WO2009103227A1

WO2009103227A1 - Method, device and system for sending initial configuration message to access point device

Info

Publication number: WO2009103227A1
Application number: PCT/CN2009/070397
Authority: WO
Inventors: 何纲; 聂爽; 韩少伟
Original assignee: 华为技术有限公司
Priority date: 2008-02-21
Filing date: 2009-02-11
Publication date: 2009-08-27
Also published as: CN101515881A

Abstract

A method for sending the initial configuration message to the access point device involves receiving the obtaining request for the initial configuration message of the access point device through the encrypted channel, and obtaining the initial configuration message of the access point device, which includes the address information of the home security gateway, according to the obtaining request, and sending the initial configuration message of the access point device through the encrypted channel. The method is applied to a network device and a network system.

Description

Method, device and system for delivering initial configuration information of access point device

The embodiments of the present invention relate to the field of communications, and in particular, to a method, device, and system for delivering initial configuration information of an access point device. Background technique

The development of the communications industry to 3G has set a good prospect for people and set a high standard for future communications. In order to improve the problem of network coverage, 3G operators used macro base stations to solve indoor coverage in the early days, but used macro base stations to solve indoor coverage, site acquisition difficulties, coverage blindness, and low investment efficiency. In order to solve this technical defect, a universal mobile communication system (Universal 1 Mobile Telecommunications System Access Point, UMTS AP) system is selected to improve wireless wide network coverage in areas such as homes and small office areas.

The UMTS AP system easily interfaces seamlessly with existing networks, including fixed and mobile networks, through an open, standard 3G core network interface. In the UMTS AP system, the AP mainly integrates the functions of the base station (NobeB) and the radio network controller (RNC); the AP access gateway (AP Gateway) mainly implements the control and management of the AP and The function of routing to other network elements. Usually, users only need to add one AP, connect the AP to the existing home broadband equipment (such as ADSL MODEM), and connect to the universal mobile communication system (UMTS) core network through the broadband access network or the public network (Inte met). AG, AG supports standard UMT S IuCS, IuPS and other interfaces. By connecting the core network with the existing Universal Mobility Telecommunications System (UMTS) network, the 3G UMTS access application can be realized.

In the UMTS AP system, the AP can realize convenient access of 3G UMTS through self-starting. Throughout the access process, the user only needs to power on the AP without additional intervention, and the configuration parameters required for the AP to start up and Configuration information such as configuration parameters required to initiate a service can be automatically configured to implement Plug and Play (P 1 ug and P lay ) functions. FIG. 1 is a system structural diagram of initial configuration information of an access point device in the prior art. As shown in Figure 1, after the AP is powered on, it initiates query access to a dedicated server or system terminal device (such as AP Home Regiver, AHR) deployed in the UMTS core network through a public network interface (such as the Ab interface). The request of the device initial configuration (AP BOOT) information; after receiving the request, the dedicated server or the system terminal device sends the initial configuration information of the AP to the AP; the AP receives the initial configuration information of the AP, completes the automatic configuration according to the initial configuration information of the AP, and initiates the normal configuration. Business process. In the process of implementing the present invention, the inventor has found that the prior art that the AP acquires the initial configuration information of the AP has at least the following defects:

1. Dedicated server or system terminal device with AP initial configuration information of AP is deployed in UMT

In the S core network, because the firewall (F i rewa ll ) provided at the front end of these devices has low security protection performance, the AP accesses the UMTS core network from the public network through the public network interface, making the dedicated server or system terminal device vulnerable to Attacks, sensitive core data is in danger of being stolen, which may cause disruption of system services.

2. There is no authentication or simple username and password authentication between the AP and the dedicated server or system terminal device. The dedicated server or system terminal device is vulnerable to attack or crack, which may cause illegal users to access the UMTS core network, resulting in network security. Hidden dangers.

3. The interaction information between the AP and the dedicated server or system terminal device is transmitted in plain text, and the information is easily stolen or tampered with.

Therefore, when the AP is fully configured and connected to the USTM network, the network security problem when the AP obtains the initial configuration information of the AP cannot be ignored. A more secure method for the AP to process the AP initial configuration information is urgently needed. Summary of the invention

The embodiments of the present invention provide a method, a device, and a system for delivering initial configuration information of an access point device, which are used to ensure the security of the initial configuration information of the access point device in the public network transmission, which is beneficial to the implementation. The technical effect of the safe and self-starting of the access point device.

