Authentication system and authentication server

Abstract

To provide an authentication system and an authentication server that allow for the flexible setting of authentication strength for each of a plurality of wireless LAN access points.SOLUTION: A communication terminal 14 operates as a supplicant based on the IEEE802.1X standard. An authentication server 11 authenticates the communication terminal 14 based on the IEEE802.1X standard. A wireless LAN controller 12 operates as an authenticator based on the IEEE802.1X standard, and communicates EAPOL frames with the communication terminal 14 and RADIUS packets with the authentication server 11. The authentication server 11 selects one of multiple authentication methods based on identification information APID that identifies a wireless LAN access point 13 and that is included in the RADIUS packets from the wireless LAN controller 12, and proposes use of the selected authentication method to the communication terminal 14.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an authentication system and an authentication server. [Background technology]

[0002] Patent Document 1 discloses a setting information server that can change setting information for an access point for a provider that provides a wireless LAN service. The setting information server stores provider identification information and access point setting information in association with each other. When a user terminal uses the wireless LAN service, the setting information server receives an authentication request including the provider identification information from the access point and acquires setting information associated with the provider identification information. The setting information server then transmits an authentication response including the acquired setting information to the access point. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2017-50785 A Summary of the Invention [Problem to be solved by the invention]

[0004] Authentication based on the IEEE802.1X standard is widely used in authentication systems that include wireless LANs. The IEEE802.1X standard performs authentication using the Extensible Authentication Protocol (EAP) and Remote Authentication Dial-In User Service (RADIUS) standards. EAP defines the procedures for using various authentication methods. The RADIUS standard defines the procedures for authenticating using a RADIUS server in response to an authentication request from a RADIUS client.

[0005] In such an authentication system, the authentication strength can be changed depending on the authentication method used. For example, when an authentication method with low authentication strength is used, the security level may be insufficient, but there is no need to implement advanced functions in the communication terminal, which is the device to be authenticated, which is advantageous in terms of operational costs, convenience, versatility, etc. On the other hand, when an authentication method with high authentication strength is used, the security level may be sufficient, but there are disadvantages in terms of operational costs, convenience, versatility, etc. Therefore, a mechanism is desired that allows for flexible setting of authentication strength, i.e., security level, taking such a balance into consideration.

[0006] Here, by utilizing the technology disclosed in Patent Document 1, a setting information server defines setting information for each operator in a common access point, thereby enabling the authentication method between the access point and the communication terminal to be changed for each operator. Meanwhile, an authentication system may be provided with multiple access points. In this case, it is desirable to change the authentication strength for each of the multiple access points depending on, for example, the installation environment of the access points. The technology disclosed in Patent Document 1 has difficulty in adequately meeting such demands.

[0007] Therefore, one object of the present invention is to provide an authentication system and an authentication server that can flexibly set authentication strength for each of a plurality of wireless LAN access points.

[0008] The above and other objects and novel features of the present invention will become apparent from the description of this specification and the accompanying drawings. [Means for solving the problem]

[0009] A brief summary of a representative embodiment of the invention disclosed in this application will be given below.

[0010] An authentication system according to one embodiment includes a communication terminal, an authentication server, and a RADIUS client. The communication terminal operates as a supplicant based on the IEEE 802.1X standard. The authentication server authenticates the communication terminal based on the IEEE 802.1X standard. The RADIUS client operates as an authenticator based on the IEEE 802.1X standard, exchanging EAPOL frames with the communication terminal and RADIUS packets with the authentication server. Here, the RADIUS client is a wireless LAN access point that wirelessly communicates with the communication terminal, or a wireless LAN controller that manages the wireless LAN access point. The authentication server selects one authentication method from multiple authentication methods based on identification information that identifies the wireless LAN access point, which is included in the RADIUS packet from the RADIUS client, and proposes use of the selected authentication method to the communication terminal. [Effects of the Invention]

