JP6450257B2 - Wireless communication system - Google Patents

Description

  The present invention relates to a wireless communication system.

  In recent years, in order to ensure the security of confidential information such as personal information stored in a server on the Internet, user authentication using authentication information such as a user ID and a password has been performed (for example, Patent Document 1). In principle, the server performs user authentication each time a user accesses confidential information.

  However, if user authentication is executed for each access, authentication information input is required each time, which is cumbersome for the user. Therefore, a tracking technique is used in which the server tracks the user to determine the identity of the user and omits re-user authentication for the user determined to be the same.

  Currently, there are various tracking technologies. One example is tracking using a cookie that identifies a session. The cookie is information that the server issues to the browser that the user uses to access the server, and includes a session ID that is a character string that identifies the session.

  A session means a series of processes (screen transition, data storage, etc.) that a user executes using a browser on a website provided by a server. For example, in a case where a user performs online shopping at a shopping site provided by a server, the user accesses the site, browses products, adds them to a shopping cart, and performs processing for purchasing products in the shopping cart. Are treated as one session in the server.

  A series of processes in one session may be substantially a series, and strict continuity of page transitions is not required. For example, in the above example, when a user visits another website after adding a product to the shopping cart and returns to the above shopping site again, it may be handled as one session.

  If cookies are used, user authentication can be omitted. For example, as shown in FIG. 1, when the user authentication is successful, the server transmits a cookie including a session ID to the browser of the user device. As shown in FIG. 2, when the browser of the user device accesses the server using the above session ID, the server determines that the user authentication is not necessary again because the access is an access in a series of sessions.

  Another example of the tracking technique is tracking based on an IP address (destination access network). The IP address is an identifier for identifying a device used by a user and an access network (LTE network, wireless LAN, etc.) used by the device.

  Even if an IP address is used, user authentication can be omitted. For example, as shown in FIG. 3, the server stores the IP address assigned to the user device when the user authentication is successful. As shown in FIG. 4, when the user device accesses the server using the same IP address as the stored IP address, the server uses the same access network as when the user device accessed before. Therefore, it is determined that user authentication is not necessary again.

  Multiple tracking technologies can be combined to further improve the security level. For example, as shown in FIG. 5, tracking using both a cookie and an IP address is possible. In tracking using only a cookie, when a session ID is stolen, an unauthorized user device may be handled as an authenticated user device.

  FIG. 6 shows a case where the session ID is stolen by an unauthorized user device. In tracking using both a cookie and an IP address, the server does not treat a user device having a matching session ID but a different IP address (access network) as an authenticated user device, and does not treat the user device as an unauthorized user device. Re-authenticate against it. Therefore, the latter tracking has a higher security level.

JP2013-250612A

  However, in tracking techniques where the server is configured to require the user to re-authenticate when the IP address has changed (ie, the connected access network has changed), the access to which the user is connected Re-authentication is required every time the network is changed, which is cumbersome for the user. The above problems are particularly noticeable in the recent system environment in which the access network is frequently changed due to traffic offload.

  In view of the above circumstances, an object of the present invention is to appropriately control a connection destination access network according to a tracking setting.

  A wireless communication system according to the present invention is a wireless communication system including a user device connectable to a plurality of access networks and a server for authenticating the user device, wherein the user device authenticates the user device. An authentication request transmitting unit that transmits an authentication request including necessary authentication information is provided, and the server authenticates the user device based on the authentication request and an authentication request receiving unit that receives the authentication request from the user device. Authentication that includes a user authentication unit, a tracking unit that performs tracking for the user device authenticated by the user authentication unit, and an authentication response including an authentication result by the user authentication unit and a tracking setting related to the tracking, to the user device A response transmission unit, wherein the user apparatus further receives an authentication response. A receiver, in response to the tracking setting included in the authentication response, and an access network control unit for inhibiting the change of the connection destination access network.

  The communication control method of the present invention is a communication control method in a wireless communication system including a user device connectable to a plurality of access networks and a server that authenticates the user device, and is necessary for authenticating the user device. Transmitting an authentication request including authentication information from the user device to the server, receiving the authentication request from the user device at the server, and authenticating the user device based on the authentication request. Performing tracking on the authenticated user device, transmitting an authentication response including an authentication result and a tracking setting relating to the tracking from the server to the user device, and Receiving the authentication response, and the tracker included in the authentication response. Depending on the grayed setting, and a arresting changes the connection destination access network.

