard protocol, and since this authentication protocol is already known, a detailed description thereof will be omitted.

When authentication is performed, the authentication server 500 searches the authentication database 510 to check whether there is access request information corresponding to the user ID, and if there is access request information, the access point 200 with the authentication result. Transfer to (S150).

The access relay unit 233 of the access point 200 blocks the user's connection if the authentication result is unsuccessful (S160 to S170), and establishes a session if the authentication is successful. That is, the DHCP server 900 which automatically allocates and manages the setting information necessary for executing Transmission Control Protocol / Internet Protocol (TCP / IP) communication allocates an IP address to the user terminal 100. A wireless network for the terminal 100 is configured (S180).

Next, the authentication processing unit 210 of the access point 200 stores the connection request information provided from the authentication server 500 in the storage unit 220, and at this time, the user terminal 100 of the user terminal 100 that can be obtained during the authentication process The access request information is stored in correspondence with the address (S190).

As described above, after the network setting of the user terminal 100 is completed, when the user inputs the address of the site to be accessed in the user terminal 100 or selects a site address already input, the destination of the corresponding site address A data packet as information is transmitted to the access point 200. The transmitted data packet includes a user terminal address and destination information of the packet (S200).

The packet analyzer 231 of the access point 200 analyzes the transmitted data packet to determine destination information, and provides the determined destination information and the user terminal address to the address determiner 232. The address determining unit 232 searches the storage unit 220 based on the user terminal address provided from the packet analyzing unit 231 to find the connection request information corresponding to the terminal address, and then the access request information and the destination of the packet. The information is compared, and the comparison result is transmitted to the connection relay unit 233 (S210 to S220).

In the embodiment of the present invention, the access point 200 determines whether the destination information of the packet provided from the user terminal 100 matches the stored access request information according to the processing capability of the access point as follows. Methods can be used.

For example, if the access point is capable of URL identification and processing, the connection request information provided from the authentication server may be the URL of the sites or the VLAN domain name. In this case, the access point 200 compares the URL corresponding to the destination information of the packet provided from the user terminal 100 with the URL corresponding to the access request information, and controls the user's access to the site according to the match.

Alternatively, if the access point can only handle the IP address level, the connection request information provided from the authentication server may be the IP addresses of the sites. In this case, the access point 200 requests the IP address corresponding to the destination information of the packet to the domain management server 800 and accordingly compares the IP address of the received destination information with the IP address corresponding to the access request information. After that, the user accesses the site according to the match. At this time, the access point 200 first searches whether there is an IP address corresponding to the destination information of the packet in the list of IP addresses stored in the storage unit 220, and then, if there is no corresponding IP address, the domain management server. In step 800, an IP address corresponding to the destination information may be requested.

Meanwhile, even though the access point processes only the IP address level, the access request information provided from the authentication server may be a URL. In this case, the access point may receive an IP address corresponding to the URL of the access request information from the IP address list of the domain management server 800 or the storage unit 220 and compare it with the IP address corresponding to the destination information of the packet.

In addition, when a user directly inputs an IP address of a site address to be accessed without inputting a URL or the like, the access point 200 immediately transmits a packet without requesting an IP address to a domain management server as described above. The user accesses the site according to whether or not the IP address, which is the destination information, and the IP address of the connection request information obtained as described above match.

In step S220, when the destination information of the packet provided from the user terminal 100 does not correspond to the connection request information, the connection relay unit 233 does not connect to the site where the user terminal 100 corresponds to the destination information. Do not handle it. Specifically, the packet is discarded or redirected to a setting site (a separate site set to be connected if a user wants to connect to a site other than a site to which access is allowed) rather than a site corresponding to destination information (S230). .

Meanwhile, when the destination information of the packet provided from the user terminal 100 corresponds to the user's connection request information, the packet transmitted from the user terminal 100 is transferred to the corresponding site so that the user terminal is connected to the site. (S240).

As described above, in the first embodiment of the present invention, since the connection to the specific site is made without changing the existing network structure, the limited access to the specific site is minimized while minimizing the load on the network and the system. Is done.

In the first embodiment described above, when a user subscribes to a wireless LAN access service, a plurality of sites to be accessed are registered, and then the user's Internet access is selectively selected according to whether the address of the site and the registered address match. Alternatively, the user may access only one site.

In the second embodiment of the present invention, a user is allowed to access only one site, and in particular, it is possible to apply for access restriction service through wireless LAN as described above through one site, It is a technology that makes it possible to connect only to the site at the time of wireless LAN connection using ID.

Since the structure of the Internet access system through the wireless LAN according to the second embodiment of the present invention is the same as the first embodiment described above, a detailed description thereof will be omitted.

First, a description will be given of a process in which a user applies for an access restriction service through a specific site. In FIG. 4, an access restriction service subscription process according to a second embodiment of the present invention is conceptually illustrated, and the process is sequentially illustrated in FIG. 5.

