Abstract:
A replay attack from an unauthorized user is easily avoided by wireless communication authentication. A mobile node acquires an inherent identification number owned by a base station connected to the mobile node, and sends authentication packet data including the identification number and information providing transfer route information for packet data sent to the mobile node through a wireless link. A router holds an inherent identification number owned by a base station connected to the router, and, if the identification number held by the router agrees with the identification number included in the authentication packet data sent from the mobile node, registers the transfer route information in a route table based on the authentication packet data.

Description:
BACKGROUND OF THE INVENTION  
       [0001]     1. Field of the Invention  
         [0002]     The present invention relates to a wireless communication authentication system and a wireless communication authentication method for excluding an unauthorized user from a network that is connected to a wireless communication area.  
         [0003]     2. Description of the Related Art  
         [0004]     Generally, wireless communication systems need to authenticate legitimate users who are going to use the network in order to exclude an unauthorized user who would attempt to intercept data sent from a mobile node owned by a legitimate user to a wireless link and abuse the network based on the intercepted data.  
         [0005]      FIG. 1  of the accompanying drawings shows a conventional host routing hierarchical network comprising external network  100 , a plurality of routers  101 ,  102 - 1 ,  102 - 2 ,  103 - 1  through  103 - 4 , a plurality of base stations  104 - 1  through  104 - 8 , mobile node  105 , and authentication server  106 . Router  101  is connected to external network  100 . Routers  102 - 1 ,  102 - 2  are connected to and operate under router  101 . Routers  103 - 1 ,  103 - 2  are connected to and operate under router  102 - 1 . Routers  103 - 3 ,  103 - 4  are connected to and operate under router  102 - 2 . Base stations  104 - 1 ,  104 - 2  are connected to and operate under router  103 - 1 . Base stations  104 - 3 ,  104 - 4  are connected to and operate under router  103 - 2 . Base stations  104 - 5 ,  104 - 6  are connected to and operate under router  103 - 3 . Base stations  104 - 7 ,  104 - 8  are connected to and operate under router  103 - 4 . Mobile node  105  is a node that is movable while being connected to the network. Authentication server  106  serves to authenticate data in routers  103 - 1  through  103 - 4 .  
         [0006]     A wireless communication authentication process which is carried out in the conventional host routing hierarchical network shown in  FIG. 1  will be described below with reference to  FIG. 2  of the accompanying drawings.  
         [0007]     It is assumed that mobile node  105  is currently present in an area covered by base station  104 - 2  and is connected to base station  104 - 2  through a wireless link. Therefore, data sent from mobile node  105  travels through a communication route extending from mobile node  105  through base station  104 - 2 , router  103 - 1 , router  102 - 1  to router  101 . The communication route is held in route tables that are owned respectively by routers  101 ,  102 - 1 ,  103 - 1 .  
         [0008]     Thereafter, mobile node  105  moves from the area covered by base station  104 - 2  into an area covered by base station  104 - 3 .  
         [0009]     When mobile node  105  moves, it sends route update data to base station  104 - 3  (step  301 ). The route update data includes the identifier of a destination router, the identifier of mobile node  105 , a time stamp or a sequence number.  
         [0010]     When the route update data sent from mobile node  105  is received by base station  104 - 3  (step  302 ), the received route update data is sent from base station  104 - 3  to router  103 - 2  (step  303 ).  
         [0011]     When the route update data sent from base station  104 - 3  is received by router  103 - 2  (step  304 ), the received route update data is sent from router  103 - 2  to authentication server  106  (step  305 ).  
         [0012]     When the route update data sent from router  103 - 2  is received by authentication server  106  (step  306 ), the received route update data is authenticated by authentication server  106  (step  307 ).  
         [0013]     The route update data includes an authentication code in addition to the items described above. The authentication code is calculated by a hash function from a secret key and the above items, other than the authentication code, of the route update data. The secret key can be recognized by only authentication server  106  and mobile node  105 . In step  307 , the route update data is authenticated by recalculating the authentication code and determining whether the received authentication code is correct or not.  
         [0014]     Even if the route update data is intercepted and used by an unauthorized user in the wireless zone between mobile node  105  and base stations  104 - 1  through  104 - 8 , the route update data thus intercepted and used is rejected as incorrect data. Specifically, since the route update data includes the time stamp or the sequence number, authentication server  106  detects a duplication of the time stamp or the sequence number and judges that the duplicated route update data is used by an unauthorized user.  
         [0015]     When authentication server  106  authenticates the route update data, authentication server  106  sends an authentication result to router  103 - 2  (step  308 ).  
