JP4776283B2 - Wireless LAN system and communication method - Google Patents

Description

  The present invention relates to a wireless LAN system in which a wireless LAN terminal communicates via an access point.

  Conventionally, wireless LAN systems that perform communication based on standards such as IEEE802.11a and IEEE802.11b are known. In the wireless LAN system, when a plurality of access points are installed and within the access area of the access point, by switching the access point that relays communication data, even if the wireless LAN terminal moves, Wireless communication based on a wireless LAN can be performed via an access point.

  In a wireless LAN system, a wireless LAN terminal communicates via an access point using radio waves. Therefore, if a wireless LAN terminal is within a range where the radio waves of the access point can reach, the wireless LAN terminal can communicate via the access point. There are cases where you can For this reason, other wireless LAN terminals used by malicious users may cause a large amount of unnecessary packets to flow over the network via the access point, or may be illegally accessed by other servers in the network. . For this reason, communication via an access point may be permitted only for a wireless LAN terminal that has been successfully authenticated.

  However, if authentication as described above is performed for each access point, authentication with the access point must be performed each time so-called roaming is performed in which the relay access point is switched as the wireless LAN terminal moves. In some cases, the communication data required for the authentication may reduce the effective communication data transmission speed. In order to avoid this, in Patent Document 1, when an authentication server authenticates a wireless LAN terminal and the authentication is successful, the identification information of the wireless LAN terminal that has been successfully authenticated is sent to the access point managed by the authentication server. And the authentication when the wireless LAN terminal that has been authenticated switches the access point by roaming is omitted.

JP 2004-135055 A

  By the way, a wireless LAN terminal usually performs roaming by switching the relay destination of communication data to an access point having the strongest received electric field strength. For example, in FIG. 12 showing the configuration of the conventional wireless LAN system 100, a plurality of access points 101-1 to 101-5 are arranged, and the wireless LAN terminal is connected to the access point 101- from the vicinity of the access point 101-1. Consider the case of moving to the vicinity of 2.

  In FIG. 12, in the area A, the radio wave from the access point 101-1 or the access point 101-2 reaches the wireless LAN terminal 103 with sufficient strength to perform communication, and the wireless LAN terminal 103 Wireless communication based on the wireless LAN can be performed via the point 101-1 or the access point 101-2. The authentication server 102-1 permits the access point 101-1 or the access point 101-2 to relay the communication data of the wireless LAN terminal 103. The authentication server 102-2 includes the access point 101-3, the access point The relay of communication data of the wireless LAN terminal 103 by the access point 101-4 or the access point 101-5 is not permitted.

  In FIG. 12, if the wireless LAN terminal 103 performs roaming by switching the relay destination of communication data to an access point having the strongest received electric field strength, the wireless LAN terminal 103 moves near the access point 101-4. If it passes, the communication data relay destination may be switched from the access point 101-1 to the access point 101-4.

  Since the authentication server 102-2 does not permit the relay of communication data of the wireless LAN terminal 103 by the access point 101-4, the wireless LAN terminal 103 tries useless authentication to the access point 101-4. If communication is performed through the authenticated access point 101-1 or access point 101-2, the access point switching time by roaming may be about several tens of ms, but the authentication process is performed during the access point switching process. If this is done, it may take several seconds to switch the access points.

  Therefore, data transmission / reception between the wireless LAN terminal 103 and another communication device is interrupted for several seconds until the switching of the access point is completed. Furthermore, if the authentication is not successful, it is necessary to switch the communication data relay destination to another access point, and the communication data transmission / reception interruption time may become longer. For this reason, the communication link may be disconnected or a long silent portion may occur during a voice call such as VoIP, which may hinder communication.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to shorten communication interruption time when a wireless LAN terminal switches a relay destination access point during communication. To do.

  In order to solve the above problems, when the wireless LAN terminal of the present invention succeeds in authentication with the authentication server, the wireless LAN terminal acquires from the authentication server a list of access points that are permitted to relay communication data due to the success of the authentication. When roaming, the access point in the acquired list is preferentially roamed.

