JP5332701B2 - Wireless communication device and wireless communication device authentication method - Google Patents

Description

  The present invention relates to a wireless communication apparatus and a wireless communication apparatus authentication method.

  In general, an authentication method using a certificate is widely used in authentication when a communication apparatus is connected to a network. In such authentication, the validity of the certificate is confirmed, and a preset expiration date is checked.

  Normally, the expiration date is checked by comparing the current date and time of the internal clock of the communication device with the date and time set as the expiration date when the communication device is connected to the network (Patent Document 1).

JP 2006-172293 A JP-A-6-258709

  However, in such an authentication method, when the main power of the communication device is turned off, the time information is initialized and the value of the internal clock becomes the past date and time. There has been a problem that communication devices connected to the network cannot be controlled correctly.

  Accordingly, the present invention has been made in view of the above problems, and an object of the present invention is to provide a certificate expiration date in a wireless communication apparatus that does not have a hardware mechanism for acquiring time information. It is an object of the present invention to provide a new and improved wireless communication apparatus and wireless communication apparatus authentication method capable of accurately performing the above authentication.

  In order to solve the above-described problem, according to one aspect of the present invention, a wireless communication device connected via a communication network to a server capable of transmitting time information, the time acquisition unit acquiring time information from the server And an authenticating unit that performs authentication for connecting to the communication network using a certificate with an expiration date set, and the authenticating unit acquires the correct time information from the server after the time acquiring unit acquires the correct time information. Provided is a wireless communication apparatus that performs the expiration date authentication.

  According to such a configuration, the wireless communication apparatus can acquire correct time information before authenticating the expiration date, so that the certificate expiration date can be correctly authenticated. Further, since the time information is acquired from a server in the communication network to which the time information is connected, the time of the wireless communication device can be calibrated with the time information on the communication network side.

  The authentication unit authenticates that the wireless communication apparatus is connected to the communication network without authenticating the validity period of the certificate, and is valid after the time acquisition unit acquires correct time information from the server. You may authenticate the deadline.

  Such a configuration is one of specific examples for obtaining correct time information before performing the above-described expiration date authentication. Without authenticating the expiration date, the validity of the certificate is authenticated and the IP address can be acquired. As a result, the wireless communication apparatus can connect to the time server and acquire time information.

  The server may be a radio base station, and the time acquisition unit transmits a first message including a time information acquisition request to the radio base station, and is a response message of the first message. The time information may be acquired from the second message including the time information.

  Such a configuration is another specific example for acquiring correct time information before performing the above-described expiration date authentication. Time information can be acquired by using message exchange with a radio base station without acquiring an IP address as in the first example.

  Further, the first message and the second message may be messages transmitted and received in the MAC layer between the radio base station and the radio communication device using a predetermined frame.

  By using messages transmitted and received in the MAC layer in this way, time information can be acquired even before an IP address is acquired.

  The predetermined frame may have a TLV field, and the time information acquisition request and the time information may be transmitted / received using the TLV field.

  The time acquisition unit may acquire the time information and store the time information in a data storage unit.

  By storing time information in the data storage unit when accurate time information is acquired, it is possible to prepare for a case where time information cannot be acquired from the server.

  The time acquisition unit acquires time information stored in the data storage unit when the time information cannot be acquired from the server, and the authentication unit acquires time information acquired from the data storage unit. You may authenticate the said expiration date using.

  With this configuration, the wireless communication apparatus can authenticate the expiration date of the certificate using time information saved in advance in the data storage unit. When processing for storing time information is incorporated in the stop preparation for the wireless communication device, the time information stored in the data storage unit is time information when the wireless communication device was stopped last time. Therefore, the expiration date can be authenticated using time information that is accurate to some extent, and a state in which the wireless communication apparatus cannot connect to the wireless communication network can be avoided.

