CN113660661A

CN113660661A - Modification method of terminal network configuration and related equipment

Info

Publication number: CN113660661A
Application number: CN202010348858.2A
Authority: CN
Inventors: 黄正全
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2020-04-28
Filing date: 2020-04-28
Publication date: 2021-11-16

Abstract

The embodiment of the application discloses a modification method of terminal network configuration and related equipment thereof, which are used in the technical field of communication and comprise the following steps: an access point in a wireless local area network acquires a network configuration updating command, wherein the network configuration updating command comprises new configuration parameters, the network configuration updating command is used for updating access configuration parameters of the access point, and the new configuration parameters comprise new passwords; the access point sends a terminal configuration updating command to a target terminal, and the terminal configuration updating command indicates the target terminal to automatically modify the configuration parameters of the target terminal according to the terminal configuration updating command; the configuration parameters before modification include an old password, the terminal configuration update command includes the new configuration parameters, a wireless local area network frame carrying the terminal configuration update command is encrypted by a key derived from the old password, and the modified configuration parameters include the new configuration parameters.

Description

Modification method of terminal network configuration and related equipment

Technical Field

The present application relates to the field of communications technologies, and in particular, to a method for modifying a terminal network configuration and a related device.

Background

In a Wireless Local Area Network (WLAN), a manner in which a terminal device first accesses a certain wireless network may be that, first, surrounding wireless network information is obtained by scanning, and when the terminal device selects a wireless network to be accessed, a link authentication request is initiated to the wireless network access point. In the link authentication process, a user manually configures network access parameters, such as a preset shared key, and the access point determines whether the authentication is successful by verifying whether the network access parameters of the terminal device are the same as the preset parameters of the access point. When the authentication is successful, the wireless network allows the terminal equipment to access and provide services for the terminal equipment. And the terminal equipment can store the current network configuration parameters, and when the terminal equipment accesses the wireless network again, the connection is directly carried out according to the stored network configuration parameters without manually inputting related parameters again.

After the terminal equipment is successfully accessed into the wireless network, when the related network configuration of the wireless network is modified, and the terminal equipment which is successfully accessed is offline and then needs to be accessed into the wireless network again, the network configuration on the terminal equipment needs to be synchronously modified; at present, terminal equipment is generally modified one by one in a manual mode, so that the workload of a user is increased, mistakes are easy to make, and the user experience is not high.

Disclosure of Invention

The application provides a modification method of terminal network configuration and related equipment, which are used for automatically updating configuration parameters of a terminal according to access configuration parameters of a wireless network.

A first aspect of the present application provides a method for modifying a terminal network configuration, including:

in a wireless local area network, when configuration parameters of a wireless network are changed, a receiving point receives a network configuration update command sent by wireless network equipment, wherein the network configuration update command is used for instructing an access point to update access configuration parameters of the access point according to modified new configuration parameters, and the new configuration parameters may include a new password, a new service set identifier and the like; when the access point receives the network configuration updating command, the access point changes the access configuration parameters of the access point, and simultaneously sends a terminal configuration updating command to the target terminal to indicate the target terminal to synchronously update the configuration parameters of the terminal, wherein the terminal configuration updating command can comprise a new password, and a wireless local area network frame carrying the terminal configuration updating command is encrypted by a key derived from an old password; therefore, the terminal equipment can receive the terminal configuration updating command according to the old password, then automatically modify the old password according to the new password in the terminal configuration updating command, and finally, the terminal is connected with the wireless network according to the modified password.

When the access point encrypts the wireless local area network frame carrying the terminal configuration updating command by using the key derived from the old password, the target terminal connected with the wireless network can decrypt the received command according to the key derived from the old password before modification, and then automatically modify the self configuration parameters according to the new configuration parameters contained in the command, so that the target terminal can be connected with the wireless network according to the new configuration parameters, the user does not need to manually input the new configuration parameters for many times, the workload of the user is reduced, and the accuracy of modifying the configuration parameters and the user experience are improved.

Based on the first aspect, the present application further provides a first implementation manner of the first aspect:

the target terminal needs to connect to the wireless network before sending the terminal configuration update command, so the access point needs a transition period during which the new password and the old password are simultaneously stored.

When the access point stores the new password and the old password simultaneously in the transition period, the terminal which has successfully accessed the wireless network equipment can access the wireless network according to the old password, then receives the terminal configuration updating command, after the transition period is finished, the access point only stores the new password, and the terminal must perform link authentication according to the new password, so that the terminal can be ensured to successfully receive the terminal configuration updating command, and meanwhile, the existence of the transition period can also ensure that the password is changed, and network security is provided.