For example, the present invention is a wireless LAN system including a wireless LAN terminal, a plurality of access points, and an authentication server that permits or prohibits relaying of communication data of the wireless LAN terminal by the access points,
The authentication server
AP identification information storage means for storing in advance a list of identification information of access points managed by itself;
Server-side authentication means for authenticating the wireless LAN terminal via the access point;
When the authentication by the server side authentication unit is successful, the permitted terminal ID transmission unit that transmits the identification information of the wireless LAN terminal that has been successfully authenticated to each of the access points corresponding to the identification information stored in the AP identification information storage unit When,
Receives a response indicating that relaying is permitted or denied from an access point to which identification information of a wireless LAN terminal that has been successfully authenticated has been transmitted, and creates a list that includes the identification information of the access point that has transmitted a response indicating that relaying is permitted AP list creation means to
AP list transmission means for transmitting the list created by the AP list creation means to the wireless LAN terminal that has been successfully authenticated via the access point;
Have
The access point
Relay restricting means for rejecting relay of communication from a wireless LAN terminal of predetermined identification information and permitting relay of communication from a wireless LAN terminal of other identification information;
Authorized terminal ID storage means for storing identification information of the wireless LAN terminal authenticated by the authentication server;
When the identification information of the authenticated wireless LAN terminal is received from the authentication server, if relay of communication from the wireless LAN terminal corresponding to the identification information is permitted by the relay restriction unit, the received wireless LAN terminal If the identification information is stored in the permitted terminal ID storage means and a response indicating that relaying is permitted is returned to the authentication server, and relaying of communication from the wireless LAN terminal corresponding to the identification information is rejected by the relay restriction means , Without allowing the received identification information of the wireless LAN terminal to be stored in the permitted terminal ID storage means, the permitted terminal ID receiving means for returning a response indicating that the relay is rejected to the authentication server ;
Communication relay means for relaying communication data from the wireless LAN terminal;
When the wireless LAN terminal is requested to relay communication data, if the identification information of the wireless LAN terminal that requested the relay is stored in the permitted terminal ID storage means, the communication relay means is instructed to relay the communication data. Relay identification means for instructing the communication relay means to relay the communication data only to the authentication server when the identification information of the wireless LAN terminal that requested the relay is not stored in the permitted terminal ID storage means ;
Have
Wireless LAN terminal
Relayable AP information receiving means for receiving a list of identification information of the access point from the authentication server via the access point;
Relayable AP information storage means for storing a list of identification information of access points received by the relayable AP information receiving means;
A terminal-side authentication unit that authenticates with the authentication server via the access point when there is no list of identification information of the access point in the relayable AP information storage unit;
A communication means for communicating with other communication devices via an access point;
Based on the reception quality of the signal transmitted from the access point, the access point that requests relay of communication data is determined from the access points corresponding to the identification information in the relayable AP information storage means, and the determined access point is a relay destination determining unit for instructing the communication unit to communicate over,
A wireless LAN system is provided.

  ADVANTAGE OF THE INVENTION According to this invention, when a wireless LAN terminal switches a relay destination access point during communication, communication interruption time can be shortened.

  Hereinafter, a first embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 shows a configuration of a wireless LAN system 10 according to an embodiment of the present invention. The wireless LAN system 10 includes an authentication server 20, a wireless LAN terminal 40, and a plurality of access points 30.

  The authentication server 20 authenticates the wireless LAN terminal 40 via any one of the plurality of access points 30. When the authentication of the wireless LAN terminal 40 is successful, the authentication server 20 notifies the identification information of the wireless LAN terminal 40 that has been successfully authenticated to each of the plurality of access points 30 that it manages. The relay of the wireless LAN terminal 40 is permitted. Furthermore, the authentication server 20 notifies the identification information of the plurality of access points 30 managed by the authentication server 20 to the wireless LAN terminal 40 that has been successfully authenticated via any one of the access points 30.

  The access point 30 relays the communication data from the wireless LAN terminal 40 notified from the authentication server 20 as being authenticated in accordance with the destination included in the communication data. On the other hand, the access point 30 relays only communication data from the wireless LAN terminal 40 other than the wireless LAN terminal 40 notified from the authentication server 20 as being authenticated to the authentication server 20.

  The wireless LAN terminal 40 has a roaming function for switching the relay destination access point 30 as it moves. For example, the wireless LAN terminal 40 performs authentication with the authentication server 20 via the access point 30 having the strongest received electric field strength. When the authentication is successful, the wireless LAN terminal 40 acquires an AP list that is a list of identification information of the access point 30 permitted to relay via the access point 30. Then, the wireless LAN terminal 40 preferentially roams with respect to the access point 30 included in the AP list acquired from the authentication server 20.

  For example, in the wireless LAN terminal 40, there is an access point 30 having a stronger received electric field strength than the current relay destination access point 30, and the identification information of the access point 30 is stored in the AP list acquired from the authentication server 20. If included, the wireless LAN terminal 40 roams to the access point 30.

  In addition, when the received electric field strength from the current relay destination access point 30 is less than a predetermined value, the wireless LAN terminal 40 accesses the received electric field strength that is equal to or higher than the predetermined value in the AP list acquired from the authentication server 20. If the point 30 does not exist, roaming is attempted to the access point 30 having the strongest received electric field strength among the access points 30 other than the access point 30 included in the AP list acquired from the authentication server 20.

  As a result, as shown in FIG. 12, even if the wireless LAN terminal 40 of this embodiment moves to the vicinity of an access point where authentication is not permitted, the wireless LAN terminal 40 of the present embodiment has identification information in the AP list acquired from the authentication server. It is possible to preferentially roam to an access point corresponding to. Therefore, the wireless LAN terminal 40 according to the present embodiment can keep communication appropriately without performing useless authentication processing.

  FIG. 2 is a block diagram illustrating an example of a detailed configuration of the authentication server 20 in the first embodiment. The authentication server 20 includes an AP list storage unit 21, an AP list transmission unit 22, an authentication unit 23, and a permitted terminal ID transmission unit 24.

  The AP list storage unit 21 stores identification information of the access point 30 managed by the authentication server 20. The identification information stored in the AP list storage unit 21 is, for example, the MAC address of each access point 30. When accessed from the wireless LAN terminal 40 via the access point 30, the authentication unit 23 performs authentication processing with the accessed wireless LAN terminal 40. Then, when the authentication of the wireless LAN terminal 40 is successful, the authentication unit 23 notifies the AP list transmission unit 22 and the permitted terminal ID transmission unit 24 of identification information of the wireless LAN terminal 40 that has been successfully authenticated. The identification information of the wireless LAN terminal 40 is, for example, the MAC address of the wireless LAN terminal 40.