[0011] To briefly explain the effect obtained by a representative embodiment of the invention disclosed in this application, it becomes possible to flexibly set authentication strength. [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a schematic diagram illustrating an example of the configuration and main operations of an authentication system according to an embodiment; [Figure 2] 2 is a schematic diagram showing an example of the configuration of an authentication method setting table provided in the authentication server in FIG. [Figure 3A] 1 is a schematic diagram showing an example of the format configuration of an EAPOL frame used in communication between a RADIUS client and a communication terminal in FIG. [Figure 3B] 1 is a schematic diagram showing an example of the format configuration of a RADIUS packet used in communication between a RADIUS client and an authentication server. [Figure 4] 2 is a sequence diagram showing an example of an operation when authenticating a communication terminal communicating with a wireless LAN access point in FIG. [Figure 5A] 1. FIG. 5 is a sequence diagram showing an example of an operation when authenticating a communication terminal in FIG. 1 that communicates with a wireless LAN access point different from that in FIG. [Figure 5B] 1. FIG. 5 is a sequence diagram showing an example of an operation when authenticating a communication terminal in FIG. 1 that communicates with a wireless LAN access point different from that in FIG. [Figure 6] 2 is a functional block diagram showing an example of the configuration of the main part of the authentication server appearing in FIG. 1; DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. In all drawings for explaining the embodiments, the same components are generally designated by the same reference numerals, and repeated description thereof will be omitted.

[0014] <Outline of the authentication system> Fig. 1 is a schematic diagram showing an example of the configuration and main operation of an authentication system according to an embodiment. The authentication system shown in Fig. 1 includes an authentication server 11, a wireless LAN controller (WLC) 12, multiple wireless LAN access points (APs) 13a, 13b, and so on, and multiple communication terminals 14a, 14b, and so on. In this specification, the multiple wireless LAN access points 13a, 13b, and so on are collectively referred to as wireless LAN access points 13, and the multiple communication terminals 14a, 14b, and so on are collectively referred to as communication terminals 14.

[0015] The authentication server 11, wireless LAN controller 12, and wireless LAN access point 13 are connected via a network 10, specifically a layer 2 (L2) and layer 3 (L3) network. The wireless LAN access point 13 communicates wirelessly with a communication terminal 14. In this example, multiple wireless LAN access points 13a and 13b communicate wirelessly with communication terminals 14a and 14b, respectively. The wireless LAN controller 12 centrally manages the multiple wireless LAN access points 13a, 13b, ...

[0016] The communication terminal 14 operates as a supplicant based on the IEEE802.1X standard. Specifically, the communication terminal 14 has, for example, a processor and a memory, and operates as a supplicant by executing a supplicant program stored in the memory with the processor. In this example, the communication terminals 14a and 14b are mobile devices such as smartphones and tablet PCs. However, the communication terminal 14 may also be an ordinary PC equipped with a wireless LAN interface. The communication terminal 14a is used by a user 15a, and the communication terminal 14b is used by a user 15b.

[0017] Authentication server 11 is a RADIUS server, and authenticates communication terminal 14 via an authenticator based on the IEEE 802.1X standard, in this example, wireless LAN controller 12. Wireless LAN controller 12 operates as an authenticator based on the IEEE 802.1X standard, and as a RADIUS client based on the RADIUS standard. The RADIUS client, in this example, wireless LAN controller 12, communicates EAPOL (EAP Over LAN) frames with communication terminal 14. In addition, the RADIUS client communicates RADIUS packets with authentication server 11.

[0018] Wireless LAN network devices primarily require wireless communication functions based on the IEEE 802.11 standard and a control function for setting up and managing the underlying network environment. The control function also includes authentication processing. Generally, there are two types of wireless LAN access points 13: autonomous and centrally managed. Figure 1 shows an example of a configuration using a centrally managed wireless LAN access point 13.

[0019] The centralized management type wireless LAN access point 13 is used in conjunction with the wireless LAN controller 12, and is provided with functions that are primarily specialized for wireless communication functions. The control function is primarily performed by the wireless LAN controller 12. However, the wireless LAN access point 13 is not limited to such a centralized management type, and may also be an autonomous type. In this case, the wireless LAN controller 12 in FIG. 1 is not particularly required.

