Abstract:
An access point and a method supporting multiple authentication policies for a WLAN are disclosed. The access point according to the present invention includes an authentication policy detector for detecting an authentication policy of a terminal from a signal transmitted by the terminal, a plurality of authentication modules for performing the authentication procedures corresponding to different authentication policies, and an authentication processor for performing an appropriate authentication procedure by selecting the corresponding authentication module according to the authentication policy detected by the authentication policy detector. The access point and method for supporting multiple authentication policies according to the present invention avoid duplication of network elements for authentication by providing an authentication service for terminals using different authentication policies with a single access point.

Description:
[0001]    This application claims priority under 35 U.S.C. §119 to an application entitled “ACCESS POINT AND METHOD FOR SUPPORTING MULTIPLE AUTHENTICATION POLICIES” filed in the Korean Intellectual Property Office on Aug. 18, 2006 and assigned Serial No. 2006-77935, the contents of which are incorporated herein by reference. 
       BACKGROUND OF THE INVENTION 
       [0002]    1. Field of the Invention 
         [0003]    The present invention relates to an access point and a method for a wireless local area network (WLAN), and more particularly, to an access point and a method for supporting multiple authentication policies in a WLAN. 
         [0004]    2. Description of the Prior Art 
         [0005]    When transmitting data through a wireless network, transmitters of this data, for security purposes, may not want the transmitted data to be exposed to a third party. Whereas a wired network requires a physical connection for data reception, wireless data packets may be received by a third party who has a compatible receiver. A wireless communication system based on IEEE 802.11 utilizes a data cipher method to prevent data from being received by a third party. 
         [0006]    The IEEE 802.11(i) standard defines a protocol modified from the IEEE 802.11 standard, and specifies a security mechanism for a wireless network. The IEEE 802.11(i) standard discloses a Robust Security Network (RSN) having an improved cipher capability in authentication security. The IEEE 802.11i standard defines RSN and pre-RSN classes as two security frameworks for the IEEE 802.11 WLAN. A terminal enabling RSN Association (RSNA) is called an RSN equipment. 
         [0007]    IEEE 802.11i utilizes IEEE 802.1X for authentication and key management services. IEEE 802.11i integrates an IEEE 802.1X port and an Authentication Server (AS) as two elements in an IEEE 802.11 structure. The IEEE 802.1X port enables connection between two terminals, and provides 1:1 mapping for connection with the IEEE 802.1X port. 
         [0008]    In order to improve confidentiality, the IEEE 802.11i utilizes an advanced cipher algorithm of a Counter-mode/CBC-MAC Protocol (CCMP) and an advanced cipher algorithm of a Temporal Key Integrity Protocol (TKIP). CCMP is essential for RSN, but TKIP is selectively used for pre-RSN equipments. 
         [0009]    WLAN may operate in an Extended Service Set (ESS) mode or in an Independent Basic Service Set (IBSS) mode. The ESS mode is generally used as a part of a network for the connection to a wired LAN, having terminals, access points (APs), and wired LAN interfaces. Wireless terminals are equipped with a Network Interface Card (NIC) for interfacing the terminals with the access points through Radio-Frequency (RF) transmission. 
         [0010]    Another mode of WLAN is configured with an independent RF network having only terminals. This mode is an independent WLAN which is commonly known as an adhoc or IBSS mode. 
         [0011]    The ESS mode is configured with a plurality of Basic Service Sets (BSS). The BSS mode is configured with an access point and a plurality of terminals. The access point advertises a Service Set Identifier (SSID) of ESS and RSN capability by using an associated RSN Information Element (IE), and terminals advertise RSN capability by using their RSN IE. 
         [0012]    An access point for managing one BSS determines whether to allow or restrict access trials of all terminals. The access point compares a parameter value required by the BSS with a parameter value of a terminal, and verifies use of security policy and available cipher mechanism. If the security policy used by the terminal differs from the security policy of the access point, the access point denies access by the corresponding terminal to a network. 
         [0013]      FIG. 1  is a block diagram illustrating a conventional BSS configured with an access point and a plurality of terminals, and illustrates an example in which an access point for managing the BSS performs user authentication and key management by using TKIP and 802.1X extended authentication protocol (802.1X EAP). 
         [0014]    Referring to  FIG. 1 , the BSS is configured with an access point  110  and first to fifth terminals ( 121  to  125 ). The access point  110  performs user authentication and key management by using TKIP and 802.1X EAP. The first terminal  121  uses WEP-40 (Wired Equivalent Privacy-40), the second terminal  122  uses TKIP and 802.1X EAP, the fourth terminal  124  uses WEP-104, the fifth terminal  125  uses CCMP and 802.1X, and the third terminal  123  does not use a security policy. In this case, the access point  110  denies access by terminals  121 ,  123 ,  124 , and  125  to the network, and permits access only to the second terminal  122  using the same security policy as the access point  110 . 
         [0015]    In order for all the terminals in the BSS to be serviced through a wireless network, the BBS must install 5 access points supporting different security polices used by each terminal  121  to  125  in the same BSS, or all terminals  121  to  125  must support the same security policy (for example, TKIP and 802.1X EAP). 
         [0016]      FIG. 2  is a block diagram illustrating a BSS configured with access points for supporting-different security policies. 
         [0017]    Referring to  FIG. 2 , a first access point  211  uses WEP-40, a second access point  212  uses TKIP and 802.1X EAP, a fourth access point  214  uses WEP-104, a fifth access point  215  uses CCMP and 802.1X EAP, and a third access point  213  does not use a security policy. 