When a user connects to a specific site (for example, 701) affiliated with an access restriction service according to an embodiment of the present invention, and applies for a connection restriction service that can access only the site 701 when using a wireless LAN, the site 701 ) Transmits the user's subscription information (for example, user information such as name, social security number, password, etc.) to the subscription server 600 (S300 to S310).

The subscription server 600 stores subscription information transmitted from the site 701 and generates and gives a portal ID to the user by using the subscription information (S320 ?? S330). The portal ID is an ID that is distinguished from an ID that a user applies for when a user subscribes to a general WLAN access service. The portal ID is the user ID (the ID applied for the wireless LAN access service or the ID subscribed at the site), the delimiter, and the site information (the site to which the user applied for access restriction service, that is, the site that the user wants to access. Identifier). For example, the portal ID may be composed of a user ID ID1, a separator @, and site information Site_1, and may be displayed as "ID1 @ Site_1".

Next, the subscription server 600 transmits a part of the received subscription information and the portal ID to the authentication server 500 for authentication and charging, and the authentication server 500 corresponds to the portal ID in the authentication database 510. The subscriber information and the access request information (for example, the URL or IP address of the site where the user applied for the access restriction service) are stored (S340 to S350).

As such, after the process of the user applying for and subscribing to the access restriction service through the specific site is completed, the user receives the access restriction service through the wireless LAN using the portal ID.

6 and 7 conceptually illustrate an access process using a portal ID according to the second embodiment of the present invention, and the process is sequentially illustrated in FIG. 8.

6 and 8, when the user runs the access program on the user terminal 100 at a place where the WLAN access service is provided, and then enters the portal ID and password, the first described above The portal ID and password input as in the embodiment are provided to the access point 200, and the authentication server 500 performs authentication using the ID provided from the access point 200 (S400 to S440).

Thereafter, the authentication server 500 determines whether the authenticated ID is a portal ID (S450). In this case, it is determined whether the ID is a portal ID or a general ID according to whether a separator (@) is included in the transmitted ID.

In the case of a general ID instead of a portal ID, only the authentication confirmation information is provided to the access point 200 so that the user terminal 100 can be connected to the Internet by the access point 200 in the same manner as the conventional wireless LAN connection process. (S460). In this case, the user can freely access any site on the Internet.

However, if the ID transmitted in step S450 is a portal ID, the authentication database 510 is searched to find access request information corresponding to the portal ID, and transmitted to the access point 200 together with the authentication confirmation information (S450). S470).

As in the first embodiment, the connection relay unit 233 of the access point 200 blocks the user's connection if the authentication result is failed (S480 to S490), and sets a session if the authentication is successful (S500). When the session is established, the access relay unit 233 stores the access request information corresponding to the address of the user terminal that inputs the portal ID to the storage unit 220 (S510).

Then, when the data packet is transmitted from the user terminal 100, the access relay unit 233 of the access point 200 is the destination of the packet and the connection request information corresponding to the address of the user terminal of the storage unit 220 Only when the information is matched, the user's Internet connection is made (S520 to S560). Here, the method of determining whether or not the connection request information and the destination information of the packet match is the same as in the first embodiment described above, and thus a detailed description thereof will be omitted.

For example, as illustrated in FIG. 8, when the user inputs "ID1 @ Site_1" as the portal ID, the destination information of the data packet transmitted from the user terminal 100 matches the address of Site1 (Site_1). Only pass the data packet to the site, if it doesn't match, ignore it or redirect to another configuration site. In this case, a user having a portal ID of ID2 @ Site_2 cannot connect to site 1 (Site_1), but only to site2 (Site_2).

Thus, the user can access only one site. In addition, it is possible to easily distinguish a user who wants to receive a restricted access service by giving a portal ID including information of a site requesting a connection to be used for wireless LAN access.

Meanwhile, in the first and second embodiments described above, the access restriction service for registering a site address where a user requests access and thus allowing the access point to access only the registered site is described. The user may register a site address for requesting access blockage, and then block access if the address for which the user requests access corresponds to a registered site address. To this end, the authentication database 510 stores and stores corresponding site addresses (access blocking information) for each user. Next, the authentication server 500 provides the access blocking information of the user after the authentication process to the access point 200, which accesses the data packet provided from the user terminal 100 as described above. Analyze As a result of the analysis, if the destination information corresponds to the access blocking information, the user terminal 100 discards the packet or redirects to another setting site so that the user terminal 100 cannot access the site corresponding to the destination information. Such a method may be easily implemented by those skilled in the art based on the embodiments described above, and thus detailed description thereof will be omitted.

The access request information and the access blocking information described above may be collectively referred to as access restriction information. Therefore, according to an embodiment of the present invention, the user terminal may be selectively connected to or blocked from the site corresponding to the access restriction information according to whether the destination information of the data packet provided from the user terminal matches the access restriction information.

In addition, in the above-described embodiment, the Internet access authentication is performed through the wireless LAN based on the ID input by the user. Alternatively, the access authentication may be performed through the address (MAC address) of the user terminal. Since this authentication process is already known technology, a detailed description thereof will be omitted.

