CA2480612A1 - Authentication system and method having mobility in public wireless local area network - Google Patents
Authentication system and method having mobility in public wireless local area network Download PDFInfo
- Publication number
- CA2480612A1 CA2480612A1 CA002480612A CA2480612A CA2480612A1 CA 2480612 A1 CA2480612 A1 CA 2480612A1 CA 002480612 A CA002480612 A CA 002480612A CA 2480612 A CA2480612 A CA 2480612A CA 2480612 A1 CA2480612 A1 CA 2480612A1
- Authority
- CA
- Canada
- Prior art keywords
- access point
- authentication
- wireless terminal
- charging
- request message
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M15/00—Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
- H04W12/062—Pre-authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W36/00—Hand-off or reselection arrangements
- H04W36/0005—Control or signalling for completing the hand-off
- H04W36/0011—Control or signalling for completing the hand-off for data sessions of end-to-end connection
- H04W36/0033—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information
- H04W36/0038—Control or signalling for completing the hand-off for data sessions of end-to-end connection with transfer of context information of security context information
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/24—Accounting or billing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
- H04W88/08—Access point devices
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W84/00—Network topologies
- H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
- H04W84/10—Small scale networks; Flat hierarchical networks
- H04W84/12—WLAN [Wireless Local Area Networks]
Abstract
The present invention discloses an authentication system and method having mobility in a public wireless LAN. The authentication system includes an access point for requesting authentication of a wireless terminal to an acce ss point manager, enabling data transmission and reception of the authenticated wireless terminal, and requesting the access point manager to charge the wireless terminal, and the access point manager for authenticating the wireless terminal which has already been authenticated on the basis of previously-registered registration information upon the request of the acces s point, authenticating the wireless terminal which has not been registered through an authentication server of a wireless network operator, and transmitting the authentication information to the access point. As a result , the wireless terminal can continuously access the network through the access points of the same subnet as well as different subnet without re- authentication, thereby achieving mobility and processing charging.
Description
AUTHENTICATION SYSTEM AND METHOD HAVING MOBILITY IN PUBLIC
WIRELESS LOCAL AREA NETWORK
Technical Field The present invention relates to authentication of a wireless terminal, and in particular to an authentication system and method having mobility in a public wireless local area network (LAN) which allow a wireless terminal to access an access point of one to subnet and receive authentication, and validate authentication and charging even if the wireless terminal moves to an access point of a different subnet.
Background Art ~5 The 802.11b standard leading a generally-used public wireless LAN does not cover authentication. To authenticate users, the 801.1x has been used. That is, the wireless LAN does not support wide mobility.
In order for a wireless terminal using the wireless LAN to roam between access points, the access points must be added with a roaming function. For this, standardization 2o processes have been performed under the IEEE 802.11f. Some companies support the wireless terminal to roam between the access points by adding an intrinsic function. Here, roaming implies movement between the access points positioned in the identical subnet.
Fig. 1 is a schematic view illustrating a conventional LAN system of a wireless network operator. Reference numeral 10 denotes a network, WT denotes a wireless 25 terminal, 20 denotes an access point, 30 denotes an IP network core, 40 denotes a wireless network, 42 denotes an authentication server, 44 denotes a wireless network operator core, 46 denotes a mobile switching center/home location register (MSC/HI.R) and 48 denotes a charging gateway.
The conventional LAN system of the wireless network operator transmits a s control signal data to the wireless network operator core 44. The access point 20 routes a user data packet directly to the IP network core 30 to access a public or personal service.
Referring to Fig. 1, the wireless terminal accesses the access point 20 and receives an IP address from the access point 20. The access point 20 transmits an authentication request to the authentication server 42 composing a gateway between an access network 1o and a signal network. The authentication server 42 queries the HLR 46 about the authentication data, and authenticates the user according to the authentication data.
Fig. 2 is a detailed view illustrating an authentication process by the conventional public wireless LAN and the wireless network operator system of Fig. 1.
As shown in Fig. 2, the wireless terminal WT accesses the network 10 through the is access point 20 (S11). Thereafter, the wireless terminal WT receives the IP
address from the access point 20 and transmits an initial authentication request to the access point 20.
The authentication server 42 accesses the MSC/HI,R 46 and requests a triplet to the HLR.
Then, the authentication server 42 transmits random number authentication (RAND) to the wireless terminal WT through the access point 20 according to a message authentication 2o code calculated by the RAND (S21 ).
The message authentication code achieves mutual authentication between the wireless network 40 and the wireless terminal WT. The wireless terminal WT
calculates a message authentication code and compares the result with the message authentication code from the network 10 (S23).
2s When the wireless terminal WT transmits the calculated message authentication code to the access point 20, the access point 20 transmits the response to the authentication server 42 (S27 and S29). The authentication server 42 calculates a message authentication code and verifies the response of the wireless terminal WT (S31). Thereafter, the authentication server 42 transmits an authentication result code to the access point (S33).
Here, when the authentication is successful, the access point 20 notifies initiation of a new account session to the authentication server 42 (S35).
Finally, the access point 20 routes a terminal data packet and transmits an acknowledgement signal to the wireless terminal WT (S37).
However, the conventional method always requests re-authentication for roaming.
to That is, when the wireless terminal moves to a new access point area, the wireless terminal must be authenticated by the new access point. Such re-authentication does not guarantee continuity of data. In addition, the related methods do not include a charging process and thus not satisfy the operators.
Disclosure of Invention Accordingly, it is an object of the present invention to provide an authentication system and method having mobility in a public wireless LAN which guarantee mobility of a wireless terminal by authenticating the wireless terminal on the basis of the previously-2o authenticated registration information, even if the wireless terminal authenticated by one access point moves to another access point of a different subnet.
In order to achieve the above-described object of the invention, there is provided an authentication system having mobility in a public wireless LAN which processes authentication and charging through an authentication server of a wireless network operator, including: an access point wirelessly connected to a wireless terminal, for outputting an authentication request message or charging request message added with information of the wireless terminal and requesting authentication and charging of the wireless terminal, and receiving an authentication response message and enabling data transmission and reception of the authenticated wireless terminal; and an access point manager for receiving the authentication request message for the wireless terminal from the access point, confirming whether the wireless terminal has already been authenticated, transmitting the authentication request message to the authentication server of the wireless network operator and transmitting the received authentication response message to the access point when the wireless terminal has not been authenticated, and transmitting the authentication response message to the access point on the basis of the registered authentication information when the wireless terminal has been authenticated.
According to another aspect of the invention, an authentication method having mobility in a public wireless LAN which receives an authentication or charging request message for a wireless terminal from an access point and processes authentication and charging through an authentication server of a wireless network operator includes: an authentication step for receiving the authentication request message from the access point, authenticating the wireless terminal on the basis of the authentication request message, and transmitting an authentication response message to the corresponding access point; and a charging step for receiving the charging request message from the access point and 2o transmitting the received charging request message to the authentication server, and receiving a charging request response message from the authentication server and transmitting the received charging request response message to the access point.
According to another aspect of the invention, an authentication method having mobility in a public wireless LAN where an access point requests authentication and 35 charging of a wireless terminal through an access point manager includes: a step for the access point to be wirelessly connected to the wireless terminal; an authentication request step for adding information of the wireless terminal to an authentication request message and transmitting it to the access point manager; and a step for receiving an authentication response message to the authentication request message transmitted in the authentication request step from the access point manager, and selectively requesting the access point manager to start charging on the basis of the authentication information included in the authentication response message.
Brief Description of the Drawings to The present invention will become better understood with reference to the accompanying drawings which are given only by way of illustration and thus are not limitative of the present invention, wherein:
Fig. 1 is a schematic view illustrating an access state of a conventional public wireless LAN and wireless network operator system;
Fig. 2 is a detailed view illustrating an authentication process by the conventional public wireless LAN and wireless network operator system of Fig. 1;
Fig. 3 is a structure view illustrating an authentication and charging system by a public wireless LAN and wireless network operator system in accordance with a preferred 2o embodiment of the present invention;
Fig. 4 shows a protocol for processing authentication and charging among a wireless terminal, an access point, an access point manager and an authentication server of Fig. 3;
Fig. 5 shows formats of an authentication request message, an authentication response message and a wireless terminal status message of Fig. 4;
Fig. 6 is a detailed flowchart showing the operation of the access point of Fig. 4;
and Fig. 7 is a detailed flowchart showing the operation of the access point manager of Fig. 4.
