JP5217837B2 - Radio relay apparatus and attribution management method - Google Patents

Description

  The present invention relates to a wireless relay device, and more particularly to a wireless access point attribution management technique compatible with IEEE 802.1x authentication.

  In order for a wireless LAN terminal to connect to a network via a wireless access point, it is necessary to prove that the wireless LAN terminal is a legitimate terminal with respect to the wireless access point and to belong to this wireless access point. For this certification, IEEE 802.1x authentication is generally used in which authentication is performed with a certificate using a RADIUS server.

  However, the authentication process of IEEE 802.1x authentication is supposed to take about 1 second, and there is a problem that the sound is interrupted when the wireless LAN terminal is in real-time communication such as during a call.

As a solution to this problem, there is a technique called pre-authentication (Non-Patent Document 1). In the pre-authentication, when the wireless LAN terminal belongs to the wireless access point to which the wireless LAN terminal belongs, the wireless LAN terminal detects surrounding wireless access points. Then, IEEE 802.1x authentication is performed with each neighboring wireless access point via the belonging wireless access point, and a PMK (Pairwise Master Key) generated by this authentication is shared with each neighboring wireless access point ( PMK cash). Then, when the wireless LAN terminal performs handover from the belonging wireless access point to another wireless access point, the wireless LAN terminal confirms the PMK shared with the handover destination wireless access point, thereby omitting the IEEE 802.1x authentication. And belong to the wireless access point of the handover destination.
“IEEE Std 802.11i (TM) -2004”, IEEE, July 23, 2004, p. 69-71

  However, when using pre-authentication, every time handover is performed from the wireless access point to which the wireless LAN terminal belongs, in order to confirm the PMK shared between the wireless LAN terminal and the wireless access point of the handover destination, PMK flies over. For this reason, PMK may be intercepted. In this case, an unauthorized terminal impersonates a pre-authenticated wireless LAN terminal using the intercepted PMK and can belong to the wireless LAN access point.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a technique capable of further improving the security of pre-authentication.

  In order to solve the above problems, in the present invention, authentication processing using the result of pre-authentication is performed only when a wireless terminal in a call is handed over from the wireless relay apparatus to which it belongs. Even if the wireless terminal is handed over from the wireless relay device to which it belongs, if this wireless terminal is not in a call (if it is on standby), whether or not pre-authentication has been performed between this wireless terminal and the wireless relay device that is the handover destination Regardless, normal authentication processing is performed.

For example, the present invention is a wireless relay device for connecting a wireless terminal having a pre-authentication function to a network,
A first authentication processing means for performing a first authentication process using an authentication server for the wireless terminal;
A second authentication processing means for performing a second authentication process using the authentication information obtained by the first authentication process on the wireless terminal;
When a pre-authentication request is received from the wireless terminal via the network, the first authentication processing unit causes the wireless terminal to perform the first authentication process,
Authenticated management means for managing the wireless terminal authenticated by the first authentication process;
Attribution management means for managing attribution of the wireless terminal to the own wireless relay device;
Pre-authentication request relay means for relaying the pre-authentication request received from the wireless terminal belonging to the own wireless relay apparatus by the belonging management means to another wireless relay apparatus via the network;
A call state determining means for determining a call state of the wireless terminal belonging to the own wireless relay device by the belonging management means ;
When said by attribution management means belonging of the wireless terminal in the belonging to the radio relay apparatus is released, if the call state of the wireless terminal is determined to be "busy" by the call state determination unit, a handover notification including the identification information of the wireless terminal has a handover notification means for sending to another wireless relay apparatus via the network,
The attribution management means is
When receiving the attribution request from the wireless terminal, if the wireless terminal is managed by the authenticated management means and the handover notification including the identification information of the wireless terminal has been received, the second the authentication processing means, the by carrying out the second authentication processing for the wireless terminal, the wireless terminal is assigned to the wireless relay apparatus, whether the wireless terminal is not managed in the authenticated management means, Alternatively, if the handover notification including the identification information of the wireless terminal has not been received, the first authentication processing unit is caused to perform the first authentication processing on the wireless terminal so that the wireless terminal is automatically Be attributed to the wireless relay device,
When an attribution cancellation request is received from the wireless terminal, the attribution of the wireless terminal to the own wireless relay device is canceled.

Here, for example, the first authentication process is an authentication process according to IEEE 802.1x authentication performed by using a RADIUS server , and the second authentication process is a PMK obtained by IEEE 802.1x authentication. This is an authentication process using a cache as the authentication information .

  According to the present invention, even when a handover is performed from a radio relay apparatus to which a radio terminal belongs, if the radio terminal is not in a call (if it is in a standby state), the radio terminal and the radio relay apparatus that is the handover destination Regardless of whether or not pre-authentication has been completed, normal authentication processing is performed. For this reason, an unauthorized terminal cannot impersonate this wireless terminal using the information intercepted during the pre-authentication between the wireless terminal and the handover destination wireless relay apparatus, and cannot belong to the handover destination wireless relay apparatus. Therefore, it is possible to improve the security of the pre-authentication while maintaining the advantage of the pre-authentication such as prevention of sound interruption of the call during the handover.

  Embodiments of the present invention will be described below.

  FIG. 1 is a schematic diagram of a wireless communication system including a wireless access point 1 according to an embodiment of the present invention.