  According to the present invention, the change of the connection destination access network is suppressed according to the tracking setting.

It is explanatory drawing of the cookie transmission with respect to a user apparatus from a server. It is explanatory drawing of the access to the server using session ID. It is explanatory drawing that a server memorize | stores the IP address of a user apparatus. It is explanatory drawing of the access to the server using an IP address. It is explanatory drawing of the combination of several tracking technique. It is explanatory drawing which shows the case where session ID was stolen by the unauthorized user apparatus. It is a figure which shows the radio | wireless communications system which concerns on 1st Embodiment. It is a block diagram of the configuration of the user device of the first embodiment. It is a block diagram of the configuration of the server of the first embodiment. It is a flowchart which shows the example of the authentication operation | movement of 1st Embodiment.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

1. First Embodiment 1 (1). Overview of Radio Communication System FIG. 7 is a diagram showing a radio communication system CS according to the first embodiment of the present invention. The radio communication system CS includes a user apparatus UA, a server SV, and a plurality of access networks AN (AN1, AN2,...).

  The user apparatus UA can be connected to each of a plurality of access networks AN (AN1, AN2,...). The server SV is a server device that can authenticate the user device UA. For example, the server SV is an application server that provides an online shopping site to the user device UA.

  The first access network AN1 is a wireless communication network conforming to a cellular communication standard (for example, LTE / SAE (Long Term Evolution / System Architecture Evolution) standard included in 3GPP (Third Generation Partnership Project) standard). According to the terms defined in the 3GPP standard, the user equipment UA is User Equipment (UE).

  Although not shown, the first access network AN1 includes devices such as a base station that is a wireless connection destination of the user device UA and a gateway that is a connection point with the Internet. When the user apparatus UA connects to the first access network AN1, an IP address is assigned to the user apparatus UA from the network side.

  The second access network AN2 is a wireless communication network that conforms to a non-cellular communication standard (for example, an IEEE 802.11 wireless LAN standard). According to the terms defined in the wireless LAN standard, the user apparatus UA is a Station (STA).

  Although not shown, the second access network AN2 includes devices such as an access point that is a wireless connection destination of the user device UA. When the user apparatus UA connects to the second access network AN2, an IP address is assigned to the user apparatus UA from the network side.

1 (2). Configuration of each node 1 (2) -1. Configuration of User Device FIG. 8 is a configuration block diagram of the user device UA according to the first embodiment. The user apparatus UA includes a first wireless communication unit 100, a second wireless communication unit 110, a storage unit 120, and a control unit 130. Illustrations of an output device that outputs audio, video, and the like, an input device that receives an instruction from a user, and the like are omitted for convenience.

  The first wireless communication unit 100 is an element for communicating with the first access network AN1 according to the cellular communication standard, and the second wireless communication unit 110 is an element for communicating with the second access network AN2 according to the non-cellular communication standard. . The above-described wireless communication units 100 and 110 conform to the corresponding communication standards, such as a transmission / reception antenna, a reception circuit that receives a radio signal (radio wave) and converts it into an electrical signal, and a control signal / user signal, A transmission circuit that converts an electrical signal into a radio signal (radio wave) and transmits the signal.

  The control unit 130 includes an authentication request transmission unit 132, an authentication response reception unit 134, and an access network control unit 136. The authentication request transmission unit 132 transmits an authentication request including authentication information (for example, a user ID and a password) necessary for authenticating the user device UA to the server SV. The authentication response receiving unit 134 receives an authentication response from the server SV. The access network control unit 136 suppresses the change of the connection destination access network according to the tracking setting included in the authentication response. Details of the above operation will be described later.

  The control unit 130 and the elements included in the control unit 130 are functional blocks realized by a CPU (not shown) in the user apparatus UA executing a computer program stored in each storage unit 120 and functioning according to the computer program. It is.

1 (2) -2. Server Configuration FIG. 9 is a configuration block diagram of the server SV according to the first embodiment. The server SV includes a wired communication unit 200, a storage unit 210, and a control unit 220. The wired communication unit 200 is an element for communicating with the first access network AN1 and the second access network AN2, and transmits and receives electrical signals by wire.

