KR20060039793A - Apparatus and method for processing authentication in wireless network system - Google Patents

Abstract

The present invention relates to authentication processing in a wireless network system. When authentication is required for accessing a wireless Internet service of an arbitrary wireless terminal, an authentication request for a wireless Internet service is performed via wireless, and authentication for a wireless Internet service is performed. An authentication processing apparatus and method in a wireless network system for transmitting result information according to the processing to a wireless terminal through a wireline are proposed.

Wireless network system, authentication processing, wired

Description

Authentication processing device and method thereof in wireless network system {APPARATUS AND METHOD FOR PROCESSING AUTHENTICATION IN WIRELESS NETWORK SYSTEM}

1 is a block diagram illustrating a wireless network system according to an embodiment of the present invention.

FIG. 2 is a diagram for showing a detailed block diagram of the wireless terminal shown in FIG. 1; FIG.

FIG. 3 is a diagram for showing a detailed block diagram of the access point shown in FIG. 1; FIG.

4 is a flowchart illustrating an authentication processing method in a wireless network system according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100, 110: wireless terminal 200: access point

400: authentication server 410: authentication DB

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to authentication processing in a wireless network system. More particularly, the present invention relates to authentication processing in a wireless network system which prevents leakage of result information according to authentication processing for a wireless terminal connected to the wireless network system. An apparatus and a method thereof are provided.

In general, terminals such as personal computers, personal digital assistants, notebook computers, and the like are connected to a local area network (hereinafter, referred to as a "LAN") to share various types of data or information with each other.

Such a LAN system may be classified into a wired LAN system and a wireless LAN system according to whether a terminal can be moved.

The wired LAN system shares information and resources in a fixed place through a cable, which is inconvenient to move because it is connected by wire, and requires professional cable work during installation. In addition, the wired LAN system takes a long time to maintain, causing many inconveniences such as interrupting work.

A wireless LAN system refers to a system that performs communication between wireless terminals through radio media using radio frequency or light. This wireless LAN system has been developed in recent years due to the rapid development of Internet service and wireless communication technology. It is installed in a place where wired network is not easy to establish, maintenance and repair such as network connection between buildings or large office or distribution center. Because of its simplicity, its use is soaring.

The wireless terminal belonging to the wireless LAN accesses the corresponding network equipment through the access point in order to communicate with the network equipment belonging to the wired LAN.

Accordingly, the network equipment undergoes an authentication process to confirm whether the user of the wireless terminal connected through the access point is a legitimate object. When the user of the wireless terminal is authenticated as a legitimate user, a master session key generated from the network equipment (authentication server) is provided to the access point, and the access point exchanges the master session key with the wireless terminal to provide a key. Synchronize the point of use. The access point encrypts a message indicating that the wireless terminal is allowed to access the wireless LAN with a synchronized master session key and transmits the message to the wireless terminal. The wireless terminal and the access point then secure the communication with each other using the dynamically distributed master session key.

The authentication between the wireless terminal and the access point and the synchronization of the master session key may be performed through the wireless, or by using a separate communication channel (for example, an infrared channel) between the wireless terminal and the access point.

However, when authentication between the wireless terminal and the access point and synchronization of the master session key are performed over the air, there is a problem in that the risk of exposing the master session key to other wireless terminals is large due to the radio openness.

On the other hand, when the authentication between the wireless terminal and the access point and the synchronization of the master session key is made through a separate toin channel, the corresponding channel must be set in the wireless terminal and the access point. The problem of increase arises.

Accordingly, the present invention was devised to solve the above problems, and by transmitting a master session key generated after authentication to a wireless terminal user to the wireless terminal by wire, thereby preventing the leakage of the master session key. An object of the present invention is to provide an authentication processing apparatus and a method thereof.

An authentication processing apparatus in a wireless network system according to an aspect of the present invention for achieving the above object, the authentication for the wireless network service connection when the authentication request message for authentication for wireless network service connection from the wireless network is received. A first unit for requesting processing to the authentication server and transmitting authentication result information for accessing the wireless network service processed by the authentication server to the wired network, and authentication for access to the wireless network service when the wireless network service connection is required And a second unit generating a request message and transmitting the request message to the first unit through the wireless network, and receiving the authentication result information for the wireless network service connection transmitted from the first unit through the wired network.