Best mode for Carrying Out the Invention An authentication system and method having mobility in a public wireless LAN
in accordance with a preferred embodiment of the present invention will now be described to in detail with reference to Figs. 3 to 7.
Fig. 3 is a structure view illustrating the authentication system by the public wireless LAN and wireless network operator system in accordance with the preferred embodiment of the present invention. Reference numerals 120 and 140 denote access points, 130 denotes an IP network core, 160 denotes an access point manager(APM), 310 ~5 denotes an authentication server, 320 denotes an MSC/HLR, 330 denotes a wireless network operator core, and 340 denotes a charging gateway. In addition, WT
denotes a wireless terminal, MSC is a mobile switching center and HLR is a home location register.
As depicted in Fig. 3, a plurality of access points 120 and 140 access the IP
network core 130. Each of the access points 120 and 140 composes a subnet for wirelessly 2o accessing the plurality of wireless terminals WT to the IP network core 130. A necessary number of access points can access the IP network core 130 according to the structure of the operator.
The access point manager 160 access the IP network core 130 to manage authentication and charging of the whole access points 120 and 140 accessing the IP
25 network core 130. In addition, the access point manager 160 accesses the authentication server 310 of the wireless network operator.
Still referring to Fig. 3, reference 300 denotes an area of the wireless network operator. The authentication server 310, the MSC/HIJR 320 and the charging gateway 340 access the wireless network operator core 330.
Accordingly, the access point manager 160 requests authentication and charging through the authentication server 310 of the wireless network operator. When receiving an authentication request from the access point manager 160, the authentication server 310 accessing the wireless network operator core 330 processes the authentication request through the MSC/HI.,R 320, and when receiving a charging request, the authentication 1o server 310 processes the charging request through the charging gateway 340.
Thereafter, the authentication server 310 transmits the authentication request or charging request result to the access point manager 160.
Fig. 4 shows a protocol for processing authentication and charging among the wireless terminal WT, the access point AP, the access point manager APM and the authentication server 310 of Fig. 3. Reference numeral WT denotes the wireless terminal, AP 1 denotes the first access point 120, APn denotes the nth access point 140, and APM
denotes the access point manager i 60.
Fig. 4 shows a message transmission process until the wireless terminal WT
associated with the first access point AP1 ofthe first access point area 110 accesses the nth 2o access point 140 of the nth access point area 150 and ends access to the nth access point 140.
The wireless terminal WT is associated with the first access point AP 1. Here, the first access point AP 1 transmits an authentication request message Aut-request to the access point manager APM (S120). The authentication request message Aut-request includes user 1D and password information. In addition, the authentication request message Aut-request includes the IP address of the access point AP 1 currently transmitting the authentication request message.
The access point manager APM authenticates the wireless terminal WT through the authentication server 310 upon the authentication request of the first access point AP 1 (S130). The authentication between the access point manager APM and the authentication server 310 can be processed by selectively using for example, MD-5, TLS, SRP
and OTP.
Accordingly, the wireless terminal is authenticated. The access point manager APM
transmits an authentication response message Aut-response to the corresponding access point AP 1 (S 140). . Here, the authentication response message Aut-response includes 1o authentication registration information.
When authentication of the wireless terminal WT is finished, the first access point AP1 enables data transmission and reception of the wireless terminal WT, and transmits a charging start request message Acc-request(start) to the access point manager APM (S 150).
The access point manager APM transmits the charging start request message Acc-~s request(start) received from the first access point APl to the authentication server 310 to start charging (S 160).
When the access point manager APM receives a charging start response message Acc-response(start) from the authentication server 310 (S 170), it transmits the charging start response message Acc-response(start) to the first access point AP 1. The first access 2o point AP 1 transmits information of the authenticated wireless terminal to the access point manager APM through a wireless terminal status message Wireless terminal-status (S 190).
Accordingly, the first authentication and charging are started due to association between the wireless terminal WT and the first access point AP 1. The process where the wireless terminal WT is associated with the nth access point APn and completes 25 authentication will now be explained in detail.
When the wireless terminal WT moves to the nth access point APn, the wireless terminal WT is re-associated with the nth access point APn (S210). The nth access point APn transmits the authentication request message Aut-request to the access point manager APM (5220). The access point manager APM receiving the authentication request message Aut-request extracts the information of the wireless terminal WT included in the authentication request message Aut-request, and confirms whether the wireless terminal WT has already been authenticated. Since the wireless terminal WT has been authenticated, the access point manager APM does not request authentication to the authentication server 301 but transmits the authentication response message Aut-response to the nth access point to APn for authentication (S230). The access point manager APM authenticates the wireless terminal WT when a MAC address and an allocated IP address of the wireless terminal WT included in the received authentication request message Aut-request are identical to a MAC address and an allocated IP address of the wireless terminal WT stored in a management table and when an IP address of the access point is changed.
When receiving the authentication response message Aut-response from the access point manager APM (S230), the nth access point APn enables data transmission and reception of the wireless terminal WT.
When the nth access point APn receives a log off request from the wireless terminal WT during the data transmission or time-out is generated due to interruption of 20. the data transmission (S240), the nth access point APn transmits a charging stop request message Acc-request(stop) to the access point manager APM to stop charging (S250).
The access point manager APM transmits the charging stop request message Acc-request(stop) received from the nth access point APn to the authentication server 310 (5260). Thereafter, when receiving a charging stop response message Acc-response(stop) from the authentication server 310 (5270), the access point manager APM
transmits it to the nth access point APn (S280). Therefore, the authentication between the nth access point APn and the authentication server 310 is finished (5290).
Fig. 5 shows formats of the authentication request message, the authentication response message and the wireless terminal status message of Fig. 4.
Fig. Sa shows a format of the authentication request message.
Here, ISAMP version is a field representing a version of an inter subnet-access point mobile protocol which implies a protocol of the invention, and is composed of for example 1 byte. Identifier is a field representing a message identifier and is composed of for example 2 bytes. Length is a field representing a length of IARP packet and is to composed of for example 2 bytes. AP-IP address is a field representing an address of the current access point. Wireless terminal-MAC address includes an address length defined as a field representing a media access control(MAC) address of the currently-associated wireless terminal. User ID is a field representing identification of the user.
Sequence Number is a field representing a serial number and is composed of 2 bytes. For instance, Sequential Number has a value from 0 to 2048.
Fig. Sb shows a format of the authentication response message.
Here, ISAMP version is a field representing a version of an inter subnet-access point mobile protocol and is composed of for example 1 byte. Identifier is a field representing a message identifier and is composed of for example 2 bytes.
Length is a field . representing a length of IARP packet and is composed of for example 2 bytes.
AP-IP
address is a field representing an address of the current access point.
Connection is a field representing identification of authentication registration and is composed of for example 1 byte. Connection respectively displays a state where the wireless terminal firstly requests authentication and a state where the wireless terminal which has already been authenticated and registered requests authentication. For instance, Connection is set up as OOh for the newly-registered wireless terminal and 11 h for the previously-registered wireless terminal.
Sequence Number is a field representing a serial number and is composed of 2 bytes. For example, Sequential Number has a value from 0 to 2048.
Fig. Sc shows a format of the wireless terminal status message.
Here, ISAMP version is a field representing a version of an inter subnet-access point mobile protocol and is composed of for example 1 byte. Identifier is a field representing a message identifier and is composed of for example 2 bytes.
Length is a field representing a length of IARP packet and is composed of for example 2 bytes.
AP-IP
address is a field representing an address of the current access point.
Wireless terminal-to MAC address includes an address length defined as a field representing a media access control address of the currently-associated wireless terminal. Wireless terminal-IP address is a field representing an IP address allocated to the wireless terminal.
Sequence Number is a field representing a serial number and is composed of 2 bytes. For instance, Sequential Number has a value from 0 to 2048.