  The AP list transmission unit 22 refers to the AP list storage unit 21 when the identification information of the wireless LAN terminal 40 that has been successfully authenticated is notified from the authentication unit 23, and the access point 30 managed by the authentication server 20. AP list that is a list of the identification information is acquired, and the acquired AP list is transmitted to the wireless LAN terminal 40 that has been successfully authenticated via the access point 30. Thereby, the wireless LAN terminal 40 can acquire an AP list that is a list of authenticated access points 30.

  The permitted terminal ID transmission unit 24 stores the notified identification information of the wireless LAN terminal 40 in the AP list storage unit 21 when the identification unit 23 is notified of the identification information of the wireless LAN terminal 40 that has been successfully authenticated. It transmits to each of the access points 30 corresponding to the identification information. Thereby, each access point 30 can acquire the identification information of the authenticated wireless LAN terminal 40.

  FIG. 3 is a block diagram illustrating an example of a detailed configuration of the access point 30 in the first embodiment. The access point 30 includes a communication relay unit 31, a permitted terminal ID storage unit 32, a relay determination unit 33, and a permitted terminal ID reception unit 34.

  The authorized terminal ID receiving unit 34 receives the authorized terminal ID, which is identification information of the wireless LAN terminal 40 that has been successfully authenticated, from the authorized terminal ID transmitting unit 24 of the authentication server 20 and adds it to the authorized terminal ID storage unit 32. And store. As another example, the permitted terminal ID receiving unit 34 stores the date and time when the permitted terminal ID is received in the permitted terminal ID storage unit 32 in association with the permitted terminal ID. For example, the permitted terminal ID for which a predetermined period such as one month has elapsed may be deleted. Thereby, the wireless LAN terminal 40 can be periodically authenticated by the authentication server 20, and the security of the wireless LAN system 10 can be maintained appropriately.

  The communication relay unit 31 receives communication data from the wireless LAN terminal 40, extracts identification information of the transmission source wireless LAN terminal 40 included in the received communication data, and sends the identification information to the relay determination unit 33. When receiving a relay permission notification from the relay determination unit 33, the communication relay unit 31 relays the communication data to the destination communication device included in the communication data. When receiving a relay failure notification from the relay determination unit 33, the communication relay unit 31 relays the communication data to the authentication server 20.

  When the relay determination unit 33 receives the identification information of the wireless LAN terminal 40 that is the transmission source of communication data from the communication relay unit 31, the relay determination unit 33 refers to the permitted terminal ID storage unit 32, and the identification information is the permitted terminal ID storage unit. It is determined whether or not it matches any one of the permitted terminal IDs stored in 32. When the identification information matches one of the permitted terminal IDs in the permitted terminal ID storage unit 32, the relay determination unit 33 notifies the communication relay unit 31 of relay permission. On the other hand, when the identification information does not match any of the permitted terminal IDs in the permitted terminal ID storage unit 32, the relay determination unit 33 notifies the communication relay unit 31 that relaying is impossible.

  Thereby, the access point 30 can relay only the communication data from the authenticated wireless LAN terminal 40 according to the destination included in the communication data, and also allows the authentication server 20 to authenticate the wireless LAN terminal 40 that has not been authenticated. be able to.

  FIG. 4 is a block diagram illustrating an example of a detailed configuration of the wireless LAN terminal 40. The wireless LAN terminal 40 includes an AP list reception unit 41, an AP list storage unit 42, an authentication unit 43, a relay AP determination unit 44, and a communication unit 45.

  The AP list receiving unit 41 receives the AP list from the authentication server 20 via the access point 30 and stores the received AP list in the AP list storage unit 42. When the old AP list is stored in the AP list storage unit 42, the AP list receiving unit 41 updates the old AP list with the latest AP list acquired from the authentication server 20.

  The AP list storage unit 42 stores NULL data as initial data. In this example, the AP list storage unit 42 is configured by a non-volatile memory such as an HDD or a Flash-ROM that can continue to store data even when the power is turned off.

  The authentication unit 43 authenticates with the authentication server 20 via the access point 30 when instructed by the relay AP determination unit 44. If the authentication is successful, the authentication unit 43 notifies the communication unit 45 to that effect. The communication unit 45 starts transmission / reception of communication data via the access point 30 when receiving an authenticated notification from the authentication unit 43. The communication unit 45 roams to the access point 30 when instructed by the relay AP determination unit 44 to be the roaming destination access point 30.

  The relay AP determination unit 44 performs channel scanning by measuring the reception quality of the beacon transmitted by the access point 30 in the vicinity of the wireless LAN terminal 40. In this example, the relay AP determination unit 44 measures the received electric field strength as the reception quality of the beacon transmitted by the access point 30.

  When the NULL data is stored in the AP list storage unit 42, the relay AP determination unit 44 causes the authentication unit 43 to perform authentication with the authentication server 20 via the access point 30 having the strongest received electric field strength. Then, the AP list receiving unit 41 acquires the AP list from the authentication server 20 via the access point 30 and stores it in the AP list storage unit 42.

