Abstract:
A system for setting security in a wireless network system using a cluster function. An access point stores a list of candidate terminals of each neighboring access point. When an arbitrary terminal sends an access request, the access point determines whether or not the terminal is authenticated using the stored list of candidate terminals, and transmits an authentication success message to the requesting terminal if the requesting terminal is authenticated. The terminal performs hand-over to the access point without performing authentication upon receiving the authentication success message from the access point in response to the access request. Thus, the hand-over time of a Wi-Fi phone is reduced in an environment based on Wi-Fi Protected Access (WPA) that is one of the strongest wireless LAN security policies, so that the safety and mobility of wireless LAN services can be improved at the same time.

Description:
CROSS-REFERENCE TO RELATED APPLICATION(S) AND CLAIM OF PRIORITY 
       [0001]    The present application claims the benefit under 35 U.S.C. §119(a) of a Korean patent application filed in the Korean Intellectual Property Office on Jan. 29, 2008 and there duly assigned Serial No. 10-2008-0009228, the entire disclosure of which is hereby incorporated by reference. 
       TECHNICAL FIELD OF THE INVENTION 
       [0002]    The present invention relates to a system for setting security in a wireless network system using a cluster function and a method of controlling the same. 
       BACKGROUND OF THE INVENTION 
       [0003]    In a Wireless Fidelity (Wi-Fi) phone in motion, a hand-over time is a very important factor in the quality of speech. 
         [0004]    The Wi-Fi phone provides access to a new access point of another wireless Local Area Network (LAN) while in motion. At this time, the Wi-Fi phone goes through a series of processes for the access. 
         [0005]    The access to the new access point must be provided quickly enough as not to be recognized by a phone user. 
         [0006]    If the hand-over time is delayed, the phone user experiences mute or call disconnection. 
         [0007]    The hand-over time is dependent on how security is set for the wireless LAN. 
         [0008]    The security of the wireless LAN is based on Open (encryption-free) and various encryption standards such as Wired Equivalent Privacy (WEP), Wi-Fi Protected Access-Pre Shared Key (WPA-PSK), and Wi-Fi Protected Access (WPA). Among them, the WPA has the highest security level but the longest hand-over time. 
         [0009]    An accessing process based on the WPA includes 802.1x authentication as illustrated in  FIG. 1A , and generation of a data encryption key as illustrated in  FIG. 1B . 
         [0010]    Particularly, the 802.1x authentication takes much time because an authentication server (i.e., a Remote Authentication Dial-In User Service (RADIUS) server) interworks with the access point and terminals to transceive many messages, and thus has difficulty ensuring continuous hand-over. 
         [0011]    Thus, studies are presently being made to reduce the hand-over time. 
         [0012]    The representative study is Fast BSS Transition of IEEE802.11r. 
         [0013]    However, the proposals of these studies are ongoing in an unstandardized state, and are considerably modified and complicated in comparison with an existing authentication scheme. As such, these schemes have a great difficult with easy application. 
         [0014]    Further, in the light of to which access point the terminal provides access in the future, its range is not fixed, and thus it is difficult to easily handle a security aspect in order to ensure fast hand-over to any access point. 
       SUMMARY OF THE INVENTION 
       [0015]    To address the above-discussed deficiencies of the prior art, it is a primary object to provide a system for setting security in a wireless network system using a cluster function, which can get services for a predetermined time without additional authentication and without interruption, and a method of controlling the same. 
         [0016]    According to an aspect of the invention, there is provided a system for setting security in a wireless network system using a cluster function. The system includes an access point storing a list of candidate terminals of each neighboring access point, determining, when a neighboring terminal sends an access request, whether or not a terminal is authenticated using the stored list of candidate terminals, and transmitting an authentication success message to the terminal if the terminal is authenticated; and the terminal performing hand-over to the access point without performing authentication when receiving the authentication success message from the access point in response to the access request. 
         [0017]    In an embodiment of the present invention, the access point may include a storage storing the list of candidate terminals; a list manager updating the stored list of candidate terminals upon receiving information about the list of candidate terminals from any one of the neighboring access points; and a terminal authentication processor checking whether or not the terminal is authenticated using the list of candidate terminals of the storage when the terminal requests access, and transmitting the authentication success message to the terminal if the terminal is authenticated. 
         [0018]    In another embodiment of the present invention, the list manager may update the list of candidate terminals with information about the terminal when performing authentication on the terminal through an authentication server, and transmit the information about the list of candidate terminals to the neighboring access points to share the information with the neighboring access points. 