         [0016]     When the authentication result sent from authentication server  106  is received by router  103 - 2  (step  309 ), if the authentication result is GOOD, then the route table in router  103 - 2  is updated based on the route update data which has been authenticated and information indicating that the base station to which the route update data has been sent is base station  104 - 3  (step  310 ). At this time, the route table in router  103 - 2  is updated such that data to be sent to mobile node  105  will be routed through base station  104 - 3 . If the authentication result is NOT GOOD, then the route table is not updated, and the authentication process is put to an end.  
         [0017]     After the route table in router  103 - 2  is updated, the route update data is sent from router  103 - 2  to router  102 - 1  (step  312 ). Based on the received route update data and information indicating that the route update data is sent from router  103 - 2 , the route table in router  102 - 1  is updated (step  313 ). At this time, the route table in router  102 - 1  is updated such that data to be sent to mobile node  105  will be routed through router  103 - 2 .  
         [0018]     Router  101  which is higher in level than router  102 - 1  already has route information with respect to mobile node  105  and the route information does not need to be changed. Therefore, the route update data is not sent from router  102 - 1  to router  101 .  
         [0019]     However, because one common authentication server is used to authenticate the route update data in routers  103 - 1  through  103 - 4 , problems arise as follows:  
         [0020]     When a mobile node switches base stations which the mobile node connected to according to a technique known as handover for wireless communication systems, the authentication server authenticates the connected user for the base station which is newly connected to the mobile node. If the authentication server is widely spaced from the newly connected base station, then an authentication packet transmitted between the authentication server and the base station suffers a transmission delay, possibly resulting in a communication failure time upon handover.  
         [0021]     It has been considered to reduce the transmission delay time by placing a plurality of authentication servers in respective positions close to the base stations or designing the base stations such that they also serve as authentication servers.  
         [0022]     However, the above solutions make it possible for an unauthorized user to use the network based on a replay attack. The replay attack is one of hacking attempts to eavesdrop on the password or the encryption key of a user and use it to masquerade the user.  
         [0023]      FIG. 3  of the accompanying drawings shows a wireless communication authentication system employing routers which also serve as authentication servers. The wireless communication authentication system shown in  FIG. 3  comprises external network  200 , a plurality of authentication-capable routers  201 ,  202 - 1 ,  202 - 2 , a plurality of base stations  204 - 1  through  204 - 8 , and mobile nodes  205 ,  207 . Router  201  is connected to external network  200 . Routers  202 - 1 ,  202 - 2  are connected to and operate under router  201 . Authentication-capable routers  203 - 1 ,  203 - 2  are edge routers with an authenticating function which are connected to and operate under router  202 - 1 . Authentication-capable routers  203 - 3 ,  203 - 4  are edge routers with an authenticating function which are connected to and operate under router  202 - 2 . Base stations  204 - 1 ,  204 - 2  are connected to and operate under authentication-capable router  203 - 1 . Base stations  204 - 3 ,  204 - 4  are connected to and operate under authentication-capable router  203 - 2 . Base stations  204 - 5 ,  204 - 6  are connected to and operate under authentication-capable router  203 - 3 . Base stations  204 - 7 ,  204 - 8  are connected to and operate under router  203 - 4 . Mobile nodes  205 ,  207  are nodes that are movable while being connected to the network. Mobile node  207  is the mobile node of an unauthorized user who intercepts route update data in a wireless zone between mobile node  205  and base station  204 - 2  and attempts to masquerade mobile node  205  to use the network.  
         [0024]     A wireless communication authentication process which is carried out in the wireless communication authentication system shown in  FIG. 3  will be described below with reference to  FIG. 4  of the accompanying drawings.  
         [0025]     It is assumed that mobile node  205  is currently present in an area covered by base station  204 - 2  and is going to be connected to base station  204 - 2  through a wireless link. Mobile node  205  sends route update data to base station  204 - 2  (step  401 ). The route update data includes the identifier of a destination router, the identifier of mobile node  205 , a time stamp or a sequence number.  
         [0026]     When the route update data sent from mobile node  205  is received by base station  204 - 2  (step  402 ), the received route update data is sent from base station  204 - 2  to authentication-capable router  203 - 1  (step  403 ).  
         [0027]     When the route update data sent from base station  204 - 2  is received by authentication-capable router  203 - 1  (step  404 ), the received route update data is authenticated by authentication-capable router  203 - 1  (step  405 ).  