  The control unit 220 includes an authentication request receiving unit 222, a user authentication unit 224, a tracking unit 226, and an authentication response transmission unit 228. The authentication request receiving unit 222 receives an authentication request from the user apparatus UA. The user authentication unit 224 authenticates the user device UA based on the authentication request received by the authentication request reception unit 222. The tracking unit 226 performs tracking for the user device UA authenticated by the user authentication unit 224. The authentication response transmission unit 228 transmits an authentication response including an authentication result by the user authentication unit 224 and a setting (tracking setting) related to tracking executed by the tracking unit 226 to the user apparatus UA. Details of the above operation will be described later.

  The control unit 220 and the elements included in the control unit 220 are functional blocks realized by a CPU (not shown) in the server SV executing a computer program stored in the storage unit 210 and functioning according to the computer program. It is.

1 (3) -1. Example of authentication operation (first example)
An example of the authentication operation in the first embodiment will be described below with reference to FIG. In the first embodiment, a flag that instructs to inhibit or allow access network changes is transmitted from the server SV to the user apparatus UA as a tracking setting.

  In the example of FIG. 10, it is initially assumed that the user apparatus UA is connected to the first access network AN1. The user apparatus UA transmits an access request for the web page provided by the server SV (S10). The server SV returns an access response including the content of the web page specified by the access request (S20). The web page indicated by the above access response includes an input field for authentication information for logging on to the site provided by the server SV.

  The authentication request transmission unit 132 of the user device UA transmits an authentication request to the server SV (S30). The authentication request includes authentication information (user ID and password) necessary for authenticating the user device UA. The authentication request receiving unit 222 of the server SV receives an authentication request from the user device UA. The received authentication request is supplied to the user authentication unit 224 of the server SV.

  The user authentication unit 224 authenticates the user device UA based on the authentication request (S40). More specifically, the user authentication unit 224 determines whether or not the combination of the user ID and password included in the authentication request matches any of the combination of the user ID and password stored in the storage unit 210. judge. If they match, the user device UA is authenticated, and if they do not match, the user device UA is not authenticated. In this example, a case where the user apparatus UA is authenticated in step S40 will be described below.

  When the user device UA is authenticated, the tracking unit 226 of the server SV starts tracking the authenticated user device UA (S50). In the example of FIG. 10, the tracking unit 226 executes both a tracking method using a cookie and a tracking method using an IP address.

  That is, the tracking unit 226 of this example gives a cookie including a session ID to various responses transmitted from the server SV to the user apparatus UA after the user authentication in step S40. And the tracking part 226 determines the identity of a session based on session ID contained in the various requests | requirements transmitted from the user apparatus UA after receiving the above cookie. When it is determined that the sessions are not the same due to reasons such as different session IDs, no session IDs, or expired cookies, the tracking unit 226 requests the user apparatus UA to re-authenticate.

  Further, the tracking unit 226 of the present example causes the storage unit 210 to store the IP address assigned to the user device UA at the time of user authentication in step S40. Then, the tracking unit 226 determines the identity of the access network AN to which the user device UA is connected based on the IP address used when the user device UA accesses the server SV. When the tracking unit 226 detects that the access network to which the user apparatus UA is connected has been changed due to an access from an IP address different from that at the time of user authentication, the tracking unit 226 re-authenticates the user apparatus UA. Request.

  The authentication response transmission unit 228 of the server SV transmits an authentication response including the authentication result by the user authentication unit 224 and the tracking setting related to the above tracking to the user apparatus UA (S60). The tracking setting in this example indicates a suppression flag that instructs the access network control unit 136 of the user apparatus UA to suppress the change of the connection destination access network.

  The authentication response reception unit 134 of the user device UA receives an authentication response from the server SV. The received authentication response is supplied to the access network control unit 136. The access network control unit 136 inhibits the first wireless communication unit 100 from changing the connection destination access network from the first access network AN1 based on the inhibition flag included in the authentication response (S70). As a result of the change of the connection destination access network being suppressed, the execution of re-authentication based on the change of the IP address is suppressed.