Based on the first implementation manner of the first aspect, the present application further provides a second implementation manner of the first aspect:

the target terminal needs to be connected with the wireless network before receiving the terminal configuration updating command, and the access point needs to authenticate the target terminal by using the old password because the configuration parameter before the target terminal is modified is the old password; when the access point receives an authentication response message, because the access point cannot directly sense the attribute of the terminal sending the message, the encrypted challenge code in the message needs to be decrypted by using a new password and an old password; for example, the access point may decrypt according to the new password, if the decryption is successful, the terminal directly authenticates successfully, if the decryption fails, the challenge code is decrypted again by using the old password, the authentication succeeds if the decryption succeeds, and if the decryption fails twice, the terminal authentication fails and the terminal cannot be allowed to access the wireless network; the access point can also decrypt the encrypted challenge code by using the old password, and decrypt the challenge code by using the new password after the decryption fails, wherein the specific decryption sequence is not limited.

The access point processes the received authentication response message by using the new password and the old password, so that the target terminal which has successfully accessed the wireless network can be ensured to access the wireless network by using the old password in a transition period, and the target terminal is ensured to receive a network configuration updating command so as to complete the automatic updating of the configuration parameters; and the target terminal with the configuration parameter of the new password can be ensured to complete link authentication and successfully access the wireless network.

Based on the first implementation manner of the first aspect to the second implementation manner of the first aspect, the present application further provides a third implementation manner of the first aspect:

the terminal configuration update command sent by the access point to the target terminal includes not only the new configuration parameters, but also the deadline, which is used to indicate the time when the access point only uses the new configuration parameters as its own access configuration parameters, that is, the target terminal needs to change the configuration parameters within the deadline, and the access point does not use the old password to authenticate the terminal after the deadline.

When the deadline time is exceeded, the access point only uses the new configuration parameters as the self access configuration parameters, the terminal changes the self configuration parameters within the deadline time, so that the terminal can be connected to the wireless network, and if the deadline time is exceeded, the terminal is not allowed to automatically update the configuration parameters, so that the network security can be improved.

Based on the first aspect through the third implementation manner of the first aspect, the present application further provides a fourth implementation manner of the first aspect:

in the wireless local area network, the network configuration updating command sent by the wireless network equipment can also instruct the access point to modify the new service set identifier, the access point modifies the new service set identifier according to the network configuration updating command, then sends a terminal configuration updating command to the terminal equipment which has successfully accessed the network, instructs the target terminal to automatically modify the service set identifier, and facilitates the target terminal to switch to a new wireless network according to the new service set identifier and the new password.

A second aspect of the present application provides a method for modifying a terminal network configuration, including:

in the wireless local area network, when the configuration parameters of the wireless network are changed, a receiving point modifies the access configuration parameters of the receiving point and indicates a target terminal to synchronously update the configuration parameters of the terminal, an access point sends a terminal configuration update command to the terminal, a wireless local area network frame carrying the terminal configuration update command is encrypted by a key derived from an old password, then the terminal modifies the configuration parameters of the receiving point according to a new password included in the terminal configuration update command, and finally the receiving point is connected with the access point by using the new password.

The target terminal modifies the configuration parameters according to the terminal configuration updating command sent by the access point, so that when the related configuration of the wireless network is changed, the successfully verified terminal can automatically modify the configuration parameters without manual input of a user, the workload of the user is reduced, and the experience is improved.

Based on the second aspect, the present application further provides the first implementation manner of the second aspect:

the terminal configuration update command sent by the access point also includes a deadline indicating that the target terminal needs to connect the access point with the new configuration parameters before the deadline, that is, the terminal needs to complete the update of the configuration parameters before the deadline, and if the new parameters are not modified before the deadline, the user needs to manually modify the configuration parameters, so that the network security is improved.

A third aspect of the present application provides an access device for a wireless local area network, including:

an obtaining unit, configured to obtain a network configuration update command, where the network configuration update command includes a new configuration parameter, the network configuration update command is used to update an access configuration parameter of the access point, and the new configuration parameter includes a new password.

A sending unit, configured to send a terminal configuration update command to a terminal device, where the terminal configuration update command indicates that the terminal device automatically modifies a configuration parameter of the terminal device according to the terminal configuration update command.

The configuration parameters before modification include an old password, the terminal configuration update command includes the new configuration parameters, a wireless local area network frame carrying the terminal configuration update command is encrypted by a key derived from the old password, and the modified configuration parameters include the new configuration parameters.

Based on the third aspect, the present application further provides the first implementation manner of the third aspect:

the access device further comprises: and the storage unit is used for storing the new password and the old password in a transition period.

Based on the first implementation manner of the third aspect, the present application further provides a second implementation manner of the third aspect:

a receiving unit, configured to receive, in the transition period, an authentication response packet sent by the terminal device, where the authentication response packet includes an encrypted challenge code.

A processing unit for decrypting the challenge code using a first password; if the first password is used for successfully decrypting the challenge code, the target terminal is successfully authenticated; if the first password fails to decrypt the challenge code, the access point decrypts the challenge code by using a second password; and if the challenge code is successfully decrypted by the second password, the target terminal is successfully authenticated.

Wherein the first password is the new password, and the second password is the old password; or the first password is the old password, and the second password is the new password.

In accordance with a second implementation of the third aspect, the present application further provides a third implementation of the third aspect:

the terminal configuration update command further comprises an expiration time, wherein the expiration time is used for indicating the time when the access point only uses the new configuration parameters as the access configuration parameters of the access point.