         [0018]    Accordingly, network connection of a first terminal  221  using WEP-40 is made through the first access point  211  using the same security policy. Network connection of a second terminal  222  using TKIP and 802.1X EAP is made through the second access point  212 . Network connection of a third terminal  223  not using a security policy is made through the third access point  213  not using a security policy. Network connection of a fourth terminal  224  using WEP-40 is made through the fourth access point  214  using the same security policy, and network connection of a fifth terminal  225  using CCMP and 802.1X EAP is made through the fifth access point  215  using the same security policy. 
         [0019]      FIG. 3  is a block diagram illustrating a BSS configured with an access point for supporting a single security policy and a plurality of terminals. 
         [0020]    As shown in  FIG. 3 , an access point  310  and all the terminals  321  to  325  in the BSS use WEP-40, and thereby all the terminals  321  to  325  may be connected through the same access point  310 . 
         [0021]    However, in the case of an authentication method for configuring BSS by disposing access points supporting different security policies in the same BSS, each access point must use a different frequency, and therefore efficiency of frequency usage is reduced. Additionally, in the case of an authentication method for configuring BSS by disposing one access point supporting only one security policy in the same BSS, all terminals must support the same security policy as the access point, and therefore diversified security services may not be provided to terminals supporting various security polices. 
       SUMMARY OF THE INVENTION 
       [0022]    The present invention has been made in view of the above problems, and an object of the present invention is to provide an access point and a method for supporting multiple authentication policies, enabling an authentication service for terminals using different authentication policies. 
         [0023]    Another object of the present invention is to provide an access point and a method for supporting multiple authentication policies, enabling an authentication service for terminals using different authentication policies by supporting various authentication policies in the same BSS, and improving frequency usage efficiency by supporting various authentication policies through a single channel. 
         [0024]    In order to achieve the above objects, the present invention provides an access point for a wireless network including at least one access point supporting authentication procedures for network connection to a plurality of terminals. An access point according to the present invention includes an authentication policy detector for detecting an authentication policy of a terminal from a signal transmitted by the terminal, a plurality of authentication modules for performing the authentication procedures corresponding to different authentication policies, and an authentication processor for performing an appropriate authentication procedure by selecting the corresponding authentication module according to the authentication policy detected by the authentication policy detector. 
         [0025]    The authentication policy detector may include a mapping table for associating a media access control address of the terminal with an authentication policy used by the terminal. The authentication processor may include an authentication module selector for selecting the authentication module according to the authentication policy detected by the authentication policy detector, and an authentication server selector for selecting an authentication server according to the authentication policy detected by the authentication policy detector. The authentication module supports one authentication policy selected from WEP-40, WEP-104, 802.1X EAP+TKIP, 802.1X EAP+CCMP, and non-security. 
         [0026]    In order to achieve the above and other objects, the present invention provides an authentication method for a wireless network including at least one access point supporting authentication procedures for network connection to a plurality of terminals. An authentication method according to the present invention includes detecting an authentication policy of a terminal from a signal transmitted by the terminal selecting the detected authentication policy from at least two authentication policies supported by the access point and performing an authentication procedure according to the selected authentication policy. 
         [0027]    The step of detecting an authentication policy includes identifying whether the terminal is registered in an authentication policy mapping table, and detecting, if the terminal is registered in an authentication policy mapping table, an authentication policy mapped in the authentication policy mapping table. The authentication policy mapping table associates the media access control address of the terminal with the authentication policy used by the terminal. The authentication policy includes WEP-40, WEP-104, 802.1X EAP+TKIP, 802.X EAP+CCMP, and non-security. 
         [0028]    In order to achieve the above objects, the present invention provides an authentication method for a wireless LAN system including at least one access point supporting authentication procedures for network connection to a plurality of terminals. An other authentication method according to the present invention includes receiving an association request message from a terminal, identifying, in response to the association request message, whether the terminal is registered in an authentication policy mapping table, detecting, if it is determined that the terminal is registered in an authentication policy mapping table, an authentication policy of the terminal from the authentication policy mapping table; and performing an authentication procedure according to the detected authentication policy of the terminal. 
         [0029]    The authentication method further includes detecting, if the terminal is not registered in an authentication policy mapping table, an address and an authentication policy of the terminal from the association request message; and updating the authentication policy mapping table by newly registering the detected address and authentication policy of the terminal. The authentication policy mapping table associates the media access control (MAC) address of the terminal with the authentication policy used by the terminal. The authentication policy includes WEP-40, WEP-104, 802.1X EAP+TKIP, 802.1X EAP+CCMP, and non-security. 
     
