Wireless network control device and wireless network control system

• US 20070150732A1
• Filed: 03/31/2006
• Published: 06/28/2007
• Est. Priority Date: 12/28/2005
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Kubota, Yoshihiro, Oyama, Takuji, Suzuki, Hidehiko, Ando, Tatsuhiro
• Granted Patent: US 7,693,507 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

To provide a technology capable of accommodating, in parallel, wireless networks of a plurality of user groups having different authentication policies etc and providing a proper communication service in response to an access from a user of each of the user groups.

A wireless LAN control device 3 includes a wireless LAN control unit having a transmitting/receiving unit performing communications with a plurality of wireless LAN access points 4 belonging to different user groups and a wireless LAN connection control unit executing control of transferring a user authentication request received by the transmitting/receiving unit via one of the plurality of wireless LAN access points 4 and given from a wireless LAN terminal 5 belonging to one of the user groups toward an authentication server 2 that should execute an authentication process in response to the user authentication request, and transmitting an authentication result given from the authentication server 2 in response to the user authentication request to the wireless LAN terminal 5 via one of the plurality of wireless LAN access points 4.

Claims

1. A wireless network control device comprising:

a communication unit performing communications with a plurality of wireless base stations belonging to different user groups; and

a control unit executing control of transferring a user authentication request received by the communication unit via one of the plurality of wireless base stations and given from a wireless terminal belonging to one of the user groups toward an authentication device that should execute an authentication process in response to the user authentication request, and transmitting an authentication result given from the authentication device in response to the user authentication request to the wireless terminal via one of the plurality of wireless base stations.

2. A wireless network control device according to claim 1, wherein the control unit, when receiving the user authentication request, judges whether or not the wireless terminal has authority of using one of the plurality of wireless base stations and, if not having the authority, does not transfer the user authentication request.

3. A wireless network control device according to claim 1, wherein the control unit transfers the authentication request to the authentication device corresponding to the user group to which one of the plurality of wireless base stations belongs, and the user authentication request is, if the authentication process can not be executed by the authentication device corresponding to the user group to which one of the plurality of wireless base stations belongs, transferred to the authentication device that should execute the authentication process in response to the authentication request via at least one relay device.

4. A wireless network control device according to claim 1, wherein when the communication unit receives the IP address acquisition request from the wireless terminal succeeding in the user authentication via one of the plurality of wireless base stations, the control unit transfers the IP address acquisition request to a leasing device that leases the IP address for a user group to which the wireless terminal belongs, and transmits the IP address received from the leasing device to the wireless terminal from the communication unit.

5. A wireless network control device according to claim 1, wherein the control unit, if the wireless terminal and one of the plurality of wireless base stations belong to a different user group, restricts a communication service utilizable to the wireless terminal by use of one of the plurality of wireless base stations.

6. A wireless network control device according to claim 2, further comprising a storage unit registered with a usage authority identifier specifying usage authority of one of the plurality of wireless base stations, wherein the control unit, if the usage authority identifier received together with the user authentication request by the communication unit and given from the wireless terminal is registered in the storage unit, transfers the user authentication request but, if not, does not transfer the user authentication request.

7. A wireless network control device according to claim 6, wherein the storage unit is stored with identifying information of the authentication device to which the user authentication request associated with the usage authority identifier should be transferred, and the control unit transfers the user authentication request on the basis of the identifying information of the authentication device.

8. A wireless network control device according to claim 4, further comprising the storage unit stored with identifying information of the leasing device associated with the usage authority identifier specifying the usage authority of one of the plurality of wireless base stations, wherein the control unit transfers the IP address acquisition request on the basis of the identifying information of the leasing device associated with the usage authority identifier received together with the IP address acquisition request by the communication unit and given from the wireless terminal.

9. A wireless network control device according to claim 8, wherein the usage authority identifier has a value different on a user-group-by-user-group basis, a plurality of IP address groups associated with the usage authority identifiers are prepared, and the IP address is leased to the wireless terminal from the IP address group associated with the usage authority identifier given from the wireless terminal.

10. A wireless network control device according to claim 9, wherein the plurality of IP address groups are managed by the user group to which one of the plurality of wireless base stations belongs and contain subnets different from each other.

11. A wireless network control device according to claim 6, wherein one of the plurality of wireless base stations is a wireless LAN access point, the wireless terminal is a wireless LAN terminal, and the usage authority identifier is an ESSID.

12. A wireless network control device according to claim 5, further comprising a storage unit stored with definition information that defines a communication service utilizable to the wireless terminal associates with the IP address leased to the wireless terminal, and

when a transmitting/receiving unit receives an IP packet from the wireless terminal via the plurality of wireless base stations, the control unit judges permission/non-permission of passage of the IP packet in accordance with the definition information associated with a source IP address set in the IP packet.

13. A wireless network control device according to claim 9, wherein the definition information contains information showing that the transfer of the IP packet to a predetermined destination address is not permitted.

14. A wireless network control device according to claim 9, wherein the definition information contains information showing that the transfer of the IP packet related to a predetermined application is not permitted.

15. A wireless network control system comprising:

a wireless network control device accommodating a plurality of wireless base stations belonging to different user groups; and

a plurality of authentication devices each executing an authentication process in response to a user authentication request given from a wireless terminal of a user belonging to each of the user groups,

wherein the wireless network control device, when receiving a user authentication request from the wireless terminal via one of the plurality of wireless base stations, transfers the user authentication request to the authentication device corresponding to the user group to which one of the plurality of wireless base stations belongs,

the authentication device receiving the user authentication request from the wireless network control device, if unable to execute an authentication process in response to the user authentication request in the self-device, executes a transfer process of transferring the user authentication request, and

the transferred user authentication request reaches the authentication device that should execute the authentication process in response to the user authentication request via at least one of relay devices.

16. A wireless network control system according to claim 15, wherein the authentication device receiving the user authentication request from the wireless network control device, if unable to execute the authentication process in response to the user authentication request in the self-device, transfers the user authentication request to the authentication device that should execute the authentication process in response to the user authentication request sent through a direct connection established by VPN (Virtual Private Network).

17. A wireless network control system according to claim 15, wherein each of the authentication devices includes:

a storage unit registered with user information of a user executing the authentication process in the self-device and with transfer destination information showing a transfer destination of the user authentication request given from the user who is not contained in the user information; and

a control unit executing, when receiving the user authentication request and if the storage unit is registered with the user information corresponding to the user authentication request, the authentication process in response to the user authentication request and, if not, transferring the user authentication request in accordance with the transfer destination information.