[0020] That is, the autonomous wireless LAN access point 13 has both a wireless communication function and a control function, and is configured to be usable independently, including for authentication processing, etc. When the autonomous wireless LAN access point 13 is used, the autonomous wireless LAN access point 13 itself serves as the authenticator and the RADIUS client. On the other hand, when the centralized management wireless LAN access point 13 is used, the authenticator and the RADIUS client usually serve as the wireless LAN controller 12.

[0021] In such an authentication system, for example, assume that the communication terminal 14a is to be authenticated. Briefly, first, the communication terminal 14a wirelessly transmits an EAPOL frame including authentication information to the wireless LAN access point 13a (step S101a). The wireless LAN access point 13a then transmits the received EAPOL frame via a wired connection to the wireless LAN controller 12 (step S101b).

[0022] In response to this, the wireless LAN controller 12 transmits a RADIUS packet containing various RADIUS attribute information to the authentication server 11 (step S102). The RADIUS attribute information includes the authentication information contained in the EAPOL frame as well as various information added by the wireless LAN controller 12. The various information includes identification information APID for identifying the wireless LAN access point 13a.

[0023] Next, the authentication server 11 selects one authentication method from a plurality of pre-defined authentication methods based on the identification information APID included in the RADIUS packet from the wireless LAN controller 12 (step S103). Specifically, the authentication server 11 stores an authentication method setting table 18 that indicates the correspondence between the identification information APID and the authentication method in the memory 17. The authentication server 11 selects the authentication method by referring to the authentication method setting table 18 using the identification information APID from the wireless LAN controller 12.

[0024] Then, the authentication server 11 proposes the use of the selected authentication method to the communication terminal 14a via the wireless LAN controller 12 and the wireless LAN access point 13a. Specifically, the authentication server 11 transmits a RADIUS packet to the wireless LAN controller 12 to propose the use of the selected authentication method (step S104). The wireless LAN controller 12 converts the received RADIUS packet into an EAPOL frame and transmits the converted EAPOL frame to the wireless LAN access point 13a via a wired connection (step S105a). The wireless LAN access point 13a transmits the received EAPOL frame wirelessly to the communication terminal 14a (step S105b).

[0025] Note that the process for authenticating communication terminal 14b is similar to that for communication terminal 14a, except that wireless LAN access point 13a is replaced by wireless LAN access point 13b. Furthermore, if authentication of communication terminals 14a and 14b is successful after this process, communication between communication terminals 14a and 14b may be performed via wireless LAN controller 12 or may be performed without via wireless LAN controller 12, depending on the specifications of wireless LAN controller 12, etc. In the former case, wireless LAN controller 12 is also referred to strictly as a wireless LAN switch. However, in this specification, no distinction is made between these two, and the wireless LAN switch is also referred to as wireless LAN controller 12.

[0026] By using such a method, it becomes possible to flexibly set the authentication strength for each of the identification information APID and, in turn, for each of the multiple wireless LAN access points 13. As a specific example, assume that wireless LAN access point 13a is installed within the company for employees, and wireless LAN access point 13b is installed outside the company for guests. In this case, it is desirable that communication terminal 14b using wireless LAN access point 13b have a higher authentication strength than communication terminal 14a using wireless LAN access point 13a. Using the authentication system shown in FIG. 1 makes it possible to meet such requirements.

[0027] Here, examples of authentication methods that can be used by authentication server 11 include PEAP (Protected EAP), EAP-TLS (EAP-Transport Level Security), EAP-MD5 (EAP-Message Digest 5), and EAP-TTLS (EAP-Tunneled TLS). PEAP and EAP-TTLS are authentication methods that use a server certificate in authentication server 11 and a user ID and user password in communication terminal 14. EAP-TLS is an authentication method that uses a server certificate in authentication server 11 and a client certificate in communication terminal 14. EAP-MD5 is an authentication method that uses a user ID and user password in communication terminal 14 without using a server certificate.