In accordance with a third embodiment of the third aspect, the present application also provides a fourth embodiment of the third aspect: the new configuration parameters also include a new service set identification.

A fourth aspect of the present application provides an access device for a wireless local area network, including:

a receiving unit, configured to receive a terminal configuration update command sent by an access device, where the terminal configuration update command includes a new configuration parameter, the new configuration parameter includes a new password, and a wireless local area network frame carrying the terminal configuration update command is encrypted with a key derived from an old password.

And the processing unit is used for modifying the configuration parameters by using the new configuration parameters, wherein the configuration parameters before modification comprise the old password.

A connecting unit, configured to connect the access point with the new configuration parameter.

Based on the fourth aspect, the present application further provides the first implementation manner of the fourth aspect: the terminal configuration update command comprises an expiration time, and the target terminal connects with the access point by using the new configuration parameters before the expiration time.

A fifth aspect of the present application provides an access device, including: at least one processor and a communication interface, the processor performing the method according to any one of the possible implementations of the first aspect to the first aspect.

A sixth aspect of the present application provides a terminal device, including: at least one processor, a memory, the memory storing computer-executable instructions executable on the processor, the processor performing the method according to any one of the possible implementations of the second aspect as described above when the computer-executable instructions are executed by the processor.

A seventh aspect of the present application provides a system for modifying a terminal network configuration, including: as for any access device in the third to fourth embodiments of the third to fourth aspects, as for any terminal device in the first to fourth embodiments of the fourth to fourth aspects, the access device sends a terminal configuration update command to the terminal device.

An eighth aspect of the present application provides a computer storage medium for storing computer software instructions for the access device or the terminal device, which includes a program designed for executing the access device or the terminal device.

The access device may be as described in the previous third aspect.

The terminal device may be as described in the fourth aspect above.

A ninth aspect of the present application provides a chip or a chip system, where the chip or the chip system includes at least one processor and a communication interface, the communication interface and the at least one processor are interconnected by a line, and the at least one processor is configured to execute a computer program or instructions to perform the method for modifying a terminal network configuration described in any one of the possible implementation manners of the first aspect;

the communication interface in the chip may be an input/output interface, a pin, a circuit, or the like.

In one possible implementation, the chip or chip system described above in this application further comprises at least one memory having instructions stored therein. The memory may be a storage unit inside the chip, such as a register, a cache, etc., or may be a storage unit of the chip (e.g., a read-only memory, a random access memory, etc.).

A tenth aspect of the present application provides a chip or a chip system, where the chip or the chip system includes at least one processor and a communication interface, the communication interface and the at least one processor are interconnected by a line, and the at least one processor is configured to execute a computer program or instructions to perform the method for modifying a terminal network configuration described in any one of any possible implementation manners of the second aspect to the second aspect;

An eleventh aspect of the present application provides a computer program product, which includes computer software instructions that can be loaded by a processor to implement the flow of the method for modifying a terminal network configuration according to any one of the first to second aspects.

According to the technical scheme, the method has the following advantages:

by using the method and the device, the access point of the wireless network encrypts the wireless local area network frame carrying the terminal configuration updating command by using the key derived from the old password, and then sends the wireless local area network frame to the target terminal connected with the wireless network, the access point automatically modifies the self configuration parameters according to the terminal configuration updating command, and then the target terminal connects the wireless network according to the new configuration parameters without the need of manually inputting the new configuration parameters for many times by a user, so that the workload of the user is reduced, and the accuracy of modifying the configuration parameters and the user experience are improved.

Drawings

Fig. 1 is a schematic diagram of a wireless network topology provided in an embodiment of the present application;

fig. 2 is a schematic flowchart of shared key authentication provided in an embodiment of the present application;

fig. 3 is a flowchart illustrating a method for modifying a terminal network configuration according to an embodiment of the present application;

fig. 4 is a flowchart illustrating another method for modifying a terminal network configuration according to an embodiment of the present application;

fig. 5 is a schematic structural diagram of an access device of a wireless local area network according to an embodiment of the present application;

fig. 6 is a schematic structural diagram of a terminal device of a wireless local area network according to an embodiment of the present application;

fig. 7 is a schematic structural diagram of another access device of a wireless local area network according to an embodiment of the present application;

fig. 8 is a schematic structural diagram of another terminal device of a wireless local area network according to an embodiment of the present application.

Detailed Description

The technical solutions in the present application will be described in detail below with reference to the drawings in the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all embodiments.