         [0028]     The route update data includes an authentication code in addition to the items described above. The authentication code is calculated by a hash function from a secret key and the above items, other than the authentication code, of the route update data. The secret key is recognized by only authentication-capable routers  203 - 1  through  203 - 4  and mobile node  205 . In step  405 , the route update data is authenticated by recalculating the authentication code and determining whether the received authentication code is correct or not.  
         [0029]     If the authentication result produced by authentication-capable router  203 - 1  is GOOD, then the route table in authentication-capable router  203 - 1  is updated based on the route update data which has been authenticated and information indicating that the base station to which the route update data has been sent is base station  204 - 2  (step  406 ). At this time, the route table in authentication-capable router  203 - 1  is updated such that data to be sent to mobile node  205  will be routed through base station  204 - 2 . If the authentication result is NOT GOOD, then the route table is not updated, and the authentication process is put to an end.  
         [0030]     After the route table in authentication-capable router  203 - 1  is updated, the route update data is sent from authentication-capable router  203 - 1  to router  202 - 1  (step  407 ).  
         [0031]     When the route update data sent from authentication-capable router  203 - 1  is received by router  202 - 1  (step  408 ), the route table in router  202 - 1  is updated based on the received route update data and information indicating that authentication-capable router from which the route update data has been sent is authentication-capable router  203 - 1  (step  409 ). At this time, the route table in router  202 - 1  is updated such that data to be sent to mobile node  205  will be routed through authentication-capable router  203 - 1 . Thereafter, the route update data is sent from router  202 - 1  to router  201  (step  410 ).  
         [0032]     The route update data sent from mobile node  205  to base station  204 - 2  in step  401  is intercepted by mobile node  207  owned by an unauthorized user who is present in the area covered by base station  204 - 3  (step  411 ). Mobile node  207  masquerades mobile node  205  and sends the intercepted route update data to base station  204 - 3  (step  412 ). The route update data sent from mobile node  207  is received by base station  204 - 3  (step  413 ). The received route update data is sent from base station  204 - 3  to authentication-capable router  203 - 2  (step  414 ).  
         [0033]     When the route update data sent from base station  204 - 3  is received by authentication-capable router  203 - 2  (step  415 ), the received route update data is authenticated by authentication-capable router  203 - 2  (step  416 ).  
         [0034]     Unlike authentication server  106  shown in  FIG. 1  which is common to all the routers, the individual routers shown in  FIG. 3  have respective authenticating functions. Therefore, even though the route update data includes a sequence number or a time stamp, the route update data that includes the same sequence number or the same time stamp is received by the different authentication-capable routers. Each of the authentication-capable routers is thus unable to determine whether the route update data is incorrect or not from its authentication records, but recognizes all successfully authenticated route update data as legitimate route update data. Accordingly, the data used by the unauthorized user is not excluded, but is normally processed.  
         [0035]     If the authentication result produced by authentication-capable router  203 - 2  is GOOD, then the route table in authentication-capable router  203 - 2  is updated based on the route update data which has been authenticated and information indicating that the base station to which the route update data has been sent is base station  204 - 3  (step  417 ). At this time, the route table in authentication-capable router  203 - 2  is updated such that data to be sent to mobile node  205  will be routed through base station  204 - 3 . If the authentication result is NOT GOOD, then the route table is not updated, and the authentication process is put to an end.  
         [0036]     After the route table in authentication-capable router  203 - 2  is updated, the route update data is sent from authentication-capable router  203 - 2  to router  202 - 1  (step  418 ).  
         [0037]     When the route update data sent from authentication-capable router  203 - 2  is received by router  202 - 1  (step  419 ), the route table in router  202 - 1  is updated based on the received route update data and information indicating that authentication-capable router from which the route update data has been sent is authentication-capable router  203 - 2  (step  420 ). At this time, the route table in router  202 - 1  is updated such that data to be sent to mobile node  205  will be routed through authentication-capable router  203 - 2 .  
         [0038]     As described above, the communication route to legitimate mobile node  205 , which has been updated in step  409 , is changed by mobile node  207  that has impersonated mobile node  205 . Consequently, legitimate mobile node  205  is no longer able to use the wireless communication authentication system.  
         [0039]     In view of the above problems, a process of excluding an unauthorized user is disclosed in JP-1995-203540A. According to the disclosed process, the base stations of a wireless communication network have respective authenticating functions. When a mobile node sends a connection request to a base station, the base station sends an inherent identification number of its own to the mobile node. The mobile node generates an authentication code as well as other route information based on the identification number, adds the authentication code to route update data, and sends the route update data to the base station. The base station determines, based on its authenticating function, whether the identification number included in the received route update data is the same as the identification number of the base station or not. An unauthorized user who has sent route update data including a different identification number is thus excluded.  