Although the preferred embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

According to this embodiment of the present invention, only a connection to a site where a wireless LAN user requests access is made, thereby providing a specialized access service that meets the needs of users who want to access only a specific site.

In addition, limited access to specific sites can be achieved while minimizing network and system load.

In addition, since the usage fee can be lowered according to limited access than when all sites are allowed to access the wireless LAN, the wireless LAN users can use the wireless LAN access service at a lower cost.

In addition, it is possible to easily calculate statistical data indicating how many user terminals attempted to access a restricted site for each setting period (for example, one day) from the access point, and characteristics of which users mainly use which sites. Analysis can be made easily.

In addition, among the wireless LAN users, minors can be easily blocked from accessing harmful sites.

Claims (10)

In the system connected to the authentication server and the user terminal through a network, and performs the Internet access using the wireless LAN of the user terminal An authentication processing unit for providing user authentication information provided from a user terminal connected through the wireless LAN to the authentication server to perform user authentication; A storage unit storing access request information provided from the authentication server with respect to the authenticated user terminal-identification information of sites that the user requests to connect to; And The destination information of the data packet provided from the user terminal is compared with the connection request information stored in the storage unit, and when the destination information matches the connection request information, the user terminal is a site on the Internet corresponding to the destination information. Connection controller Internet access system via a wireless LAN comprising a. The method of claim 1 The authentication server, after performing authentication, finds the connection request information of the user from a database in which the access request information is stored for each user and provides the access point to the access point via the wireless LAN. In a system that is connected to a number of sites through the Internet, and controls the Internet access of the user terminal through a wireless LAN A subscription server for generating and assigning a portal ID to the user when the subscription information of the user who requested the restricted access service is transmitted from one site; An authentication server corresponding to the portal ID and storing subscriber information and access request information which is identification information of the site in correspondence; An authentication processing unit for providing user authentication information including user ID provided from a user terminal connected through the wireless LAN to the authentication server, and access provided from the authentication server to the authenticated user terminal A storage unit for storing request information, and a connection for connecting the user terminal to a site on the Internet corresponding to the destination information when the destination information of the data packet provided from the user terminal and the connection request information stored in the storage unit are identical. An access point comprising a control unit Including, The authentication server And an access request information corresponding to the portal ID to the access point when the user ID included in the authentication information provided from the access point is the portal ID. The method of claim 3, The portal ID is a system for accessing the Internet through a wireless LAN including a user ID, a separator, and site information. The method of claim 4 And the authentication server determines that the user ID is a portal ID when the user ID provided from the access point includes a delimiter. The method according to claim 1 or 3 Further includes a domain management server providing the IP address of each site, When the destination information of the packet is a domain name, the access controller receives an IP address for the domain name from the domain management server, and then the user according to whether the IP address of the destination information matches the access request information. Control the Internet access of the terminal, The access request information is an Internet access system through a wireless LAN which is an IP address of a site. In the Internet access method of the system connected to the authentication server and the user terminal through a network, providing an Internet connection using a wireless LAN of the user terminal a) providing authentication information provided from a user terminal connected through the wireless LAN to the authentication server to perform user authentication; b) receiving and storing access request information provided from the authentication server, for example, identification information of sites that the user requests to connect to the authenticated user terminal; And c) connecting the user terminal to a site on the Internet corresponding to the destination information when the destination information of the data packet provided from the user terminal matches the connection request information; Internet access via a wireless LAN comprising a. In the Internet access method of the system connected to the authentication server and the user terminal through a network, providing an Internet connection using a wireless LAN of the user terminal a) providing authentication information provided from a user terminal connected through the wireless LAN to the authentication server to perform user authentication; b) receiving and storing access blocking information provided from the authentication server, for example, identification information of sites for which the user has requested access blocking, for the authenticated user terminal; And c) blocking access to a site on the Internet corresponding to the destination information of the user terminal when the destination information of the data packet provided from the user terminal matches the connection blocking information; Internet access via a wireless LAN comprising a. In a method of controlling access to the Internet of a user terminal through a wireless LAN using an access point connected to a plurality of sites through the Internet a) generating and assigning a portal ID to the user when subscription information of the user who requested the limited access service is transmitted from the site; b) storing subscriber information and access request information, which is identification information of the site, in correspondence with the portal ID; c) if authentication information including a user ID of a user terminal connecting through the wireless LAN is provided from the access point, performing user authentication based on the authentication information; d) determining whether the authenticated user ID is a portal ID; e) when the user ID is a portal ID, transmitting access request information corresponding to the portal ID to the access point; f) extracting, by the access point, destination information included in the data packet when the data packet is transmitted from the user terminal and comparing the connection request information with the connection request information; And g) connecting the user terminal to a site corresponding to the destination information when the destination information of the data packet matches the connection request information; Internet access via a wireless LAN comprising a. The method of claim 9 The portal ID includes a user ID, a separator, and site information. In step d), if the user ID provided from the access point includes a separator, determining that the user ID is a portal ID.