The terms "first," "second," "third," "fourth," and the like in the description and in the claims of the present application and in the drawings described above, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It will be appreciated that the data so used may be interchanged under appropriate circumstances such that the embodiments described herein may be practiced otherwise than as specifically illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

Please refer to fig. 1, which is a schematic diagram of a wireless network topology according to an embodiment of the present application. As shown in fig. 1, a wireless connection is formed between a Station (STA) and a wireless Access Point (AP), and the AP is connected to a network (e.g., Internet) through a Wireless Access Controller (WAC) by wire. The workstation STA may be a terminal device supporting 802.11 standards, including a computer with a wireless network card, a mobile phone supporting WLAN, and the like; the AP provides wireless access service based on 802.11 standard for the STA, and plays a role in bridging a wired network and a wireless network; the wireless controller controls and manages all APs in the wlan in a centralized network architecture. For example, the WAC may provide authentication services to the user by interacting with an authentication server. Alternatively, the wireless controller may be an Access Controller (AC) defined by a wireless access point control and provisioning of wireless access points (CAPWAP) protocol.

The process of accessing the wireless network by the STA can be divided into three stages, including a scanning stage, an association stage and a link authentication stage; in the scanning stage, the STA can acquire surrounding wireless network information through active scanning and passive scanning, and selects a wireless network to be accessed; in the association stage, the association process is a link service negotiation process in essence, the STA initiates the link service negotiation, the specific negotiation is realized through an association message, after receiving the association response, the STA judges whether the access authentication of the user is needed or not, and if not, the STA can directly access the wireless network; if necessary, the STA can initiate a link authentication request; in the link authentication stage, in order to ensure the security of the wireless link, the AP needs to complete authentication of the STA during the access process, and the STA can access the wireless network only after the authentication is successful.

Generally, the link authentication mechanism may be an open system, which is not authenticated, and any STA may directly access the wireless network. The link authentication mechanism may also be shared key authentication, which requires that the STA and the AP configure the same pre-shared key (PSK) in advance, and the access point AP needs to verify whether the key configurations on both sides are the same in the link authentication process; if the two are consistent, the authentication is successful; otherwise, authentication fails. Please refer to fig. 2, which is a schematic flowchart illustrating a shared key authentication method according to an embodiment of the present application; as shown in fig. 2: the STA firstly sends an authentication request to the AP, and the AP immediately generates a challenge phrase to the STA after receiving the authentication request; the STA then encrypts the "challenge phrase" using a preset key and sends the encrypted "challenge phrase" to the AP again; after receiving the encrypted challenge phrase, the AP decrypts the message by using a preset key of the AP, and then compares the decrypted challenge phrase with the challenge phrase which is sent to the STA before; if the key is the same, the STA and the key preset by the AP are the same, and the terminal authentication is successful; otherwise, the authentication fails, and the AP does not allow the terminal to access the wireless network.

When the terminal and the AP perform link layer authentication in a PSK authentication method, the terminal and the AP must be configured with the same PSK in advance. In a certain scene, if the PSK is to be modified, the AP and the terminal must be modified synchronously, and currently, the PSK is only manually modified in a manual manner, which increases the workload of the user, and makes manual input error easily, and the user experience is not high.

A Service Set Identifier (SSID) is an identifier representing a wireless network and is used to distinguish different wireless networks; similarly, when the SSID of the terminal needs to be modified by the wireless network, the SSID of the terminal needs to be manually modified or reconfigured, and then the wireless terminal can initiate active scanning and access authentication for the new SSID, which greatly increases the workload of the user and affects the experience of the user.

Referring to fig. 3, a schematic flow chart of a method for modifying a terminal network configuration in an embodiment of the present application is shown, as shown in fig. 3, the method includes:

301. the terminal initiates link authentication to the access point by using the old password.

When a terminal accesses a wireless network for the first time, the terminal firstly needs to scan to obtain the wireless network information, then sends an authentication request to the access point, and the access point randomly generates a 'challenge phrase' to the terminal after receiving the authentication request; the terminal encrypts the "challenge phrase" with the old password set in advance and re-sends the encrypted "challenge phrase" to the access point. It can be understood that the old password preset by the terminal is manually input by the user, and the old password is accessed to the wireless network by sharing the wireless network key.

302. The access point determines that the terminal authentication is successful.

After the access point receives the encrypted challenge phrase, because the access configuration parameter of the access point is still the old password at this time, the access point needs to decrypt the challenge phrase by using the old password, and when the decrypted challenge phrase is consistent with the previously sent challenge phrase, the fact that the password preset by the terminal is the same as the password of the access point is proved, that is, the authentication is successful, and the access point allows the successfully authenticated terminal to access the wireless network.

303. The terminal is connected to the access point.

And when the link authentication is successful, the terminal associates with the wireless network. The terminal will continue to initiate link service negotiation, and finally the terminal accesses the wireless network to complete data transmission.

304. The wireless controller sends a network configuration update command to the access point.

When the network configuration parameters of the wireless network need to be changed, optionally, a network administrator may first perform configuration adjustment on the wireless controller WAC, and then the wireless controller WAC automatically synchronizes the adjusted network configuration to the access point AP, it can be understood that the WAC may send a network configuration update command to the AP, where the command includes new configuration parameters, such as a new password or a new SSID and a new password corresponding to the SSID; to indicate to the access point to modify access configuration parameters of the access point.

305. And the access point changes the access configuration parameters according to the network configuration updating command.

After receiving the network configuration update command, the AP firstly modifies the access configuration parameters of the AP and authenticates the terminal by using a new password or a new SSID and the password.