  As illustrated, the wireless communication system includes a plurality of wireless access points (AP) 1 according to the present embodiment, a wireless LAN terminal 2 having a pre-authentication function, and authentication of the wireless LAN terminal 2 by the wireless access point 1. A RADIUS server 3 that is used in the network, a LAN 4 that interconnects the wireless access point 1 and the RADIUS server 3, and a router 5 that connects the LAN 4 to the WAN 6.

  When the wireless access point 1 receives a pre-authentication request from the wireless LAN terminal 2, the wireless access point 1 performs IEEE 802.1x authentication using the RADIUS server 3 for the wireless LAN terminal 2.

  Further, when the wireless access point 1 receives the attribution request from the wireless LAN terminal 2, the wireless LAN terminal 2 is authenticated by the IEEE 802.1x authentication and includes the MAC address of the wireless LAN terminal 2. If the notification has been received, the wireless LAN terminal 2 is subjected to an authentication process using the PMK cache. After the authentication is established, the wireless LAN terminal 2 is attributed to the own wireless access point 1 and the wireless LAN terminal 2 is connected to the LAN 4. On the other hand, if the handover notification including the MAC address of the wireless LAN terminal 2 has not been received, regardless of whether or not the wireless LAN terminal 2 has been authenticated by IEEE 802.1x, Then, IEEE 802.1x authentication using the RADIUS server 3 is performed. After the authentication is established, the wireless LAN terminal 2 is attributed to the own wireless access point 1 and the wireless LAN terminal 2 is connected to the LAN 4.

  Further, when the wireless access point 1 receives the attribution cancellation request from the wireless LAN terminal 2, the wireless access point 1 cancels the attribution of the wireless LAN terminal 2 to the own wireless access point 1 and disconnects the wireless LAN terminal 2 from the LAN 4. To do. At this time, if the wireless LAN terminal 2 is busy, a handover notification including the MAC address of the wireless LAN terminal 2 is transmitted to the LAN 4.

  FIG. 2 is a schematic configuration diagram of the wireless access point 1.

  As illustrated, the wireless access point 1 includes a wired communication unit 101, a wireless communication unit 102, an authentication processing unit 103, a pre-authentication processing unit 104, an authenticated management unit 105, an attribution management unit 106, and a relay. Unit 107, call state determination unit 108, handover notification transmission / reception unit 109, and authentication invalid notification transmission / reception unit 110.

  The wired communication unit 101 is an interface for communicating with other communication devices (another wireless access point 1, a RADIUS server 3, a router 5, etc.) via the LAN 4.

  The wireless communication unit 102 is an interface for communicating with the wireless LAN terminal 2 via the wireless LAN.

  The authentication processing unit 103 performs authentication processing for the wireless LAN terminal 2. As illustrated, the authentication processing unit 103 includes an 802.1x authentication processing unit 1031 and a PMK cache authentication processing unit 1032.

  The 802.1x authentication processing unit 1031 performs the IEEE 802.1x authentication for the wireless LAN terminal 2 using the RADIUS server 3. The PMK cache authentication processing unit 1032 authenticates the wireless LAN terminal 2 by confirming the PMK shared with the wireless LAN terminal 2 by the IEEE 802.1x authentication (pre-authentication) performed in advance.

  The pre-authentication processing unit 104 causes the 802.1x authentication processing unit 1031 to perform IEEE 802.1x authentication for the wireless LAN terminal 2 in accordance with the pre-authentication request received from the wireless LAN terminal 2 via the other wireless access point 1. (Pre-authentication).

  The authenticated management unit 105 uses the authenticated management table (TB) 1051 to manage the state of the wireless LAN terminal 2 that has been authenticated by IEEE 802.1x by the 802.1x authentication processing unit 1031.

  FIG. 3A is a diagram schematically illustrating an example of registered contents of the authenticated management table 1051. As shown in the figure, a record 10510 is registered in the authenticated management table 1051 for each wireless LAN terminal 2 that has been IEEE 802.1x authenticated by the 802.1x authentication processing unit 1031. The record 10510 has a field 10511 for registering the MAC address (authenticated terminal address) of the wireless LAN terminal 2 and a field 10512 for registering the reception state of the handover notification including this MAC address.

  The attribution management unit 106 controls the attribution and attribution cancellation of the wireless LAN terminal 2 to the own wireless access point 1 in accordance with the attribution request and attribution cancellation request received from the wireless LAN terminal 2. Further, the belonging management unit 106 manages the state of the wireless LAN terminal 2 belonging to the own wireless access point 1 using the belonging management table (TB) 1061.

  FIG. 3B is a diagram schematically showing an example of registered contents of the attribution management table 1061. As shown in the figure, a record 10610 is registered in the attribution management table 1061 for each wireless LAN terminal 2 that is belonging. The record 10610 includes a field 10611 for registering the MAC address (assigned terminal address) of the wireless LAN terminal 2, a field 10612 for registering the call state of the wireless LAN terminal 2, and the update date / time of the call state registered in the field 10612. And a field 10613 for registering.

  The relay unit 107 relays data exchange between the wireless LAN terminal 2 belonging to the own wireless access point 1 and the LAN 4.

  The call state determination unit 108 uses the call state determination table (TB) 1081 to determine the call state of the wireless LAN terminal 2 belonging to the own wireless access point 1. Further, when the call state of the wireless LAN terminal 2 is changed, the changed call state is notified to the attribution management unit 106.