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0030]    The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description in conjunction with the accompanying drawings, in which: 
           [0031]      FIG. 1  is a block diagram a conventional BSS configured with an access point and a plurality of terminals; 
           [0032]      FIG. 2  is a block diagram illustrating a conventional BSS configured with access points for supporting different security policies; 
           [0033]      FIG. 3  is a block diagram a conventional BSS configured with an access point for supporting a single security policy and a plurality of terminals; 
           [0034]      FIG. 4  is a block diagram illustrating an access point for supporting multiple authentication policies according to the present invention; 
           [0035]      FIG. 5A  is a diagram illustrating an association request frame format including an RSN IE format for supporting multiple authentication policies according to the present invention; 
           [0036]      FIG. 5B  is a diagram illustrating a capability information field included in the frame body field of the association request frame format of  FIG. 5A ; 
           [0037]      FIG. 5C  is a diagram illustrating a suite selector format included in the RSN IE format of the association request frame of  FIG. 5A ; 
           [0038]      FIG. 6  is a flow diagram illustrating a method for performing an association between a terminal and an access point using a method for supporting multiple authentication policies according to the present invention; and 
           [0039]      FIG. 7  is a flow chart illustration a method for supporting multiple authentication policies according to the present invention. 
       
    
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
       [0040]    Hereinafter, preferred embodiments of the present invention are described in detail with reference to the accompanying drawings. The same reference numbers are used for the same or like components in the drawings. Detailed explanations for well-known functions and compositions may be omitted to avoid obscuring the subject matter of the present invention. 
         [0041]      FIG. 4  is a block diagram showing a configuration of an access point for supporting multiple authentication policies according to the present invention. 
         [0042]    Referring to  FIG. 4 , the access point for supporting multiple authentication policies includes an RF unit  410  for processing an RF signal transmitted and received through an antenna, an authentication unit  470  having a plurality of authentication modules for processing various authentication methods, an authentication mapping unit  430  for extracting an authentication method used by a terminal from the RF signal transmitted by the RF unit  410  by associating a media access control (MAC) address of the terminal with the authentication method, an authentication selector  450  for selecting an authentication module corresponding to the authentication method output by the authentication mapping unit  430 , and an authentication server selector  490  for selecting an authentication server corresponding to the authentication method provided by the authentication mapping unit  430  and for performing an authentication procedure through the selected authentication server by using a signal output by the selected authentication module. 
         [0043]    In more detail, the authentication mapping unit  430  generates an authentication policy mapping table, shown in Table 1 below, for associating the MAC address of a terminal with the authentication policy used by the terminal; identifies, if a signal is received, whether the corresponding terminal is registered in the authentication policy mapping table; and transmits, if information on the corresponding terminal is available, information on the corresponding authentication method to the authentication selector  450 . 
         [0000]    
       
         
               
               
               
             
           
               
                   
                 TABLE 1 
               
               
                   
                   
               
               
                   
                 Authentication system 
                 Authentication module address 
               
               
                   
                   
               
             
             
               
                   
                 WEP-40 
                 MAC Address 1 
               
               
                   
                 WEP-104 
                 MAC Address 2 
               
               
                   
                 802.1X EAP with TKIP 
                 MAC Address 3 
               
               
                   
                 802.1X EAP with CCMP 
                 MAC Address 4 
               
               
                   
                 Non-security 
                 MAC Address 5 
               
               
                   
                   
               
             
          
         
       