  Then, as the wireless LAN terminal 40 moves, the received electric field strength from the access point 30 changes, and radio waves with sufficient strength to communicate are not received from any of the access points 30 included in the AP list. In this case, the relay AP determination unit 44 determines whether or not a radio wave having a sufficient strength for communication is received from the access point 30 other than the AP list. When a sufficiently strong radio wave arrives, the relay AP determination unit 44 causes the authentication unit 43 to perform authentication with the authentication server 20 via the access point 30 having the strongest received electric field strength, for example.

  Further, the relay AP determination unit 44 measures the received electric field strength from the other access point 30 while the communication unit 45 is communicating with another communication device via the access point 30. Then, when the received electric field strength is stronger than the access point 30 that is currently communicating and there is an access point 30 included in the AP list, the relay AP determining unit 44 sends the communication unit 45 to the access point 30. Instruct roaming.

  In this way, the wireless LAN terminal 40 has a stronger received electric field strength than the access point 30 that is currently communicating, and roams to the access point 30 included in the AP list. Therefore, as shown in FIG. However, since the received electric field strength is strong, roaming is not performed and authentication processing is not required. Therefore, the wireless LAN terminal 40 can preferentially roam to the authenticated access point 30 and can prevent communication from being interrupted for a long time by the authentication process.

  As another example, the AP list reception unit 41 stores the date and time when the AP list is received in the AP list storage unit 42 in association with the list, and the AP list storage unit 42 stores a predetermined date such as one month, for example. You may make it delete AP list which passed the period. As a result, the authentication unit 43 periodically authenticates with the authentication server 20 and can maintain the security of the wireless LAN system 10 appropriately.

  FIG. 5 is a flowchart illustrating an example of the operation of the authentication server 20. For example, at a predetermined timing such as power-on, the authentication server 20 starts the processing shown in this flowchart.

  First, the authentication unit 23 determines whether or not an access is made from the wireless LAN terminal 40 via any access point 30 (S100). If not accessed from the wireless LAN terminal 40 (S100: No), the authentication unit 23 repeats Step 100 until accessed.

  When accessed from the wireless LAN terminal 40 (S100: Yes), the authentication unit 23 performs authentication processing with the accessed wireless LAN terminal 40 (S101). Then, the authentication unit 23 determines whether or not the authentication is successful (S102). When the authentication is not successful (S102: No), the authentication unit 23 performs the process shown in Step 100 again.

  When the authentication is successful (S102: Yes), the authentication unit 23 notifies the AP list transmission unit 22 and the permitted terminal ID transmission unit 24 of the identification information of the wireless LAN terminal 40 that has been successfully authenticated. The permitted terminal ID transmission unit 24 transmits the notified identification information of the wireless LAN terminal 40 to each of the access points 30 corresponding to the identification information stored in the AP list storage unit 21 (S103). Next, the AP list transmission unit 22 transmits the AP list stored in the AP list storage unit 21 to the wireless LAN terminal 40 that has been successfully authenticated (S104), and the authentication unit 23 again performs the processing shown in step 100. I do.

  FIG. 6 is a flowchart showing an example of the operation of the access point 30. For example, the access point 30 starts the processing shown in this flowchart at a predetermined timing such as when the power is turned on.

  First, the communication relay unit 31 determines whether communication data is received from the wireless LAN terminal 40 (S200). When the communication data is not received from the wireless LAN terminal 40 (S200: No), the permitted terminal ID receiving unit 34 determines whether the permitted terminal ID is received from the authentication server 20 (S204). When the permitted terminal ID has not been received (S204: No), the communication relay unit 31 performs the process shown in step 200 again.

  When the permitted terminal ID is received (S204: Yes), the permitted terminal ID receiving unit 34 stores the received permitted terminal ID in the permitted terminal ID storage unit 32 (S205), and the communication relay unit 31 returns to step 200 again. Perform the indicated process.

  In step 200, when communication data is received from the wireless LAN terminal 40 (S200: Yes), the communication relay unit 31 extracts the identification information of the wireless LAN terminal 40 that is the transmission source of the communication data from the communication data, and performs relay determination. Notify unit 33. Then, the relay determination unit 33 refers to the permitted terminal ID storage unit 32 and determines whether or not the identification information notified from the communication relay unit 31 exists in the permitted terminal ID storage unit 32 (S201).

  When it does not exist in the permitted terminal ID storage unit 32 (S201: No), the relay determination unit 33 notifies the communication relay unit 31 that relaying is impossible. Then, the communication relay unit 31 relays the received communication data to the authentication server 20 (S202), and the communication relay unit 31 performs the process shown in step 200 again.

  When the identification information notified from the communication relay unit 31 exists in the permitted terminal ID storage unit 32 (S201: Yes), the relay determination unit 33 notifies the communication relay unit 31 of the relay permission. Then, the communication relay unit 31 relays the received communication data to the destination communication device included in the communication data (S203), and the communication relay unit 31 performs the process shown in step 200 again.

  FIG. 7 is a flowchart showing an example of the operation of the wireless LAN terminal 40. For example, the wireless LAN terminal 40 starts the processing shown in this flowchart at a predetermined timing such as when the power is turned on.