For example, the AP may change the network configuration parameters according to the network condition, that is, the AP modifies the access configuration parameters of the AP and authenticates the terminal with a new password or a new SSID and password, and it is understood that in this case, step 304 and step 305 may not be executed.

306. And the access point sends a terminal configuration updating command to the terminal.

After the access configuration parameters are modified by the access point, the access point needs to inform the online terminal which has successfully accessed the wireless network to synchronously modify the configuration parameters of the terminal, so that the terminal automatically updates the configuration parameters.

The access point can inform the accessed online terminal of updating the configuration parameters through the encrypted broadcast message; generally, a Pairwise Master Key (PMK) generated according to a pre-shared secret PSK during access authentication may generate two types of temporary keys, one type is a pairwise Transient key (ptk) (pairing Transient key) used for encrypting unicast messages, and the other type is a Group Transient Key (GTK) used for encrypting multicast and broadcast wireless messages; therefore, the broadcast message is encrypted by using the old GTK, and the new configuration parameters included in the broadcast message may include a new password, the new password includes a new PSK, and may also include a new SSID and a PSK corresponding to the SSID, and the specific form is not limited. And after the terminal accesses the network according to the new configuration parameters, generating a new PMK by the new PSK, and then generating new PTKs and GTKs by the new PMK to encrypt different messages.

Illustratively, the access point may send the terminal configuration update command using a management frame with a reserved number, and the content of the management frame may include a new PSK, a new SSID, an expiration time of the update configuration, or an update mode. Illustratively, this may be achieved using a reserved category in the action frame; in the action frame, some reserved categories and vendor-defined categories exist, and specific functions are not clearly defined, so that the terminal configuration update command can also be sent by using the action frame with the reserved number.

For example, the implementation is performed by using an action frame (action type code is 22) of reserved codes, and the related brief definitions are as follows in table 1:

TABLE 1

The format of the action frame is shown in table 2:

TABLE 2

The update network configuration advertisement (RNCA) action domain value in table 2 may include multiple values, and the definition of each value is shown in table 3:

RNCA Action field value	Description (description)
		0	Immediate update
1	Update after restart
		2	Updating at specified times
3-255	Retention

TABLE 3

Meanwhile, in table 2, updating the network configuration elements may modify SSID and PSK, so that each element may be assigned an element ID, and the specific assignment result may be as shown in table 4:

TABLE 4

Wherein the action frame may be defined in TLV format, as shown in table 5:

TABLE 5

Wherein, the meaning of each field in table 5 is: the element ID is an element ID which needs to be updated, for example, when the SSID is updated, the value is 0, and when the PSK is updated, the value is 2; length is the length of the subsequent field of the element field, i.e. the length of the identified byte; the deadline is an expiration time, and the expiration time is used for indicating the time when the access point only uses the new configuration parameter as the access configuration parameter of the access point; indicating the terminal to automatically update the deadline of the configuration parameter according to the action domain; the new time is the designated update time, for example, when the access point does not indicate the update time of the new configuration parameter, the value may be 0, and if the update time is designated, the terminal selects the mode of modifying the configuration parameter according to the update time; the new value refers to a new configuration value, i.e., reserved information, for defining other variables. The access point can set an action frame according to the definition of each field, and then send the action frame to the target terminal to instruct the terminal to modify the configuration parameters.

307. And the terminal modifies the configuration parameters according to the terminal configuration updating command.

After receiving the network configuration update command, the terminal modifies the configuration parameters of the terminal according to the relevant information in the terminal configuration update command, illustratively, the terminal can modify the password according to the new password and also can modify the configuration parameters into a new SSID and the new password; meanwhile, the time limit for modifying the password can be determined according to the cut-off time; the modification mode is determined according to the update time, for example, the terminal modifies the configuration parameters immediately after receiving the terminal configuration update command, may also save the new configuration parameters first, modify the configuration parameters after the terminal is restarted, or modify the configuration parameters at a specified time, which is not limited specifically.

308. And the terminal is connected with the access point according to the new configuration parameters.

And after the terminal modifies the configuration parameters, the terminal authenticates the wireless network by using the new configuration parameters to complete the switching or modification of the wireless network.

In this embodiment, an access point of a wireless network encrypts a wireless local area network frame carrying a terminal configuration update command by using a key derived from an old password, and then sends the wireless local area network frame to a target terminal connected to the wireless network, the access point automatically modifies a self-configuration parameter according to the terminal configuration update command, and then the target terminal connects the wireless network according to a new configuration parameter without manually inputting the new configuration parameter for many times by a user, so that the workload of the user is reduced, and the accuracy of modifying the configuration parameter and the user experience are improved.

Referring to fig. 4, a schematic flow chart of another method for modifying a terminal network configuration in an embodiment of the present application is shown, as shown in fig. 4, the method includes:

401. the wireless controller sends a network configuration update command to the access point.

Step 401 is similar to step 304 in the embodiment shown in fig. 3, and is not described herein again.