  In order to solve the above problem, according to another aspect of the present invention, a wireless communication apparatus connected to a server capable of transmitting time information via a communication network uses a certificate with an expiration date set. An authentication method for performing authentication for connecting to the communication network, the wireless communication device connecting to the server, the wireless communication device acquiring time information from the server, and the time information And a method for authenticating the validity period of the certificate based on the authentication method.

  As described above, according to the present invention, it is possible to accurately authenticate the validity period of a certificate in a wireless communication apparatus that does not have a hardware mechanism for acquiring time information.

It is a functional block diagram of the radio | wireless communication apparatus which concerns on 1st Embodiment. It is a sequence diagram which shows the authentication method of the radio | wireless communication apparatus which concerns on 1st Embodiment. It is a sequence diagram which shows the modification of the authentication method of FIG. It is a function block diagram of the radio | wireless communication apparatus which concerns on 2nd Embodiment. It is a sequence diagram which shows the authentication method of the radio | wireless communication apparatus which concerns on 2nd Embodiment. It is a frame block diagram used for the authentication method of FIG. It is explanatory drawing explaining the detail of the flame | frame of FIG. It is a sequence diagram which shows the authentication method of the conventional radio | wireless communication apparatus.

  Exemplary embodiments of the present invention will be described below in detail with reference to the accompanying drawings. In addition, in this specification and drawing, about the component which has the substantially same function structure, duplication description is abbreviate | omitted by attaching | subjecting the same code | symbol.

  Hereinafter, an authentication method in a conventional wireless communication apparatus will be described first, and then the first embodiment and the second embodiment will be described respectively.

<1. Authentication Method in Conventional Wireless Communication Device>
First, in order to facilitate understanding of the features of the authentication method of the wireless communication apparatus according to each embodiment of the present invention, the authentication method in the conventional wireless communication apparatus will be described with reference to FIG. FIG. 8 is a sequence diagram for explaining an authentication method in a conventional wireless communication apparatus.

  First, the wireless communication device 900 is activated (S300). In the wireless communication device 900, the time information managed by the OS when the power is last turned off is initialized. Therefore, until the wireless communication apparatus 900 acquires time information next time, the internal clock of the wireless communication apparatus 900 keeps the past time.

  In the wireless connection phase of step S302, operations such as negotiation for the wireless communication apparatus 900 to wirelessly connect to the wireless base station 200 at the MAC layer level are performed. Next, the wireless communication apparatus 900 performs authentication for connecting to the wireless communication network (S304). In the authentication phase of step S304, authentication processing is performed between the wireless communication apparatus 900 and the authentication server 400.

  In the authentication process, it is necessary to check the validity period set in the certificate in addition to checking the validity of the certificate. However, at this time, the wireless communication device 900 does not have correct time information.

In order to obtain the correct time information, it is necessary to obtain the time information from the outside when the wireless communication apparatus 900 itself does not have a hardware mechanism having the correct time information. However, at this time, the wireless communication apparatus 900 has not acquired an IP address, and therefore cannot connect to an external server having correct time information.

  Accordingly, the wireless communication apparatus 900 cannot have correct time information at this time, and cannot correctly check the certificate expiration date in the authentication phase.

  For example, consider a case where the communication device is “01/01/1970 00:00:00” at the time of activation and the actual current date is “2009/02/1 01:00”. For example, when the expiration date is “until January 31, 2009” and only the expiration date is set, the communication device sets the current date and time even though the expiration date has actually expired. Since it is recognized as “January 01, 1970 00:00:00”, there may be a problem of authentication.

  For example, when the expiration date is set as “from January 1, 2009 to March 31, 2009”, the expiration date is outside the expiration date even though it is actually within the expiration date. Since it is determined that the communication device is present, there may occur a problem that the communication device cannot be connected to the network.

  If the expiration date is checked based on the incorrect time information as described above and the authentication is successful, the wireless communication apparatus 900 next acquires an IP address from the DHCP server 500 (S306). If the authentication fails, the wireless communication device 900 cannot connect to the DHCP server and cannot perform subsequent processing.