~5 Fig. 6 is a detailed flowchart showing the operation of the access point AP
of Fig.
WIRELESS LOCAL AREA NETWORK
Technical Field The present invention relates to authentication of a wireless terminal, and in particular to an authentication system and method having mobility in a public wireless local area network (LAN) which allow a wireless terminal to access an access point of one to subnet and receive authentication, and validate authentication and charging even if the wireless terminal moves to an access point of a different subnet.
Background Art ~5 The 802.11b standard leading a generally-used public wireless LAN does not cover authentication. To authenticate users, the 801.1x has been used. That is, the wireless LAN does not support wide mobility.
In order for a wireless terminal using the wireless LAN to roam between access points, the access points must be added with a roaming function. For this, standardization 2o processes have been performed under the IEEE 802.11f. Some companies support the wireless terminal to roam between the access points by adding an intrinsic function. Here, roaming implies movement between the access points positioned in the identical subnet.
Fig. 1 is a schematic view illustrating a conventional LAN system of a wireless network operator. Reference numeral 10 denotes a network, WT denotes a wireless 25 terminal, 20 denotes an access point, 30 denotes an IP network core, 40 denotes a wireless network, 42 denotes an authentication server, 44 denotes a wireless network operator core, 46 denotes a mobile switching center/home location register (MSC/HI.R) and 48 denotes a charging gateway.
The conventional LAN system of the wireless network operator transmits a s control signal data to the wireless network operator core 44. The access point 20 routes a user data packet directly to the IP network core 30 to access a public or personal service.
Referring to Fig. 1, the wireless terminal accesses the access point 20 and receives an IP address from the access point 20. The access point 20 transmits an authentication request to the authentication server 42 composing a gateway between an access network 1o and a signal network. The authentication server 42 queries the HLR 46 about the authentication data, and authenticates the user according to the authentication data.
Fig. 2 is a detailed view illustrating an authentication process by the conventional public wireless LAN and the wireless network operator system of Fig. 1.
As shown in Fig. 2, the wireless terminal WT accesses the network 10 through the is access point 20 (S11). Thereafter, the wireless terminal WT receives the IP
address from the access point 20 and transmits an initial authentication request to the access point 20.
The authentication server 42 accesses the MSC/HI,R 46 and requests a triplet to the HLR.
Then, the authentication server 42 transmits random number authentication (RAND) to the wireless terminal WT through the access point 20 according to a message authentication 2o code calculated by the RAND (S21 ).
The message authentication code achieves mutual authentication between the wireless network 40 and the wireless terminal WT. The wireless terminal WT
calculates a message authentication code and compares the result with the message authentication code from the network 10 (S23).
2s When the wireless terminal WT transmits the calculated message authentication code to the access point 20, the access point 20 transmits the response to the authentication server 42 (S27 and S29). The authentication server 42 calculates a message authentication code and verifies the response of the wireless terminal WT (S31). Thereafter, the authentication server 42 transmits an authentication result code to the access point (S33).
Here, when the authentication is successful, the access point 20 notifies initiation of a new account session to the authentication server 42 (S35).
Finally, the access point 20 routes a terminal data packet and transmits an acknowledgement signal to the wireless terminal WT (S37).
However, the conventional method always requests re-authentication for roaming.
to That is, when the wireless terminal moves to a new access point area, the wireless terminal must be authenticated by the new access point. Such re-authentication does not guarantee continuity of data. In addition, the related methods do not include a charging process and thus not satisfy the operators.
Disclosure of Invention Accordingly, it is an object of the present invention to provide an authentication system and method having mobility in a public wireless LAN which guarantee mobility of a wireless terminal by authenticating the wireless terminal on the basis of the previously-2o authenticated registration information, even if the wireless terminal authenticated by one access point moves to another access point of a different subnet.
In order to achieve the above-described object of the invention, there is provided an authentication system having mobility in a public wireless LAN which processes authentication and charging through an authentication server of a wireless network operator, including: an access point wirelessly connected to a wireless terminal, for outputting an authentication request message or charging request message added with information of the wireless terminal and requesting authentication and charging of the wireless terminal, and receiving an authentication response message and enabling data transmission and reception of the authenticated wireless terminal; and an access point manager for receiving the authentication request message for the wireless terminal from the access point, confirming whether the wireless terminal has already been authenticated, transmitting the authentication request message to the authentication server of the wireless network operator and transmitting the received authentication response message to the access point when the wireless terminal has not been authenticated, and transmitting the authentication response message to the access point on the basis of the registered authentication information when the wireless terminal has been authenticated.
According to another aspect of the invention, an authentication method having mobility in a public wireless LAN which receives an authentication or charging request message for a wireless terminal from an access point and processes authentication and charging through an authentication server of a wireless network operator includes: an authentication step for receiving the authentication request message from the access point, authenticating the wireless terminal on the basis of the authentication request message, and transmitting an authentication response message to the corresponding access point; and a charging step for receiving the charging request message from the access point and 2o transmitting the received charging request message to the authentication server, and receiving a charging request response message from the authentication server and transmitting the received charging request response message to the access point.
According to another aspect of the invention, an authentication method having mobility in a public wireless LAN where an access point requests authentication and 35 charging of a wireless terminal through an access point manager includes: a step for the access point to be wirelessly connected to the wireless terminal; an authentication request step for adding information of the wireless terminal to an authentication request message and transmitting it to the access point manager; and a step for receiving an authentication response message to the authentication request message transmitted in the authentication request step from the access point manager, and selectively requesting the access point manager to start charging on the basis of the authentication information included in the authentication response message.
Brief Description of the Drawings to The present invention will become better understood with reference to the accompanying drawings which are given only by way of illustration and thus are not limitative of the present invention, wherein:
Fig. 1 is a schematic view illustrating an access state of a conventional public wireless LAN and wireless network operator system;
Fig. 2 is a detailed view illustrating an authentication process by the conventional public wireless LAN and wireless network operator system of Fig. 1;
Fig. 3 is a structure view illustrating an authentication and charging system by a public wireless LAN and wireless network operator system in accordance with a preferred 2o embodiment of the present invention;
Fig. 4 shows a protocol for processing authentication and charging among a wireless terminal, an access point, an access point manager and an authentication server of Fig. 3;
Fig. 5 shows formats of an authentication request message, an authentication response message and a wireless terminal status message of Fig. 4;
Fig. 6 is a detailed flowchart showing the operation of the access point of Fig. 4;
and Fig. 7 is a detailed flowchart showing the operation of the access point manager of Fig. 4.
Best mode for Carrying Out the Invention An authentication system and method having mobility in a public wireless LAN
in accordance with a preferred embodiment of the present invention will now be described to in detail with reference to Figs. 3 to 7.
Fig. 3 is a structure view illustrating the authentication system by the public wireless LAN and wireless network operator system in accordance with the preferred embodiment of the present invention. Reference numerals 120 and 140 denote access points, 130 denotes an IP network core, 160 denotes an access point manager(APM), 310 ~5 denotes an authentication server, 320 denotes an MSC/HLR, 330 denotes a wireless network operator core, and 340 denotes a charging gateway. In addition, WT
denotes a wireless terminal, MSC is a mobile switching center and HLR is a home location register.
As depicted in Fig. 3, a plurality of access points 120 and 140 access the IP
network core 130. Each of the access points 120 and 140 composes a subnet for wirelessly 2o accessing the plurality of wireless terminals WT to the IP network core 130. A necessary number of access points can access the IP network core 130 according to the structure of the operator.
The access point manager 160 access the IP network core 130 to manage authentication and charging of the whole access points 120 and 140 accessing the IP
25 network core 130. In addition, the access point manager 160 accesses the authentication server 310 of the wireless network operator.
Still referring to Fig. 3, reference 300 denotes an area of the wireless network operator. The authentication server 310, the MSC/HIJR 320 and the charging gateway 340 access the wireless network operator core 330.
Accordingly, the access point manager 160 requests authentication and charging through the authentication server 310 of the wireless network operator. When receiving an authentication request from the access point manager 160, the authentication server 310 accessing the wireless network operator core 330 processes the authentication request through the MSC/HI.,R 320, and when receiving a charging request, the authentication 1o server 310 processes the charging request through the charging gateway 340.