  FIG. 3C is a diagram schematically showing an example of registered contents of the call state determination table 1081. As shown in the figure, a record 10810 is registered in the call state determination table 1081 for each wireless LAN terminal 2 that belongs. The record 10810 has a field 10811 for registering the MAC address (attribute terminal address) of the wireless LAN terminal 2 and a field 10812 for registering the timer value of the busy timer of the wireless LAN terminal 2. Here, the busy timer decreases the timer value as time elapses. The timer value of the busy timer is updated to a default value (for example, 100 ms) every time an RTP packet having the wireless LAN terminal 2 corresponding to the busy timer as a transmission source or transmission destination is relayed.

  The handover notification transmission / reception unit 109 receives the handover notification transmitted by another wireless access point 1 via the LAN 4 and notifies the authenticated management unit 105 of the handover notification. Further, when the wireless LAN terminal 2 in a call is released from the own wireless access point 1, the handover notification transmission / reception unit 109 transmits a handover notification including the MAC address of the wireless LAN terminal 2 to the LAN 4.

  The authentication invalid notification transmission / reception unit 110 receives the authentication invalid notification transmitted by another wireless access point 1 via the LAN 4 and notifies the authenticated management unit 105 of the notification. Further, when the standby wireless LAN terminal 2 is forcibly released from its own wireless access point 1, the authentication invalidity notification transmission / reception unit 110 sends an authentication invalidity notification including the MAC address of the wireless LAN terminal 2 to the LAN 4. Send.

  FIG. 4 is a flowchart for explaining the operation of the wireless access point 1.

  When the pre-authentication processing unit 104 receives a pre-authentication request from the wireless LAN terminal 2 via the other wireless access point 1 via the wired communication unit 101 (YES in S10), the pre-authentication processing is performed (S11). ).

  When the attribution management unit 106 receives an attribution request from the wireless LAN terminal 2 via the wireless communication unit 102 (YES in S12), the attribution management unit 106 performs attribution processing described later (S13). When the attribution management unit 106 receives an attribution cancellation request from the wireless LAN terminal 2 via the wireless communication unit 102 (YES in S14), the attribution management unit 106 performs an attribution cancellation process described later (S15).

  When the handover notification transmission / reception unit 109 receives a handover notification from another wireless access point 1 via the wired communication unit 101 (YES in S16), the handover notification transmission / reception unit 109 notifies the authenticated management unit 105 of this handover notification. In response to this, the authenticated management unit 105 searches the authenticated management table 1051 for a record 10510 in which the MAC address included in this handover notification is registered in the field 10511. Then, the handover notification reception state registered in the field 10512 of the record 10510 is updated to “Received” (S17).

  When receiving the authentication invalidity notification from another wireless access point 1 via the wired communication unit 101 (YES in S18), the authentication invalidity notification transmitting / receiving unit 110 notifies the authenticated management unit 105 of this authentication invalidity notification. In response to this, the authenticated management unit 105 searches the authenticated management table 1051 for a record 10510 in which the MAC address included in the authentication invalidation notification is registered in the field 10511. Then, this record 10510 is deleted (S19).

  If there is a record 10610 of the wireless LAN terminal 2 that is belonging to the attribution management table 1061 (YES in S20), the attribution management unit 106 performs the attribution process described later in cooperation with the call state determination unit 108 (S21). ).

  FIG. 5A is a flowchart for explaining the pre-authentication process (S11) of FIG.

  First, the pre-authentication processing unit 104 notifies the authentication processing unit 103 of a pre-authentication request received from the wireless LAN terminal 2 via another wireless access point 1 via the wired communication unit 101. In response to this, the 802.1x authentication processing unit 1031 performs IEEE 802.1x authentication for the wireless LAN terminal 2 in cooperation with the RADIUS server 3 (S1101).

  As a result, if IEEE 802.1x authentication is established (YES in S1102), the 802.1x authentication processing unit 1031 is shared with the wireless LAN terminal 2 that is the pre-authentication request source by this IEEE 802.1x authentication (PMK cache). The PMK thus registered is registered in the PMK cache authentication processing unit 1032 in association with the MAC address of the wireless LAN terminal 2 (S1103).

  Further, the 802.1x authentication processing unit 1031 notifies the authenticated management unit 105 of a record addition instruction including the MAC address of the wireless LAN terminal 2. In response to this, the authenticated management unit 105 adds a new record 10510 to the authenticated management table 1051, and stores the MAC address of the wireless LAN terminal 2 as the authenticated terminal address in the field 10511 of the record 10510. In 10512, “not received” is registered as a handover notification reception state (S1104).

  On the other hand, if IEEE 802.1x authentication is not established (NO in S1102), predetermined error processing such as sending an error message to the pre-authentication request source wireless LAN terminal 2 is performed (S1105).

  FIG. 6 is a flowchart for explaining the attribution process (S13) of FIG.

  First, the attribution management unit 106 notifies the authentication processing unit 103 of the attribution request received from the wireless LAN terminal 2 via the wireless communication unit 102. In response to this, the authentication processing unit 103 notifies the authenticated management unit 105 of the MAC address of the wireless LAN terminal 2. The authenticated management unit 105 checks whether or not the record 10510 in which the MAC address is registered in the field 10511 is registered in the authenticated management table 1051, so that the wireless LAN terminal 2 is IEEE 802.1x authenticated. Is checked (S1301).