  If the wireless communication device 900 fails to authenticate, the wireless communication device 900 is not connected to the network. Therefore, even if maintenance is performed, the maintenance staff cannot perform remote operation, and wireless communication is performed. There is no choice but to connect directly to the place where the device 900 is installed.

  Since the wireless communication apparatus 900 to which the IP address is assigned can be connected to the time server 600, the wireless communication apparatus 900 acquires time information from the time server 600 (S308). The wireless communication device 900 updates the internal clock information based on the time information acquired from the time server.

  Each step of S302 to S308 described above is a procedure for the wireless communication apparatus 900 to connect to the wireless communication network. If each of these steps is successful, the wireless communication device 900 can be connected to the wireless communication network, and the wireless communication device 900 can relay communication for the user terminal 300 to connect to the wireless communication network. It becomes like this.

  In step S <b> 310, the user terminal 300 connects to the wireless communication apparatus 900. Thereafter, the user terminal 300 connects to the authentication server 400 and performs an authentication process (S312). Next, the user terminal 300 acquires an IP address from the DHCP server 500 (S314), and can connect to the communication destination device 700.

  Thus, in the conventional wireless communication apparatus 900, it is necessary to correct the information of the internal clock initialized when the main power is turned off. After authenticating and obtaining an IP address, you can connect to the time server to get the correct time information, but at the time of authentication you do not have an IP address and cannot connect to the time server. .

  Therefore, conventionally, a hardware mechanism such as an RTC circuit and a backup battery has been used to obtain correct time information at this stage. Further, when such a hardware mechanism is not provided, the wireless communication apparatus 900 cannot correctly have time information in the authentication phase, and therefore correctly checks the certificate expiration date in the authentication phase. I couldn't.

  In particular, wireless communication devices do not occupy physical lines, but can be connected by a third party, so the authentication operation on the wireless when connecting to the network is important, and proof Certificate expiration dates should also be strictly checked.

  In addition, when the main power is off, there is also proposed a method for solving the above problems by a hardware mechanism in which an RTC (Real Time Clock) circuit that updates time information is operated by a backup battery. However, there is a problem that the price of the apparatus becomes expensive.

  Therefore, the wireless communication device 100 according to each embodiment of the present invention described below enables the wireless communication device 100 to acquire correct time information in the authentication phase.

<2. First Embodiment>
First, the functional configuration of the wireless communication apparatus according to the first embodiment of the present invention will be described. Next, an authentication method using the wireless communication apparatus according to the present embodiment will be described, and finally a modified example will be described.

  In the first embodiment, in order to check the expiration date of a certificate using correct time information, provisional authentication is performed in which the expiration date is not checked before the main authentication is performed. When the validity of the certificate is confirmed, the wireless communication apparatus 100 is in a temporary authentication state in which an IP address can be acquired and can be connected to a time server, so that time information can be acquired.

[2-1. Functional configuration]
First, the functional configuration of a wireless communication apparatus according to an embodiment of the present invention will be described with reference to FIG. FIG. 1 is a functional configuration diagram of a wireless communication apparatus according to an embodiment of the present invention.

  A wireless communication apparatus 100 according to an embodiment of the present invention connects to a wireless base station 200 via a wireless communication network. The user terminal 300 is connected via a wireless or wired communication network. Although not shown in FIG. 1, an authentication server 400, a DHCP server 500, and a time server 600 exist in the host device of the radio base station 200.

  The wireless communication device 100 is a device having a wireless communication function, and is connected to the wireless base station 200 and the user terminal 300. The radio communication device 100 is, for example, a radio relay device, and relays communication between the user terminal 300 and the radio base station 200.

  The radio base station 200 performs radio communication with the user terminal 300. The radio base station 200 can directly communicate with the user terminal 300 or can communicate via a radio relay apparatus.

  The user terminal 300 is a terminal capable of performing wireless communication. The user terminal 300 can perform wireless communication via the wireless base station 200, and can also perform wireless communication by relaying the wireless communication apparatus 100.