Preferably, the first unit is a wireless LAN access point, and the second unit is a wireless terminal.

The authentication result information for the wireless network service access is a communication for the wireless Internet service between the first unit and the second unit generated in the authentication server when the authentication for the wireless network service connection of the second unit Security key information for encrypting and decrypting information to be generated in the process is included.

The first unit switches a communication channel from a wireless network to a wired network to perform communication with the second unit through a wired network when the authentication request message is received from the second unit through the wireless network, And a switching control unit for switching the communication channel from the wired network to the wireless network when the transmission of the authentication result information to the second unit through the network is completed.

The switching control unit, a) when the authentication request message is received from the second unit via the wireless network during the communication with the third unit via the wireless network, to the third unit via the wireless network Request communication stop for the wireless Internet service, switch the communication channel from the wireless network to the wired network for communication with the second unit, and b) transmit the authentication result information to the second unit via the wired network. In order to resume communication with the third unit, the communication channel is switched from the wired network to the wireless network, and the third unit is requested to resume communication for the wireless Internet service through the wireless network.

After transmitting the authentication request message to the first unit via the wireless network, the second unit switches a communication channel from the wireless network to the wired network for communication with the first unit, and from the first unit via the wired network. Switching processing unit for switching the communication channel from the wired network to the wireless network when the reception of the authentication result information is completed, when the reception of the authentication result information from the first unit via the wired network is completed, the reception of the authentication result information is completed It includes a display unit for displaying.

On the other hand, in the wireless network system including at least one or more wireless terminals and an access point according to an aspect of the present invention, the authentication method of the access point, the authentication for the wireless network service connection from the first wireless terminal through the wireless network Requesting an authentication process for accessing a wireless network service to a first wireless terminal with an authentication server when an authentication request message for receiving the message is received, wired in a wireless network to perform communication with the first wireless terminal through a wired network. Switching a communication channel to a network; transmitting authentication result information regarding a wireless network service connection to a first wireless terminal processed and received by the authentication server to a first wireless terminal through a wired network; 1When the transmission of the authentication result information to the wireless terminal is completed The communication channel comprises the step of switching from a wired network to a wireless network.

In the authentication processing method according to an aspect of the present invention, the authentication result information for the wireless network connection, the first generated by the authentication server when the authentication for the wireless network service connection of the first wireless terminal Security key information for encrypting and decrypting information to be generated in a communication process for a wireless Internet service between the wireless terminal and the access point.

In the authentication processing method according to an aspect of the present invention, when the authentication request message is received from a first wireless terminal through a wireless network while performing communication for a wireless Internet service with a second wireless terminal through a wireless network, Requesting a communication stop for a wireless Internet service to a second wireless terminal through a wireless network, and switching a communication channel from a wireless network to a wired network for communication with the first wireless terminal, the first wireless terminal through a wired network When the transmission of the authentication result information is completed, the communication channel is switched from the wired network to the wireless network in order to resume communication with the second wireless terminal, and the communication resume for the wireless Internet service is performed to the second wireless terminal through the wireless network. The method further includes the step of requesting.

On the other hand, in a wireless network system including at least one or more wireless terminals and an access point according to another aspect of the present invention, the authentication processing method of a wireless terminal, authentication for wireless network service connection in response to a request for wireless network service connection. Generating and transmitting an authentication request message to the access point via a wireless network, switching a communication channel from a wireless network to a wired network for communication with the access point via a wired network, and wireless Internet access from a wireless terminal Switching the communication channel from the wired network to the wireless network when the authentication result information for the service connection is completed through the wired network.

In the authentication processing method according to another aspect of the present invention, the authentication result information for accessing the wireless network service is accessed with the wireless terminal generated in the authentication server when the wireless network connection of the wireless terminal is authenticated. It includes security key information for encrypting and decrypting information to be generated in the communication process for the point-to-point wireless Internet service.

The authentication processing method according to another aspect of the present invention may further include displaying completion of the reception of the authentication result information when reception of the authentication result information from the access point is completed through a wired network.