  First, the relay AP determination unit 44 refers to the AP list storage unit 42 and determines whether or not an AP list is stored in the AP list storage unit 42 (S300). When the AP list is stored (S300: Yes), the relay AP determination unit 44 performs channel search to measure the received electric field strength from the access point 30 in the vicinity of the wireless LAN terminal 40 (S301). . Then, the relay AP determination unit 44 refers to the AP list storage unit 42 and determines whether or not the identification information of the access point 30 having a received electric field strength equal to or greater than a predetermined value is in the AP list (S302).

  When the identification information of the access point 30 having the received electric field strength equal to or greater than the predetermined value is not in the AP list (S302: No), the authentication unit 43 performs the process shown in step 304. When the identification information of the access point 30 having the received electric field strength equal to or greater than the predetermined value is in the AP list (S302: Yes), the communication unit 45 starts communication in accordance with an instruction from the user of the wireless LAN terminal 40 It is determined whether or not to perform (S306). When the communication is not started (S306: No), the relay AP determination unit 44 performs the process shown in Step 301 again.

  In step 300, when the AP list is not stored in the AP list storage unit 42 (S300: No), the relay AP determination unit 44 performs a channel search to thereby access the access point 30 in the vicinity of the wireless LAN terminal 40. The received electric field strength from is measured (S303). Then, the relay AP determination unit 44 instructs the authentication unit 43 to perform authentication through the access point 30 having the strongest received electric field strength. The authentication unit 43 performs authentication with the authentication server 20 via the access point 30 instructed by the relay AP determination unit 44 (S304).

  When the authentication is successful, the AP list receiving unit 41 receives the AP list from the authentication server 20 via the access point 30. Then, the AP list receiving unit 41 stores the received AP list in the AP list storage unit 42 (S305), and the communication unit 45 performs the processing shown in step 306. If the authentication is not successful in step 304, the authentication unit 43 performs authentication through the access point 30 having the next strong received electric field strength.

  In step 306, when communication is started in response to an instruction from the user of the wireless LAN terminal 40 (S306: Yes), the relay AP determination unit 44 refers to the AP list storage unit 42 and is the most in the AP list. The communication unit 45 is notified of identification information of the access point 30 having a strong received electric field strength. And then. The communication unit 45 starts communication with another communication device via the access point 30 notified from the relay AP determination unit 44 (S307).

  Next, the relay AP determination unit 44 measures the received electric field strength from the access point 30 in the vicinity of the wireless LAN terminal 40 by performing a channel search (S308). Then, the relay AP determination unit 44 determines whether or not there is an access point 30 that is included in the AP list and has a stronger received electric field strength than the access point 30 that is currently communicating (S309).

  When there is an access point 30 that is included in the AP list and has a stronger received electric field strength than the access point 30 that is currently communicating (S309: Yes), the relay AP determining unit 44 identifies the access point 30 by identifying information. At the same time, the communication unit 45 is notified that the access point 30 should be roamed. Then, the communication unit 45 roams to the access point 30 notified from the relay AP determination unit 44 (S310).

  Next, the communication unit 45 determines whether or not to end communication in accordance with an instruction from the user of the wireless LAN terminal 40 (S311). When the communication is to be ended (S311: Yes), the communication unit 45 ends the communication (S312), and the relay AP determination unit 44 performs the process shown in step 301 again. When the communication is continued (S311: No), the relay AP determination unit 44 performs the process shown in Step 308 again.

  In step 309, when the received electric field strength from the access point 30 currently communicating is the strongest in the AP list (S309: No), the relay AP determining unit 44 receives the received electric field strength from the access point 30 currently communicating. Is less than a predetermined value (S313). When the received electric field intensity from the access point 30 currently communicating is equal to or higher than the predetermined value (S313: No), the communication unit 45 performs the process shown in step 311.

  When the received electric field strength from the currently communicating access point 30 is less than the predetermined value (S313: Yes), the relay AP determining unit 44 accesses other than the access point 30 in the AP list whose received electric field strength is equal to or higher than the predetermined value. It is determined whether or not the point 30 exists (S314). If there is no access point 30 with the received electric field strength equal to or higher than the predetermined value other than the access point 30 in the AP list (S314: No), the communication unit 45 performs the process shown in step 312.

  When there is an access point 30 whose received electric field strength is not less than the predetermined value other than the access point 30 in the AP list (S314: Yes), the relay AP determining unit 44 passes through the access point 30 having the strongest received electric field strength. The authentication unit 43 is instructed to perform authentication. The authentication unit 43 performs authentication with the authentication server 20 via the access point 30 instructed by the relay AP determination unit 44 (S315). When the authentication is successful, the AP list receiving unit 41 receives the AP list from the authentication server 20 via the access point 30. Then, the AP list reception unit 41 stores the received AP list in the AP list storage unit 42 (S316), and the relay AP determination unit 44 performs the process shown in step 308 again.

  The first embodiment of the present invention has been described above.

  As described above, according to the wireless LAN system 10 of the present embodiment, during the communication, the authenticated access point 30 is preferentially roamed, so that the communication interruption time during the roaming can be shortened. it can.

  Next, a second embodiment of the present invention will be described.