  If the wireless LAN terminal 2 that is the attribution request source has been IEEE 802.1x authenticated (YES in S1301), the authenticated management unit 105 stores the MAC address of the wireless LAN terminal 2 in the record 10510 registered in the field 10511. By examining the field 10512, it is examined whether or not the handover notification including the MAC address of the wireless LAN terminal 2 has been received (S1302).

  When the handover notification including the MAC address of the wireless LAN terminal 2 that is the attribution request source has been received (YES in S1302), the authenticated management unit 105 notifies the authentication processing unit 103 that it is a target of PMK cache authentication. To do. In response to this, the PMK cache authentication processing unit 1032 performs PMK cache authentication. That is, by determining whether or not the PMK included in the attribution request matches the PMK registered in advance in association with the MAC address of the attribution request source wireless LAN terminal 2, this wireless LAN terminal 2 authentication is performed (S1303).

  As a result, if PMK cache authentication is established (YES in S1304), the PMK cache authentication processing unit 1032 notifies the attribution management unit 106 of attribution permission. In response, the attribution management unit 106 adds a new record 10610 to the attribution management table 1061, calls the field 10611 of this record 10610 with the MAC address of this wireless LAN terminal 2 as the attribution terminal address, and calls the field 10612. The state “waiting” is registered, and the current date / time is registered in the field 10613 as the update date / time. In addition, the attribution management unit 106 adds a new record 10810 to the call state determination table 1081, the MAC address of the wireless LAN terminal 2 as the belonging terminal address in the field 10811 of this record 10810, and the call in the field 10812. A predetermined timer value (for example, “remaining 0 ms”) is registered as a middle timer (S1309).

  Thereafter, the attribution management unit 106 controls the relay unit 107 to perform the attribution process of the wireless LAN terminal 2 that is the attribution request source. As a result, the relay unit 107 connects the wireless LAN terminal 2 as the attribution request source to the LAN 4 and starts relaying between the wireless LAN terminal 2 and the LAN 4 (S1310). When the wireless LAN terminal 2 belongs to the assigned wireless access point 1, the wireless LAN terminal 2 detects the surrounding wireless access point 1 and pre-authenticates to each surrounding wireless access point 1 via the assigned wireless access point 1. Send a request. The wireless access point 1 that has received the pre-authentication request performs pre-authentication on the pre-authentication request source wireless LAN terminal 2 via the other wireless access point 1.

  When the wireless LAN terminal 2 as the attribution request source is not IEEE 802.1x authenticated (NO in S1301), or when the handover notification including the MAC address of the wireless LAN terminal 2 as the attribution request source has not been received (S1302). NO), the authenticated management unit 105 notifies the authentication processing unit 103 that it is subject to IEEE 802.1x authentication. In response to this, the 802.1x authentication processing unit 1031 performs IEEE 802.1x authentication for the wireless LAN terminal 2 in cooperation with the RADIUS server 3 (S1305).

  As a result, if IEEE 802.1x authentication is established (YES in S1306), the 802.1x authentication processing unit 1031 is shared (PMK cache) with the wireless LAN terminal 2 that is the attribution request source by the IEEE 802.1x authentication. The PMK is registered in the PMK cache authentication processing unit 1032 in association with the MAC address of the wireless LAN terminal 2 (S1307).

  Further, the 802.1x authentication processing unit 1031 notifies the authenticated management unit 105 of a record addition instruction including the MAC address of the wireless LAN terminal 2. In response to this, the authenticated management unit 105 adds a new record 10510 to the authenticated management table 1051, and stores the MAC address of the wireless LAN terminal 2 as the authenticated terminal address in the field 10511 of the record 10510. In 10512, “not received” is registered as a handover notification reception state (S1308).

  Further, the 802.1x authentication processing unit 1031 notifies the attribution management unit 106 of the attribution permission. In response, the attribution management unit 106 adds a new record 10610 to the attribution management table 1061, calls the field 10611 of this record 10610 with the MAC address of this wireless LAN terminal 2 as the attribution terminal address, and calls the field 10612. The state “waiting” is registered, and the current date / time is registered in the field 10613 as the update date / time. In addition, the attribution management unit 106 adds a new record 10810 to the call state determination table 1081, the MAC address of the wireless LAN terminal 2 as the belonging terminal address in the field 10811 of this record 10810, and the call in the field 10812. A predetermined timer value is registered as a middle timer (S1309).

  Thereafter, the attribution management unit 106 controls the relay unit 107 to perform the attribution process of the wireless LAN terminal 2 that is the attribution request source. As a result, the relay unit 107 connects the wireless LAN terminal 2 as the attribution request source to the LAN 4 and starts relaying between the wireless LAN terminal 2 and the LAN 4 (S1310). As described above, when the wireless LAN terminal 2 belongs to the assigned wireless access point 1, the wireless LAN terminal 2 detects the surrounding wireless access point 1 and passes through the assigned wireless access point 1. 1 Send a pre-authentication request to each. Then, the wireless access point 1 that has received the pre-authentication request performs pre-authentication on the wireless LAN terminal 2 that is the pre-authentication request source via the other wireless access point 1.

  On the other hand, if the PMK cache authentication is not established (NO in S1304) or the IEEE 802.1x authentication is not established (NO in S1306), the authentication processing unit 103 notifies the attribution management unit 106 of attribution rejection. In response, the attribution management unit 106 performs predetermined error processing such as sending an error message to the wireless LAN terminal 2 that is the attribution request source (S1311).

  FIG. 5B is a flowchart for explaining the attribution release process (S15) of FIG.