  The user terminal 300 may be, for example, a PC, a mobile phone, a PDA, or the like, and does not ask about the type as long as it is a communicable terminal that can be operated by the user.

  The authentication server 400 is a server that performs authentication for connecting to a communication network. The DHCP server 500 is a server that assigns an IP address to a terminal connected to a communication network. The time server is a server that provides time information.

  The radio communication apparatus 100 mainly includes a user terminal control unit 110, a radio base station control unit 120, a router function unit 130, and a data storage unit 140.

  The user terminal control unit 110 is a control unit for the wireless communication apparatus 100 to connect the user terminal 300 via a wireless or wired network. The radio base station control unit 120 is a control unit for the radio communication apparatus 100 to connect to the radio base station 200.

  The router function unit 130 includes a function for distributing packets requested by the user terminal control unit 110 and the radio base station control unit 120 and various LAN protocol functions.

  The router function unit 130 mainly includes a packet distribution unit 131, an authentication unit 132, a DHCP unit 133, and a time acquisition unit 134.

  The packet distribution unit 131 has a function of distributing packets requested from the user terminal control unit 110 and the radio base station control unit 120. The authentication unit 132 performs authentication processing for the wireless communication apparatus 100 to connect to the wireless communication network. In the present embodiment, authentication is performed using a certificate in which an expiration date is set.

  The authentication unit 132 performs authentication for connecting to the communication network using a certificate with an expiration date set. It functions as a client of the authentication server 400 and authenticates that the certificate is valid. Furthermore, it is determined whether the certificate is within the validity period set in the certificate.

  In the present embodiment, the authentication unit 132 has a function of performing main authentication performed after the time acquisition unit 134 acquires correct time information from a server having time information, and provisional authentication that does not check the expiration date.

  The DHCP unit 133 functions as a client of the DHCP server 500. An IP address is acquired from the DHCP server and set in the wireless communication apparatus 100.

  The time acquisition unit 134 is a functional unit that acquires time information from a server or the like, and acquires time information in order to keep the internal time of the wireless communication apparatus 100 accurate. In this embodiment, it functions as a client of the time server 600.

  The time acquisition unit 134 has a function of acquiring time information stored in a data storage unit, which will be described later, when time information cannot be acquired from a server having time information.

  The wireless communication apparatus 100 can be connected to the wireless communication network after authentication including the authentication of the expiration date is normally performed. However, in the present embodiment, provisional authentication is performed in which the validity period is not checked before the main authentication is performed. When the validity of the certificate is confirmed, the wireless communication apparatus 100 is in a temporary authentication state in which an IP address can be acquired and can be connected to a time server, so that time information can be acquired.

  Each functional unit of the wireless communication device 100 described above may be realized by hardware or may be realized by software. When implemented by software, a CPU (not shown) reads a program from a storage medium such as a ROM or RAM (none of which is shown) that stores a program describing the processing executed by each functional unit, and This is accomplished by interpreting and executing the program. The CPU may operate using the RAM as a work area based on a program stored in the ROM.

  The data storage unit 140 is a storage device that can store and store various data. The data storage unit 140 includes, for example, a magnetic recording medium such as a hard disk, EEPROM (Electronically Erasable and Programmable Read Only Memory), flash memory, MRAM (Magnetoresistive Random Access Memory), FeRAM (Ferroelectric Random Access Memory), PRAM ( Non-volatile memory, such as Phase change Random Access Memory), is not limited to the above.

  The data storage unit 140 has a function of storing time information. If the time information cannot be acquired when the wireless communication device 100 is activated, the time information stored in the data storage unit 140 can be used to obtain time information that is accurate to some extent. A method for avoiding a situation in which it is impossible to connect to the network will be described later.

[2-2. Authentication method]
Next, an authentication method when the wireless communication apparatus 100 according to the first embodiment connects to a wireless communication network will be described with reference to FIG. FIG. 2 is a sequence diagram illustrating an authentication method of the wireless communication device 100 according to the first embodiment.