  FIG. 8 is a block diagram illustrating an example of a detailed configuration of the authentication server 20 in the second embodiment. The authentication server 20 includes an AP list storage unit 21, an AP list transmission unit 22, an authentication unit 23, a permitted terminal ID transmission unit 24, and an AP list creation unit 25. Except for the points described below, in FIG. 8, the components denoted by the same reference numerals as those in FIG. 2 have the same or similar functions as those in FIG.

  In the present embodiment, each of the plurality of access points 30 managed by the authentication server 20 has a MAC address filtering function individually. Therefore, even if the authentication server 20 is a wireless LAN terminal 40 that is permitted to relay, there may be an access point 30 that is not permitted to be relayed by the MAC address filtering function.

  In order to avoid this, the authentication server 20 of the present embodiment is configured to reject communication from the wireless LAN terminal 40 by the MAC address filtering function even if the authentication is successful. The identification information of the existing access point 30 is deleted from the AP list transmitted to the wireless LAN terminal 40 and transmitted to the wireless LAN terminal 40.

  When each access point 30 is notified of the permitted terminal ID from the permitted terminal ID transmission unit 24, each access point 30 determines whether or not the permitted terminal ID should be rejected by the MAC address filtering function set in itself. Each access point 30 transmits a rejection response to the AP list creation unit 25 when it should be rejected, and transmits a permission response to the AP list creation unit 25 when it should be permitted.

  The AP list creation unit 25 receives the permission response or the rejection response transmitted from the access point 30, and collects identification information of the access point 30 that has transmitted the permission response to create an AP list. Then, the AP list creation unit 25 causes the AP list transmission unit 22 to transmit the created AP list.

  FIG. 9 is a sequence diagram illustrating an example of the operation of the wireless LAN system 10 according to the second embodiment. First, for example, the authentication unit 43 is connected to the authentication unit 23 of the authentication server 20 via the access point 30-1 having the strongest reception electric field strength and not set to deny access by the MAC address filtering function. Then, the authentication process is performed (S400).

  If the authentication is successful, the authentication unit 23 notifies the wireless LAN terminal 40 that the authentication is successful via the access point 30-1 (S401). Next, the permitted terminal ID transmission unit 24 transmits the permitted terminal ID, which is identification information of the wireless LAN terminal 40 that has been successfully authenticated, to each of the access points 30 corresponding to the identification information stored in the AP list storage unit 21. Transmit (S402, S403).

  Then, the access point 30-2 and the access point 30-3 determine whether or not the received permitted terminal ID should be rejected by its own MAC address filtering function. If the relay should be permitted, the access point 30 transmits a permission response to the authentication server 20 (S404). On the other hand, if the relay should be rejected, the access point 30 transmits a rejection response to the authentication server 20 (S405).

  Next, the AP list creation unit 25 creates the AP list by collecting the identification information of the access point 30 that transmitted the permission response (S406). Then, the AP list transmission unit 22 transmits the AP list created by the AP list creation unit 25 to the wireless LAN terminal 40 that has been successfully authenticated (S407).

  The second embodiment of the present invention has been described above.

  Next, a third embodiment of the present invention will be described.

  FIG. 10 is a block diagram illustrating an example of a detailed configuration of the access point 30 in the third embodiment. The access point 30 includes a communication relay unit 31, a permitted terminal ID storage unit 32, a relay determination unit 33, a permitted terminal ID reception unit 34, a registration unit 35, and a response unit 36. Except for the points described below, in FIG. 10, the components denoted by the same reference numerals as those in FIG. 3 have the same or similar functions as those in FIG.

  When the access point 30 is powered on, the registration unit 35 transmits its identification information together with a registration request to the authentication server 20. Thereby, the registration unit 35 can notify the authentication server 20 of the identification information of the newly installed access point 30.

  When the response unit 36 receives an operation confirmation request from the authentication server 20, the response unit 36 returns an operation confirmation response together with its own identification information. Thereby, the authentication server 20 can acquire the identification information of the activated access point 30.

  FIG. 11 is a block diagram illustrating an example of a detailed configuration of the authentication server 20 according to the third embodiment. The authentication server 20 includes an AP list storage unit 21, an AP list transmission unit 22, an authentication unit 23, an authorized terminal ID transmission unit 24, an AP registration reception unit 26, and an AP operation confirmation unit 27. Except for the points described below, in FIG. 11, the components denoted by the same reference numerals as those in FIG. 2 have the same or similar functions as those in FIG.

  When receiving a registration request together with identification information from the access point 30, the AP registration receiving unit 26 refers to the AP list storage unit 21, and the identification information received together with the registration request is stored in the AP list storage unit 21. If not, the received identification information is added to the AP list storage unit 21.

  The AP operation confirmation unit 27 transmits an operation confirmation request to the access point 30 corresponding to the identification information stored in the AP list storage unit 21 at a predetermined period such as 1 hour or at a predetermined timing. The operation confirmation response is received together with the identification information of the access point 30. Then, the AP operation confirmation unit 27 refers to the AP list storage unit 21 and deletes the identification information corresponding to the access point 30 that does not send back an operation confirmation response from the AP list storage unit 21. Thereby, the AP operation confirmation unit 27 can reduce the amount of data in the AP list storage unit 21 and can reduce the amount of data transmitted to the wireless LAN terminal 40 via the AP list transmission unit 22. . Therefore, the amount of data transmitted in the wired section and the wireless section can be reduced, and communication can be maintained appropriately.