Thereafter, the authentication server 310 transmits the authentication request or charging request result to the access point manager 160.
Fig. 4 shows a protocol for processing authentication and charging among the wireless terminal WT, the access point AP, the access point manager APM and the authentication server 310 of Fig. 3. Reference numeral WT denotes the wireless terminal, AP 1 denotes the first access point 120, APn denotes the nth access point 140, and APM
denotes the access point manager i 60.
Fig. 4 shows a message transmission process until the wireless terminal WT
associated with the first access point AP1 ofthe first access point area 110 accesses the nth 2o access point 140 of the nth access point area 150 and ends access to the nth access point 140.
The wireless terminal WT is associated with the first access point AP 1. Here, the first access point AP 1 transmits an authentication request message Aut-request to the access point manager APM (S120). The authentication request message Aut-request includes user 1D and password information. In addition, the authentication request message Aut-request includes the IP address of the access point AP 1 currently transmitting the authentication request message.
The access point manager APM authenticates the wireless terminal WT through the authentication server 310 upon the authentication request of the first access point AP 1 (S130). The authentication between the access point manager APM and the authentication server 310 can be processed by selectively using for example, MD-5, TLS, SRP
and OTP.
Accordingly, the wireless terminal is authenticated. The access point manager APM
transmits an authentication response message Aut-response to the corresponding access point AP 1 (S 140). . Here, the authentication response message Aut-response includes 1o authentication registration information.
When authentication of the wireless terminal WT is finished, the first access point AP1 enables data transmission and reception of the wireless terminal WT, and transmits a charging start request message Acc-request(start) to the access point manager APM (S 150).
The access point manager APM transmits the charging start request message Acc-~s request(start) received from the first access point APl to the authentication server 310 to start charging (S 160).
When the access point manager APM receives a charging start response message Acc-response(start) from the authentication server 310 (S 170), it transmits the charging start response message Acc-response(start) to the first access point AP 1. The first access 2o point AP 1 transmits information of the authenticated wireless terminal to the access point manager APM through a wireless terminal status message Wireless terminal-status (S 190).
Accordingly, the first authentication and charging are started due to association between the wireless terminal WT and the first access point AP 1. The process where the wireless terminal WT is associated with the nth access point APn and completes 25 authentication will now be explained in detail.
When the wireless terminal WT moves to the nth access point APn, the wireless terminal WT is re-associated with the nth access point APn (S210). The nth access point APn transmits the authentication request message Aut-request to the access point manager APM (5220). The access point manager APM receiving the authentication request message Aut-request extracts the information of the wireless terminal WT included in the authentication request message Aut-request, and confirms whether the wireless terminal WT has already been authenticated. Since the wireless terminal WT has been authenticated, the access point manager APM does not request authentication to the authentication server 301 but transmits the authentication response message Aut-response to the nth access point to APn for authentication (S230). The access point manager APM authenticates the wireless terminal WT when a MAC address and an allocated IP address of the wireless terminal WT included in the received authentication request message Aut-request are identical to a MAC address and an allocated IP address of the wireless terminal WT stored in a management table and when an IP address of the access point is changed.
When receiving the authentication response message Aut-response from the access point manager APM (S230), the nth access point APn enables data transmission and reception of the wireless terminal WT.
When the nth access point APn receives a log off request from the wireless terminal WT during the data transmission or time-out is generated due to interruption of 20. the data transmission (S240), the nth access point APn transmits a charging stop request message Acc-request(stop) to the access point manager APM to stop charging (S250).
The access point manager APM transmits the charging stop request message Acc-request(stop) received from the nth access point APn to the authentication server 310 (5260). Thereafter, when receiving a charging stop response message Acc-response(stop) from the authentication server 310 (5270), the access point manager APM
transmits it to the nth access point APn (S280). Therefore, the authentication between the nth access point APn and the authentication server 310 is finished (5290).
Fig. 5 shows formats of the authentication request message, the authentication response message and the wireless terminal status message of Fig. 4.
Fig. Sa shows a format of the authentication request message.
Here, ISAMP version is a field representing a version of an inter subnet-access point mobile protocol which implies a protocol of the invention, and is composed of for example 1 byte. Identifier is a field representing a message identifier and is composed of for example 2 bytes. Length is a field representing a length of IARP packet and is to composed of for example 2 bytes. AP-IP address is a field representing an address of the current access point. Wireless terminal-MAC address includes an address length defined as a field representing a media access control(MAC) address of the currently-associated wireless terminal. User ID is a field representing identification of the user.
Sequence Number is a field representing a serial number and is composed of 2 bytes. For instance, Sequential Number has a value from 0 to 2048.
Fig. Sb shows a format of the authentication response message.
Here, ISAMP version is a field representing a version of an inter subnet-access point mobile protocol and is composed of for example 1 byte. Identifier is a field representing a message identifier and is composed of for example 2 bytes.
Length is a field . representing a length of IARP packet and is composed of for example 2 bytes.
AP-IP
address is a field representing an address of the current access point.
Connection is a field representing identification of authentication registration and is composed of for example 1 byte. Connection respectively displays a state where the wireless terminal firstly requests authentication and a state where the wireless terminal which has already been authenticated and registered requests authentication. For instance, Connection is set up as OOh for the newly-registered wireless terminal and 11 h for the previously-registered wireless terminal.
Sequence Number is a field representing a serial number and is composed of 2 bytes. For example, Sequential Number has a value from 0 to 2048.
Fig. Sc shows a format of the wireless terminal status message.
Here, ISAMP version is a field representing a version of an inter subnet-access point mobile protocol and is composed of for example 1 byte. Identifier is a field representing a message identifier and is composed of for example 2 bytes.
Length is a field representing a length of IARP packet and is composed of for example 2 bytes.
AP-IP
address is a field representing an address of the current access point.
Wireless terminal-to MAC address includes an address length defined as a field representing a media access control address of the currently-associated wireless terminal. Wireless terminal-IP address is a field representing an IP address allocated to the wireless terminal.
Sequence Number is a field representing a serial number and is composed of 2 bytes. For instance, Sequential Number has a value from 0 to 2048.
~5 Fig. 6 is a detailed flowchart showing the operation of the access point AP
of Fig.
4.
The access point AP is associated with the wireless terminal WT in each area (S310). Then, the access point AP provides the wireless terminal information and the access point information to the access point manager APM to request authentication (S320).
2o Here, the access point AP transmits the information to the access point.
manager APM
through the authentication request message Aut-request.
The access point AP confirms whether the access point manager APM responds to the authentication request (5330). Here, the access point AP receives the authentication information from the access point manager APM through the authentication response 25 message Aut-response.
When the authentication is normally finished, the access point AP analyzes the received authentication response message, and confirms whether the wireless terminal WT
has already been registered or is newly registered (S340). For example, when the value of Connection field of the authentication response message Aut-response is OOh, the access point AP decides that the wireless terminal is newly registered, and when the value of Connection field is l lh, the access point AP decides that the wireless terminal has already been registered.
When the wireless terminal is newly registered (OOh), the access point AP
requests the access point manager APM to start charging (5350). Here, the access point AP
1o transmits information through the charging start request message Acc-request(start). In addition, the access point AP enables data transmission and reception of the wireless terminal WT (S360). When receiving the charging start request response from the access point manager APM (5370), the access point AP transmits the wireless terminal status information to the access point manager APM (5380). The wireless terminal status information is transmitted from the access point AP to the access point manager APM
through the wireless terminal status message Wireless terminal-status.
On the other hand, when the access point AP confirms that the wireless terminal WT has already been registered by analyzing the authentication response message Aut-response( 11 h), the access point AP does not request the access point manager APM to start 2o charging but continuously enables data transmission and reception of the wireless terminal (5385).
In addition, the access point AP confirms whether the log off request is received from the wireless terminal WT or time-out is generated (S390). If so, the access point AP
requests the access point manager APM to stop charging (S400). Here, the access point AP
transmits the information through the charging stop request message Acc-request(stop).