  First, the attribution management unit 106 searches the attribution management table 1061 for a record 10610 in which the MAC address of the wireless LAN terminal 2 that is the attribution cancellation request source is registered in the field 10611. Then, the call state registered in the field 10612 of the retrieved record 10610 is checked (S1501).

  When the call state is “standby” (NO in S1501), the attribution management unit 106 deletes the retrieved record 10610 from the attribution management table 1061. Further, the record 10810 in which the MAC address of the wireless LAN terminal 2 as the attribution cancellation request source is registered in the field 10811 is searched from the call state determination table 1081, and the searched record 10810 is deleted from the call state determination table 1081 (S1503). .

  On the other hand, when the call state is “busy” (YES in S1501), the attribution management unit 106 notifies the handover notification transmission / reception unit 109 of the MAC address of the wireless LAN terminal 2 that is the attribution cancellation request source, and performs handover notification. Instruct to send. In response to this, the handover notification transmission / reception unit 109 transmits a handover notification including the MAC address of the wireless LAN terminal 2 to the LAN 4 by broadcast or multicast via the wired communication unit 101 (S1502). Then, the attribution management unit 106 deletes the retrieved record 10610 from the attribution management table 1061. Further, the record 10810 in which the MAC address of the wireless LAN terminal 2 as the attribution cancellation request source is registered in the field 10811 is searched from the call state determination table 1081, and the searched record 10810 is deleted from the call state determination table 1081 (S1503). .

  When the attribution management unit 106 deletes the records 10610 and 10810 of the wireless LAN terminal 2 that is the attribution cancellation request source, the attribution management unit 106 controls the relay unit 107 to perform the attribution cancellation processing of the wireless LAN terminal 2. As a result, the relay unit 107 disconnects the wireless LAN terminal 2 that is the attribution cancellation request source from the LAN 4, and ends the relay between the wireless LAN terminal 2 and the LAN 4 (S1504).

  FIG. 7 is a flowchart for explaining the belonging process (S21) of FIG.

  The call state determination unit 108 monitors a frame relayed by the relay unit 107 and checks whether or not an RTP packet is stored in this frame. When a frame in which the RTP packet is stored is detected (YES in S2101), the call state determination is performed on the record 10810 in which the MAC address of the wireless LAN terminal 2 that is the transmission source or transmission destination of this frame is registered in the field 10811. The table 1081 is searched, and the timer value of the busy timer registered in the field 10812 of this record 10810 is updated to a default value (for example, 100 ms) (S2102). Note that, as described above, the busy timer decreases the timer value as time elapses.

  Next, the call state determination unit 108 searches the attribution management table 1061 for the record 10610 in which the MAC address of the wireless LAN terminal 2 that is the transmission source or transmission destination of this frame is registered in the field 10611. The call state registered in the field 10612 is checked. If the call state is not “busy” (NO in S2103), the call state registered in the field 10612 of this record 10610 is changed to “busy” and the update date / time registered in the field 10613 is updated. Is updated to the current date and time (S2104).

  In addition, the call state determination unit 108 monitors the call state determination table 1081, and the timer value of the busy timer registered in the field 10812 is “remaining 0 ms”, that is, the record 10810 that has timed out. For example, periodically check whether there is any. When a record 10810 in which the timer value of the busy timer registered in the field 10812 has timed out is detected (YES in S2105), the MAC address registered in the field 10811 of the record 10810 is specified. Then, the call state determination unit 108 searches the attribution management table 1061 for the record 10610 in which the identified MAC address is registered in the field 10611, and checks the call state registered in the field 10612 of the record 10610. If the call state is not “standby” (NO in S2106), the call state registered in the field 10612 of this record 10610 is changed to “standby” and the update date / time registered in the field 10613 is updated. Is updated to the current date and time (S2107). On the other hand, if the call state registered in the field 10612 is “standby” (YES in S2106), the process proceeds to S2108.

  In S2108, the attribution management unit 106 checks whether or not a predetermined time T (for example, 3 minutes) has elapsed from the update date and time registered in the field 10613 of the record 10610. If the predetermined time T has elapsed since the update date and time (YES in S2108), the authenticated management table 1051 is searched for the record 10510 in which the MAC address registered in the field 10611 of this record 10610 is registered in the field 10511. The handover notification reception state registered in the field 10512 of this record 10510 is further examined (S2108A). If the handover notification reception state is “received” (YES in S2108A), the wireless LAN terminal 2 identified by the MAC address registered in the field 10611 of the record 10610 belongs to the own wireless access point 1 Is forcibly released (S2109 to S2112).

  Specifically, the attribution management unit 106 first deletes this record 10610 from the attribution management table 1061. Further, the record 10810 in which the MAC address of the wireless LAN terminal 2 to be forcibly removed is registered in the field 10811 is searched from the call state determination table 1081, and the searched record 10810 is deleted from the call state determination table 1081 ( S2109).

  Next, the attribution management unit 106 notifies the authentication invalidity notification transmission / reception unit 110 of an authentication invalidation instruction including the MAC address of the wireless LAN terminal 2 that is subject to forced attribution cancellation. In response to this, the authentication invalidity notification transmission / reception unit 110 generates an authentication invalidity notification including the MAC address of the wireless LAN terminal 2 to be subject to forced attribution cancellation, and is registered in advance via the wired communication unit 101. Is transmitted to the wireless access point 1 (S2110).