402. And the access point changes the access configuration parameters according to the network configuration updating command.

Step 402 is similar to step 305 in the embodiment shown in fig. 3, and is not described herein again.

403. The access point saves the new password and the old password.

After the access configuration parameters of the access point are changed, because the off-line terminals which are not connected with the wireless network exist, the off-line terminals are terminal equipment which is successfully authenticated and is connected with the wireless network, in order to enable the off-line terminals to automatically modify the configuration parameters, the access point needs to enable the terminals to be connected into the wireless network according to the old configuration parameters, and then the off-line terminals are indicated to automatically modify; for network security, a preferred scheme is that the access point stores a new password and an old password in a transition period, and deletes the old password after the transition period, and performs link authentication only according to the new password.

404. The terminal initiates link authentication to the access point.

The terminal sends an authentication request to the access point, so that the access point authenticates the terminal.

405. The access point authenticates the terminal.

The access point responds to an authentication request sent by the terminal, because the access configuration parameters of the access point comprise a new password and an old password, and because the access point cannot directly sense the configuration parameters of the terminal, the new password and the old password are required to be used for performing link authentication, in a transition period, when the access point receives an authentication response message sent by the terminal, the new password is firstly used for decrypting the challenge code, and if the new password is used for successfully decrypting the challenge code, the terminal authentication is directly determined to be successful; if the new password fails to decrypt the challenge code, the access point needs to decrypt the challenge code by using the old password, and then determines the authentication result according to the decryption result of the old password.

It can be understood that the access point may also decrypt the encrypted challenge code by using the old password and then decrypt the challenge code by using the new password, and the specific form is not limited.

406. And the access point sends a terminal configuration updating command to the terminal.

Step 406 is similar to step 306 in the embodiment shown in fig. 3, but the access point may issue a terminal configuration update command in a unicast manner, and encrypt a unicast packet by using the pairwise transient key PTK; therefore, the unicast message is encrypted by using the old PTK, and the new configuration parameters included in the unicast message may include a new password, and may also include a new SSID and a new password corresponding to the SSID, and the specific form is not limited.

407. And the terminal modifies the configuration parameters according to the terminal configuration updating command.

Step 407 is similar to step 307 in the embodiment shown in fig. 3, and is not described herein.

408. And the terminal is connected with the access point according to the new configuration parameters.

Step 408 is similar to step 308 in the embodiment shown in fig. 3, and is not described herein again.

In this embodiment, the access point of the wireless network stores the new password after modification and the old password before modification, so that in the transition period, the terminal with the configuration parameter of the new password or the old password can be successfully connected to the wireless network, and since the terminal with the configuration parameter of the old password is successfully connected to the wireless network, the access point can send a terminal configuration update command to the terminal, so that the terminal can automatically modify the configuration parameter of the terminal, the user does not need to manually input the new configuration parameter, the workload of the user is reduced, and the accuracy of modifying the configuration parameter and the user experience are improved.

Referring to fig. 5, a schematic structural diagram of an access device of a wireless local area network according to an embodiment of the present application is shown. As shown in fig. 5, the access device 500 includes:

an obtaining unit 501, configured to obtain a network configuration update command, where the network configuration update command includes a new configuration parameter, the network configuration update command is used to update an access configuration parameter of the access device 500, and the new configuration parameter includes a new password;

a sending unit 502, configured to send a terminal configuration update command to a terminal device, where the terminal configuration update command indicates that the terminal device automatically modifies a configuration parameter of the terminal device according to the terminal configuration update command;

In a possible implementation, the access device 500 further includes:

a storage unit 503, configured to store the new password and the old password in a transition period.

In a possible implementation, the access device 500 further includes:

a receiving unit 504, configured to receive, in the transition period, an authentication response packet sent by the terminal device, where the authentication response packet includes an encrypted challenge code;

a processing unit 505, configured to decrypt the challenge code using a first password; if the first password is used for successfully decrypting the challenge code, the target terminal is successfully authenticated; if the first password fails to decrypt the challenge code, a second password is used for decrypting the challenge code; if the challenge code is decrypted successfully by the second password, the target terminal is authenticated successfully;

In a possible implementation, the terminal configuration update command further includes an expiration time, where the expiration time is used to indicate a time when the access point uses only the new configuration parameters as the access configuration parameters of the access point.

In one possible implementation, the new configuration parameter further includes a new service set identifier.

It should be noted that, for the functions of each unit of the access device, specific reference may be made to details of implementation of the access point in the method embodiments shown in fig. 3 and fig. 4, and details are not described here again.

Referring to fig. 6, a schematic structural diagram of a terminal device of a wireless local area network according to an embodiment of the present application is shown. As shown in fig. 6, the terminal apparatus 600 includes:

a receiving unit 601, configured to receive a terminal configuration update command sent by an access device, where the terminal configuration update command includes a new configuration parameter, the new configuration parameter includes a new password, and a wireless local area network frame carrying the terminal configuration update command is encrypted with a key derived from an old password;

a processing unit 602, configured to modify a configuration parameter with the new configuration parameter, where the configuration parameter before modification includes the old password;

a connecting unit 603, configured to connect to the access point with the new configuration parameter.