The access point AP receives the charging stop request response message from the access point manager APM (S410). Accordingly, the authentication of the wireless terminal WT
between the access point AP and the authentication server 310 is finished(5420).
Fig. 7 is a detailed flowchart showing the operation of the access point manager APM of Fig. 4 The access point manager APM confirms whether the authentication request is received from the access point AP (5510). Here, the access point manager APM
receives the authentication request message Aut-request from the access point AP. When receiving the authentication request message Aut-request from the access point AP, the access point 1o manager APM confirms whether the wireless terminal WT has been authenticated by analyzing the authentication request message Aut-request (S610). That is, the access point manager APM confirms whether the wireless terminal WT has been authenticated by referring to the MAC address and IP address of the wireless terminal WT and the IP
address of the access point AP included in the received authentication request message Aut-request.
In the case that the wireless terminal WT has not been authenticated, the access point manager APM transmits 'the authentication request message Aut-request to the authentication server 310 to request authentication (S620). Thereafter, the access point manager APM receives the authentication information from the authentication server 310 (5630). When the authentication is normally processed, the access point manager APM
stores the wireless terminal information, access point information and authentication information (S640). The access point manager APM transmits the authentication response message Aut-response to the access point AP which requests authentication (5650). Here, the access point manager APM sets up Connection field of the authentication response message Aut-response as for example, OOh, thereby notifying that the wireless terminal WT is newly authenticated.
When the wireless terminal WT has been authenticated, the access point manager APM does not request authentication to the authentication server 310 but directly authenticates the wireless terminal WT. Here, the access point manager APM
renews and stores the IP address of the access point AP included in the authentication request message Aut-request (S660). Thereafter, the access point manager APM transmits the authentication response message Aut-response to the access point AP which requests authentication (5670). Here, the access point manager APM sets up Connection field of the authentication response message Aut-response as for example, llh, thereby notifying that the wireless to terminal WT has already been authenticated.
On the other hand, the access point manager APM confirms whether the charging request signal is received from the access point AP (S520). When receiving the charging start request message Acc-request(start) from the access point AP, the access point manager APM transmits the charging start request message Acc-request(start) to the authentication server 310 to request charging (5530). Thereafter, when receiving the charging start response message Acc-response(start) from the authentication server 310, the access point manager APM transmits the charging start response message Acc-response(start) to the corresponding access point AP (S550). In addition, the access point manager APM receives the wireless terminal status message Wireless terminal-status 2o showing the status of the wireless terminal WT from the access point AP
(S560).
When receiving the charging stop request message Acc-request(stop) from the access point AP, the access point manager APM transmits the received charging stop request message Acc-request(stop) to the authentication server 310 to stop charging (S570).
Then, when receiving the charging stop response message Acc-response(stop) from the authentication server 310, the access point manager APM transmits the charging stop t.t response message Acc-response(stop) to the corresponding the access point AP
(S590).
Therefore, the authentication of the wireless terminal WT between the access point AP and the authentication server 310 is finished (S600).
As the present invention may be embodied in several forms without departing from the spirit or essential characteristics thereof, it should also be understood that the above-described embodiment is not limited by any of the details of the foregoing description, unless otherwise specified, but rather should be construed broadly within its spirit and scope as defined in the appended claims, and therefore all changes and modifications that fall within the metes and bounds of the claims, or equivalences of such to metes and bounds are therefore intended to be embraced by the appended claims.
As discussed earlier, in accordance with the present invention, when the wireless terminal moves between the access points of the same subnet as well as different subnet, the access point manager manages the previously-authenticated information and authenticates the wireless terminal in the access point. As a result, the wireless terminal can continuously access the network without re-authentication, thereby achieving mobility and processing charging.
The access point AP is associated with the wireless terminal WT in each area (S310). Then, the access point AP provides the wireless terminal information and the access point information to the access point manager APM to request authentication (S320).
2o Here, the access point AP transmits the information to the access point.
manager APM
through the authentication request message Aut-request.
The access point AP confirms whether the access point manager APM responds to the authentication request (5330). Here, the access point AP receives the authentication information from the access point manager APM through the authentication response 25 message Aut-response.
When the authentication is normally finished, the access point AP analyzes the received authentication response message, and confirms whether the wireless terminal WT
has already been registered or is newly registered (S340). For example, when the value of Connection field of the authentication response message Aut-response is OOh, the access point AP decides that the wireless terminal is newly registered, and when the value of Connection field is l lh, the access point AP decides that the wireless terminal has already been registered.
When the wireless terminal is newly registered (OOh), the access point AP
requests the access point manager APM to start charging (5350). Here, the access point AP
1o transmits information through the charging start request message Acc-request(start). In addition, the access point AP enables data transmission and reception of the wireless terminal WT (S360). When receiving the charging start request response from the access point manager APM (5370), the access point AP transmits the wireless terminal status information to the access point manager APM (5380). The wireless terminal status information is transmitted from the access point AP to the access point manager APM
through the wireless terminal status message Wireless terminal-status.
On the other hand, when the access point AP confirms that the wireless terminal WT has already been registered by analyzing the authentication response message Aut-response( 11 h), the access point AP does not request the access point manager APM to start 2o charging but continuously enables data transmission and reception of the wireless terminal (5385).
In addition, the access point AP confirms whether the log off request is received from the wireless terminal WT or time-out is generated (S390). If so, the access point AP
requests the access point manager APM to stop charging (S400). Here, the access point AP
transmits the information through the charging stop request message Acc-request(stop).
The access point AP receives the charging stop request response message from the access point manager APM (S410). Accordingly, the authentication of the wireless terminal WT
between the access point AP and the authentication server 310 is finished(5420).
Fig. 7 is a detailed flowchart showing the operation of the access point manager APM of Fig. 4 The access point manager APM confirms whether the authentication request is received from the access point AP (5510). Here, the access point manager APM
receives the authentication request message Aut-request from the access point AP. When receiving the authentication request message Aut-request from the access point AP, the access point 1o manager APM confirms whether the wireless terminal WT has been authenticated by analyzing the authentication request message Aut-request (S610). That is, the access point manager APM confirms whether the wireless terminal WT has been authenticated by referring to the MAC address and IP address of the wireless terminal WT and the IP
address of the access point AP included in the received authentication request message Aut-request.
In the case that the wireless terminal WT has not been authenticated, the access point manager APM transmits 'the authentication request message Aut-request to the authentication server 310 to request authentication (S620). Thereafter, the access point manager APM receives the authentication information from the authentication server 310 (5630). When the authentication is normally processed, the access point manager APM
stores the wireless terminal information, access point information and authentication information (S640). The access point manager APM transmits the authentication response message Aut-response to the access point AP which requests authentication (5650). Here, the access point manager APM sets up Connection field of the authentication response message Aut-response as for example, OOh, thereby notifying that the wireless terminal WT is newly authenticated.
When the wireless terminal WT has been authenticated, the access point manager APM does not request authentication to the authentication server 310 but directly authenticates the wireless terminal WT. Here, the access point manager APM
renews and stores the IP address of the access point AP included in the authentication request message Aut-request (S660). Thereafter, the access point manager APM transmits the authentication response message Aut-response to the access point AP which requests authentication (5670). Here, the access point manager APM sets up Connection field of the authentication response message Aut-response as for example, llh, thereby notifying that the wireless to terminal WT has already been authenticated.
On the other hand, the access point manager APM confirms whether the charging request signal is received from the access point AP (S520). When receiving the charging start request message Acc-request(start) from the access point AP, the access point manager APM transmits the charging start request message Acc-request(start) to the authentication server 310 to request charging (5530). Thereafter, when receiving the charging start response message Acc-response(start) from the authentication server 310, the access point manager APM transmits the charging start response message Acc-response(start) to the corresponding access point AP (S550). In addition, the access point manager APM receives the wireless terminal status message Wireless terminal-status 2o showing the status of the wireless terminal WT from the access point AP
(S560).
When receiving the charging stop request message Acc-request(stop) from the access point AP, the access point manager APM transmits the received charging stop request message Acc-request(stop) to the authentication server 310 to stop charging (S570).
Then, when receiving the charging stop response message Acc-response(stop) from the authentication server 310, the access point manager APM transmits the charging stop t.t response message Acc-response(stop) to the corresponding the access point AP
(S590).