  Then, the authentication invalid notification transmission / reception unit 110 notifies the authenticated management unit 105 of an instruction to delete the authenticated record including the MAC address of the wireless LAN terminal 2 that is the target of forced attribution cancellation. In response to this, the authenticated management unit 105 searches the authenticated management table 1051 for the record 10510 in which the MAC address of the wireless LAN terminal 2 that is the target of forced attribution cancellation is registered in the field 10511, and the searched record 10510 Is deleted from the authenticated management table 1051 (S2111).

  Thereafter, the attribution management unit 106 controls the relay unit 107 to perform attribution cancellation processing of the wireless LAN terminal 2 that is a target of forced attribution cancellation. As a result, the relay unit 107 disconnects the wireless LAN terminal 2 subject to forced attribution cancellation from the LAN 4 and ends the relay between the wireless LAN terminal 2 and the LAN 4 (S2112).

  Next, an operation example of the wireless communication system shown in FIG. 1 will be described.

  8 and 9 are sequence diagrams for explaining the operation of the wireless communication system shown in FIG. Here, in order to distinguish the two wireless access points 1 shown in FIG. 1 from each other, one is a wireless access point (a) 1 and the other is a wireless access point (b) 1.

  First, in FIG. 8, when the wireless LAN terminal 2 enters the wireless communication area of the wireless access point (a) 1, it transmits an attribution request to the wireless access point (a) 1 (S31).

  In response to this, the wireless access point (a) 1 performs IEEE 802.1x authentication for the wireless LAN terminal 2 in cooperation with the RADIUS server 3 (S32). After the authentication is established, the record 10510 of the wireless LAN terminal 2 is added to the authenticated management table 1051 (S33), and the record 10610 of the wireless LAN terminal 2 is added to the attribution management table 1061 (S34). Then, the wireless LAN terminal 2 is assigned to the wireless access point (a) 1.

  Next, when the wireless LAN terminal 2 belongs to the wireless access point (a) 1, it detects the wireless access point (b) 1. Then, a pre-authentication request is transmitted to the wireless access point (b) 1 via the assigned wireless access point (a) 1 (S35).

  In response to this, the wireless access point (b) 1 performs IEEE 802.1x authentication for the wireless LAN terminal 2 in cooperation with the RADIUS server 3 (S36). Then, after the authentication is established, the record 10510 of this wireless LAN terminal 2 is added to the authenticated management table 1051 (S37).

  Here, when the wireless LAN terminal 2 accepts the call operation from the user, the wireless LAN terminal 2 performs a call control process with the other party (for example, the telephone terminal on the WAN 6 side) and establishes a communication path with the other party (S39). Then, a call (transmission / reception of RTP packet) is started via this call path (S40).

  The wireless access point (a) 1 is connected to the wireless LAN terminal during a period in which the RTP packet is transmitted and received between the wireless LAN terminal 2 and the communication partner via the wireless access point (a) 1. 2 is determined to be “busy” (S41).

  Next, when the wireless LAN terminal 2 leaves the wireless communication area of the wireless access point (a) 1 as the user moves, the wireless LAN terminal 2 transmits an attribution cancellation request to the wireless access point (a) 1 (S42).

  In response to this, the wireless access point (a) 1 confirms that the call state of the wireless LAN terminal 2 that is the attribution cancellation request source is “busy”, and performs handover including the MAC address of the wireless LAN terminal 2 Generate a notification. Then, this handover notification is transmitted (S43). Further, the wireless access point (a) 1 deletes the record 10610 of this wireless LAN terminal 2 from the attribution management table 1061 (S44). Then, the wireless LAN terminal 2 is released from belonging to the wireless access point (a) 1.

  On the other hand, when the wireless access point (b) 1 receives the handover notification from the wireless access point (a) 1, the wireless access point (b) 1 specifies the MAC address record 10510 included in the handover notification from the authenticated management table 1051. The handover notification reception state is changed to “received” (S45).

  Next, in FIG. 9, when the wireless LAN terminal 2 enters the wireless communication area of the wireless access point (b) 1 as the user moves, the wireless LAN terminal 2 transmits an attribution request to the wireless access point (b) 1 (S46). .

  In response to this, the wireless access point (b) 1 confirms that the wireless LAN terminal 2 has been pre-authenticated (IEEE 802.1x authentication) based on the authenticated management table 1051, and On the other hand, PMK cache authentication is performed using the PMK acquired by pre-authentication (S47). After the authentication is established, the record 10610 of the wireless LAN terminal 2 is added to the attribution management table 1061 (S48). Thereby, the wireless LAN terminal 2 is attributed to the wireless access point (b) 1. As a result, a call (transmission / reception of RTP packet) between the wireless LAN terminal 2 and the other party is performed via the wireless access point (b) 1.

  The wireless access point (b) 1 is connected to the wireless LAN terminal during a period in which RTP packets are transmitted and received between the wireless LAN terminal 2 and the other party of communication via the wireless access point (b) 1. 2 is determined as “busy” (S49).

  Here, when receiving a disconnection operation from the user (S50), the wireless LAN terminal 2 performs a call control process with the call partner to cut the call path with the call partner and ends the call (transmission / reception of the RTP packet) ( S51).

  When the wireless access point (b) 1 completes transmission / reception of the RTP packet between the wireless LAN terminal 2 and the communication partner via the own wireless access point (b) 1, 2 is determined to be “standby” (S52). When the call state “standby” continues for a predetermined time T or longer, the wireless access point (b) 1 deletes the record 10610 of the wireless LAN terminal 2 from the belonging management table 1061 (S53). Then, the wireless LAN terminal 2 is forcibly released from belonging to the wireless access point (b) 1.