         [0040]     The process disclosed in the above patent document is problematic in that many base stations installed in a wireless communication area need to have respective authenticating functions, and an edge router has to recognize whether all base stations connected to and operable under the edge router have respective authenticating functions or not. In addition, if there is a base station having no authenticating function, then the edge router is required to perform some authenticating process on its own.  
       SUMMARY OF THE INVENTION  
       [0041]     It is an object of the present invention to provide a wireless communication authentication system and a wireless communication authentication method which are capable of performing a quick authentication process for avoiding a replay attack carried out by an unauthorized user, without the need for the addition of authenticating functions to respective base stations.  
         [0042]     According to the present invention, a mobile node acquires an inherent identification number owned by a base station connected to the mobile node. The mobile node sends authentication packet data including the acquired identification number and information providing transfer route information through the base station to a router. If the identification number of the base station which is included in the authentication packet data sent from the mobile node and received by the router and an inherent identification number held by the router and owned by a base station connected to the router agree with each other, then the transfer route information is registered in a route table in the router based on the authentication packet data.  
         [0043]     As described above, only if the identification number of the base station which is included in the authentication packet data sent from the mobile node agrees with the identification number of the base station which is held by the router, the transfer route information is registered in the route table in the router based on the authentication packet data. Even if an unauthorized user intercepts authentication packet data on a wireless link and sends the intercepted authentication packet data to a different router, the identification number of the base station which is included in the authentication packet data and the identification number of the base station which is held by the router do not agree with each other, and no transfer route information is registered in the route table. Consequently, a transfer route based on the data sent from the unauthorized user is not established, and the unauthorized user is excluded from the network. If the function according to the present invention is provided in the router, then the function does not need to be provided in each of a number of base stations installed in a wireless area. Furthermore, each of routers used independently operates to perform the above sequence, a high-speed authentication process can be carried out.  
         [0044]     The above and other objects, features, and advantages of the present invention will become apparent from the following description with reference to the accompanying drawings which illustrate examples of the present invention. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0045]      FIG. 1  is a block diagram of a conventional host routing hierarchical network to which a mobile node is connected;  
         [0046]      FIG. 2  is a sequence diagram illustrative of a wireless communication authentication process which is carried out in the conventional host routing hierarchical network shown in  FIG. 1 ;  
         [0047]      FIG. 3  is a block diagram of a wireless communication authentication system employing routers which also serve as authentication servers;  
         [0048]      FIG. 4  is a sequence diagram illustrative of a wireless communication authentication process which is carried out in the wireless communication authentication system shown in  FIG. 3 ;  
         [0049]      FIG. 5  is a block diagram of a wireless communication authentication system according to a first embodiment of the present invention;  
         [0050]      FIG. 6  is a block diagram of an authentication-capable router in the wireless communication authentication system shown in  FIG. 5 ;  
         [0051]      FIG. 7  is a block diagram of a mobile node in the wireless communication authentication system shown in  FIG. 5 ;  
         [0052]      FIG. 8  is a sequence diagram illustrative of a wireless communication authentication process which is carried out in the wireless communication authentication system shown in  FIGS. 5 through 7 ;  
         [0053]      FIG. 9  is a block diagram of a wireless communication authentication system according to a second embodiment of the present invention;  
         [0054]      FIG. 10  is a block diagram of a RADIUS server in the wireless communication authentication system shown in  FIG. 9 ;  
         [0055]      FIG. 11  is a block diagram of a mobile node in the wireless communication authentication system shown in  FIG. 9 ; and  
         [0056]      FIG. 12  is a sequence diagram illustrative of a wireless communication authentication process which is carried out in the wireless communication authentication system shown in  FIGS. 9 through 11 . 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
     1st Embodiment  
       [0057]      FIG. 5  shows in block form a wireless communication authentication system according to a first embodiment of the present invention. As shown in  FIG. 5 , the wireless communication authentication system according to the first embodiment comprises external network  10 , a plurality of routers  1 ,  2 - 1 ,  2 - 2 , a plurality of authentication-capable routers  3 - 1  through  3 - 4 , a plurality of base stations  4 - 1  through  4 - 8 , and mobile node  5 . Router  1  is connected to external network  10 . Routers  2 - 1 ,  2 - 2  are connected to and operate under router  1 . Authentication-capable routers  3 - 1 ,  3 - 2  are edge routers with an authenticating function which are connected to and operate under router  2 - 1 . Authentication-capable routers  3 - 3 ,  3 - 4  are edge routers with an authenticating function which are connected to and operate under router  2 - 2 . Base stations  4 - 1 ,  4 - 2  are connected to and operate under authentication-capable router  3 - 1 . Base stations  4 - 3 ,  4 - 4  are connected to and operate under authentication-capable router  3 - 2 . Base stations  4 - 5 ,  4 - 6  are connected to and operate under authentication-capable router  3 - 3 . Base stations  4 - 7 ,  4 - 8  are connected to and operate under router  3 - 4 . Mobile node  5  sends packet data to and receives packet data from external network  10  through the wireless communication authentication system.  