  The wireless communication apparatus 100 according to the first embodiment of the present application performs authentication when connecting to a wireless communication network using a certificate in which an expiration date is set.

  First, the wireless communication device 100 is activated (S100). At this time, the time information managed by the OS inside the wireless communication device 100 is initialized. The wireless communication device 100 performs the operation of the wireless connection phase (S102) in order to establish a communication path with the wireless base station 200.

  Next, temporary authentication of the certificate is performed so that only authorized users can use the communication path (S104). In the conventional example, the validity and expiration date of the certificate are checked at this stage. However, in this temporary authentication phase, since the wireless communication device 100 does not have accurate time information, the normal authentication phase No certificate expiration date check is performed.

  If the temporary authentication is successful, the wireless communication apparatus 100 connects to the DHCP server 500 and acquires an IP address (S106).

  Since the wireless communication device 100 that has acquired the IP address can connect to the time server 600, the wireless communication device 100 connects to the time server 600 and acquires time information (S108). The wireless communication device 100 updates the internal clock information based on the time information acquired from the time server.

  After the wireless communication device 100 acquires accurate time information from the time server 600 in step S108, the wireless communication device 100 performs authentication including a certificate expiration date check based on the accurate time information in the main authentication phase of step S110. It becomes possible to do.

  When the communication path can be established between the radio communication apparatus 100 and the radio base station 200 as described above, the user terminal 300 performs the connection phase (S112) and the user IP acquisition phase (S114), and finally The user communication phase (S118), which is communication between the user terminal 300 and the communication partner 700, can be performed.

  As described above, in the authentication method using the wireless communication apparatus according to the first embodiment of the present invention, the wireless communication apparatus 100 connects to the time server 600 without checking the expiration date. Since the validity period is checked after obtaining the correct time information from the time server 600, the validity period can be checked accurately.

  For example, you can prevent a situation where you can connect even though you have a certificate that has expired, or you cannot connect even though you have a certificate that is still valid. Will be able to.

  Further, since the time information is acquired from the server in the connected communication network, the time of the wireless communication device 100 can be calibrated with the time information on the communication network side.

[2-3. Modified example]
Next, a modification of the first embodiment will be described with reference to FIG. FIG. 3 is a sequence diagram illustrating a modified example of the authentication method of the wireless communication device according to the first embodiment. Each step according to S100 to S118 is the same as that in FIG. Only differences from FIG. 2 will be described below.

  In the modification shown in FIG. 3, if time information cannot be acquired from the time server 600 in the time acquisition phase of FIG. 2, authentication is performed using the time information stored in the data storage unit 140. It is.

  In preparation for the case where the time information cannot be acquired from the time server 600 as described above, in this modification, the time information is stored in the data storage unit 140 after the time information is acquired from the time server 600 in step S108 (S150). In addition, when the wireless communication device 100 starts to stop (S152), the time information is stored in the data storage unit 140 (S154).

  Here, the time information is stored in the time acquisition step S108 prior to the main authentication in step S110 and the time information in the apparatus stop preparation. However, the time information is regularly backed up during this time. You may make it perform.

  As described above, even when the time information cannot be acquired from the time server 600 in the time acquisition phase of step S108 in a state where the time information is previously saved in the data storage unit 140, the data storage unit 140 stores the time information in the data storage unit 140. By checking the expiration date based on certain time information, it is possible to check the expiration date of the certificate with some accuracy.

  For example, if the wireless communication device 100 becomes unable to connect to the wireless communication network when the connection to the time server 600 becomes impossible, the maintenance staff can wirelessly connect from the remote even if the wireless communication device 100 needs to be maintained. The communication device 100 cannot be operated, and the user only has to go to the place where the wireless communication device 100 is installed.

  When the number of managed wireless communication devices 100 is large or when the wireless communication devices 100 are installed far away, it is very time-consuming to go to each installation location and perform maintenance work. A method for enabling the wireless communication apparatus 100 to connect to the wireless communication network using the saved time information as in the modified example is effective.