  Then, the wireless access point (b) 1 deletes the record 10510 of the wireless LAN terminal 2 from the authenticated management table 1051 (S54), and the wireless access point (a) 1 sends the MAC of the wireless LAN terminal 1 to it. An authentication invalidation notification including the address is transmitted (S55).

  When the wireless access point (a) 1 receives the authentication invalidity notification from the wireless access point (b) 1, the wireless LAN terminal 2 having the MAC address included in the authentication invalidation notification is obtained from the authenticated management table 1051. The record 10510 is deleted (S54).

  The embodiment of the present invention has been described above.

  In the present embodiment, pre-authentication (IEEE 802.1x) is performed at the handover destination wireless access point 1 only when a handover is made from the wireless access point 1 to which the wireless LAN terminal 2 in communication belongs to another wireless access point 1. PMK cache authentication is performed using the result of authentication. Even when the wireless LAN terminal 2 is handed over from the wireless access point 1 to which the wireless LAN terminal 2 belongs, if the wireless LAN terminal 2 is not in a call (standby), the wireless LAN terminal 2 and the wireless access point 1 that is the handover destination are connected. Regardless of whether or not pre-authentication has been performed, IEEE 802.1x authentication is performed.

  For this reason, an unauthorized terminal impersonates the wireless LAN terminal 2 using the PMK intercepted during the pre-authentication between the wireless LAN terminal 2 and the handover destination wireless access point 1, and belongs to the handover destination wireless access point 1. I can't do it. Therefore, according to the present embodiment, it is possible to improve the security of pre-authentication while maintaining the advantage of pre-authentication such as prevention of sound interruption of a call at the time of handover.

  In the present embodiment, the wireless access point 1 determines the call state of the wireless LAN terminal 2 by monitoring RTP packets having the wireless LAN terminal 2 to which it belongs as a transmission destination or transmission source. For this reason, the wireless access point 1 does not need to monitor and specify a call control message transmitted / received by the wireless LAN terminal 2 in order to determine the call state of the wireless LAN terminal 2. Therefore, according to the present embodiment, the call state can be determined with a relatively simple configuration.

  In the present embodiment, the wireless access point 1 is a wireless LAN terminal 2 belonging to the own wireless access point 1 and has been determined to be “standby” for a predetermined time or more. The wireless LAN terminal 2 is forcibly released from belonging to its own wireless access point 1 and transmits an authentication invalidity notification including the MAC address of the wireless LAN terminal 2 to the LAN 4. The wireless access point 1 is specified by the MAC address included in the authentication invalidity notification received from the wireless LAN terminal 2 that has been forcibly released from its own wireless access point 1 and from another wireless access point 1. The wireless LAN terminal 2 is removed from the management target as being not authenticated by the IEEE 802.1x authentication. Therefore, according to the present embodiment, it is possible to prevent the result of the pre-authentication from remaining in the wireless access point 1 forever and squeezing the storage area of the wireless access point 1.

  In addition, this invention is not limited to said embodiment, Many deformation | transformation are possible within the range of the summary.

  For example, in the above embodiment, the configuration of the wireless access point 1 shown in FIG. 2 may be implemented by an integrated logic IC such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). Alternatively, it may be executed by software by a computer such as a DSP (Digital Signal Processor). Alternatively, in a general purpose computer such as a PC (Personal Computer) equipped with an auxiliary storage device such as a CPU, memory, HDD, DVD-ROM, and a communication interface such as a modem, the CPU loads a predetermined program from the auxiliary storage device onto the memory. It may be realized by loading and executing.

  In the above embodiment, IEEE 802.1x authentication is used as normal authentication and pre-authentication, and PMK cache authentication is used as authentication using the result of pre-authentication. However, the present invention is not limited to this. Even when a handover is performed from the wireless access point 1 to which the wireless LAN terminal 2 belongs to another wireless access point 1, if the wireless LAN terminal 2 is not in a call (waiting), the wireless LAN terminal 2 and the handover destination Regardless of whether or not the first authentication is completed with the wireless access point 1, the first authentication is performed, and the wireless access point 1 to which the wireless LAN terminal 2 in communication belongs belongs to another wireless access point 1. It is only necessary that the second authentication using the result of the first authentication that has already been performed at the handover destination wireless access point 1 is performed only when the handover is performed.

  In the above embodiment, the case where the present invention is applied to the wireless access point 1 that connects the wireless LAN terminal 2 to the LAN 4 has been described as an example. However, the present invention is not limited to this. The present invention can be similarly applied to a radio base station that connects a mobile phone or a PHS to a public network or the like.

FIG. 1 is a schematic diagram of a wireless communication system including a wireless access point 1 according to an embodiment of the present invention. FIG. 2 is a schematic configuration diagram of the wireless access point 1. 3A is a diagram schematically illustrating an example of registered contents of the authenticated management table 1051, and FIG. 3B is a diagram schematically illustrating an example of registered contents of the attribution management table 1061. FIG. 3C is a diagram schematically showing an example of registered contents of the call state determination table 1081. FIG. 4 is a flowchart for explaining the operation of the wireless access point 1. 5A is a flowchart for explaining the pre-authentication process (S11) of FIG. 4, and FIG. 5B is a flowchart for explaining the attribution release process (S15) of FIG. is there. FIG. 6 is a flowchart for explaining the attribution process (S13) of FIG. FIG. 7 is a flowchart for explaining the belonging process (S21) of FIG. FIG. 8 is a sequence diagram for explaining the operation of the wireless communication system shown in FIG. FIG. 9 is a sequence diagram for explaining the operation of the wireless communication system shown in FIG.