         [0019]    In another embodiment of the present invention, the list of candidate terminals of each neighboring access point may include a Media Access Control (MAC) address of the authenticated terminal, a MAC address of the clustered access point, an encryption key, and an authentication time. 
         [0020]    In another embodiment of the present invention, the terminal authentication processor may perform an existing authentication process on the requesting terminal if the requesting terminal is not authenticated using the list of candidate terminals. 
         [0021]    According to another aspect of the invention, there is provided a method of controlling a system for setting security in a wireless network system using a cluster function. The method includes steps of storing, by an access point having a cluster function, a list of candidate terminals of neighboring access points, and when a neighboring terminal sends an access request, determining whether or not the terminal is authenticated using the stored list of candidate terminals; and transmitting, by the access point, an authentication success message to the terminal if the terminal is authenticated using the stored list of candidate terminals. 
         [0022]    In an embodiment of the present invention, the method may further include steps of performing, by the access point, authentication on the terminal through an authentication server if the terminal is not authenticated using the stored list of candidate terminals; updating, by the access point, the list of candidate terminals with information about the authenticated terminal; and transmitting, by the access point, information about the updated list of candidate terminals to the neighboring access points and sharing the information with the neighboring access points. 
         [0023]    In another embodiment of the present invention, the transmitting and sharing of information about the updated list of candidate terminals are performed through encryption. 
         [0024]    In another embodiment of the present invention, the method may further include steps of determining, by the access point, whether or not the information about the updated list of candidate terminals is received from any one of the neighboring access points; and if the information about the updated list of candidate terminals is received, updating, by the access point, the stored list of candidate terminals with the received information about the updated list of candidate terminals. 
         [0025]    In another embodiment of the present invention, the list of candidate terminals of each neighboring access point includes a Media Access Control (MAC) address of the authenticated terminal, a MAC address of the clustered access point, an encryption key, and an authentication time. 
         [0026]    According to a further aspect of the invention, there is provided a method of controlling a system for setting security in a wireless network system using a cluster function. The method includes steps of sending, by a terminal, an access request to a neighboring access point in order to perform hand-over; determining, by the terminal, whether or not an authentication success message is received from the neighboring access point; and handing-over, by the terminal, to the neighboring access point if an authentication success message is received from the neighboring access point. 
         [0027]    In an embodiment of the present invention, the handing-over includes enabling the terminal to use a value of a previously authenticated encryption key without generating a value of a new encryption key. 
         [0028]    In another embodiment of the present invention, the method may further include a step of enabling, by the terminal, the neighboring access point to perform authentication on the terminal through an authentication server if an authentication success message is not received from the neighboring access point. 
         [0029]    As described above, according to embodiments of the present invention, the system for setting security in a wireless network system using a cluster function and the method of controlling the same can reduce the hand-over time of a Wi-Fi phone in an environment based on Wi-Fi Protected Access (WPA) that is one of the strongest wireless LAN security policies, and thus improve the safety and mobility of wireless LAN services at the same time. 
         [0030]    Before undertaking the DETAILED DESCRIPTION OF THE INVENTION below, it may be advantageous to set forth definitions of certain words and phrases used throughout this patent document: the terms “include” and “comprise,” as well as derivatives thereof, mean inclusion without limitation; the term “or,” is inclusive, meaning and/or; the phrases “associated with” and “associated therewith,” as well as derivatives thereof, may mean to include, be included within, interconnect with, contain, be contained within, connect to or with, couple to or with, be communicable with, cooperate with, interleave, juxtapose, be proximate to, be bound to or with, have, have a property of, or the like. Definitions for certain words and phrases are provided throughout this patent document, those of ordinary skill in the art should understand that in many, if not most instances, such definitions apply to prior, as well as future uses of such defined words and phrases. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0031]    For a more complete understanding of the present disclosure and its advantages, reference is now made to the following description taken in conjunction with the accompanying drawings, in which like reference numerals represent like parts: 
           [0032]      FIG. 1A  illustrates a typical process for 802.1x authentication; 
           [0033]      FIG. 1B  illustrates a typical process for data encryption key generation (based on a “way handshaking” scheme); 
           [0034]      FIG. 2  is a block diagram illustrating a system for setting security using a cluster function in a wireless network system according to an embodiment of the present invention; 
           [0035]      FIG. 3  is a functional block diagram illustrating the detailed configuration of an access point in the system for setting security in a wireless network system using the cluster function as illustrated in  FIG. 2  according to an embodiment of the present invention; 
           [0036]      FIG. 4  is a flow chart illustrating a method of controlling a system for setting security in a wireless network system using a cluster function according to an embodiment of the present invention; 
           [0037]      FIG. 5  is a flow chart illustrating a process in which any access point manages a list of candidate terminals in a method of controlling a system for setting security in a wireless network system using a cluster function according to an embodiment of the present invention; and 
           [0038]      FIG. 6  is a flow chart illustrating the controlling process of a terminal in a method of controlling a system for setting security in a wireless network system using a cluster function according to an embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0039]      FIGS. 2 through 6 , discussed below, and the various embodiments used to describe the principles of the present disclosure in this patent document are by way of illustration only and should not be construed in any way to limit the scope of the disclosure. Those skilled in the art will understand that the principles of the present disclosure may be implemented in any suitably arranged wireless communication system. 