The first aspect of the embodiments of the present invention provides a method for delivering initial configuration information of an access point device, including:

Receiving an initial configuration information acquisition request from an access point device through an encrypted channel;

Obtaining initial configuration information of the access point device including the home security gateway address information according to the obtaining request;

The access point device initial configuration information is sent to the access point device through the encrypted channel. In the method for transmitting the initial configuration information of the access point device in the first embodiment of the present invention, the PBOOT information acquisition request is initially transmitted through the encrypted channel, and the initial configuration information of the obtained access point device is performed through the encrypted channel. The risk of the initial configuration information of the access point device being stolen or falsified during the transmission process of the public network is reduced, and the security and reliability of the initial configuration information of the access point device are enhanced, and the corresponding access point device is received according to the The initial configuration information of the reliable access point device is automatically configured, which improves the security of the self-starting of the access point device.

A second aspect of the embodiments of the present invention provides a network system, including: an access point device, a security gateway, and an initial function server, where:

The access point device is configured to establish, by the security gateway corresponding to the preset security gateway address information, an encryption channel, and receive, by using the encrypted channel, initial configuration information of the corresponding access point device from the initial function server;

a security gateway, configured to establish an encrypted channel with the access point device;

An initial function server, configured to receive an initial configuration information acquisition request from the access point device, and obtain, according to the obtaining request, initial configuration information of the access point device including the home security gateway address information; and accessing the access through the encrypted channel The point device sends the initial configuration information of the access point device.

In the network system of the second aspect of the present invention, a security gateway is set in front of the initial function server, and the security gateway address information and the initial function server related to the initial configuration information storage path of the access point device are preset in the access point device. The address information is obtained by using an encryption channel between the existing access point device and the security gateway of the network architecture to obtain an initial configuration information acquisition request of the access point device and corresponding The transmission of the initial configuration information of the access point device reduces the risk that the initial configuration information of the access point device is stolen or falsified during the transmission process of the public network, and enhances the security and reliability of the initial configuration information of the access point device. The corresponding access point device automatically configures according to the received initial configuration information of the reliable access point device, thereby improving the security of the self-starting of the access point device; and, because the system utilizes the existing access of the existing network architecture The encrypted channel between the point device and the security gateway realizes the safe self-starting of the access point device, thereby reducing the cost and development amount of the entire network.

A third aspect of the embodiments of the present invention provides a network device, including:

a receiving module, configured to receive an initial configuration information acquisition request from an access point device by using an encrypted channel;

And an obtaining module, configured to acquire, according to the obtaining request, initial configuration information of the access point device including the home security gateway address information;

And a sending module, configured to send, by using the encrypted channel, the access point device initial configuration information to the access point device.

In the network device of the third aspect of the present invention, the receiving module transmits the initial configuration information acquisition request of the access point device through the encrypted channel, and the initial configuration information of the access point device acquired by the obtaining module is delivered by the sending module through the encrypted channel, Therefore, the risk that the initial configuration information of the access point device is stolen or falsified during the transmission process of the public network is reduced, and the security and reliability of the initial configuration information of the access point device are enhanced, and the corresponding access point device is reliable according to the received information. The initial configuration information of the access point device is automatically configured, which improves the security of the self-starting of the access point device.

A fourth aspect of the embodiments of the present invention provides an access point device, including:

a setting module, configured to preset security gateway address information and initial function server address information; and a requesting module, configured to establish an encryption channel with a security gateway corresponding to the preset security gateway address information, and use the encrypted channel to preset The initial function server corresponding to the initial function server address information sends an access point device configuration information acquisition request;

a startup module, configured to receive, by using the encrypted channel, initial configuration information of an access point device from the initial function server, and a home safety network included according to initial configuration information of the access point device The address information is closed, and the business process is initiated to the corresponding home security gateway.

In the access point device of the fourth aspect of the present invention, the security gateway address information and the initial function server address information are preset by the setting module, the encryption channel is established by the requesting module and the corresponding security gateway, and the access point device is initially transmitted through the encrypted channel. The configuration information acquisition request and the corresponding initial configuration information of the access point device are reduced, thereby reducing the risk that the initial configuration information of the access point device is stolen or falsified during the transmission process of the public network, and enhancing the security of the initial configuration information of the access point device. And reliability, the startup module automatically configures according to the received initial configuration information of the reliable access point device, thereby improving the security of the self-starting of the access point device. DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without paying any creative work.