Explanation of symbols

  1: wireless access point, 2: wireless LAN terminal, 3: RADIUS server, 4: LAN, 5: router, 6: WAN, 101: wired communication unit, 102: wireless communication unit, 103: authentication processing unit, 104: advance Authentication processing unit 105: Authenticated management unit 106: Attribution management unit 107: Relay unit 108: Call state determination unit 109: Handover notification transmission / reception unit 110: Authentication invalid notification transmission / reception unit 1031: 802.1x authentication Processing unit, 1032: PMK cache authentication processing unit, 1051: authenticated management table, 1061: attribution management table, 1081: call state determination table

Claims (5)

A wireless relay device for connecting a wireless terminal having a pre-authentication function to a network,
A first authentication processing means for performing a first authentication process using an authentication server for the wireless terminal;
A second authentication processing means for performing a second authentication process using the authentication information obtained by the first authentication process on the wireless terminal;
When a pre-authentication request is received from the wireless terminal via the network, the first authentication processing unit causes the wireless terminal to perform the first authentication process,
Authenticated management means for managing the wireless terminal authenticated by the first authentication process;
Attribution management means for managing attribution of the wireless terminal to the own wireless relay device;
Pre-authentication request relay means for relaying the pre-authentication request received from the wireless terminal belonging to the own wireless relay apparatus by the belonging management means to another wireless relay apparatus via the network;
A call state determining means for determining a call state of the wireless terminal belonging to the own wireless relay device by the belonging management means ;
When said by attribution management means belonging of the wireless terminal in the belonging to the radio relay apparatus is released, if the call state of the wireless terminal is determined to be "busy" by the call state determination unit, a handover notification including the identification information of the wireless terminal has a handover notification means for sending to another wireless relay apparatus via the network,
The attribution management means is
When receiving the attribution request from the wireless terminal, if the wireless terminal is managed by the authenticated management means and the handover notification including the identification information of the wireless terminal has been received, the second the authentication processing means, the by carrying out the second authentication processing for the wireless terminal, the wireless terminal is assigned to the wireless relay apparatus, whether the wireless terminal is not managed in the authenticated management means, Alternatively, if the handover notification including the identification information of the wireless terminal has not been received, the first authentication processing unit is caused to perform the first authentication processing on the wireless terminal so that the wireless terminal is automatically Be attributed to the wireless relay device,
A wireless relay device, wherein upon receiving an attribution cancellation request from the wireless terminal, the attribution of the wireless terminal to the own wireless relay device is canceled. The wireless relay device according to claim 1,
The call state determination means includes:
The radio relay apparatus characterized in that the state of communication of the radio terminal is determined by monitoring RTP packets having the radio terminal belonging to the radio relay apparatus belonging to the own radio relay apparatus as a transmission destination or a transmission source by the attribution management means . The wireless relay device according to claim 1 or 2,
The attribution management means is
If there is the wireless terminal belonging to the own wireless relay device by the belonging management means and the wireless terminal has been determined to be “standby” for a predetermined time or more by the call state determining means, Forcibly canceling attribution to the wireless relay device, and sending an authentication invalidity notification including identification information of the wireless terminal to another wireless relay device via the network,
The authenticated management means includes
Identified by the identification information included in the authentication invalidation notification received from the wireless terminal whose membership to the wireless relay device is forcibly released by the membership management means or from another wireless relay device via the network The wireless relay device according to claim 1, wherein the wireless terminal is excluded from a management target on the assumption that authentication by the first authentication processing is not performed. The wireless relay device according to any one of claims 1 to 3,
The first authentication process is an authentication process in accordance with IEEE 802.1x authentication performed using a RADIUS server ,
The wireless authentication device according to claim 2, wherein the second authentication process is an authentication process using a PMK cache obtained by IEEE 802.1x authentication as the authentication information . A wireless relay device is an attribution management method for connecting a wireless terminal having a pre-authentication function to a network,
When a pre-authentication request is received from the wireless terminal via the network, a first authentication process using an authentication server is performed on the wireless terminal,
If the wireless terminal has been authenticated by the first authentication process based on the pre-authentication request and has received a handover notification including identification information of the wireless terminal when receiving the attribution request from the wireless terminal For example, the second authentication process using the authentication information obtained by the first authentication process based on the pre-authentication request is performed on the wireless terminal, and the wireless terminal is attributed to the own wireless relay apparatus. On the other hand, if the wireless terminal is not authenticated by the first authentication process based on the pre-authentication request or if the handover notification including the identification information of the wireless terminal has not been received, the wireless terminal The first authentication process is performed for the wireless terminal to belong to the own wireless relay device,
When the pre-authentication request is received from the wireless terminal belonging to the own wireless relay device, relay to another wireless relay device via the network,
In the case of receiving an attribution cancellation request from the wireless terminal, the handover of the wireless terminal to the own wireless relay device is canceled, and if the wireless terminal is in a call, the handover including identification information of the wireless terminal assignment management method characterized by sending a notification, to another wireless relay apparatus via the network.

Images