     
         [0044]    The authentication unit  470  includes a WEP-40 authentication module  471  for supporting a WEP-40 authentication policy, a WEP-104 authentication module  472  for supporting a WEP-104 authentication policy, an 802.1X EAP+TKIP authentication module  473  for supporting an 802.1X EAP+TKIP authentication policy, an 802.1X EAP +CCMP authentication module  474  for supporting an 802.1X EAP+CCMP authentication policy, and a non-security module  475  for supporting a non-security policy. The type and quantity of the authentication module(s) may be changed according to a communication environment. 
         [0045]    Hereinafter, an operation method of the access point having the above configuration and supporting multiple authentication policies will be described. 
         [0046]    Through a radio channel, communication between an access point and a terminal complies with the IEEE 802.11 protocol. The access point and the terminal use a shared key, and comply with the same authentication (or security) policy to share the same shared key. 
         [0047]      FIG. 5A  is a diagram showing an association request frame format including an RSN IE format for supporting multiple authentication policies according to the present invention. 
         [0048]    As shown in  FIG. 5A , an RSN information element (IE) format for supporting multiple authentication policies is included in the association request frame format. The RSN IE format is configured with an element identifier field  501 , length field  503 , version field  505 , group cipher suite field  507 , pairwise cipher suite field  509 , pairwise cipher suite list field  511 , Authentication and Key Management (AKM) suite list field  513 , and RSN capability field  515 . 
         [0049]      FIG. 5B  is a diagram showing a capability information field included in the frame body field of the association request frame format of  FIG. 5A . 
         [0050]    As shown in  FIG. 5B , the RSN capability information field is configured with an ESS field  521 , IBSS field  523 , contention-free (CF) pollable field  525 , CF poll request field  527 , privacy field  529 , and reserved field  531 . 
         [0051]    When security is required in data communication, the value of the privacy field  529  is set to 1, and a cipher to be used in a BSS is indicated as a value of a suite selector field located in the group cipher suite field  507  or pairwise cipher suite field  509  of the RSN IE format. 
         [0052]      FIG. 5C  is a diagram showing a suite selector format included in the RSN IE format of the association request frame format of  FIG. 5A . The suite selector format is configured with an OUI (organizationally unique identifier) field  541  and a suite type field  543 . The capability information field and RNS IE format are included in a beacon message, probe response message, association request message, and re-association request message. According to the present invention, the access point for supporting multiple authentication policies broadcasts the types of cipher suite fields applicable to the access point in a round robin system through a beacon message. Terminals in the BSS try to associate with the access point by including their security information in the RSN IE. 
         [0053]      FIG. 6  is a flow diagram illustrating a method for forming an association between a terminal and an access point in a method for supporting multiple authentication policies according to the present invention. 
         [0054]    Referring to  FIG. 6 , the access point  600  broadcasts a beacon message including RNS IE security parameters supported by the access point ( 600 ), such as CCMP, TKIP, WEP, and 802.1X EAP in step S 601 ; and a terminal  602  receiving the beacon message transmits a probe request message to the access point  600  in response in step S 603 . When the probe request message is received, the access point  600  transmits to the terminal  602  a probe response message including security parameters supported by the access point  600 , such as CCMP, TKIP, WEP, and 802.1X EAP in step S 605 . When the probe response message is received, the terminal  602  transmits an authentication request message to the access point  600  in step S 607 , and the access point  600  transmits an authentication response message to the terminal  602  in response in step S 609 . The terminal  602 , having received the authentication response message, transmits an association request message including RSN IE security parameters supported by the terminal  602  to the access point  600  in step S 611 . The access point  602  transmits an association response message to the access point  600  in step S 613 , and thereby association setting is completed. 
         [0055]      FIG. 7  is a flow chart illustrating a method for supporting multiple authentication policies according to the present invention. 
         [0056]    Referring to  FIG. 7 , in the method for supporting multiple authentication policies, the access point firstly identifies reception of an association request message in step S 701 . The access point then determines, when the association is received, whether information on the terminal that transmitted the association request message is registered in an authentication policy mapping table in step S 703 . If it is determined that the information on the terminal is registered in an authentication policy mapping table, the access point selects an authentication policy associated with the MAC address of the terminal from the authentication policy mapping table in step S 709 , and performs an authentication procedure according to the selected authentication policy in step S 711 . A cipher to be used in a BSS may be identified by referring to a suite selector field located in the group cipher suite field  507  or pairwise cipher suite field  509  of the RSN IE format. 
         [0057]    If it is determined that information on the terminal that transmitted the association request message is not registered in an authentication policy mapping table in step S 703 , the access point detects information on the address and authentication policy of the corresponding terminal from the association request message in step S 705 , and updates the authentication policy mapping table by newly registering the address and authentication policy of the terminal in the authentication policy mapping table in step S 707 . Terminal information for the new registration is collected from the capability information field of the RSN IE included in the association request message. 
         [0058]    After updating the authentication policy mapping table, the access point selects the authentication policy of the terminal from the updated authentication policy mapping table in step S 709 , and performs an authentication procedure according to the selected authentication policy in step S 711 . 
         [0059]    As described above, the access point and method for supporting multiple authentication policies according to the present invention may avoid duplication of network elements for authentication, by providing an authentication service for terminals using different authentication policies with a single access point. Additionally, the access point and method for supporting multiple authentication policies according to the present invention support various authentication policies through a single channel, and thereby frequency source usage efficiency is improved. 
         [0060]    Although exemplary embodiments of the present invention have been described in detail hereinabove, it should be understood that many variations and modifications of the basic inventive concept herein described, which may appear to those skilled in the art, will still fall within the spirit and scope of the present invention as defined in the appended claims.