Hereinafter, an authentication processing apparatus and method thereof in a wireless network system according to the present invention will be described in detail with reference to the accompanying drawings.

In addition, it should be noted that the same reference numerals are given to the same elements, although belonging to different drawings for convenience of understanding.

1 is a block diagram of a wireless network system according to an embodiment of the present invention.

As shown in FIG. 1, a wireless network system includes an authentication server 400 including wireless terminals 100 and 110, an access point 200, and an authentication database 410.

When the wireless terminal 100 or 110 is not authenticated to receive the wireless Internet service, an authentication request for receiving the wireless Internet service input from the user after a wired connection between the access points 200 is made by the user. Is transmitted to the access point 200 via wireless.

The wireless terminal 100 or 110 transmits an authentication request for receiving a wireless Internet service to the access point 200 via wireless, and then access point 200 for receiving a master session key generated after authentication processing is performed. Switching the communication channel using the inter-wireless communication to the communication channel using the wire, and when the reception of the master session key for the wireless Internet service is completed through the wired communication channel, the communication channel via the wire between the access points 200 is wireless. Switch to the communication channel via.

In addition, the wireless terminals 100 and 110 may be configured to perform authentication processing between the access point 200 received from the access point 200 and any wireless terminal while receiving the wireless Internet service through the access point 200. In response to the communication stop request for the wireless Internet service between 100 and 110, the communication for the wireless Internet service between the access points 200 is stopped, and the authentication process is performed between the access point 200 and any wireless terminal from the access point 200. Is completed, the communication resume request for the wireless Internet service resumes the communication between the access point 200 for the wireless Internet service.

The access point 200 has a wired connection with a wireless terminal requesting to receive a wireless Internet service, and when the authentication request for receiving wireless Internet service from the wireless terminal is wireless, the access point 200 is connected to the wireless terminal over the Internet 300. The authentication server 400 requests the authentication server 400 to determine whether the user of the terminal is a legitimate user for receiving the wireless Internet service.

On the other hand, when the access point 200 is performing communication for the wireless Internet service between the wireless terminal other than the wireless terminal that requested the authentication at the time when the authentication request for the wireless Internet service from the wireless terminal requesting the authentication, Request the communication stop for the wireless Internet service to the other wireless terminal, and switches to the communication channel with a wired connection for authentication between the wireless terminal requesting the authentication.

When the user of the wireless terminal requesting authentication for the wireless Internet service from the authentication server 400 receives the master session key generated by authenticating as a legitimate user for receiving the wireless Internet service, the access point 200 receives the wireless Internet service. The master session key is transmitted through a wired connection to the wireless terminal requesting authentication.

The access point 200 wirelessly switches a communication channel for resuming communication for the wireless Internet service with the other wireless terminal when the transmission of the master session key to the wireless terminal that has requested the authentication is completed, A request for resumption of communication for a wireless Internet service is requested to the other wireless terminal via wireless.

The authentication server 400 is a wireless Internet service that the user of the wireless terminal that requested the authentication by using the authentication information stored in the authentication database (Data Base) 410 when there is an authentication request for the wireless Internet service through the Internet (300) Judgment of the legitimate user for The authentication information stored in the authentication DB 410 may be ID (ID) information and password information set by the user of the wireless terminal to determine whether the user of the wireless terminal is a legitimate user.

FIG. 2 is a diagram for illustrating a detailed block diagram of the wireless terminal illustrated in FIG. 1.

As shown in FIG. 2, the wireless terminal 170 includes a MAC processing unit 150, a PHY processing unit 152, an RF processing unit 154, a switching unit 156, a wired connection unit 158, and a wireless terminal control unit 160. ) Is included.

  The wired connection unit 158 provides a channel for receiving a master session key, which is generated by authenticating a user of the wireless terminal 170 as a legitimate user for the use of the wireless Internet service by the authentication server, via the access point. Here, the wired connection unit 158 may be implemented as a wired cable having a connection terminal.

The wireless terminal controller 160 generates an authentication request message when there is a request for the wireless Internet service from the user of the wireless terminal 170, thereby generating the MAC processor 150, the PHY processor 152, the RF processor 154, and the switching unit. The wireless terminal 170 transmits to the access point providing an area for wireless Internet service where the wireless terminal 170 is located, and controls the switching unit 156 to switch to be connected to the wired control unit 158.