  In the authentication method described above, as a method for acquiring time information before performing the certificate expiration date check, in the first embodiment, provisional authentication is performed without performing the expiration date check in the certificate authentication. The wireless communication apparatus 100 can acquire an IP address and connect to the time server 600 before checking the expiration date.

<3. Second Embodiment>
In the second embodiment to be described next, the wireless communication device 100 attempts to acquire time information using the exchange of existing messages at the MAC layer level between the wireless communication device 100 and the wireless base station 200. .

  In the present embodiment, an example will be described in which time information is acquired using a frame format based on a WiMAX communication method defined in IEEE 802.16e.

[3-1. Functional configuration]
A configuration of the wireless communication apparatus 100 according to the present embodiment will be described with reference to FIG. FIG. 4 is a block diagram illustrating a functional configuration of the wireless communication apparatus 100 according to the second embodiment. The functional configuration of the wireless communication apparatus 100 according to the second embodiment and the wireless communication apparatus 100 according to the first embodiment shown in FIG. 1 are the authentication unit 132, the internal processing in the time acquisition unit 134, and the wireless base station 200. The wireless communication apparatus control unit 210 is different in that a function is added.

  Hereinafter, only the parts different from the wireless communication apparatus 100 according to the first embodiment shown in FIG. 1 will be described, and the other configurations are the same, and the description thereof will be omitted. The radio base station control unit 120 is a functional unit that controls communication with the radio base station 200. In this embodiment, the radio base station control unit 120 also has a function of controlling message exchange in the MAC layer particularly in a phase of establishing a communication path with the radio base station.

  The authentication unit 132 functions as a client of the authentication server 400, and confirms that the certificate is valid, a certificate stored in the wireless communication device 100, and a certificate stored in the authentication server 400. Use to authenticate. Furthermore, it is determined whether the certificate is within the validity period set in the certificate.

  In this embodiment, after the time acquisition unit 134 acquires time information from messages exchanged between the radio base station control unit 120 and the radio communication device control unit 210, the authentication unit 132 determines that the radio communication device 100 Authenticate to connect to the wireless communication network.

  The time acquisition unit 134 is a functional unit that acquires time information. It functions as a client of the time server, or acquires time information from messages exchanged between the radio base station control unit 120 and the radio communication device control unit 210.

  The wireless communication device control unit 210 is a control unit for connecting to the wireless communication device 100. In the present embodiment, the wireless communication device control unit 210 mainly has a function of controlling message exchange in the MAC layer particularly in a phase of establishing a communication path with the wireless communication device.

[3-2. Authentication method]
Next, authentication when the wireless communication apparatus 100 according to the second embodiment of the present application connects to a wireless communication network will be described with reference to FIG. FIG. 5 is a sequence diagram illustrating an authentication method of the wireless communication device 100 according to the second embodiment.

  First, it is assumed that the radio base station 200 has acquired accurate time information from the time server 600 or the like. Next, the wireless communication device 100 is activated (S200). At this time, the time information inside the wireless communication device 100 is initialized.

  After the wireless communication device 100 is activated in step S200, the wireless communication device 100 receives wireless notification information from the wireless base station 200 (S202). Here, the wireless broadcast information is information periodically transmitted, and DL-MAP corresponds to it in WiMAX. DL-MAP is information in which various initialization parameters in communication are described.

  After the wireless communication apparatus 100 starts wireless connection in step S204, wireless timing, output, frequency adjustment, and the like are performed by ranging (S206). Next, in basic function confirmation step S208, information necessary for wireless communication is negotiated.

  In the basic function confirmation step S208, the wireless communication device 100 acquires time information from the wireless base station 200 by using message exchange between the wireless communication device 100 and the wireless base station 200. In WiMAX, the basic function confirmation is performed between the SBC-REQ that is a message in the direction from the radio communication apparatus 100 to the radio base station 200 and the SBC-RSP that is a message in the direction from the radio base station 200 to the radio communication apparatus 100. This corresponds to step S208.