[0028] EAP-TLS, which uses a server certificate and a client certificate, has the highest authentication strength, while EAP-MD5, which uses neither a server certificate nor a client certificate, has the lowest. However, using EAP-TLS requires that a client certificate be pre-installed in the communication terminal 14, which can be disadvantageous in terms of operational costs, convenience, versatility, and the like. Furthermore, PEAP is supported as standard by communication terminals 14 equipped with an OS such as Windows (registered trademark). For this reason, PEAP is an authentication method that offers an excellent balance between operational costs, convenience, versatility, and authentication strength.

[0029] For example, assuming that such authentication methods are provided, authentication server 11 may select PEAP as the authentication method when authenticating communication terminal 14a via wireless LAN access point 13a installed inside the company, and may select EAP-TLS as the authentication method when authenticating communication terminal 14b via wireless LAN access point 13b installed outside the company.

[0030] Furthermore, the identification information APID for identifying the wireless LAN access point 13 is specifically at least one of a NAS (Network Access Server)-IP address and a called station ID (Called Station ID). The called station ID usually stores the MAC address of the wireless LAN access point 13 or an SSID (Service Set IDentifier) ​​assigned to the wireless LAN access point 13.

[0031] The NAS-IP address stores the IP address of the RADIUS client. In the configuration example shown in Fig. 1, the NAS-IP address stores the IP address of the wireless LAN controller 12. However, as mentioned above, when an autonomous wireless LAN access point 13 is used, the NAS-IP address may store the IP address of the wireless LAN access point 13.

[0032] Therefore, how to use the NAS-IP address or cold station ID as the identification information APID may vary depending on the configuration of the authentication system. For example, consider a centralized management system in which multiple wireless LAN controllers 12 are provided. In this case, the multiple wireless LAN controllers 12 can be identified by their NAS-IP addresses. The multiple wireless LAN access points 13 managed by the identified wireless LAN controllers 12 can be identified by their cold station IDs. In addition, in the case of an autonomous system, the multiple wireless LAN access points 13 can be identified by either their NAS-IP addresses or their cold station IDs.

[0033] Fig. 2 is a schematic diagram showing an example of the configuration of the authentication method setting table 18 provided in the authentication server 11 in Fig. 1. The authentication method setting table 18 shown in Fig. 2 defines the correspondence between identification information APID that identifies the wireless LAN access point 13 and the authentication method. The authentication method setting table 18 is registered in advance by, for example, an administrator of the authentication server 11. The identification information APID registers the value of the NAS-IP address and the value of the cold station ID.

[0034] 2, PEAP is registered as the authentication method for the NAS-IP address "IPAa" and cold station ID "MAa." EAP-TLS is also registered as the authentication method for the NAS-IP address "IPAa" and cold station ID "MAb." "IPAa" is the IP address of the wireless LAN controller 12. "MAa" and "MAb" are the MAC addresses of the wireless LAN access points 13a and 13b, respectively.

[0035] <Authentication system details> [About communication formats] 3A is a schematic diagram showing an example of the format of an EAPOL frame used in communication between the RADIUS client and communication terminal 14 in FIG. 1. The EAPOL frame 20 shown in FIG. 3A is also a MAC frame based on the EAPOL protocol. The EAPOL frame 20 includes fields for a destination MAC address 30, a source MAC address 31, and an EAP message 32. The EAP message 32 includes fields for a packet type 33 and a packet body 34. The packet body 34 includes an EAP packet 21. The EAP packet 21 includes fields for a code 35, a type 36, and data 37.

[0036] Packet type 33 sets the function to be performed by the packet, such as EAP packet, EAP start, or EAP end. When an EAP packet is set using packet type 33, code 35 in EAP packet 21 sets the command or notification content, such as EAP request, EAP response, EAP success, or EAP failure. Furthermore, type 36 sets the notification content, such as "Identity" or "NAK," or the type of authentication method, such as EAP-TLS or PEAP. The data 37 field stores various data according to the setting of code 35 or type 36. EAP success indicates successful authentication, and EAP failure indicates unsuccessful authentication.

[0037] 3B is a schematic diagram showing an example of the format configuration of a RADIUS packet used in communication between the RADIUS client and authentication server 11 in FIG. 1. As shown in FIG. 3B, a RADIUS packet 26 is stored in a UDP data 42 area within a User Datagram Protocol (UDP) packet 25. In addition to the UDP data 42 area, the UDP packet 25 includes areas for a source port 40 and a destination port 41. Each of the source port 40 and destination port 41 areas stores a specified value representing RADIUS.