  The third embodiment of the present invention has been described above.

  In addition, this invention is not limited to each above-mentioned embodiment, Many deformation | transformation are possible within the range of the summary.

  In the above embodiment, when the authentication is successful, the authentication server 20 transmits the list of access points 30 managed by the authentication server 20 to the wireless LAN terminal 40 that has been successfully authenticated. The LAN terminal 40 may store in advance a list of access points 30 that are permitted to be relayed when authentication by the authentication server 20 is successful. In this case, the wireless LAN terminal 40 preferentially roams to the access points 30 included in the list of access points 30 stored in advance after successful authentication with the authentication server 20.

  In the embodiment described above, the received electric field strength is measured as the reception quality of the beacon. As another form, the error rate of the frame included in the beacon signal, the error rate of the bit in the frame, and the like are measured as the reception quality of the beacon. May be.

  The wireless LAN terminal 40 attempts to roam and stores the identification information of the access point 30 that has been denied roaming, and the identification information of the access point 30 when authentication is requested and authentication fails. When trying roaming, roaming may be performed preferentially to access points 30 that are not included in the stored identification information.

1 shows a configuration of a wireless LAN system 10 according to an embodiment of the present invention. It is a block diagram which shows an example of a detailed structure of the authentication server 20 in 1st Embodiment. It is a block diagram which shows an example of a detailed structure of the access point 30 in 1st Embodiment. 2 is a block diagram illustrating an example of a detailed configuration of a wireless LAN terminal 40. FIG. 4 is a flowchart illustrating an example of the operation of the authentication server 20. 3 is a flowchart showing an example of the operation of an access point 30. 5 is a flowchart showing an example of the operation of the wireless LAN terminal 40. It is a block diagram which shows an example of a detailed structure of the authentication server 20 in 2nd Embodiment. It is a sequence diagram which shows an example of operation | movement of the wireless LAN system 10 in 2nd Embodiment. It is a block diagram which shows an example of a detailed structure of the access point 30 in 3rd Embodiment. It is a block diagram which shows an example of a detailed structure of the authentication server 20 in 3rd Embodiment. It is a conceptual diagram for demonstrating the subject of the conventional wireless LAN system 100. FIG.

Explanation of symbols

10, 100 ... Wireless LAN system, 20, 102 ... Authentication server, 21, 42 ... AP list storage unit, 22 ... AP list transmission unit, 23, 43 ... Authentication unit, 24. ..Permitted terminal ID transmission unit, 25 ... AP list creation unit, 26 ... AP registration acceptance unit, 27 ... AP operation confirmation unit, 30, 101 ... access point, 31 ... communication relay 32 ... Authorized terminal ID storage unit 33 ... Relay determination unit 34 ... Authorized terminal ID receiving unit 35 ... Registration unit 36 ... Response unit 40, 103 ... Wireless LAN terminal, 41... AP list receiving unit, 44... Relay AP determining unit, 45.

Claims (4)