  In the present invention, the wireless communication device 100 can acquire time information by adding time information that is not defined in the standard in the exchange of messages for confirming the basic function, and this time is obtained in the subsequent authentication step S210. Authenticate the certificate expiration date based on the information.

  After being authenticated in the authentication step S210, the IP address is acquired through the registration step S212 and the IP address acquisition step S214 to the base station, and IP communication becomes possible. Note that accurate time information is acquired from the time server 600 when IP communication becomes possible (S216).

  Henceforth, since each step (S218-S224) of user connection is the same as that of 1st Embodiment, description is abbreviate | omitted. Also in the wireless communication apparatus 100 according to the second embodiment, the time of the wireless communication apparatus 100 can be calibrated with the time information on the communication network side to which the wireless communication apparatus 100 is connected.

  Further, as described in the first embodiment, the time information is stored in the data storage unit 140, and the time information stored as an alternative means when the time information cannot be acquired from the radio base station 200 is stored. It may be used.

  In that case, the wireless communication device 100 obtains the time information after obtaining time information from the message exchanged in the basic function confirmation phase in step S208 or after obtaining time information from the time server 600 in the time information acquisition phase in step S216, for example. The data is stored in the data storage unit 140. Similarly to FIG. 3, the wireless communication device 100 may store time information in the data storage unit when stopping.

[3-3. Frame configuration]
Next, as a specific example of the message for confirming the basic function, an example using a frame defined in the WiMAX communication method will be described with reference to FIGS. FIG. 6 is an explanatory diagram showing the frame format of messages exchanged in the basic function confirmation of this embodiment. FIG. 7 is an example of the contents of the TLV format portion of the frame of FIG.

  In the present embodiment, in the basic function confirmation phase, an SBC-REQ that is an existing message and a message in the direction from the radio communication apparatus 100 to the radio base station 200, and a message in the direction from the radio base station 200 to the radio communication apparatus 100. The radio communication apparatus 100 acquires time information from the radio base station 200 using the SBC-RSP exchange.

  SBC-REQ and SBC-RSP are messages transmitted and received in the MAC layer between the radio communication apparatus 100 and the radio base station 200.

As shown in FIG. 6, the SBC-REQ 60 mainly includes a MAC header 61, a payload 62, and a CRC 63. The Payload 62 includes a Management Message Type 64 and a TLV format 65 portion, and the structure of the Payload 62 is as follows.
SBC-REQ_Message_Format () {
Management Message Type = 26 (8 bits)
TLV Encoded Information (TLV specific)
}

  The TLV format is a format composed of three areas: Type 651, Length 652, and Value 653. Among these, the type number represents the type of the message, but the SBC-REQ prescribed type is also defined in the WiMAX communication method. This time, using this TLV65 area, a new type number that is free for time information transmission / reception is defined, and a time information request message is sent from the radio communication apparatus 100 to the radio base station 200.

  After transmitting the time information acquisition request from the radio communication apparatus 100 to the radio base station 200 using the SBC-REQ message as described above, the radio base station 200 uses the SBC-RSP message to send time information to the radio communication apparatus 100. Send information.

The frame format of the SBC-RSP message will be described with reference to FIG. 6, similar to the SBC-REQ message. The SBC-RSP 60 mainly includes a MAC header 61, a payload 62, and a CRC 63. The Payload 62 includes a Management Message Type 64 and a TLV format 65 portion, and its structure is as follows.
SBC-RSP_Message_Format () {
Management Message Type = 27 (8 bits)
TLV Encoded Attributes (TLV specific)
}

  As shown in FIG. 7, the SBC-RSP message also defines a new empty type number in the same way as the SBC-REQ message, and the radio base station 200 transmits time information to the radio communication apparatus 100 using the Value area. .