[0038] The RADIUS packet 26 includes fields for a code 43, an authentication code 44, and an attribute 45. The code 43 contains the content of a command or notification, such as a RADIUS access request, a RADIUS access permission, a RADIUS access denial, or a RADIUS access challenge. The authentication code 44 field is used to prevent data forgery. The attribute 45 includes fields for n pieces of RADIUS attribute information 46[1] to 46[n], where n is an arbitrary number.

[0039] In this specification, n pieces of RADIUS attribute information 46[1] to 46[n] are collectively referred to as RADIUS attribute information 46. Each piece of RADIUS attribute information 46 is expressed in TLV format, which consists of a type (T), length (L), and attribute value (V). The RADIUS attribute information 46 may include various information, such as a user ID, a user password, and a calling station ID, in addition to the NAS-IP address and calling station ID mentioned above. The calling station ID is determined by the MAC address of the communication terminal 14.

[0040] 3A can be included in the RADIUS attribute information 46. This allows the wireless LAN controller 12 to receive the EAPOL frame 20 from the communication terminal 14, store the EAP message 32 contained therein in a RADIUS packet 26, and transmit the RADIUS packet 26 to the authentication server 11. Similarly, the wireless LAN controller 12 can receive the RADIUS packet 26 from the authentication server 11, store the RADIUS attribute information 46 representing the EAP message 32 contained therein in an EAPOL frame 20, and transmit the RADIUS packet 26 to the communication terminal 14.

[0041] [About the authentication sequence] Fig. 4 is a sequence diagram showing an example of an operation when authenticating the communication terminal 14a communicating with the wireless LAN access point 13a in Fig. 1. In Fig. 4, the communication terminal 14a notifies the wireless LAN controller 12, which is a RADIUS client, of the start of EAP via the wireless LAN access point 13a (step S201). In the following explanation, for the sake of simplicity, the explanation of the communication between the communication terminal 14a and the wireless LAN controller 12 via the wireless LAN access point 13a will be omitted as appropriate.

[0042] Upon receiving the notification of the start of EAP, the wireless LAN controller 12 transmits an EAP request to the communication terminal 14a to request a user ID, which is one piece of authentication information (step S202). In response, the communication terminal 14a transmits an EAP response including the user ID to the wireless LAN controller 12 (step S203). Subsequently, the wireless LAN controller 12, which has received the EAP response, transmits a RADIUS access request including various RADIUS attribute information 46 to the authentication server 11 (step S204).

[0043] At this time, the RADIUS attribute information 46 includes the authentication information, such as the user ID, included in the EAP message 32 in the EAP response, as well as the NAS-IP address and cold station ID. The wireless LAN controller 12 sets its own IP address "IPAa" as the NAS-IP address. The wireless LAN controller 12 also recognizes that the communication is from the wireless LAN access point 13a, and sets, for example, the preset MAC address "MAa" or SSID of the wireless LAN access point 13a as the cold station ID.

[0044] Next, the authentication server 11 that has received the RADIUS access request selects PEAP as the authentication method by referring to the authentication method setting table 18 using the values ​​of the NAS-IP address "IPAa" and the cold station ID "MAa" (step S205). In other words, the authentication server 11 identifies the wireless LAN access point 13a based on the identification information APID included in the RADIUS access request, and selects PEAP as the authentication method when using the wireless LAN access point 13a.

[0045] Next, the authentication server 11 transmits a RADIUS access challenge to the wireless LAN controller 12 to propose the use of PEAP (step S206). The wireless LAN controller 12, which has received the RADIUS access challenge, transmits an EAP request to the communication terminal 14a to propose the use of PEAP (step S207). In response, the communication terminal 14a transmits an EAP response to the wireless LAN controller 12 to accept the use of PEAP (step S208).