Therefore, the authentication of the wireless terminal WT between the access point AP and the authentication server 310 is finished (S600).
As the present invention may be embodied in several forms without departing from the spirit or essential characteristics thereof, it should also be understood that the above-described embodiment is not limited by any of the details of the foregoing description, unless otherwise specified, but rather should be construed broadly within its spirit and scope as defined in the appended claims, and therefore all changes and modifications that fall within the metes and bounds of the claims, or equivalences of such to metes and bounds are therefore intended to be embraced by the appended claims.
As discussed earlier, in accordance with the present invention, when the wireless terminal moves between the access points of the same subnet as well as different subnet, the access point manager manages the previously-authenticated information and authenticates the wireless terminal in the access point. As a result, the wireless terminal can continuously access the network without re-authentication, thereby achieving mobility and processing charging.
Claims (25)
1. An authentication system having mobility in a public wireless LAN
which processes authentication and charging through an authentication server of a wireless network operator, comprising:
an access point wirelessly connected to a wireless terminal, for outputting an authentication request message or charging request message added with information of the wireless terminal and requesting authentication and charging of the wireless terminal, and receiving an authentication response message and controlling data transmission and reception of the authenticated wireless terminal; and an access point manager for receiving the authentication request message for the wireless terminal from the access point, confirming whether the wireless terminal has already been authenticated, transmitting the authentication request message to the authentication server of the wireless network operator and transmitting the received authentication response message to the access point when the wireless terminal has not been authenticated, and transmitting the authentication response message to the access point on the basis of the registered authentication information when the wireless terminal has been authenticated.
which processes authentication and charging through an authentication server of a wireless network operator, comprising:
an access point wirelessly connected to a wireless terminal, for outputting an authentication request message or charging request message added with information of the wireless terminal and requesting authentication and charging of the wireless terminal, and receiving an authentication response message and controlling data transmission and reception of the authenticated wireless terminal; and an access point manager for receiving the authentication request message for the wireless terminal from the access point, confirming whether the wireless terminal has already been authenticated, transmitting the authentication request message to the authentication server of the wireless network operator and transmitting the received authentication response message to the access point when the wireless terminal has not been authenticated, and transmitting the authentication response message to the access point on the basis of the registered authentication information when the wireless terminal has been authenticated.
2. The system according to claim 1, wherein the access point adds a MAC
address and IP address of the wireless terminal which needs authentication to the authentication request message and transmits the resultant message.
address and IP address of the wireless terminal which needs authentication to the authentication request message and transmits the resultant message.
3. The system according to claim 1, wherein the access point adds an IP
address of the access point which requests authentication to the authentication request message and transmits the resultant message.
address of the access point which requests authentication to the authentication request message and transmits the resultant message.
4. The system according to claim 1, wherein the access point adds a user ID
and password from the wireless terminal which needs authentication to the authentication request message and transmits the resultant message.
and password from the wireless terminal which needs authentication to the authentication request message and transmits the resultant message.
5. The system according to claim 1, wherein the access point confirms whether the wireless terminal is newly authenticated or has already been authenticated on the basis of the authentication information included in the authentication response message.
6. The system according to claim 1, wherein, when the access point confirms that the wireless terminal is newly authenticated on the basis of the authentication information included in the authentication response message, the access point transmits a charging start request message to the access point manager to start charging the authenticated wireless terminal.
7. The system according to claim 1, wherein, when the access point transmits the charging start request message to start charging the authenticated wireless terminal, the access point controls data transmission and reception of the authenticated wireless terminal.
8. The system according to claim 1, wherein the access point transmits status information of the wireless terminal to the access point manager after transmitting the charging start request message.
9. The system according to claim 1, wherein, when a logoff request is received from the wireless terminal or time-out is generated, the access point transmits a charging stop request message to the access point manager to stop charging.
10. The system according to claim 1, wherein, when the access point manager receives the authentication request message from the access point, the access point manager confirms whether the wireless terminal has already been authenticated.
11. The system according to claim 1, wherein, when the access point manager confirms that the wireless terminal has not been authenticated on the basis of the authentication request message, the access point manager transmits the authentication request message to the authentication server of the wireless network operator for authentication.
12. The system according to claim 1, wherein, when the access point manager confirms that the wireless terminal is newly authenticated, the access point manager adds new authentication information to the authentication response message, and transmits the resultant message to the access point.
13. The system according to claim 1, wherein, when the access point manager confirms that the wireless terminal has already been authenticated on the basis of the authentication request message, the access point manager directly authenticates the wireless terminal on the basis of the registered authentication information.
14. The system according to claim 1, wherein, when the wireless terminal has already been authenticated, the access point manager adds previous authentication information to the authentication response message, and transmits the resultant message to the access point.
15. The system according to claim 1, wherein, when the access point manager receives a charging start request message for the wireless terminal from the access point, the access point manager transmits the charging start request message to the authentication server to start charging.
16. The system according to claim 1, wherein, when the access point manager receives a charging stop request message for the wireless terminal from the access point, the access point manager transmits the charging stop request message to the authentication server to stop charging.
17. An authentication method having mobility in a public wireless LAN
which receives an authentication or charging request message for a wireless terminal from
which receives an authentication or charging request message for a wireless terminal from
18 an access point and processes authentication and charging through an authentication server of a wireless network operator, comprising:
an authentication step for receiving the authentication request message from the access point, authenticating the wireless terminal on the basis of the authentication request message, and transmitting an authentication response message to the corresponding access point; and a charging step for receiving the charging request message from the access point and transmitting the received charging request message to the authentication server, and receiving a charging request response message from the authentication server and transmitting the received charging request response message to the access point.
18. The method according to claim 17, wherein the authentication step comprises the steps of:
deciding whether the wireless terminal has already been authenticated on the basis of the authentication request message received from the access point;
transmitting the authentication response message to the access point on the basis of the previously-registered authentication information, when the wireless terminal has already been authenticated; and obtaining authentication from the authentication server and transmitting the authentication response message to the access point, when the wireless terminal has not been authenticated.
an authentication step for receiving the authentication request message from the access point, authenticating the wireless terminal on the basis of the authentication request message, and transmitting an authentication response message to the corresponding access point; and a charging step for receiving the charging request message from the access point and transmitting the received charging request message to the authentication server, and receiving a charging request response message from the authentication server and transmitting the received charging request response message to the access point.
18. The method according to claim 17, wherein the authentication step comprises the steps of:
deciding whether the wireless terminal has already been authenticated on the basis of the authentication request message received from the access point;
transmitting the authentication response message to the access point on the basis of the previously-registered authentication information, when the wireless terminal has already been authenticated; and obtaining authentication from the authentication server and transmitting the authentication response message to the access point, when the wireless terminal has not been authenticated.
19. The method according to claim 18, wherein the step for obtaining authentication from the authentication server and transmitting the authentication response message to the access point comprises a step for registering wireless terminal information, access point information and authentication information.
20. The method according to claim 18, wherein the step for transmitting the authentication response message to the access point on the basis of the previously-registered authentication information comprises a step for renewing the access point information on the basis of the received authentication request message.
21. The method according to claim 18, wherein the step for transmitting the authentication response message comprises a step for adding information on whether the wireless terminal is newly authenticated or has already been authenticated to the authentication response message.
22. An authentication method having mobility in a public wireless LAN
where an access point requests authentication and charging of a wireless terminal through an access point manager, comprising:
a step for the access point to be wirelessly connected to the wireless terminal;
an authentication request step for adding information of the wireless terminal to an authentication request message and transmitting it to the access point manager; and a step for receiving an authentication response message to the authentication request message transmitted in the authentication request step from the access point manager, and selectively requesting the access point manager to start charging on the basis of the authentication information included in the authentication response message.
where an access point requests authentication and charging of a wireless terminal through an access point manager, comprising:
a step for the access point to be wirelessly connected to the wireless terminal;
an authentication request step for adding information of the wireless terminal to an authentication request message and transmitting it to the access point manager; and a step for receiving an authentication response message to the authentication request message transmitted in the authentication request step from the access point manager, and selectively requesting the access point manager to start charging on the basis of the authentication information included in the authentication response message.