In addition, the wireless terminal controller 160 transmits the information of the master session key received from the access point to the wired connection unit 158 to the switching unit 156, the RF processing unit 154, the PHY processing unit 152, and the MAC processing unit 150. If provided through, the switching unit 156 is controlled to disconnect the wired connection 158 and the RF processing unit 154 to switch so that the antenna and the RF processing unit 154 is connected. Hereinafter, the information transmitted from the wireless terminal controller 160 passes through the MAC processing unit 150, the PHY processing unit 152, the RF processing unit 154, and the switching unit 156, and is received by the wireless terminal control unit 160. The information to be passed through the switching unit 156, RF processing unit 154, PHY processing unit 152, MAC processing unit 150.

In addition, when the recipient of the master session key information is completed, the wireless terminal controller 160 notifies the user of completion of reception of the master session key information through display means (not shown).

The wireless terminal controller 160 receives any data received from the access point from the access point while performing communication for the wireless Internet service with the access point providing the area for the wireless Internet service where the wireless terminal 170 is located. In response to the communication interruption request for the wireless Internet service between the wireless terminals 170 for the authentication process for the wireless terminal, the communication for the wireless Internet service is stopped, and the authentication process for any wireless terminal is completed from the access point. Upon resumption of communication for the Internet service, communication with the access point is resumed for the corresponding wireless Internet service.

The MAC processor 150 performs a data link through a media access control (MAC) protocol.

The PHY processing unit 152 converts the frame format information provided from the MAC processing unit 150 into an analog format and provides it to the RF processing unit 154, and converts the analog format information into a frame format and provides the MAC processing unit 150. do.

The RF processing unit 154 receives and processes information of the RF signal through the switching unit 156, converts the information of the analog signal format provided from the RHY processing unit 152 into an RF signal, which is a high frequency signal, and provides it to the switching unit 156. do.

The switching unit 156 performs a switching operation for the connection between the antenna and the RF processing unit 154 and the wired connection unit 158 and the RF processing unit 154 under the control of the wireless terminal controller 160.

FIG. 3 is a diagram for illustrating a detailed block diagram of the access point illustrated in FIG. 1.

As shown in FIG. 3, the access point 260 includes a wired connection unit 248, a switching unit 250, an RF processing unit 252, an RHY processing unit 254, a MAC processing unit 256, and a control unit 258. Include.

The wired connection unit 248 provides a channel for transmitting the master session key generated by authentication by the authentication server to the first wireless terminal for the wireless Internet service to the first wireless terminal. Here, the wired connection 248 may be implemented as a wired cable having a connection terminal.

The control unit 258 is a case where the authentication request for the wireless Internet service received from the first wireless terminal via the wireless via the switching unit 250, RF processing unit 252, PHY processing unit 254 and MAC processing unit 256 In addition, the authentication request for the use of the wireless Internet service of the first wireless terminal is requested to the authentication server through the Internet, and the switching unit 250 is controlled to switch for the connection between the wired connection unit 248 and the RF processing unit 252.

The controller 258 receives the master session key information from the MAC processing unit 256 and the PHY processing unit 254 when the master session key generated by authentication of the use of the wireless Internet service is received by the authentication server. When the transmission of the master session key information to the first wireless terminal is completed via the RF processing unit 252 and the wired connection unit 248 by wire, the control unit 250 controls the switching unit 250 and the antenna. Switching for the connection between the RF processing unit 252. Hereinafter, the information transmitted from the control unit 258 passes through the MAC processing unit 256, the PHY processing unit 254, the RF processing unit 252, and the switching unit 250, and the information received by the control unit 258 is switched. It is assumed that the processor 250 passes through the RF processor 252, the PHY processor 254, and the MAC processor 256.

The control unit 258 stops communication for the wireless Internet service to the second wireless terminal when an authentication request for the use of the wireless Internet service is received from the first wireless terminal while performing communication for the wireless Internet service with the second wireless terminal. And the switching unit 250 performs a switching operation to connect the wired connection unit 248 and the RF processing unit 252.