         [0058]     As shown in  FIG. 6 , authentication-capable router  3 - 2  shown in  FIG. 5  comprises base station communication unit  11 , packet transfer unit  12 , higher-level router communication unit  13 , route update data processor  14 , user authenticator  15 , base station manager  16 , route table storage unit  17 , user information storage unit  18 , and base station information storage unit  19 . Base station communication unit  11  communicates with base stations  4 - 3 ,  4 - 4  shown in  FIG. 5 . Route table storage unit  17  registers and stores transfer route information of packet data. Packet transfer unit  12  transfers packet data to base stations  4 - 3 ,  4 - 4  or router  2 - 1  based on the transfer route information stored in route table storage unit  17 . Higher-level router communication unit  13  communicates with router  2 - 1  as a higher-level router shown in  FIG. 5 . Route update data processor  14  processes route update data sent from base stations  4 - 3 ,  4 - 4 . Base station information storage unit  19  stores in advance information of the base stations that are connected to and operate under authentication-capable router  3 - 2 . Base station manager  16  manages the information of the base stations which is stored in base station information storage unit  19 . User information storage unit  18  stores in advance user information (mobile unit identifiers, secret keys, etc.) of users who are allowed to use the wireless communication authentication system. User authenticator  15  manages the user information stored in user information storage unit  18  and authenticates users based on the user information. Each of other authentication-capable routers  3 - 1 ,  3 - 3 ,  3 - 4  has structural and processing details identical to those of authentication-capable router  3 - 2  though different routers and base stations are connected to authentication-capable routers  3 - 1 ,  3 - 3 ,  3 - 4 .  
         [0059]     As shown in  FIG. 7 , mobile node  5  shown in  FIG. 5  comprises route update data generator  21 , wireless communication unit  22 , wireless controller  23 , user information storage unit  24 , and base station connection information storage unit  25 . Wireless communication unit  22  communicates with base stations  4 - 1  through  4 - 8  shown in  FIG. 5  through a wireless link. Base station connection information storage unit  25  stores connection information required for mobile node  5  to connect to base stations  4 - 1  through  4 - 8 . Wireless controller  23  manages the connection information stored in base station connection information storage unit  25 , and controls wireless communication unit  22 . User information storage unit  24  stores in advance user information including mobile unit identifiers, secret keys, etc. Route update data generator  21  manages the user information stored in user information storage unit  24 , and generates route change data for registering or changing communication routes of packet data.  
         [0060]     A wireless communication authentication process which is carried out in the wireless communication authentication system shown in  FIGS. 5 through 7  will be described below with reference to  FIG. 8 .  
         [0061]     It is assumed that mobile node  5  has been connected to base station  4 - 2  and moves such that the base station to which mobile node  5  is connected changes from base station  4 - 2  to base station  4 - 3 .  
         [0062]     When mobile node  5  moves from an area covered by base station  4 - 2  to an area covered by base station  4 - 3 , mobile node  5  establishes its connection to base station  4 - 3 . Mobile node  5  sends a signal for requesting a base station ID representing an inherent identification number owned by base station  4 - 3  (step  801 ).  
         [0063]     When the signal for requesting a base station ID is sent from mobile node  5 , the signal is received by base station  4 - 3  (step  802 ).  
         [0064]     When the signal for requesting a base station ID is received by base station  4 - 3 , base station  4 - 3  sends the base station ID representing its own inherent identification number to mobile node  5  (step  803 ). The base station ID sent from base station  4 - 3  is received by mobile node  5  (step  804 ). The base station ID may be any inherent number for identifying a base station. For example, the base station ID may be an IP address or the latitude and longitude of a location where base station  4 - 3  is installed.  