1 is a system structural diagram of initial configuration information of an access point device in the prior art;

2 is a flowchart of a first embodiment of a method for transmitting initial configuration information of an access point device according to the present invention; FIG. 3a is a flowchart of a second embodiment of a method for transmitting initial configuration information of an access point device according to the present invention; The method for initiating the initial configuration information of the access point device is described in the second embodiment. FIG. 4 is a flowchart of the third embodiment of the method for the initial configuration information of the access point device according to the present invention; The method for the initial configuration information of the access point device is the third embodiment signaling diagram; FIG. 5 is a structural diagram of the first embodiment of the network system according to the present invention;

6 is a structural diagram of a second embodiment of a network system according to the present invention;

7 is a structural diagram of a third embodiment of a network system according to the present invention;

8 is a structural diagram of a fourth embodiment of a network system according to the present invention;

9 is a structural diagram of an embodiment of a network device according to the present invention;

FIG. 10 is a structural diagram of an embodiment of an access point device according to the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The embodiments of the present invention can be applied to a fixed network, a mobile network, and a mobile fixed mobile convergence network.

Mobile network types include: Global System for Mobile Communications (GSM), Wideband-Code Dimension Mul Tiple Access (WCDMA), Time Division Synchronous Code Division Multiple Access (Time) Division-Sync hronized Code Division Multiple Access (TD-SCDMA), Code Division Multiple Access (CDMA), WorldWide Interoperability for Microwave Access (WIMAX), Wireless LAN (Wireless Local Area Network, WLAN for short), Long Term Evo lution (LTE), etc.

The access point device in the embodiment of the present invention may be a base station, and the base station type includes: a GSM macro base station, a micro base station Pico, a UMTS AP, a WiMAX Femto base station, a WiMAX macro base station, and the like.

When the embodiment of the present invention is applied to a fixed network, the access point device may be a set top box, a router, a switch, a digital subscriber line access multiplexer (DSLAM), or the like.

The technical solutions of the embodiments of the present invention are further described in detail below with reference to the accompanying drawings and embodiments.

2 is a flowchart of a first embodiment of a method for delivering initial configuration information of an access point device according to the present invention. As shown in FIG. 2, this embodiment includes:

Step 21: Receive an initial configuration information acquisition request from an access point device (AP) through an encrypted channel. Step 22: Acquire initial configuration information of the access point device including the home security gateway address information according to the obtaining request.

Step 23: Send the initial configuration information of the access point device to the access point device by using the encrypted channel.

The method of the embodiment of the present invention can adjust the sequence of each step according to actual needs.

In this embodiment, the initial configuration (AP BOOT) information acquisition request of the access point device is transmitted through the encrypted channel, and the obtained initial AP configuration information is sent through the encrypted channel, thereby reducing the initial configuration information of the AP being stolen during the public network transmission process. The risk of tampering enhances the security and reliability of the initial configuration information of the AP. The corresponding access point device automatically configures according to the received initial configuration information of the AP, which improves the security of the self-starting of the access point device.

FIG. 3a is a flowchart of a second embodiment of a method for delivering initial configuration information of an access point device according to the present invention. FIG. 3b is a signaling diagram of a second embodiment of a method for delivering initial configuration information of an access point device according to the present invention. As shown in Figures 3a and 3b, this embodiment includes:

Step 31: Pre-set and store the IP address information of the security gateway (SeGW) and the IP address information of the initial function server (APB) in the AP; Step 32, AP and pre- The SeGW corresponding to the SeGW IP address information is used to establish an encryption channel. Step 33: The AP sends an AP initial configuration information acquisition request to the ABF corresponding to the preset ABF IP address information by using the encrypted channel established in step 12;

Step 34: The initial function server (ABF) queries and acquires the corresponding initial configuration information of the AP according to the AP identity identifier included in the initial configuration information acquisition request of the AP, and the AP initial configuration information. The information includes the home security gateway (Serv ing SeGW) IP address information; wherein, the AP identity identifier may specifically include the identity information (ID information) of the AP, the location information, the IP address information, or other information used to identify the identity of the AP;

Step 35: The ABF sends the obtained initial configuration information of the AP including the IP address information of the home security gateway to the AP through the encrypted channel established in step 12;

Step 36: The AP receives the AP initial configuration information and saves, and releases the encrypted channel established in step 12; Step 37: The AP establishes a new home encryption channel to the home security gateway corresponding to the home security gateway IP address information according to the home security gateway IP address information included in the AP initial configuration information, and initiates a normal service flow.