In a possible implementation, the terminal configuration update command includes an expiration time, and the connection unit 603 connects to the access point with the new configuration parameter before the expiration time.

It should be noted that, for the functions of each unit of the terminal device, specific reference may be made to implementation details of the terminal in the method embodiments shown in fig. 3 and fig. 4, and details are not described here again.

Please refer to fig. 7, which is a schematic structural diagram of another access device according to an embodiment of the present application, where the access device includes: a processor 701 and a communication interface 702.

The processor 701 and the communication interface 702 are connected to each other by a bus; the bus may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown in FIG. 7, but this is not intended to represent only one bus or type of bus.

The processor 701 may be a Central Processing Unit (CPU), a Network Processor (NP), or a combination of a CPU and an NP. The processor 601 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a Programmable Logic Device (PLD), or a combination thereof. The PLD may be a Complex Programmable Logic Device (CPLD), a field-programmable gate array (FPGA), a General Array Logic (GAL), or any combination thereof.

The communication interface 702 is a wireless communication interface, wherein the wireless communication interface may be a WLAN interface, a cellular network communication interface, or a combination thereof.

Optionally, the processor 701 invokes the program instruction, and may execute one or more steps in the method embodiment shown in fig. 3 or fig. 4, or an optional implementation thereof, so that the access device implements the function of the access point in the foregoing method, which is not described herein again specifically.

Please refer to fig. 8, which is a schematic structural diagram of another terminal device provided in an embodiment of the present application, where the terminal device includes: a processor 801, a memory 802, and a communication interface 803.

The processor 801, the memory 802, and the communication interface 803 are connected to each other by a bus; the bus may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown in FIG. 8, but this is not intended to represent only one bus or type of bus.

The memory 802 may include volatile memory (volatile memory), such as random-access memory (RAM); the memory may also include a non-volatile memory (non-volatile memory), such as a flash memory (flash memory), a Hard Disk Drive (HDD) or a solid-state drive (SSD); the memory 802 may also comprise a combination of the above-described types of memory.

The processor 801 may be a Central Processing Unit (CPU), a Network Processor (NP), or a combination of a CPU and an NP. The processor 801 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a Programmable Logic Device (PLD), or a combination thereof. The PLD may be a Complex Programmable Logic Device (CPLD), a field-programmable gate array (FPGA), a General Array Logic (GAL), or any combination thereof.

The communication interface 803 may be a wired communication interface, such as an ethernet interface, a wireless communication interface, or a combination thereof. The ethernet interface may be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface may be a WLAN interface, a cellular network communication interface, a combination thereof, or the like.

Optionally, the memory 802 may also be configured to store program instructions, and the processor 801 invokes the program instructions stored in the memory 802, and may execute one or more steps in the method embodiment shown in fig. 2 or fig. 3, or an optional implementation manner therein, so that the terminal device implements the function of the terminal in the foregoing method, which is not described herein again.

The embodiment of the present application further provides a system for modifying terminal network configuration, including: the access device shown in fig. 5 or fig. 7, or the terminal device shown in fig. 6 or fig. 8, sends a terminal configuration update command to the terminal device.

The embodiment of the present application further provides a chip or a chip system, where the chip or the chip system includes at least one processor and a communication interface, the communication interface and the at least one processor are interconnected by a line, and the at least one processor executes instructions or a computer program to perform one or more steps in the method embodiment shown in fig. 3 or fig. 4, or an alternative implementation thereof, so as to implement the functions of the access point in the above method.

In a possible implementation, the chip or chip system described above further comprises at least one memory, in which instructions are stored. The memory may be a storage unit inside the chip, such as a register, a cache, etc., or may be a storage unit of the chip (e.g., a read-only memory, a random access memory, etc.).

The embodiment of the present application further provides a chip or a chip system, where the chip or the chip system includes at least one processor and a communication interface, the communication interface and the at least one processor are interconnected by a line, and the at least one processor is configured to execute a computer program or an instruction to perform the method for executing the terminal described in any one of any possible implementation manners of the embodiments shown in fig. 3 and 4;

Embodiments of the present application further provide a computer storage medium, where the computer storage medium is used to store computer software instructions for the access device or the terminal device, and the computer storage medium includes a program designed to execute the program for the access device or the terminal device.

The access device may be as described in the foregoing fig. 5 or fig. 7.

The terminal device may be as described in fig. 6 or fig. 8 above.

An embodiment of the present application further provides a computer program product, where the computer program product includes computer software instructions, and the computer software instructions may be loaded by a processor to implement the flow in the method for updating the terminal network configuration shown in fig. 3 or fig. 4.

In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product.

The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the procedures or functions described in accordance with the present application are generated, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored on a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website, computer, server, or data center to another website, computer, server, or data center via wire (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can store or a data storage device, such as a server, a data center, etc., that is integrated with one or more available media. The usable medium may be a magnetic medium (e.g., floppy Disk, hard Disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., Solid State Disk (SSD)), among others.