<4. Summary>
As described above, in order to solve the problem that the validity period of the certificate cannot be correctly checked because the internal clock does not have the correct time information at the time of authentication in the conventional wireless communication apparatus, for example, hardware such as an RTC circuit and a backup battery. Several methods that do not use a general mechanism have been listed.

  In either method, the correct expiration date can be checked by acquiring the correct time information before the certificate expiration date check, and the authentication is performed based on the incorrect time information. Since the wireless communication device 100 cannot be connected to the wireless communication network, it is possible to avoid a situation in which the maintenance work must be performed by visiting the place where the wireless communication device 100 is installed.

  As mentioned above, although preferred embodiment of this invention was described in detail, referring an accompanying drawing, it cannot be overemphasized that this invention is not limited to this example. It is obvious that a person having ordinary knowledge in the technical field to which the present invention pertains can come up with various changes or modifications within the scope of the technical idea described in the claims. Of course, it is understood that these also belong to the technical scope of the present invention.

  For example, in the above embodiment, the wireless communication device 100 acquires time information from the wireless base station 200, but the present invention is not limited to such an example. The type is not limited as long as the device can exchange messages with the wireless communication device 100 at the MAC layer level.

  Further, for example, in the above embodiment, the time information is acquired using the WiMAX SBC-REQ and SBC-RSP messages, but the present invention is not limited to this example. A message that can be connected to the wireless communication apparatus 100 and that has accurate time information and is transmitted and received between the wireless communication apparatus 100 and the type of the message is limited as long as it can secure a necessary data size. is not.

  In the present specification, the steps described in the sequence diagram are not necessarily processed in time series in addition to the processes performed in time series in the described order, but in parallel or individually. Also includes processing to be performed. Further, it goes without saying that the order can be appropriately changed even in the steps processed in time series.

DESCRIPTION OF SYMBOLS 100 Wireless communication apparatus 132 Authentication part 134 Time acquisition part 200 Wireless base station 300 User terminal 400 Authentication server 500 DHCP server 600 Time server

Claims (7)

A wireless communication apparatus for connecting a server capable of transmitting time information and a communication identifier distribution server via a communication network,
A time acquisition unit for acquiring time information from the server;
An authentication unit that performs authentication for connecting to the communication network using a certificate with an expiration date set;
With
When the authentication unit authenticates that the wireless communication device is connected to the communication network without authenticating the expiration date of the certificate, the wireless communication device acquires a communication identifier from the communication identifier distribution server. A wireless communication apparatus that enables use of a communication path and authenticates an expiration date after the time acquisition unit acquires correct time information from the server. The server is a radio base station;
The time acquisition unit transmits a first message including a time information acquisition request to the radio base station, and acquires the time information from a second message that is a response message of the first message and includes time information. The wireless communication device according to claim 1.   The wireless communication device according to claim 2, wherein the first message and the second message are transmitted and received in a MAC layer between the wireless base station and the wireless communication device using a predetermined frame.   The wireless communication apparatus according to claim 2, wherein the predetermined frame has a TLV field, and the time information acquisition request and the time information are transmitted and received using the TLV field. .   The wireless communication device according to claim 1, wherein the time acquisition unit acquires the time information and stores the time information in a data storage unit. The time acquisition unit acquires the time information stored in the data storage unit when the time information could not be acquired from the server,
The wireless communication apparatus according to claim 5, wherein the authentication unit authenticates the expiration date using time information acquired from the data storage unit. A wireless communication device connected via a communication network to a first server capable of transmitting time information and a second server capable of distributing a communication identifier connects to the communication network using a certificate with an expiration date set. An authentication method for performing authentication for
Tentatively authenticating that the wireless communication device connects to the communication network without the wireless communication device authenticating the expiration date of the certificate;
After the temporary authentication is successful, the wireless communication device obtains a communication identifier from the second server and allows the communication path to be used;
Connecting the wireless communication device to the first server;
The wireless communication device obtaining time information from the first server;
Authenticating an expiration date of the certificate based on the time information;
A method for authenticating a wireless communication device including:

Images