In step 32 of the embodiment, the encryption channel can be established by using multiple transmission encryption technologies, for example: Virtual Private Network (VPN) technology, including IPSec VPN, Secure Sockets Layer (Secure Sockets Layer) , referred to as SSL) VPN; Point to Point Tunnel Protocol (PPTP) technology; Layer 2 Forwarding (L2F) technology; Layer 2 Tunnel Protocol (2TP) Technology; Genera 1 Routing Enc apsulation (GRE) technology or other transport encryption technology. In summary, the establishment of the encrypted channel in the embodiment of the present invention may be implemented in various ways.

In this embodiment, the IP address information of the SeGW and the IP address information of the ABF are preset and stored in the AP, and an encryption channel is established between the AP and the SeGW, and the AP BOOT acquisition request is sent and the corresponding AP initial configuration is implemented through the encrypted channel. The information is delivered, which reduces the risk of the AP's initial configuration information being stolen or falsified during the transmission of the public network. The security and reliability of the initial configuration information of the AP are enhanced. The AP performs the reliable AP initial configuration information. Automatic configuration improves the security of the access point device. Since the AP initial configuration information acquisition request and the AP initial configuration information are transmitted in the public network through encryption, it is beneficial to protect sensitive information on the AHR. Security is also beneficial to ensure that other APs can obtain corresponding AP initial configuration information from the AHR, thus ensuring smooth operation of the service.

On the basis of the technical solution of the embodiment, if the IP address information of the home security gateway included in the AP initial configuration information sent to the AP is the same as the information of the SeGW IP address preset by the AP, the AP and the SeGW need not be released. The encrypted channel directly initiates a business process to the SeGW through the encrypted channel. In addition, on the basis of the technical solution of the embodiment, the AP initial configuration information sent by the ABF to the AP may include multiple home security gateway IP address information, and the AP may select one of the home security gateway IP address letters. As the current home security gateway, the corresponding home security gateway initiates a service flow to the current home security gateway. If the current home security gateway does not respond, the AP may select the corresponding home security gateway of the next home security gateway IP address information in the initial configuration information of the AP until a home security gateway responds. If the home security gateway corresponding to the home security gateway IP address information included in the AP initial configuration information does not respond, the AP may re-establish an encryption channel to the SeGW by using the technical solution in this embodiment to initiate an AP BOOT acquisition request. Therefore, on the basis of the technical solution of the embodiment, the manner in which the ABF distributes the initial configuration information of the AP is very flexible, and the AP addressing mode is also very flexible, and can adapt to the requirements of various AP self-starting modes.

FIG. 4a is a flowchart of a third embodiment of a method for delivering initial configuration information of an access point device according to the present invention. FIG. 4b is a signaling diagram of a third embodiment of a method for delivering initial configuration information of an access point device according to the present invention. In this embodiment, the public domain name server (Interne t DNS) is the first domain name server in the embodiment of the present invention; the universal mobile core network domain name server (UMTS DNS) is the second domain name server in the embodiment of the present invention. As shown in Figures 4a and 4b, this embodiment includes:

Step 41: Pre-set and store the address information of the SeGW full domain name (FQDN) and the FQDN address information of the ABF in the AP.

Step 42: The AP queries the public network domain name server for the SeGW IP address information corresponding to the preset SeGW FQDN address information.

Step 43: The AP establishes an encryption channel with the SeGW corresponding to the preset SeGW IP address information. When the encryption channel is established, the AP obtains the address information of the UMTS domain name server from the SeGW through the encrypted channel. Step 44: The AP is established in step 23. The encrypted channel, according to the UMTS domain name server address information, queries the corresponding UMTS domain name server for the corresponding ABF IP address information of the ABF FQDN address information; Step 45, the AP passes the encrypted channel established in step 23, and the preset ABF IP address The ABF corresponding to the information sends an AP initial configuration information acquisition request;

Step 46: The ABF obtains the AP initial configuration information according to the AP initial configuration information acquisition request, and queries the AHR for the corresponding AP initial configuration information, where the AP initial configuration information includes the home security gateway address information, where the AP identity identifier may specifically include the AP. Identity information (ID information), location information, IP Address information or other information used to identify the identity of the AP;

Step 47: The ABF sends the AP initial configuration information including the home security gateway address information to the AP by using the encrypted channel established in step 23;

Step 48: The AP receives the AP initial configuration information and saves, and releases the encrypted channel established in step 43. Step 49: The AP according to the home security gateway address information included in the AP initial configuration information, and corresponding to the home security gateway address information. The home security gateway establishes a new home encryption channel and initiates a normal business process.