It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.

In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be substantially implemented or contributed to by the prior art, or all or part of the technical solution may be embodied in a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a read-only memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and the like.

Claims

1. A method for modifying a terminal network configuration, the method comprising:

an access point in a wireless local area network acquires a network configuration updating command, wherein the network configuration updating command comprises new configuration parameters, the network configuration updating command is used for updating access configuration parameters of the access point, and the new configuration parameters comprise new passwords;

the access point sends a terminal configuration updating command to a target terminal, and the terminal configuration updating command indicates the target terminal to automatically modify the configuration parameters of the target terminal according to the terminal configuration updating command;

2. The method of claim 1, further comprising:

the access point saves the new password and the old password during a transition period.

3. The method of claim 2, further comprising:

in the transition period, the access point receives an authentication response message sent by the target terminal, wherein the authentication response message comprises an encrypted challenge code;

the access point decrypts the challenge code using a first password;

if the first password is used for successfully decrypting the challenge code, the target terminal is successfully authenticated;

if the first password fails to decrypt the challenge code, the access point decrypts the challenge code by using a second password;

if the challenge code is decrypted successfully by the second password, the target terminal is authenticated successfully;

wherein the content of the first and second substances,

the first password is the new password, and the second password is the old password; or

The first password is the old password, and the second password is the new password.

4. The method according to any of claims 1 to 3, wherein the terminal configuration update command further comprises an expiration time indicating a time when the access point uses only the new configuration parameters as the access configuration parameters of the access point.

5. The method according to any of claims 1 to 4, wherein the new configuration parameters further comprise a new service set identity.

6. A method for modifying a terminal network configuration, the method comprising:

a terminal in a wireless local area network receives a terminal configuration updating command sent by an access point, wherein the terminal configuration updating command comprises new configuration parameters, the new configuration parameters comprise new passwords, and a wireless local area network frame carrying the terminal configuration updating command is encrypted by a key deduced from the old passwords;

the terminal modifies configuration parameters by using the new configuration parameters, wherein the configuration parameters before modification comprise the old passwords;

and the target terminal is connected with the access point by using the new configuration parameters.

7. The method of claim 6, wherein the terminal configuration update command comprises an expiration time, and wherein the target terminal connects to the access point with the new configuration parameters before the expiration time.

8. An access device of a wireless local area network, the access device comprising:

an obtaining unit, configured to obtain a network configuration update command, where the network configuration update command includes a new configuration parameter, the network configuration update command is used to update an access configuration parameter of the access point, and the new configuration parameter includes a new password;

a sending unit, configured to send a terminal configuration update command to a terminal device, where the terminal configuration update command indicates that the terminal device automatically modifies a configuration parameter of the terminal device according to the terminal configuration update command;

9. The access device of claim 8, wherein the access device further comprises:

and the storage unit is used for storing the new password and the old password in a transition period.

10. The access device of claim 9, wherein the access device further comprises:

a receiving unit, configured to receive, in the transition period, an authentication response packet sent by the terminal device, where the authentication response packet includes an encrypted challenge code;

a processing unit for decrypting the challenge code using a first password; if the first password is used for successfully decrypting the challenge code, the target terminal is successfully authenticated; if the first password fails to decrypt the challenge code, the processing unit decrypts the challenge code by using a second password; if the challenge code is decrypted successfully by the second password, the target terminal is authenticated successfully;

11. The access device of any of claims 8 to 10, wherein the terminal configuration update command further comprises an expiration time, wherein the expiration time is used to indicate a time when the access device uses only the new configuration parameters as the access configuration parameters of the access point.

12. The access device of any of claims 8 to 11, wherein the new configuration parameters further comprise a new service set identity.

13. A terminal device in a wireless local area network, the terminal device comprising:

a receiving unit, configured to receive a terminal configuration update command sent by an access device, where the terminal configuration update command includes a new configuration parameter, the new configuration parameter includes a new password, and a wireless local area network frame carrying the terminal configuration update command is encrypted with a key derived from an old password;

a processing unit, configured to modify a configuration parameter with the new configuration parameter, where the configuration parameter before modification includes the old password;

14. The terminal device according to claim 13, wherein the terminal configuration update command includes an expiration time, and the connection unit connects to the access point with the new configuration parameters before the expiration time.

15. An access device, comprising: at least one processor and a communication interface, the processor performing the method according to any one of the possible implementations of claims 1 to 5.

16. A terminal device, comprising: at least one processor, a memory, the memory storing computer-executable instructions executable on the processor, the processor performing a method according to any one of the possible implementations of the above claims 6 to 7 when the computer-executable instructions are executed by the processor.

17. A system for modifying a terminal network configuration, comprising: an access device and a terminal device, wherein the access device is the access device of any one of the above claims 8 to 12; the terminal device is the terminal device of any one of claims 13 to 14.

18. A computer-readable storage medium storing one or more computer-executable instructions, wherein when the computer-executable instructions are executed by a processor, the processor performs the method of any one of claims 1 to 7.