         [0040]      FIG. 2  is a block diagram illustrating a system for setting security using a cluster function in a wireless network system according to an embodiment of the present invention. The security setting system includes one or more access points  100 ,  100 - 1 , . . . ,  100 - n,  at least one terminal  200  such as a cell phone, and an authentication server  300 . 
         [0041]    Among the access points, one access point  100  stores a list of candidate terminals of each of the neighboring access points  100 - 1 , . . . ,  100 - n.  When an arbitrary terminal  200  requests access, the access point  100  determines whether or not the requesting terminal  200  is authenticated using the stored list of candidate terminals, and then transmits an authentication success message to the requesting terminal  200  if the requesting terminal  200  is authenticated. To this end, the access point  100  includes a storage  110 , a list manager  120 , and a terminal authentication processor  130 , as illustrated in  FIG. 3 . Any access points  100 ,  100 - 1 , . . . ,  100 - n  encrypt the list of candidate terminals when the list of candidate terminals is transmitted. 
         [0042]    The storage  110  of the access point  100  stores the list of candidate terminals of each of the neighboring access points  100 - 1 , . . . ,  100 - n.  Here, the list of candidate terminals includes a Media Access Control (MAC) address of the authenticated terminal  200 , a MAC address of the clustered access point  100 , an encryption key, and an authentication time. Here, the term “clustered” means that one or more access points are managed as a group. The group of access points shares information about the list of candidate terminals with each other. 
         [0043]    The list manager  120  of the access point  100  updates the stored list of candidate terminals when information about the list of candidate terminals is received from any one of the neighboring access points  100 - 1 , . . . ,  100 - n.  Here, the list manager  120  updates the list of candidate terminals with information about the terminal  200  when the access point  100  performs authentication on the terminal  200  through the authentication server  300 , and simultaneously transmits and shares the information about the list of candidate terminals to and with the neighboring access points  100 - 1 , . . . ,  100 - n.    
         [0044]    Further, when the arbitrary terminal  200  requests access, the terminal authentication processor  130  of the access point  100  checks whether or not the requesting terminal  200  is authenticated using the list of candidate terminals of the storage  110 . If the requesting terminal  200  is an authenticated terminal, the terminal authentication processor  130  transmits an authentication success message to the requesting terminal  200 . Meanwhile, if the requesting terminal  200  is not authenticated using the list of candidate terminals, the terminal authentication processor  130  performs existing authentication on the requesting terminal  200 . 
         [0045]    On the other hand, in the event of hand-over, the arbitrary terminal  200  requests access to any one of the neighboring access points and then receives the authentication success message from the requested neighboring access point. In this case, the requesting terminal  200  performs hand-over to the requested neighboring access point without performing authentication on the requested neighboring access point. 
         [0046]    The aforementioned components will be described regarding their operations associated with the subject matter of the present invention, instead of typical functions and detailed operations. 
         [0047]    First, the terminal  200  requests access to the access point  100 . 
         [0048]    Then, the terminal authentication processor  130  of the requested access point  100  checks whether or not the requesting terminal  200  is authenticated using a list of candidate terminals stored in the storage  110 . Here, the list of candidate terminals includes a MAC address of the authenticated terminal  200 , a MAC address of the clustered access point  100 , an encryption key, and an authentication time. 