The embodiment further considers that when the IP address information of the SeGW or the ABF is changed, if the original IP address information of the preset S eGW or the ABF in the AP is not updated in time, the AP obtains the initial configuration information of the AP and implements the self. The method of starting. In this case, the AP may not be able to establish the correct encryption channel due to the error of the SeGW IP address information, or the AP initial configuration information acquisition request sent by the AP contains the incorrect ABF IP address information, and it is difficult to obtain the corresponding AP initial configuration information. , causing the AP's self-starting to fail. In this embodiment, the FQDN address information of the SeGW and the FQDN address information of the ABF are preset by the AP, and the FQDN address information of the SeGW is obtained by using the Interne t DNS to obtain the IP address information of the corresponding SeGW, and the FQDN address information of the ABF is obtained through the UMTS DNS. The IP address information of the ABF, even if the IP address information of the S eGW or the IP address information of the ABF changes, the AP can obtain the IP address information of the changed SeGW or ABF through the FQ DN address information of the SeGW or the ABF to ensure that the AP can obtain the AP. Initial configuration information, which provides guarantee for the AP to successfully complete self-starting.

The implementation of the AP establishes an encrypted channel between the AP and the SeGW, and the AP B 00T acquisition request is sent through the encrypted channel, and the initial configuration information of the AP is delivered, thereby reducing the initial configuration information of the AP in the public network transmission process. The risk of being stolen or tampering enhances the security and reliability of the AP's initial configuration information. The AP automatically configures the received AP's initial configuration information to improve the security of the access point device. The configuration information acquisition request and the AP initial configuration information are transmitted in the public network through encryption. Therefore, it is beneficial to ensure the security of the sensitive information on the AHR, and also to ensure that other APs can obtain the corresponding AP initial configuration from the AHR. Information to ensure the smooth operation of the business. A second aspect of the present invention also provides a network system. FIG. 5 is a structural diagram of a first embodiment of a network system according to the present invention. The first embodiment of the network system includes: an access point device 10, a security gateway 20, and an initial function server 30.

The access point device 1 0 is configured to establish an encrypted channel with the security gateway corresponding to the preset security gateway address information, and receive the initial configuration information of the corresponding access point device from the initial function server through the encrypted channel.

The security gateway 20 is configured to establish an encrypted channel with the access point device 10.

The initial function server 30 is configured to receive an initial configuration information acquisition request from the access point device 10; obtain, according to the acquisition request, initial configuration information of the access point device including the home security gateway address information; and access to the access channel through the encrypted channel Point device 10 sends the initial configuration information of the access point device.

The various units of the system of the embodiments of the present invention may be integrated into one device or distributed among a plurality of devices. The above units may be combined into one unit, or may be further split into a plurality of subunits.

In this embodiment, the security gateway may be set in front of the initial function server, and the security gateway address information and the initial function server address information related to the initial configuration information storage path of the access point device are preset in the access point device, and the network architecture is used. The encryption channel between the access point device and the security gateway performs the initial configuration information acquisition request of the access point device and the corresponding initial configuration information of the access point device, thereby reducing the initial configuration information of the access point device in the public network. The risk of being stolen or tampered during transmission enhances the security and reliability of the initial configuration information of the access point device. The corresponding access point device automatically configures according to the received initial configuration information of the reliable access point device. The security of the access point device self-starting.

6 is a structural diagram of a second embodiment of a network system according to the present invention. The difference between this embodiment and the first embodiment of the network system of the present invention is that the embodiment further includes a home server 40, as shown in FIG. 6.

The home server 40 is configured to store the initial configuration information of the access point device.

Correspondingly, the initial function server 30 is further configured to acquire the initial configuration information of the access point device of the access point device 10 from the home server 40 according to the initial configuration information acquisition request from the access point device 10, The initial configuration information of the access point device is delivered through the encrypted channel.