In addition, when the transmission of the master session key to the first wireless terminal is completed, the controller 258 causes the switching unit 250 to perform a switching operation for the connection between the antenna and the RF processor 252 and through the antenna. A request for resuming communication for a wireless Internet service with a second wireless terminal is requested to the second wireless terminal.

 The MAC processor 256 performs a data link through a media access control (MAC) protocol.

The PHY processor 254 converts the frame format information provided by the MAC processor 256 into an analog format and provides the RF format to the RF processor 252, and converts the analog format information into a frame format and provides the MAC format to the MAC processor 256. do.

The RF processing unit 252 receives and processes information of the RF signal through the switching unit 250, converts the information of the analog signal format provided from the RHY processing unit 252 into an RF signal, which is a high frequency signal, and provides it to the switching unit 250. do.

The switching unit 250 performs a switching operation for the connection between the antenna and the RF processing unit 252 and the connection between the wired connection unit 248 and the RF processing unit 252 under the control of the control unit 258.

4 is a flowchart illustrating an authentication processing method in a wireless network system according to an embodiment of the present invention.

As shown in FIG. 4, the access point 450 communicates with the second wireless terminal 454 for wireless Internet service (S400).

The user of the first wireless terminal 452 connects the wired connection unit (not shown) provided in each of the first wireless terminal 452 and the access point 450 to use the wireless Internet service. ) And a wired connection is made between the access point 450 (S402).

The first wireless terminal 452 includes the authentication request for the use of the wireless Internet service by the user in the authentication request message and transmits it to the access point 450 over the air (S404), and by the authentication server (not shown) In order to receive the master session key generated by authentication of the use of the wireless Internet service, the communication channel between the access points 450 is switched to a communication channel through a wired connection having a communication channel using wireless (S406).

When the access point 450 receives an authentication request message for using the wireless Internet service from the first wireless terminal 452 via wireless, the access point 450 requests to stop the communication for the wireless Internet service between the second wireless terminals 454. Switching to a communication channel through a wired connection having a communication channel using wireless for wired transmission of the master session key generated by authentication of the first wireless terminal 452 by the authentication server to the first wireless terminal 452. (S408).

The access point 450 requests an authentication server to authenticate the use of the wireless Internet service of the first wireless terminal 452 through the Internet, and authenticates the use of the wireless Internet service of the first wireless terminal 452 by the authentication server. When the generated master session key is received from the authentication server, it is stored in its database (not shown) (S410).

The access point 450 includes the master session key information received from the certificate in the authentication response message and transmits it to the first wireless terminal 452 through a wired communication channel formed between the access point 450 and the first wireless terminal 452. (S412). Accordingly, when the first wireless terminal 452 receives an authentication response message including master session key information from the access point 450 through a wired communication channel formed between the access point 450 and the first wireless terminal 452, the first wireless terminal 452 receives access. Switching from a wired communication channel for communication between points 450 to a wireless communication channel.

Thereafter, the access point 450 switches the wired communication channel for communication between the first wireless terminals 452 to a wireless communication channel (S414), and requests a resumption of communication for a wireless Internet service to the second wireless terminal 454. When there is a response to the communication resumption request from the second wireless terminal 454 to perform communication for the wireless Internet service with the second wireless terminal 454 through the wireless communication channel (S416).

Although the present invention has been described in detail only with respect to the described embodiments, it will be apparent to those skilled in the art that various modifications and changes are possible within the technical spirit of the present invention, and such modifications and modifications belong to the appended claims.

As described above, according to the authentication processing apparatus and method in the wireless network system according to the present invention, the wireless terminal by wired to the master session key generated after the authentication is made to the wireless terminal user requesting the wireless Internet service in the wireless network system By transmitting to, it is possible to prevent the leakage of the master session key.