23. The method according to claim 22, wherein the step for requesting authentication comprises a step for adding a MAC address and IP address of the wireless terminal to the authentication request message.
24. The method according to claim 22, wherein the step for requesting authentication comprises a step for adding an IP address of the access point to the authentication request message.
25. The method according to claim 22, wherein the step for requesting the access point manager to start charging comprises the steps of:
deciding whether the wireless terminal is newly authenticated on the basis of the received authentication response message;
transmitting a charging start request message to the access point manager to start charging and starting data transmission and reception of the wireless terminal, when the wireless terminal is newly authenticated; and starting data transmission and reception of the wireless terminal when the wireless terminal has already been authenticated.
deciding whether the wireless terminal is newly authenticated on the basis of the received authentication response message;
transmitting a charging start request message to the access point manager to start charging and starting data transmission and reception of the wireless terminal, when the wireless terminal is newly authenticated; and starting data transmission and reception of the wireless terminal when the wireless terminal has already been authenticated.
Applications Claiming Priority (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| KR2002-0022346 | 2002-04-23 | ||
| KR10-2002-0022346A KR100470303B1 (en) | 2002-04-23 | 2002-04-23 | Authentication System and Method Having Mobility for Public Wireless LAN |
| PCT/KR2002/001987 WO2003092190A1 (en) | 2002-04-23 | 2002-10-24 | Authentication system and method having mobility in public wireless local area network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CA2480612A1 true CA2480612A1 (en) | 2003-11-06 |
| CA2480612C CA2480612C (en) | 2014-02-04 |
Family
ID=29267887
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CA2480612A Expired - Fee Related CA2480612C (en) | 2002-04-23 | 2002-10-24 | Authentication system and method having mobility in public wireless local area network |
Country Status (9)
| Country | Link |
|---|---|
| US (1) | US20050286489A1 (en) |
| EP (1) | EP1497934B1 (en) |
| JP (1) | JP4508864B2 (en) |
| KR (1) | KR100470303B1 (en) |
| CN (1) | CN100468990C (en) |
| AU (1) | AU2002351438A1 (en) |
| CA (1) | CA2480612C (en) |
| TW (1) | TWI249929B (en) |
| WO (1) | WO2003092190A1 (en) |
Families Citing this family (45)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7673328B1 (en) * | 1998-09-28 | 2010-03-02 | Kojima Co., Ltd. | Network authentication system using individual services providers and an authentication server |
| KR100882431B1 (en) * | 2002-06-25 | 2009-02-05 | 주식회사 케이티 | A Method of reducing authentication delay for mobile host by simplified authentication token |
| JP4290967B2 (en) * | 2002-11-26 | 2009-07-08 | Ｎｅｃインフロンティア株式会社 | Wireless LAN network QoS control system, base station, terminal, QoS control method and program |
| JP4480963B2 (en) * | 2002-12-27 | 2010-06-16 | 富士通株式会社 | IP connection processing device |
| EP1460802A1 (en) * | 2003-03-18 | 2004-09-22 | Hewlett-Packard Development Company, L.P. | Communication method and system |
| CN1549482B (en) * | 2003-05-16 | 2010-04-07 | 华为技术有限公司 | Method for realizing high rate group data service identification |
| WO2005036304A2 (en) * | 2003-09-29 | 2005-04-21 | Realm Systems, Inc. | Mobility device server |
| US20050091308A1 (en) * | 2003-09-29 | 2005-04-28 | Peter Bookman | Mobility device |
| US20060253894A1 (en) * | 2004-04-30 | 2006-11-09 | Peter Bookman | Mobility device platform |
| CN1697386B (en) * | 2004-05-14 | 2010-04-07 | 华为技术有限公司 | Method of charging base on infrastructure architecture of authentication and security in WLAN |
| ES2264853B1 (en) * | 2004-06-24 | 2007-12-16 | Vodafone España, S.A. | SYSTEM AND METHOD OF ASSETING IDENTITIES IN A TELECOMMUNICATIONS NETWORK. |
| CN1310476C (en) * | 2004-07-05 | 2007-04-11 | 华为技术有限公司 | Method for building session connection to wireless local network user |
| KR100813791B1 (en) | 2004-09-30 | 2008-03-13 | 주식회사 케이티 | Apparatus and Method for Integrated Authentification Management for Personal Mobility in wire/wireless Integrated Service Network |
| KR100656401B1 (en) * | 2004-12-27 | 2006-12-11 | 한국전자통신연구원 | Method for processing call to unregistered user in WLAN-GPRS network using SIP |
| WO2006074258A2 (en) * | 2005-01-05 | 2006-07-13 | Realm Systems, Inc. | Mobility device platform |
| KR100667284B1 (en) * | 2005-02-24 | 2007-01-12 | 삼성전자주식회사 | Authentication Method in Network System and System Thereof |
| US7308261B2 (en) * | 2005-04-25 | 2007-12-11 | Yahoo! Inc. | Method for quick registration from a mobile device |
| EP2456276B1 (en) | 2005-04-26 | 2014-06-25 | Vodafone Group PLC | Telecommunications Networks |
| US20070165582A1 (en) * | 2006-01-18 | 2007-07-19 | Puneet Batta | System and method for authenticating a wireless computing device |
| GB2435117A (en) * | 2006-02-10 | 2007-08-15 | Rabbit Point Ltd | Automatic roaming authentication in IP-based communication |
| JP2007243803A (en) * | 2006-03-10 | 2007-09-20 | Fujitsu Ltd | Wireless lan route control system, wireless lan management apparatus, wireless lan access terminal and wireless lan route control method |
| CN101043344A (en) * | 2006-05-19 | 2007-09-26 | 华为技术有限公司 | Fee counting method of WIMAX network |
| JP4867486B2 (en) * | 2006-06-12 | 2012-02-01 | 富士ゼロックス株式会社 | Control program and communication system |
| KR100863135B1 (en) * | 2006-08-30 | 2008-10-15 | 성균관대학교산학협력단 | Dual Authentication Method in Mobile Networks |
| US20090298514A1 (en) * | 2006-09-14 | 2009-12-03 | Shah Ullah | Real world behavior measurement using identifiers specific to mobile devices |
| US9445353B2 (en) | 2006-09-14 | 2016-09-13 | Omnitrail Technologies Inc. | Presence platform for passive radio access network-to-radio access network device transition |
| KR100831326B1 (en) | 2006-12-28 | 2008-05-22 | 삼성전자주식회사 | Multi-hop wireless network system and authentication method thereof |
| US7886339B2 (en) * | 2007-01-20 | 2011-02-08 | International Business Machines Corporation | Radius security origin check |
| CN101247295A (en) * | 2007-02-13 | 2008-08-20 | 华为技术有限公司 | Method and device for acquiring access controller information in wireless local area network |
| US8265593B2 (en) * | 2007-08-27 | 2012-09-11 | Alcatel Lucent | Method and system of communication using extended sequence number |
| US8467814B2 (en) | 2007-09-11 | 2013-06-18 | Yahoo! Inc. | SMS shortcode allocation |
| CN101425909B (en) * | 2008-09-28 | 2011-06-01 | 西安西电捷通无线网络通信股份有限公司 | Method for implementing WAPI system terminal zero interference charging |
| CN102104857B (en) * | 2009-12-16 | 2013-10-02 | 华为技术有限公司 | Charging method and communication system |
| TWI463904B (en) * | 2010-01-27 | 2014-12-01 | Htc Corp | Method, wireless network communication apparatus and computer readable medium thereof for accessing wireless network |
| KR101504717B1 (en) * | 2010-09-16 | 2015-03-23 | 에스케이텔레콤 주식회사 | System and method for terminal authentication processing |
| KR101720043B1 (en) * | 2010-11-25 | 2017-03-28 | 에스케이텔레콤 주식회사 | System and method for authentication in wireless lan |
| CN102014380B (en) * | 2010-12-20 | 2014-04-30 | 广州杰赛科技股份有限公司 | Authentication accelerator and high-speed authentication method based on wireless LAN authentication and privacy infrastructure (WAPI) |