[0046] Next, the wireless LAN controller 12 that has received the EAP response transmits a RADIUS access request to the authentication server 11 to accept the use of PEAP (step S209). In response, the authentication server 11 transmits a RADIUS access challenge to the wireless LAN controller 12 to notify the start of PEAP authentication (step S210). Then, the wireless LAN controller 12 that has received the RADIUS access challenge transmits an EAP request to the communication terminal 14a to notify the start of PEAP authentication (step S211).

[0047] Thereafter, an authentication sequence defined by PEAP is executed between the communication terminal 14a, the wireless LAN controller 12, and the authentication server 11 (step S212). In summary, a TLS session for providing encryption protection is established between the communication terminal 14a and the authentication server 11 through TLS negotiation using a server certificate. Then, the authentication server 11 determines whether or not the user ID and user password of the communication terminal 14a can be authenticated using a challenge-response method during the TLS session.

[0048] As a result, if the authentication server 11 permits authentication, it notifies the wireless LAN controller 12 of a RADIUS access permission indicating successful authentication, and if the authentication is denied, it notifies the wireless LAN controller 12 of a RADIUS access denial indicating unsuccessful authentication. The wireless LAN controller 12 converts the RADIUS access permission or RADIUS access denial into an EAP success or EAP failure, respectively, and notifies the communication terminal 14a.

[0049] Figures 5A and 5B are sequence diagrams showing an example of operation when authenticating communication terminal 14b in Figure 1 that communicates with wireless LAN access point 13b different from that in Figure 4. Figure 5A shows an example of operation when a client certificate is installed in communication terminal 14b, and Figure 5B shows an example of operation when a client certificate is not installed in communication terminal 14b.

[0050] 5A, first, the processes of steps S201 to S204 are performed as in the case of FIG. 4. That is, the communication terminal 14b notifies the wireless LAN controller 12 of the start of EAP (step S201). The wireless LAN controller 12 transmits an EAP request to the communication terminal 14b (step S202). The communication terminal 14b transmits an EAP response to the wireless LAN controller 12 (step S203). Then, the wireless LAN controller 12 transmits a RADIUS access request to the authentication server 11 (step S204).

[0051] Next, the authentication server 11 that has received the RADIUS access request selects EAP-TLS as the authentication method by referring to the authentication method setting table 18 using the values ​​of the NAS-IP address "IPAa" and the cold station ID "MAb" (step S305), as in the case of Fig. 4. In other words, the authentication server 11 identifies the wireless LAN access point 13b based on the identification information APID included in the RADIUS access request, and selects EAP-TLS as the authentication method when using the wireless LAN access point 13b.

[0052] Thereafter, in steps S306 to S311, the same processing as in steps S206 to S211 described with reference to Fig. 4 is performed. However, in steps S306 and S307, the authentication method proposed by authentication server 11 is EAP-TLS, which is different from the case in Fig. 4. Also, a client certificate is installed in communication terminal 14b. Therefore, after communication terminal 14b is proposed to use EAP-TLS by authentication server 11, communication terminal 14b accepts the proposal (steps S308 and S309). In response, authentication server 11 notifies communication terminal 14b of the start of EAP-TLS authentication (steps S310 and S311).

[0053] Thereafter, an authentication sequence defined by EAP-TLS is executed between communication terminal 14b, wireless LAN controller 12, and authentication server 11 (step S312). In summary, through TLS negotiation, communication terminal 14b verifies the authenticity of the server certificate from authentication server 11, and authentication server 11 verifies the authenticity of the client certificate from communication terminal 14b.

[0054] If these certificates are valid, the authentication server 11 notifies the wireless LAN controller 12 of a RADIUS access permission indicating successful authentication, and if any of the certificates are invalid, it notifies the wireless LAN controller 12 of a RADIUS access denial indicating unsuccessful authentication. The wireless LAN controller 12 converts the RADIUS access permission or RADIUS access denial into an EAP success or EAP failure, respectively, and notifies the communication terminal 14b.

[0055] In Fig. 5B, as in Fig. 5A, the processes of steps S201 to S204 and S305 to S307 are performed in order. However, unlike Fig. 5A, a client certificate is not installed in communication terminal 14b. Therefore, after communication terminal 14b is proposed to use EAP-TLS by authentication server 11 (steps S306 and S307), communication terminal 14b rejects the proposal (step S408).