On the basis of this technical solution, the access point device 10 may specifically include a setting module 101, a requesting module 102, and a starting module 103. The initial function server 30 may specifically include a receiving module 301, an obtaining module 302, and a sending module 303.

The setting module 1 01 is configured to set SeGW address information and ABF address information corresponding to the initial configuration information path of the storage access point device.

The requesting module 102 is configured to establish an encrypted channel by the SeGW corresponding to the SeGW address information preset by the setting module 101, and send the initial configuration information of the access point device by using the ABF corresponding to the ABF address information preset by the setting module 101. Get the request;

The startup module 103 is configured to receive the initial configuration information of the access point device that includes the home security gateway address information through the encrypted channel established by the requesting module 102, and initiate a service flow to the corresponding home security gateway according to the home security gateway address information.

The receiving module 301 is configured to receive an access point device initial configuration information acquisition request from the access point device 10 through an encrypted channel established between the security gateway 20 and the access point device 10.

The obtaining module 302 is configured to obtain, from the home server 40, the access point device initial configuration information including the home security gateway address information according to the obtaining request received by the receiving module 301.

The sending module 303 is configured to deliver, by using the encrypted channel, the initial configuration information of the access point device that includes the home security gateway address information acquired by the obtaining module 302.

The device configuration and deployment mode of the initial function server can be very flexible. The initial function server can be a stand-alone device or a functional integrated device. For example, you can deploy multiple networks on the entire network according to the actual networking requirements. The initial function server independent device guarantees the reliability and deployment flexibility of the initial function server; or, the initial function server and the authentication, authorization, and accounting server (Authent i ca ti oru Author i za t ion and Account ing Server ; 3A server) integration; or, because there are multiple AGs in the network, the AG and the initial function server functions can be integrated for flexible deployment of the network. In addition, a person skilled in the art can also select an appropriate initial function server device configuration and deployment mode according to the needs of the actual networking. Need to explain In this embodiment, the initial function server and the home server may be separately deployed for two independent devices, or the functions of the initial function server and the functions of the home server may be integrated into one device for centralized deployment.

In this embodiment, the security gateway address information and the initial function server address information related to the initial configuration information storage path of the access point device are preset in the access point device, and the existing access point device and the security gateway of the network architecture are utilized. The encryption channel between the access point device performs the initial configuration information acquisition request of the access point device and the corresponding initial configuration information of the access point device, thereby reducing the risk of the initial configuration information of the access point device being stolen or tampered with during the transmission process of the public network. The security and reliability of the initial configuration information of the access point device are enhanced, and the corresponding access point device automatically configures according to the received initial configuration information of the access point device, thereby improving the self-starting security of the access point device. Because the access point device initial configuration information acquisition request and the initial configuration information of the access point device are transmitted in the network through encryption, it is beneficial to ensure the security of sensitive information on the home server, and is also beneficial to protect other The AP can obtain the corresponding access point device initial from the home server. Set the information to ensure the smooth running of the service; in addition, because the system utilizes the encrypted channel between the existing access point device and the security gateway of the existing network architecture to realize the secure self-starting of the access point device, the overall operation is reduced. The cost and development of the network.

FIG. 7 is a structural diagram of a third embodiment of a network system according to the present invention. As shown in FIG. 7, the difference between the embodiment and the first embodiment of the network system of the present invention is that, in this embodiment, the setting module is specifically the first setting module 1011; the starting module 103 specifically includes the receiving unit 1 031 and the comparing unit 1032. And start unit 1 033.

The first setting module 1011 is configured to set the IP address information of the security gateway 20 and the IP address information of the initial function server 30.

The receiving unit 1031 is configured to receive the initial configuration information of the access point device that includes the home security gateway address information sent by the initial function server 30 by using the encrypted channel between the requesting module 102 and the security gateway 20;

The comparing unit 1032 is configured to compare the initial configuration information of the access point device received by the receiving unit 1 031. Whether the home security gateway address information is the same as the address information of the security gateway 20 preset by the first setting module 101, and if not, the encrypted channel between the request module 102 and the security gateway 20 is not released; if not, the release is released. An encrypted channel between the request module 102 and the security gateway 20.