         [0049]    If the requesting terminal  200  is not an authenticated terminal, the terminal authentication processor  130  of the access point  100  not only performs 801.1x authentication but also generates a data encryption key using the authentication server  300 , as illustrated in  FIGS. 1A and 1B . 
         [0050]    Using both information about the authenticated terminal  200  and information about the generated data encryption key in the aforementioned process, the list manager  120  of the access point  100  updates the list of candidate terminals stored in the storage  100 . 
         [0051]    Afterwards, when the list of candidate terminals are updated, the list manager  120  of the access point  100  transmits and shares the information about the list of candidate terminals to and with the surrounding clustered access points  100 - 1 , . . . ,  100 - n.    
         [0052]    In contrast, if the requesting terminal  200  is authenticated, the terminal authentication processor  130  of the access point  100  transmits an authentication success message to the requesting terminal  200 , thereby omitting authentication and the data encryption key generation with respect to the requesting terminal  200 . Further, the corresponding access point  100  and terminal  200  use a preset encryption key without generating a separate encryption key because they already know the encryption key through the information about the list of candidate terminals. 
         [0053]    Upon receiving the information about the list of candidate terminals from the neighboring access point  100 - 1 , . . . ,  100 - n,  the list manager  120  of the access point  100  updates the list of candidate terminals. 
         [0054]    Meanwhile, in the event of hand-over, when the terminal  200  requests access to any one of the neighboring access points and then receives an authentication success message, the requesting terminal  200  performs hand-over to the corresponding neighboring access point without performing authentication on the corresponding neighboring access point. 
         [0055]    Now, a method of controlling the system for setting security in a wireless network system using a cluster function will be described with reference to  FIG. 4 . 
         [0056]    First, when an arbitrary terminal  200  requests access, the access point  100 , which stores a list of candidate terminals of each of the neighboring access points  100 - 1 , . . . ,  100 - n,  determines whether or not the requesting terminal  200  is authenticated using the stored list of candidate terminals (S 1 ). 
         [0057]    At this time, if the requesting terminal  200  is authenticated using the stored list of candidate terminals (Yes in step S 1 ), the access point  100  transmits an authentication success message to the requesting terminal  200  (S 2 ). 
         [0058]    In contrast, if the requesting terminal  200  is not authenticated using the stored list of candidate terminals (No in step S 1 ), the access point  100  performs the authenticating process on the requesting terminal  200  through the authentication server  300  (S 3 ). 
         [0059]    Then, the access point  100  updates the list of candidate terminals with information about the authenticated terminal  200  (S 4 ). 
         [0060]    Subsequently, the access point  100  transmits information about the updated list of candidate terminals to the neighboring access points and shares the information with the latter (S 5 ). 
         [0061]    At this time, the information about the updated list of candidate terminals in step S 5  is transmitted through encryption. 
         [0062]    Meanwhile, the operation of the access point in the method of controlling the security setting system will be described with reference to  FIG. 5 . 
         [0063]    In the method of controlling the security setting system, it is determined whether or not the access point  100  receives information about a list of candidate terminals from any one of the neighboring access points (S 110 ). 
         [0064]    If the access point  100  receives information about a list of candidate terminals (Yes in step S 110 ), the access point  100  updates a stored list of candidate terminals with the received information about the list of candidate terminals (S 120 ). Here, the list of candidate terminals of the access point  100  includes a MAC address of the authenticated terminal  200 , a MAC address of the clustered access point  100 , an encryption key, and an authentication time. 
         [0065]    On the other hand, the operation of the terminal in the method of controlling the security setting system will be described with reference to  FIG. 6 . 
         [0066]    First, the terminal  200  requests access to the neighboring access points in order to perform hand-over (S 210 ). 
         [0067]    Then, the requesting terminal  200  checks whether or not the requesting terminal  200  has received an authentication success message from any one of the neighboring access points (S 220 ). 
         [0068]    If the terminal  200  receives an authentication success message (Yes in step S 220 ), the terminal  200  determines that the corresponding neighboring access point completes authentication, and thus hands over to the corresponding neighboring access point (S 230 ). 
         [0069]    In contrast, if the terminal  200  does not receive an authentication success message (No in step S 220 ), the terminal  200  and the corresponding neighboring access point perform authentication through the authentication server  300  (S 240 ). 
         [0070]    Although the present disclosure has been described with an exemplary embodiment, various changes and modifications may be suggested to one skilled in the art. It is intended that the present disclosure encompass such changes and modifications as fall within the scope of the appended claims.