A wireless LAN system comprising a wireless LAN terminal, a plurality of access points, and an authentication server that permits or prohibits relaying of communication data of the wireless LAN terminal by the access point,
The authentication server is
AP identification information storage means for storing in advance a list of identification information of access points managed by itself;
Server-side authentication means for authenticating the wireless LAN terminal via the access point;
When the authentication by the server-side authentication unit is successful, the permitted terminal ID that transmits the identification information of the wireless LAN terminal that has been successfully authenticated to each of the access points corresponding to the identification information stored in the AP identification information storage unit A transmission means;
Receives a response indicating that relaying is permitted or denied from an access point to which identification information of a wireless LAN terminal that has been successfully authenticated has been transmitted, and creates a list that includes the identification information of the access point that has transmitted a response indicating that relaying is permitted AP list creation means to
AP list transmission means for transmitting the list created by the AP list creation means to an authenticated wireless LAN terminal via an access point;
Have
The access point is
Relay restricting means for rejecting relay of communication from a wireless LAN terminal of predetermined identification information and permitting relay of communication from a wireless LAN terminal of other identification information;
Authorized terminal ID storage means for storing identification information of the wireless LAN terminal authenticated by the authentication server;
When the identification information of the authenticated wireless LAN terminal is received from the authentication server, if relay of communication from the wireless LAN terminal corresponding to the identification information is permitted by the relay restriction unit, the received wireless LAN The terminal identification information is stored in the permitted terminal ID storage means, and a response indicating that relaying is permitted is returned to the authentication server, and relaying of communication from the wireless LAN terminal corresponding to the identification information is performed by the relay restriction means. If rejected, the permitted terminal ID receiving means for returning a response to reject the relay to the authentication server without storing the received identification information of the wireless LAN terminal in the permitted terminal ID storage means ;
Communication relay means for relaying communication data from the wireless LAN terminal;
When the wireless LAN terminal is requested to relay communication data and the identification information of the wireless LAN terminal that requested the relay is stored in the permitted terminal ID storage means, the communication relay means relays the communication data. When the identification information of the wireless LAN terminal that requested the relay is not stored in the permitted terminal ID storage unit, the relay unit instructs the communication relay unit to relay the communication data only to the authentication server. A determination means ;
Have
The wireless LAN terminal is
Relayable AP information receiving means for receiving a list of identification information of the access point from the authentication server via the access point;
Relayable AP information storage means for storing a list of identification information of the access points received by the relayable AP information receiving means;
If there is no list of identification information of the access point in the relayable AP information storage means, terminal side authentication means for authenticating with the authentication server via the access point;
Communication means for communicating with other communication devices via the access point;
Based on the reception quality of the signal transmitted from the access point, an access point that requests relay of communication data is determined from the access points corresponding to the identification information in the relayable AP information storage means, and the determined access Relay destination determining means for instructing the communication means to perform communication via a point ;
A wireless LAN system comprising: A communication method in a wireless LAN system comprising a wireless LAN terminal, a plurality of access points, and an authentication server that permits or prohibits relaying of communication data of the wireless LAN terminal by the access point,
The authentication server is
Authenticating the wireless LAN terminal via the access point;
When the authentication of the wireless LAN terminal is successful, referring to the AP identification information storage means that stores in advance a list of identification information of the access point managed by itself, to each of the access points included in the list, Transmitting identification information of a wireless LAN terminal that has been successfully authenticated;
Receives a response indicating that relaying is permitted or denied from an access point to which identification information of a wireless LAN terminal that has been successfully authenticated has been transmitted, and creates a list that includes the identification information of the access point that has transmitted a response indicating that relaying is permitted And steps to
Transmitting the created list to a wireless LAN terminal that has been successfully authenticated via an access point ;
The access point is
When the identification information of the authenticated wireless LAN terminal is received from the authentication server, the relay of the communication from the wireless LAN terminal corresponding to the identification information is performed when the communication from the wireless LAN terminal of the predetermined identification information is performed. If the relay restriction unit that rejects the relay and permits the relay of communication from the wireless LAN terminal of other identification information is permitted, the received identification information of the wireless LAN terminal is stored in the permitted terminal ID storage unit. When the relay restricting means rejects the relay of communication from the wireless LAN terminal corresponding to the identification information, a response indicating that the relay is permitted is returned to the authentication server. Returning a response to reject the relay to the authentication server without storing in the permitted terminal ID storage means ;
When the wireless LAN terminal is requested to relay communication data and the identification information of the wireless LAN terminal that requested the relay is stored in the permitted terminal ID storage means, the communication data from the wireless LAN terminal is stored. Relaying and relaying the communication data only to the authentication server to the communication relay means when the identification information of the wireless LAN terminal that requested the relay is not stored in the permitted terminal ID storage means;
And
The wireless LAN terminal is
Receiving a list of identification information of the access point from the authentication server via the access point and storing it in the relayable AP information storage means;
Authenticating with the authentication server via the access point when there is no list of identification information of the access point in the relayable AP information storage means;
Determining an access point for requesting relay of communication data from among the access points corresponding to the identification information in the relayable AP information storage means based on the reception quality of the signal transmitted from the access point;
Communicating via the determined access point ;
A communication method for a wireless LAN system. An authentication server used in a wireless LAN system having a wireless LAN terminal and a plurality of access points,
AP identification information storage means for storing in advance a list of identification information of access points managed by itself;
Server-side authentication means for authenticating the wireless LAN terminal via the access point;
When the authentication by the server-side authentication unit is successful, the permitted terminal ID that transmits the identification information of the wireless LAN terminal that has been successfully authenticated to each of the access points corresponding to the identification information stored in the AP identification information storage unit A transmission means;
Receives a response indicating that relaying is permitted or denied from an access point to which identification information of a wireless LAN terminal that has been successfully authenticated has been transmitted, and creates a list that includes the identification information of the access point that has transmitted a response indicating that relaying is permitted AP list creation means to
AP list transmission means for transmitting the list created by the AP list creation means to an authenticated wireless LAN terminal via an access point;
An authentication server comprising: An access point used in a wireless LAN system,
Relay restricting means for rejecting relay of communication from a wireless LAN terminal of predetermined identification information and permitting relay of communication from a wireless LAN terminal of other identification information;
Authorized terminal ID storage means for storing identification information of the wireless LAN terminal authenticated by the authentication server;
When the identification information of the authenticated wireless LAN terminal is received from the authentication server, if relay of communication from the wireless LAN terminal corresponding to the identification information is permitted by the relay restriction unit, the received wireless LAN The terminal identification information is stored in the permitted terminal ID storage means, and a response indicating that relaying is permitted is returned to the authentication server, and relaying of communication from the wireless LAN terminal corresponding to the identification information is performed by the relay restriction means. If rejected, the permitted terminal ID receiving means for returning a response to reject the relay to the authentication server without storing the received identification information of the wireless LAN terminal in the permitted terminal ID storage means ;
Authorized terminal ID storage means for storing the authorized terminal ID received by the authorized terminal receiving means;
Communication relay means for relaying communication data from the wireless LAN terminal;
When relaying of communication data is requested from the wireless LAN terminal, when the identification information of the wireless LAN terminal that requested the relay matches any of the permitted terminal IDs stored in the permitted terminal ID storage unit, When the communication relay means is instructed to relay communication data, and the identification information of the wireless LAN terminal that requested the relay does not match any of the permitted terminal IDs stored in the permitted terminal ID storage means, the communication relay means Relay determination means for instructing to relay the communication data only to the authentication server ;
An access point comprising:

Images