1 (3) -2. Example of authentication operation (second example)
Another example of the authentication operation in the first embodiment will be described below. In this example, the tracking unit 226 performs only the tracking method using a cookie and does not execute the tracking method using an IP address. Steps S10 to S40 are the same as those in the first example described above, and a description thereof will be omitted.

  When the user device UA is authenticated, the tracking unit 226 of the server SV starts tracking the authenticated user device UA (S50). As described above, the tracking unit 226 executes only the tracking method using the cookie described in the first example, and does not detect a change in the connection destination access network. Therefore, if it is determined that the sessions are the same, the tracking unit 226 of the present example will notify the user apparatus UA even if the user apparatus UA accesses the server SV using an IP address different from that used for user authentication. Do not require re-authentication.

  The authentication response transmission unit 228 of the server SV transmits an authentication response including the authentication result and the tracking setting related to the above tracking to the user apparatus UA (S60). The tracking setting in this example indicates a permission flag that instructs the access network control unit 136 of the user apparatus UA to allow a change in the connection destination access network.

  The authentication response reception unit 134 of the user device UA receives an authentication response from the server SV. The received authentication response is supplied to the access network control unit 136. The access network control unit 136 allows the first wireless communication unit 100 to change the connection destination access network from the first access network AN1 based on the permission flag included in the authentication response (S70).

1 (4). Effects of this Embodiment According to the configuration of this embodiment described above, the tracking setting included in the authentication response is set according to the content of tracking executed by the tracking unit 226, and the connection destination of the user apparatus UA is set according to the tracking setting. The access network is properly controlled. More specifically, when re-authentication is requested along with the change of the connection destination access network, the change of the connection destination access network is suppressed. As a result, unnecessary user authentication processing is suppressed.

2. Second Embodiment A second embodiment of the present invention will be described below. In each embodiment illustrated below, about the element which an effect | action and a function are equivalent to 1st Embodiment, the code | symbol referred by the above description is diverted and each description is abbreviate | omitted suitably.

  In the first embodiment, in the server SV, a flag (inhibition flag / allowance flag) for controlling the change of the connection destination access network is set and notified to the user apparatus UA. In the second embodiment, the tracking method used by the server SV is notified to the user apparatus UA, and the user apparatus UA sets whether to prevent or permit the change of the connection destination access network.

2 (1) -1. Example of authentication operation (third example)
An example of the authentication operation in the second embodiment will be described below. In this example, similarly to the first embodiment, it is assumed that the user apparatus UA is initially connected to the first access network AN1. Steps S10 to S50 are the same as in the first example of the first embodiment, and thus the description thereof is omitted.

  The authentication response transmission unit 228 of the server SV transmits an authentication response including the authentication result by the user authentication unit 224 and the tracking setting related to tracking to the user apparatus UA (S60). The tracking setting in this example indicates a tracking method used in tracking performed by the tracking unit 226, that is, a tracking method using a cookie and a tracking method using an IP address. The tracking method using the IP address is an access network-dependent tracking method that detects a change in the access network to which the user apparatus UA is connected and requests the user apparatus UA to re-authenticate.

  The authentication response reception unit 134 of the user device UA receives an authentication response from the server SV. The received authentication response is supplied to the access network control unit 136. Since the tracking setting included in the authentication response indicates an access network-dependent tracking method, the access network control unit 136 prevents the first wireless communication unit 100 from changing the connection destination access network from the first access network AN1. (S70). As a result of the change of the connection destination access network being suppressed, the execution of re-authentication based on the change of the IP address is suppressed.

2 (1) -2. Example of authentication operation (fourth example)
Another example of the authentication operation in the second embodiment will be described below. In this example, the tracking unit 226 performs only the tracking method using a cookie and does not execute the tracking method using an IP address. Steps S10 to S40 are the same as in the third example described above, and thus the description thereof is omitted.

  When the user device UA is authenticated, the tracking unit 226 of the server SV starts tracking the authenticated user device UA (S50). As in the second example of the first embodiment, the tracking unit 226 performs only the tracking method using a cookie and does not detect a change in the connection destination access network.

  The authentication response transmission unit 228 of the server SV transmits an authentication response including the authentication result by the user authentication unit 224 and the tracking setting related to tracking to the user apparatus UA (S60). The tracking setting in this example shows only a tracking method using cookies, and does not show an access network-dependent tracking method.