The initiating unit 1033 is configured to initiate a service flow to the corresponding home security gateway according to the home security gateway address information included in the initial configuration information of the access point device received by the receiving unit 1 031. The initiating unit 1033 initiates a service flow. If the comparison unit 1032 has released the encrypted channel between the requesting module 102 and the security gateway 20, a new home encryption channel is established with the corresponding home security gateway, and the service flow is initiated through the home encryption channel. If the comparison unit 1 032 does not release the encrypted channel between the request module 102 and the security gateway 20, the business process is initiated through the encrypted channel.

The various units of the embodiments of the present invention may be integrated or may be deployed separately. The above units may be combined into one unit, or may be further split into a plurality of subunits.

In this embodiment, the IP address information of the security gateway related to the initial configuration information storage path of the access point device and the IP address information of the initial function server are preset in the first setting module of the access point device, and the request module and the security gateway are requested. An encryption channel is established, and the initial configuration information acquisition request of the access point device and the initial configuration information of the corresponding access point device are transmitted through the encrypted channel, thereby reducing the initial configuration information of the access point device being stolen during the transmission process of the public network. Or the risk of tampering, enhances the security and reliability of the initial configuration information of the access point device, and the corresponding access point device automatically configures according to the received initial configuration information of the reliable access point device, thereby improving the access point device. Self-starting security. After receiving the initial configuration information of the access point device, the receiving unit of the startup module compares the home security gateway address information and the preset security gateway IP address information in the initial configuration information of the corresponding access point device by the comparing unit. Whether it is consistent or not, if the agreement is the same, the original encrypted channel can be used to initiate the service process, so that the security self-starting process of the access device is faster.

FIG. 8 is a structural diagram of a fourth embodiment of a network system according to the present invention. As shown in FIG. 8, the difference between this embodiment and the first embodiment of the network system of the present invention is that, in this embodiment, the first domain name server 40 and the second domain name server 50 are further included; in the access point device 10, the setting module is Specifically, the second setting module 1 012; The requesting module 102 specifically includes a first query unit 1021, a channel establishing unit 1022, a second query unit 1023, and a requesting unit 1024.

The first domain name server 40 is configured to convert the full domain name address information of the security gateway 20 from the access point device 10 into the IP address information of the corresponding security gateway 20, and then deliver the information to the access point device 10.

The second domain name server 50 is configured to convert the global domain name information of the initial function server 30 from the access point device 10 into the IP address information of the corresponding initial function server 30, and then deliver the information to the access point device 10.

The second setting module 1012 is configured to set the full domain name address information of the security gateway 20 and the full domain name address information of the initial function server 30.

The first query unit 1021 is configured to query the first domain name server 40 for the IP address information of the security gateway 20 corresponding to the full domain name address information of the security gateway 20 preset by the second setting module 1012.

The channel establishing unit 1022 is configured to establish a power secret channel for the security gateway 20 corresponding to the IP address information of the security gateway 20.

The second query unit 1023 is configured to query the second domain name server 50 for the IP address information of the initial function server 30 corresponding to the full domain name address information of the initial function server 30 preset by the second setting module 1012.

The requesting unit 1024 is configured to transmit an access point device initial configuration information acquisition request to the initial function server 30 corresponding to the IP address information of the initial function server 30 through the encrypted channel established by the channel establishing unit 1022.

In this embodiment, the FQDN address information of the security gateway related to the initial configuration information storage path of the access point device and the FQDN address information of the initial function server are preset in the second setting module of the access point device, and are respectively turned to the first The DNS server and the second DNS server query the IP address information of the corresponding security gateway and the IP address information of the initial function server, establish an encryption channel between the requesting unit and the security gateway, and perform an initial configuration information acquisition request of the access point device through the encrypted channel. Corresponding access The transmission of the initial configuration information of the device is reduced, thereby reducing the risk of the initial configuration information of the access point device being stolen or falsified during the transmission process of the public network, and enhancing the security and reliability of the initial configuration information of the access point device, and correspondingly The in-point device performs automatic configuration according to the received initial configuration information of the access point device, which improves the security of the self-starting of the access point device. This embodiment is implemented by setting the security in the second setting module of the access device. The FQDN address information of the gateway and the FQDN address information of the initial function server, so that even if the IP address information of the security gateway or the IP address information of the initial function server changes, the AP can obtain the change through the FQDN address information of the security gateway or the initial function server. The IP address information of the security gateway or the initial function server ensures that the access point device can obtain the initial configuration information of the access point device, thereby providing guarantee for the AP to successfully complete the self-starting.