[0056] In detail, the communication terminal 14b, for example, rejects the use of EAP-TLS and transmits an EAP response to the wireless LAN controller 12 to suggest the use of PEAP (step S408). The wireless LAN controller 12 converts the EAP response into a RADIUS access request and transmits it to the authentication server 11 (step S409).

[0057] Here, authentication server 11 permits the use of only EAP-TLS as a communication method when wireless LAN access point 13b is used, and prohibits the use of other authentication methods. Therefore, if authentication server 11 proposes the use of EAP-TLS and then the proposal is rejected by communication terminal 14b, authentication server 11 does not change to another authentication method, in this case PEAP, and determines that authentication has failed.

[0058] As a result, the authentication server 11 notifies the wireless LAN controller 12 of a RADIUS access denial indicating authentication failure (step S410). The wireless LAN controller 12 converts the RADIUS access denial into an EAP failure and notifies the communication terminal 14b (step S411). Thereafter, the wireless LAN controller 12 blocks access to the predetermined network from the communication terminal 14b. This makes it possible to strengthen security for, for example, the communication terminal 14b that uses an external wireless LAN access point 13b.

[0059] <Authentication server details> Fig. 6 is a functional block diagram showing an example of the configuration of the main parts of the authentication server 11 in Fig. 1. The authentication server 11 shown in Fig. 6 includes an authentication method selection unit 51, an authentication method proposal unit 52, and an authentication sequence execution unit 53, in addition to a memory 17 that stores an authentication method setting table 18. Each of these units is realized, for example, by a processor executing a program (not shown) stored in the memory 17. However, each of these units is not limited to being realized by program processing by a processor, and may be realized by hardware processing using an FPGA (Field Programmable Gate Array), ASIC (Application Specific Integrated Circuit), or the like, or may be realized by a combination of program processing and hardware processing.

[0060] The authentication method selection unit 51 receives the RADIUS packet 26 from the wireless LAN controller 12, which is an authenticator and a RADIUS client. Then, the authentication method selection unit 51 selects one authentication method from among a plurality of authentication methods based on the identification information APID that identifies the wireless LAN access point 13 and is included in the RADIUS packet 26. In detail, the authentication method selection unit 51 selects the authentication method by referring to the authentication method setting table 18 using the identification information APID from the wireless LAN controller 12. That is, the authentication method selection unit 51 executes, for example, the process of step S205 shown in FIG. 4 and step S305 shown in FIGS. 5A and 5B.

[0061] The authentication method proposal unit 52 proposes the use of the authentication method selected by the authentication method selection unit 51 to the communication terminal 14 operating as a supplicant. Furthermore, after proposing the use of the selected authentication method to the communication terminal 14, if the proposal is rejected by the communication terminal 14, the authentication method proposal unit 52 notifies the communication terminal 14 of authentication failure. On the other hand, if the proposal to use the authentication method is accepted by the communication terminal 14, the authentication method proposal unit 52 determines the authentication method and notifies the communication terminal 14 of the start of authentication using the determined authentication method.

[0062] That is, the authentication method proposal unit 52 executes, for example, the processes of steps S206 and S210 shown in Fig. 4, steps S306 and S310 shown in Fig. 5A, and steps S306 and S410 shown in Fig. 5B. The authentication sequence execution unit 53 receives information about the determined authentication method from the authentication method proposal unit 52 and executes an authentication sequence based on the determined authentication method. That is, the authentication sequence execution unit 53 executes, for example, the processes of step S212 shown in Fig. 4 and step S312 shown in Fig. 5A.

[0063] In the explanation so far, one communication method is defined for each wireless LAN access point 13 based on the authentication method setting table 18 shown in FIG. 2. However, the authentication method setting table 18 may define multiple communication methods for each wireless LAN access point 13, not just one. For example, multiple communication methods may be defined for a wireless LAN access point 13a installed within a company. In this case, the authentication server 11, more specifically the authentication method proposing unit 52, notifies the communication terminal 14 of authentication failure when the communication terminal 14 rejects the use of any of the multiple communication methods.