  The authentication response reception unit 134 of the user device UA receives an authentication response from the server SV. The received authentication response is supplied to the access network control unit 136. The access network control unit 136 allows the first wireless communication unit 100 to change the connection destination access network from the first access network AN1 because the tracking setting included in the authentication response does not indicate the access network-dependent tracking method. (S70).

2 (2). Effects of the present embodiment According to the configuration of the present embodiment described above, the same effects as those of the first embodiment can be obtained.

3. Modified example
The above embodiment can be variously modified. Specific modifications are exemplified below. Two or more aspects arbitrarily selected from the above embodiments and the following examples can be appropriately combined as long as they do not contradict each other.

3 (1). Modification 1
In the example of the authentication operation in the above embodiment, it is assumed that the user apparatus UA is initially connected to the first access network AN1. However, initially, the user apparatus UA may be connected to another access network AN (for example, the second access network AN2).

3 (2). Modification 2
In the above embodiment, an IP address is used as an identifier for identifying the access network AN. However, other identifiers may be used to identify the access network AN. For example, the default gateway of the user device UA may be used as the identifier.

3 (3). Modification 3
In the above embodiment, the user authentication unit 224 performs user authentication using a character string (a combination of a user ID and a password) known only by the user as authentication information. However, any information that identifies the user can be used as authentication information. For example, information read from an IC card owned only by the user himself / herself may be used as authentication information, or a physical characteristic (fingerprint, iris pattern, etc.) unique to the user himself / herself may be used as authentication information.

3 (4). Modification 4
The user device UA is an arbitrary device capable of wireless communication with a plurality of access networks AN. The user apparatus UA may be a mobile phone terminal such as a feature phone or a smartphone, a tablet terminal, a desktop personal computer, a notebook personal computer, a UMPC (Ultra-Mobile Personal Computer), It may be a game machine or other wireless terminal.

3 (5). Modification 5
The functions executed by the CPU in the user apparatus UA and the server SV may be executed by hardware instead of the CPU, and for example, programmable logic devices such as FPGA (Field Programmable Gate Array) and DSP (Digital Signal Processor) It may be executed with.

DESCRIPTION OF SYMBOLS 100 ... 1st wireless communication part, 110 ... 2nd wireless communication part, 120 ... Memory | storage part, 130 ... Control part, 132 ... Authentication request transmission part, 134 ... Authentication response receiving part, 136 ... Access Network control unit, 200... Wired communication unit, 210... Storage unit, 220... Control unit, 222... Authentication request receiving unit, 224 ... User authentication unit, 226. , AN (AN1, AN2,...) ........ Access network, CS .... Wireless communication system, SV .... Server, UA ... User equipment.

Claims (3)

User equipment connectable to multiple access networks;
A wireless communication system comprising a server for authenticating the user device,
The user equipment is
An authentication request transmission unit that transmits an authentication request including authentication information necessary to authenticate the user device;
The server
An authentication request receiver for receiving the authentication request from the user device;
A user authentication unit that authenticates the user device based on the authentication request;
A tracking unit that performs tracking for the user device authenticated by the user authentication unit;
An authentication response transmission unit that transmits an authentication response including an authentication result by the user authentication unit and a tracking setting related to the tracking to the user device;
The user equipment further includes
An authentication response receiver for receiving the authentication response;
A wireless communication system comprising: an access network control unit that suppresses a change in a connection destination access network according to the tracking setting included in the authentication response. The tracking settings are
When the tracking unit is configured to detect a change in the connection destination access network of the user device and request the user device to re-authenticate, the access network control unit is connected to the connection destination access network If the tracking unit is set not to detect a change in the connection destination access network of the user device, the control unit controls the access network control unit. The wireless communication system according to claim 1, wherein a permission flag is provided to instruct that the change of the connection destination access network is permitted. The tracking settings are
One or more tracking techniques used in the tracking performed by the tracking unit;
The access network controller is
When the tracking setting indicates an access network-dependent tracking method that detects a change in the connected access network of the user device and requests the user device to re-authenticate, the change of the connected access network is suppressed. The wireless communication system according to claim 1, wherein when the access network dependent tracking method is not indicated in the tracking setting, the connection destination access network is allowed to change.

Images