         [0065]     When the base station ID of base station  4 - 3  is received by wireless communication unit  22  of mobile node  5 , the received base station ID is stored in base station connection information storage unit  25  by wireless controller  23 . Route update data generator  21  generates route update data as authentication packet data from the stored base station ID, a highest-level router number as a destination of packet data representing transfer route information, a mobile unit identifier stored in user information storage unit  24 , and a first authentication code that is generated from the above items of information and the secret key (step  805 ). The highest-level router number as a destination is an inherent identification number held by router  1 , and may be an IP address or the like of router  1 .  
         [0066]     When the route update data is generated, the generated route update data is sent from wireless communication unit  22  to base station  4 - 3  (step  806 ). When the sent route update data is received by base station  4 - 3  (step  807 ), the received route update data is sent from base station  403  to authentication-capable router  3 - 2  (step  808 ).  
         [0067]     When the route update date sent from base station  4 - 3  is received by base station communication unit  11  of authentication-capable router  3 - 2  (step  809 ), the received route update data is output from base station communication unit  11  to packet transfer unit  12 . The route update data that is supplied to packet transfer unit  12  is transferred therefrom to route update data processor  14 .  
         [0068]     When the route update data is supplied to route update data processor  14 , the route update data is authenticated by user authenticator  15 .  
         [0069]     Specifically, user authenticator  15  retrieves user information stored in user information storage unit  18 , using as a retrieval key the mobile unit identifier included in the route update data. User authenticator  15  calculates a second authentication code using the secret key that is included in the user information that has been retrieved. User authenticator  15  compares the calculated second authentication code with the first authentication code included in the route update data (step  810 ).  
         [0070]     If the retrieval of user information fails or the calculated second authentication code does not agree with the first authentication code included in the route update data, then the route update data is recognized as incorrect data, and the wireless communication authentication process is terminated.  
         [0071]     If the calculated second authentication code agrees with the first authentication code included in the route update data, then base station manager  16  determines whether the base station ID included in the route update data is the base station ID of a base station that is connected to and operates under its own router, i.e., authentication-capable router  3 - 2  (step  811 ).  
         [0072]     If base station manager  16  judges that the base station ID included in the route update data agrees with the base station ID, which is stored in base station information storage unit  19 , of a base station that is connected to and operates under its own router, then base station manager  16  sends an agreement signal to route update data processor  14 . Route update data processor  14  instructs packet transfer unit  12  to generate a route based on the route update data.  
         [0073]     Packet transfer unit  12  now generates or updates a route for packet data sent from router  2 - 1  as a higher-level router for mobile node  5  (step  812 ). At this time, the route update data of mobile node  5  has been received through base station  4 - 3  by authentication-capable router  3 - 2 . Therefore, the route to base station  4 - 3  is stored in route table storage unit  17  as a route for packet data sent from router  2 - 1  for mobile node  5 .  
         [0074]     If base station manager  16  judges that the base station ID included in the route update data does not agree with the base station ID, which is stored in base station information storage unit  19 , of a base station that is connected to and operates under its own router, then the route update data is recognized as incorrect data, and the wireless communication authentication process is terminated.  
         [0075]     Thereafter, higher-level router communication unit  13  sends the route update data to router  2 - 1  as a higher-level router (step  813 ).  
         [0076]     When the route update data is received by router  2 - 1  (step  814 ), the route table in router  2 - 1  is updated based on the route update data (step  815 ).  
       2nd Embodiment  
       [0077]     A wireless communication authentication system according to a second embodiment of the present invention will be described below particularly with respect to a process of authenticating a connection to a wireless LAN base station according to the protocol of IEEE802.1x, for example.  
         [0078]     As shown in  FIG. 9 , the wireless communication authentication system according to the second embodiment comprises external network  40 , a pair of routers  31 - 1 ,  31 - 2 , a plurality of base stations  32 - 1  through  32 - 8 , mobile node  33 , and a pair of RADIUS servers  34 - 1 ,  34 - 2 . Routers  31 - 1 ,  31 - 2  are connected to external network  40 . Base stations  32 - 1  through  32 - 4  are connected to and operate under router  31 - 1 . Base stations  32 - 5  through  32 - 8  are connected to and operate under router  31 - 2 . Mobile node  33  sends packet data to and receives packet data from external network  40  through the wireless communication authentication system. RADIUS (Remote Authentication Dial-In User Service) servers  34 - 1 ,  34 - 2  are connected respectively to routers  31 - 1 ,  31 - 2 . RADIUS servers  34 - 1 ,  34 - 2  are servers having a protocol for determining (authenticating) whether a network resource can be utilized or not and for recording (accounting) the fact that a network resource is utilized. RADIUS servers  34 - 1 ,  34 - 2  may be connected directly to base stations  32 - 1  through  32 - 8 , not through routers  31 - 1 ,  31 - 2 .  