Claims (12)

An authentication processing apparatus in a wireless network system, When an authentication request message for authentication of access to a wireless network service is received through a wireless network, the authentication server requests authentication processing for accessing the wireless network service, and authentication result information for accessing the wireless network service processed by the authentication server. A first unit for transmitting a wired network; If a wireless network service connection is required, an authentication request message for authentication for wireless network service access is generated and transmitted to the first unit through the wireless network, and authentication result information for the wireless network service connection transmitted from the first unit is generated. An authentication processing apparatus comprising a second unit for receiving via a wired network. The method of claim 1, And said first unit is a wireless LAN access point and said second unit is a wireless terminal. The method of claim 1, Authentication result information for the wireless network service access, Security key for encrypting and decrypting information to be generated in the communication process for the wireless Internet service between the first unit and the second unit generated in the authentication server when the second unit is authenticated for wireless network service access Authentication processing device including the information. The method of claim 1, The first unit, When the authentication request message is received from the second unit via the wireless network, the communication channel is switched from the wireless network to the wired network to perform communication with the second unit via the wired network, and the second unit is connected via the wired network. And a switching control unit for switching a communication channel from a wired network to a wireless network when the transmission of the authentication result information is completed. The method of claim 4, wherein The switching control unit, a) when the authentication request message is received from the second unit through the wireless network while performing communication for the wireless internet service with the third unit through the wireless network, Request communication stop, switch communication channel from wireless network to wired network for communication with second unit, b) when transmission of the authentication result information to the second unit through the wired network is completed, switching a communication channel from the wired network to the wireless network to resume communication with the third unit, and wirelessly transmitting to the third unit through the wireless network. Authentication processing device for requesting to resume communication for Internet service. The method of claim 1, The second unit, After transmitting the authentication request message to the first unit through a wireless network, the communication channel is switched from the wireless network to the wired network for communication with the first unit, and the authentication result information is received from the first unit through the wired network. Switching processing unit for switching the communication channel from the wired network to the wireless network when the And a display unit for indicating completion of reception of the authentication result information when reception of the authentication result information from the first unit is completed via a wired network. In the wireless network system comprising at least one or more wireless terminals and an access point, authentication method of the access point, Requesting authentication processing for accessing the wireless network service to the first wireless terminal by the authentication server when an authentication request message for authentication for accessing the wireless network service is received from the first wireless terminal through the wireless network; Switching a communication channel from a wireless network to a wired network to perform communication with the first wireless terminal through a wired network, Transmitting the authentication result information regarding the wireless network service connection to the first wireless terminal processed and received by the authentication server to the first wireless terminal through a wired network; Switching a communication channel from a wired network to a wireless network when the transmission of the authentication result information to the first wireless terminal is completed through a wired network. The method of claim 7, wherein Authentication result information for the wireless network connection, Security for encrypting and decrypting information to be generated during a communication process for a wireless Internet service between the first wireless terminal and the access point generated by the authentication server when the first wireless terminal is authenticated for accessing a wireless network service. Authentication processing method including key information. The method of claim 7, wherein When the authentication request message is received from the first wireless terminal through the wireless network while performing communication for the wireless internet service with the second wireless terminal through the wireless network, the wireless internet service is transmitted to the second wireless terminal through the wireless network. Requesting a communication stop for switching, switching a communication channel from a wireless network to a wired network for communication with a first wireless terminal, When transmission of the authentication result information is completed to the first wireless terminal through a wired network, the communication channel is switched from the wired network to the wireless network to resume communication with the second wireless terminal, and the second wireless terminal is transferred to the second wireless terminal through the wireless network. And requesting to resume communication for the wireless Internet service. In the wireless network system comprising at least one or more wireless terminals and an access point, the authentication processing method of a wireless terminal, Generating an authentication request message for authentication of the wireless network service connection according to a request for the wireless network service connection, and transmitting the authentication request message to the access point through the wireless network; Switching a communication channel from a wireless network to a wired network for communication with an access point via a wired network, Switching the communication channel from the wired network to the wireless network when the authentication result information for the wireless Internet service connection of the wireless terminal from the access point is completed through the wired network. The method of claim 10, Authentication result information for the wireless network service access, Security key information for encrypting and decrypting information to be generated during a communication process for a wireless Internet service between the wireless terminal and the access point generated in the authentication server when the wireless terminal is authenticated for wireless network access. Authentication method. The method of claim 10, And when the reception of the authentication result information from the access point is completed through a wired network, indicating completion of the reception of the authentication result information.

Images