[0064] <Major Effects of the Embodiment> As described above, in the method of the embodiment, the authentication server 11 selects one authentication method from among a plurality of authentication methods based on the identification information APID that identifies the wireless LAN access point 13. This makes it possible to flexibly set the authentication strength for each of the plurality of wireless LAN access points 13. For example, by changing the authentication strength depending on the installation environment of the wireless LAN access point 13, it is possible to strengthen security while suppressing increases in operational costs, etc.

[0065] The invention made by the inventor has been specifically described above based on the embodiments, but the present invention is not limited to the above embodiments and can be modified in various ways without departing from the spirit of the invention. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0066] For example, the above-mentioned program may be stored in a non-transitory, tangible, computer-readable recording medium and then supplied to a computer. Examples of such a recording medium include magnetic recording media such as hard disk drives, optical recording media such as DVDs (Digital Versatile Discs) and Blu-ray Discs, and semiconductor memories such as flash memories. [Explanation of symbols]

[0067] 11: Authentication server, 12: Wireless LAN controller, 13: Wireless LAN access point, 14: Communication terminal, 20: EAPOL frame, 26: RADIUS packet, 51: Authentication method selection unit, 52: Authentication method proposal unit, APID: Identification information

Claims

1. a communication terminal that operates as a supplicant based on the IEEE 802.1X standard; an authentication server that authenticates the communication terminal based on the IEEE 802.1X standard; a RADIUS client that operates as an authenticator based on the IEEE 802.1X standard, communicates an EAPOL (Extensible Authentication Protocol Over LAN) frame with the communication terminal, and communicates a RADIUS (Remote Authentication Dial In User Service) packet with the authentication server; An authentication system comprising: the RADIUS client is a wireless LAN access point that performs wireless communication with the communication terminal, or a wireless LAN controller that manages the wireless LAN access point; the authentication server selects one authentication method from a plurality of authentication methods based on identification information for identifying the wireless LAN access point, which is included in the RADIUS packet from the RADIUS client, and proposes use of the selected authentication method to the communication terminal; Authentication system.

2. 2. The authentication system according to claim 1, The identification information is at least one of a NAS (Network Access Server)-IP address or a cold station ID. Authentication system.

3. 2. The authentication system according to claim 1, the authentication server stores an authentication method setting table indicating a correspondence relationship between the identification information and the authentication method, and selects the authentication method by referring to the authentication method setting table using the identification information from the RADIUS client; Authentication system.

4. 4. The authentication system according to claim 3, the authentication server proposes to the communication terminal to use the selected authentication method, and when the proposal is rejected by the communication terminal, the authentication server does not change to another authentication method and notifies the communication terminal of authentication failure; Authentication system.

5. An authentication server that authenticates a communication terminal operating as a supplicant based on the IEEE 802.1X standard via a RADIUS (Remote Authentication Dial-In User Service) client that is an authenticator, the RADIUS client is a wireless LAN access point that performs wireless communication with the communication terminal, or a wireless LAN controller that manages the wireless LAN access point; The authentication server an authentication method selection unit that selects one authentication method from a plurality of authentication methods based on identification information that identifies the wireless LAN access point and is included in a RADIUS packet from the RADIUS client; an authentication method proposal unit that proposes to the supplicant the use of the authentication method selected by the authentication method selection unit; Equipped with Authentication server.

6. 6. The authentication server according to claim 5, The identification information is at least one of a NAS (Network Access Server)-IP address or a cold station ID. Authentication server.

7. 6. The authentication server according to claim 5, a memory for storing an authentication method setting table that indicates a correspondence relationship between the identification information and the authentication method; the authentication method selection unit selects the authentication method by referring to the authentication method setting table using the identification information from the RADIUS client; Authentication server.

8. 8. The authentication server according to claim 7, the authentication method proposing unit proposes use of the selected authentication method to the communication terminal, and when the proposal is rejected by the communication terminal, does not change to another authentication method, and notifies the communication terminal of authentication failure. Authentication server.

Images