         [0079]     As shown in  FIG. 10 , RADIUS server  34 - 1  shown in  FIG. 9  comprises communication controller  41 , RADIUS processor  42 , EAP processor  43 , user authenticator  44 , base station manager  45 , user information storage unit  46 , and base station information storage unit  47 . Communication controller  41  communicates with router  31 - 1  shown in  FIG. 9 . RADIUS processor  42  performs an authentication process with respect to base stations  32 - 1  through  32 - 4  according to the RADIUS protocol. EAP processor  43  analyzes EAP (PPP Extensible Authentication Protocol) data that has been encapsulated according to the RADIUS protocol. Base station information storage unit  47  stores in advance information of the base stations connected to and operable under router  31 - 1  that is connected to RADIUS server  34 - 1 . Base station manager  45  manages the information of the base stations which is stored in base station information storage unit  47 . User information storage unit  46  stores in advance user information (user names, secret keys, etc.) of users who are allowed to use the wireless communication authentication system. User authenticator  44  manages the user information stored in user information storage unit  46  and authenticates users based on the user information. RADIUS server  34 - 2  has structural and processing details that are identical to those of RADIUS server  34 - 1  though a different router is connected to RADIUS server  34 - 2 .  
         [0080]     As shown in  FIG. 11 , mobile node  33  shown in  FIG. 9  comprises wireless communication unit  51 , EAP processor  52 , wireless controller  53 , user information storage unit  54 , and base station connection information storage unit  55 . Wireless communication unit  51  communicates with base stations  32 - 1  through  32 - 8  shown in  FIG. 9  through a wireless link. Base station connection information storage unit  55  stores connection information required for mobile node  33  to connect to base stations  32 - 1  through  32 - 8 . Wireless controller  53  manages the connection information stored in base station connection information storage unit  55 , and controls wireless communication unit  51 . User information storage unit  54  stores in advance user information including user names, secret keys, etc. EAP processor  52  manages the user information stored in user information storage unit  54 , and generates an EAP authentication packet.  
         [0081]     A wireless communication authentication process which is carried out in the wireless communication authentication system shown in  FIGS. 9 through 11  will be described below with reference to  FIG. 12 . Router  31 - 1  is not shown in  FIG. 12  because no processing is performed in router  31 - 1  though packet data to be described below is routed through router  31 - 1 .  
         [0082]     It is assumed that mobile node  33  is currently present in an area covered by base station  32 - 2 . Mobile node  33  establishes its connection to base station  32 - 2 , and sends a signal for requesting a base station ID representing an inherent identification number owned by base station  32 - 2  (step  1201 ).  
         [0083]     When the signal for requesting a base station ID is sent from mobile node  33 , the signal is received by base station  32 - 2  (step  1202 ).  
         [0084]     When the signal for requesting a base station ID is received by base station  32 - 2 , base station  32 - 2  sends the base station ID representing its own inherent identification number to mobile node  33  (step  1203 ). The base station ID sent from base station  32 - 2  is received by mobile node  33  (step  1204 ). The base station ID may be any inherent number for identifying a base station. For example, the base station ID may be an IP address or the like.  
         [0085]     When the base station ID of base station  32 - 2  is received by wireless communication unit  51  of mobile node  33 , the received base station ID is stored in base station connection information storage unit  55  by wireless controller  53 . The stored base station ID is indicated to EAP processor  52 .  
         [0086]     Thereafter, EAP processor  52  generates an EAPOL (EAP over LAN) start packet for starting an authentication process according to the protocol of IEEE802.1x (step  1205 ). The generated EAPOL start packet is sent from wireless communication unit  51  to base station  32 - 2  (step  1206 ). When the sent EAPOL start packet is received by base station  32 - 2  (step  1207 ), an EAP request packet of an authentication request type depending on the received EAPOL start packet is sent from base station  32 - 2  to mobile node  33  (step  1208 ). The sent EAP request packet is received by mobile node  33  (step  1209 ). The EAPOL start packet and the EAP request packet will not be described in detail below as existing packets are used as the EAPOL start packet and the EAP request packet.  