| US9210557B2 (en) | 2011-04-12 | 2015-12-08 | Yahoo! Inc. | SMS-initiated mobile registration |
| KR101504173B1 (en) * | 2011-09-16 | 2015-03-23 | 주식회사 케이티 | Charging Method and Apparatus of WiFi Roaming Based on AC-AP Association |
| CN102833744B (en) * | 2012-06-28 | 2016-01-13 | 宇龙计算机通信科技(深圳)有限公司 | Obtain the method and system of WAPI certificate |
| CN102843683B (en) * | 2012-08-21 | 2015-04-22 | 北京星网锐捷网络技术有限公司 | Wireless local area network (WLAN) access method, WLAN access device and WLAN access system |
| US10505913B2 (en) | 2015-03-23 | 2019-12-10 | Biglobe Inc. | Communication management system, access point, communication management device, connection control method, communication management method, and program |
| CN105187398B (en) * | 2015-08-12 | 2018-01-30 | 四川神琥科技有限公司 | A kind of authentication recognition methods |
| CN111654464A (en) * | 2015-12-31 | 2020-09-11 | 华为技术有限公司 | Access control method, authentication device and system |
| EP4048021B1 (en) * | 2021-02-19 | 2023-12-06 | Deutsche Telekom AG | Methods and devices for voice over wifi calls |
Family Cites Families (22)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US5633888A (en) * | 1995-06-05 | 1997-05-27 | Advanced Micro Devices, Inc. | Method of using an access point adjacency matrix to establish handoff in a wireless LAN |
| FI102232B1 (en) * | 1996-01-15 | 1998-10-30 | Nokia Telecommunications Oy | packet radio networks |
| CA2221948A1 (en) * | 1996-12-30 | 1998-06-30 | Lucent Technologies Inc. | System and method for achieving handover in wireless lan by buffering data at subsequent access point |
| TW332269B (en) * | 1997-06-10 | 1998-05-21 | Inst Information Industry | Integrated system of peripheral devices of wireless network |
| US6665718B1 (en) * | 1997-10-14 | 2003-12-16 | Lucent Technologies Inc. | Mobility management system |
| US6052785A (en) * | 1997-11-21 | 2000-04-18 | International Business Machines Corporation | Multiple remote data access security mechanism for multitiered internet computer networks |
| US6477156B1 (en) * | 1999-06-29 | 2002-11-05 | Nokia Corporation | Apparatus, and associated method, for selectably operating radio device in alternate operating mode |
| JP2001016161A (en) * | 1999-06-30 | 2001-01-19 | Hitachi Ltd | Inter-road-vehicle communication system, mobile station device for the system, base station device and base station management device |
| JP2001144815A (en) * | 1999-11-16 | 2001-05-25 | Nippon Telegr & Teleph Corp <Ntt> | Connection method for high speed mobile communication network |
| JP3585422B2 (en) * | 2000-06-01 | 2004-11-04 | シャープ株式会社 | Access point device and authentication processing method thereof |
| KR20000071993A (en) * | 2000-06-10 | 2000-12-05 | 최제형 | Authentication method and device, and operation method for medium with specified period and anthorization for payment method of internet payinformation service |
| WO2002009458A2 (en) | 2000-07-24 | 2002-01-31 | Bluesocket, Inc. | Method and system for enabling seamless roaming in a wireless network |
| US6633761B1 (en) * | 2000-08-11 | 2003-10-14 | Reefedge, Inc. | Enabling seamless user mobility in a short-range wireless networking environment |
| JP3589625B2 (en) * | 2000-08-25 | 2004-11-17 | 日本電信電話株式会社 | Communication billing system |
| US7224800B1 (en) * | 2000-11-28 | 2007-05-29 | Nokia Corporation | System and method for authentication of a roaming subscriber |
| US20020136226A1 (en) * | 2001-03-26 | 2002-09-26 | Bluesocket, Inc. | Methods and systems for enabling seamless roaming of mobile devices among wireless networks |
| TWI260874B (en) * | 2001-03-26 | 2006-08-21 | Ntt Docomo Inc | Method and apparatus for providing communication service |
| KR100438155B1 (en) * | 2001-08-21 | 2004-07-01 | (주)지에스텔레텍 | Wireless local area network sytem and method for managing the same |
| AU2002343424A1 (en) * | 2001-09-28 | 2003-04-14 | Bluesocket, Inc. | Method and system for managing data traffic in wireless networks |
| KR100463067B1 (en) * | 2001-12-29 | 2004-12-23 | 하나로통신 주식회사 | Method for hand-off in access network of based wireless LAN |
| KR100429269B1 (en) * | 2002-02-19 | 2004-04-29 | 엘지전자 주식회사 | Method for Providing Roaming Service due to transfer of Station in Wireless LAN |
| KR20020035530A (en) * | 2002-04-12 | 2002-05-11 | 이정희 | A Mobile CRM Mechanism using Subscriber Real-Time Service Information |
-
2002
- 2002-04-23 KR KR10-2002-0022346A patent/KR100470303B1/en active IP Right Grant
- 2002-10-24 JP JP2004500428A patent/JP4508864B2/en not_active Expired - Fee Related
- 2002-10-24 US US10/510,728 patent/US20050286489A1/en not_active Abandoned
- 2002-10-24 EP EP02786211.9A patent/EP1497934B1/en not_active Expired - Lifetime
- 2002-10-24 AU AU2002351438A patent/AU2002351438A1/en not_active Abandoned
- 2002-10-24 CN CNB028288041A patent/CN100468990C/en not_active Expired - Fee Related
- 2002-10-24 CA CA2480612A patent/CA2480612C/en not_active Expired - Fee Related
- 2002-10-24 WO PCT/KR2002/001987 patent/WO2003092190A1/en active Application Filing
- 2002-10-29 TW TW091132049A patent/TWI249929B/en not_active IP Right Cessation
Also Published As
| Publication number | Publication date |
|---|---|
| EP1497934A1 (en) | 2005-01-19 |
| WO2003092190A1 (en) | 2003-11-06 |
| TWI249929B (en) | 2006-02-21 |
| EP1497934A4 (en) | 2008-11-26 |
| AU2002351438A1 (en) | 2003-11-10 |
| KR100470303B1 (en) | 2005-02-05 |
| JP4508864B2 (en) | 2010-07-21 |
| KR20030083941A (en) | 2003-11-01 |
| US20050286489A1 (en) | 2005-12-29 |
| TW200407024A (en) | 2004-05-01 |
| CA2480612C (en) | 2014-02-04 |
| JP2005524161A (en) | 2005-08-11 |
| CN100468990C (en) | 2009-03-11 |
| CN1625853A (en) | 2005-06-08 |
| EP1497934B1 (en) | 2016-03-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CA2480612C (en) | Authentication system and method having mobility in public wireless local area network | |
| US8074070B2 (en) | Method for fast, secure 802.11 re-association without additional authentication, accounting, and authorization infrastructure | |
| CA2483044C (en) | Roaming method between wireless local area network and cellular network | |
| US8199720B2 (en) | Method for handover between heterogenous radio access networks | |
| KR100872005B1 (en) | Method and apparatus for providing network service information to a mobile station by a wireless local area network | |
| KR101490243B1 (en) | A Method of establishing fast security association for handover between heterogeneous radio access networks | |
| EP2048891B1 (en) | Methods and equipments of notifying user's location in mobile communication system | |
| WO2019242730A1 (en) | Network access method, terminal, and network side network element | |
| WO2007045147A1 (en) | An accessing network method, system and terminal of the wireless local area network terminal | |
| JP2007195222A (en) | Method for performing handoff in radio terminal, and handoff enabled radio terminal | |
| KR100711313B1 (en) | Method for operating network link with mobile telecommunication and wireless broadband internet | |
| KR100668660B1 (en) | User authentication method for roaming service between portable internet and 3g network, and router of performing the same | |
| KR100473004B1 (en) | Inter-Access Point Roaming Method | |
| KR100485517B1 (en) | Apparatus and method of user authentication for WLAN system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| EEER | Examination request | ||
| MKLA | Lapsed |
Effective date: 20181024 |