         [0087]     When the EAP request packet is received by wireless communication unit  51  of mobile node  33 , EAP processor  52  generates an EAP response packet representing authentication packet data serving as route update data, from the base station ID stored in base station connection information storage unit  55 , information as to a destination of packet data representing transfer route information registered in router  31 - 1 , a user name and a sequence number stored in user information storage unit  54 , and a first authentication code that is generated from the above items of information and the secret key (step  1210 ). The information as to a destination of packet data is an inherent identification number owned by a destination of packet data sent from mobile node  33 , may be an IP address or the like of the destination.  
         [0088]     When the EAP response packet is generated, the generated EAP response packet is sent from wireless communication unit  51  to base station  32 - 2  (step  1211 ). When the EAP response packet sent from wireless communication unit  51  is received by base station  32 - 2  (step  1212 ), the received EAP response packet is encapsulated into a RADIUS access request packet (step  1213 ), which is sent from base station  32 - 2  to RADIUS server  34 - 1  (step  1214 ).  
         [0089]     When the RADIUS access request packet is received by communication controller  41  of RADIUS server  34 - 1  (step  1215 ), the received RADIUS access request packet is transferred to RADIUS processor  42 . RADIUS processor  42  extracts the EAP response packet from the RADIUS access request packet (step  1216 ).  
         [0090]     The extracted EAP response packet is output from RADIUS processor  42  to EAP processor  43 , which determines whether the EAP response packet supplied to EAP processor  43  has been sent from a legitimate user or not.  
         [0091]     Specifically, user authenticator  44  retrieves user information stored in user information storage unit  46 , using as a retrieval key the user name included in the EAP response packet. User authenticator  44  calculates a second authentication code using the secret key that is included in the user information that has been retrieved. User authenticator  44  compares the calculated second authentication code with the first authentication code included in the EAP response packet (step  1217 ).  
         [0092]     If the retrieval of user information fails or the calculated second authentication code does not agree with the first authentication code included in the EAP response packet, then the EAP response packet is recognized as incorrect data, and the wireless communication authentication process is terminated.  
         [0093]     If the calculated second authentication code agrees with the first authentication code included in the EAP response packet, then base station manager  45  determines whether the base station ID included in EAP response packet is the base station ID of a base station that is connected to and operates under its own router, i.e., router  31 - 1  (step  1218 ).  
         [0094]     Base station manager  45  determines whether the base station ID included in the EAP response packet agrees with the base station ID, which is stored in base station information storage unit  47 , of a base station connected to and operable under router  31 - 1  that is connected to RADIUS server  34 - 1  or not. If the base station IDs agree with each other, then base station manager  45  sends an agreement signal to EAP processor  43 . Then, EAP processor  43  indicates an authentication success to RADIUS processor  42 , which sends a RADIUS access permission packet through communication controller  41  to base station  32 - 2  (step  1219 ). At this time, router  31 - 1  on the route for the RADIUS access permission packet going from RADIUS server  34 - 1  to base station  32 - 2  recognizes that the connection of mobile node  33  to the wireless communication authentication system is permitted. The route table is updated for transferring packet data sent from external network  40  for mobile node  33  to base station  32 - 2 .  
         [0095]     When the RADIUS access permission packet is received by base station  32 - 2  (step  1220 ), base station  32 - 2  sends an EAP authentication success packet to mobile node  33  (step  1221 ). The EAP authentication success packet sent from base station  32 - 2  is received by mobile node  33  (step  1222 ), starting packet communications between mobile node  33  and external network  40 .  
         [0096]     Therefore, even though no authenticating function is present in routers  31 - 1 ,  31 - 2 , a high-speed authentication process can be performed by authentication servers provided respectively near routers  31 - 1 ,  31 - 2 .  
         [0097]     When the authentication process is performed, RADIUS servers  34 - 1 ,  34 - 2  may send encryption keys to base stations  32 - 1  through  32 - 8  and mobile node  33 .  
         [0098]     RADIUS servers  34 - 1 ,  34 - 2  shown in  FIG. 9  may be replaced with servers employing another authentication protocol.  
         [0099]     The. numbers of routers  1 ,  2 - 1 ,  2 - 2 ,  31 - 1 ,  31 - 2 , authentication-cable routers  3 - 1  through  3 - 4 , RADIUS servers  34 - 1 ,  34 - 2 , and base stations  4 - 1  through  4 - 8 ,  32 - 1  through  32 - 8 , and the number of hierarchical levels thereof are not limited to the illustrated numbers.  
         [0100]     While preferred embodiments of the present invention have been described using specific terms, such description is for illustrative purposes only, and it is to be understood that changes and variations may be made without departing from the spirit or scope of the following claims.