FIG. 9 is a structural diagram of an embodiment of a network device according to the present invention. As shown in FIG. 9, the network device of this embodiment may include a receiving module 301, an obtaining module 302, and a sending module 303. among them:

The receiving module 301 is configured to receive an initial configuration information acquisition request from the access point device through the encrypted channel.

The obtaining module 302 is configured to obtain, according to the obtaining request received by the receiving module 301, initial configuration information of the access point device including the home security gateway address information.

The sending module 303 is configured to send, by using the encrypted channel, the initial configuration information of the access point device that includes the home security gateway address information acquired by the obtaining module 302.

In this embodiment, the receiving module transmits the initial configuration information acquisition request of the access point device through the encrypted channel, and the initial configuration information of the access point device acquired by the obtaining module is sent by the sending module through the encrypted channel, thereby reducing the initiality of the access point device. The risk of the configuration information being stolen or tampered with during the transmission of the public network enhances the security and reliability of the initial configuration information of the access point device. The corresponding access point device according to the received initial configuration information of the reliable access point device. Automatic configuration improves the security of the self-starting of the access point device; since the initial configuration information acquisition request of the access point device and the initial configuration information of the access point device are transmitted in an encrypted manner in the public network, it is beneficial to Securing the sensitive information on the home server is also beneficial to ensure that other access point devices can obtain the initial configuration information of the corresponding access point device from the home server, thus ensuring smooth service. Run.

The type of the network device of this embodiment may be an initial function server, or a home server or the like. For the application of the embodiment in the refinement of the network architecture, refer to the text descriptions of the second to fourth embodiments of the network system of the present invention, and the description of FIG. 6-8, and details are not described herein again. The access point device of this embodiment may be a wireless access device, such as a base station or the like.

FIG. 10 is a structural diagram of an embodiment of an access point device according to the present invention. As shown in FIG. 10, the device for implementing the self-starting of the access point device in this embodiment includes a setting module 1 01, a requesting module 102, and a starting module 103.

The requesting module 102 is configured to establish an encrypted channel by the SeGW corresponding to the SeGW address information preset by the setting module 101, and the initial configuration of the ABF sending access point device corresponding to the ABF address information preset by the setting module 101 is performed through the encrypted channel. Information acquisition request.

The startup module 1 is configured to receive the initial configuration information of the access point device that includes the home security gateway address information by using the encrypted channel established by the requesting module 102, and initiate a service flow to the corresponding home security gateway according to the home security gateway address information.

In this embodiment, the security gateway address information and the initial function server address information corresponding to the initial configuration information storage path of the access point device are preset by the setting module, and the encryption channel is established by the requesting module and the corresponding security gateway, and the access point device is transmitted through the encrypted channel. The initial configuration information acquisition request and the corresponding initial configuration information of the access point device, thereby reducing the risk of the initial configuration information of the access point device being stolen or falsified during the transmission process of the public network, and enhancing the security of the initial configuration information of the access point device. Sexuality and reliability, the startup module automatically configures according to the received initial configuration information of the access point device, which improves the security of the self-starting of the access point device; the initial configuration information acquisition request and the access point of the access point device The initial configuration information of the device is transmitted in the public network through encryption. Therefore, it is beneficial to ensure the security of sensitive information on the home server, and it is also beneficial to protect other A. The P can obtain the initial configuration information of the corresponding access point device from the home server, thereby ensuring the smooth running of the service.

In the field of communications, especially in the field of wireless communications, this embodiment may be specifically an access point device. For the detailed structure of the functional modules of the present embodiment, reference may be made to the text descriptions of the second to fourth embodiments of the network system of the present invention, and the description of FIGS. 6-8, and details are not described herein again.

A person skilled in the art can understand that all or part of the steps of implementing the above method embodiments may be completed by using hardware related to program instructions, and the foregoing program may be stored in a computer readable storage medium, and the program is executed when executed. The steps of the foregoing method embodiments are included; and the foregoing storage medium includes: a medium that can store program codes, such as a ROM, a RAM, a magnetic disk, or an optical disk.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those skilled in the art that: The technical solutions described in the foregoing embodiments are modified, or the equivalents of the technical features are replaced by the equivalents of the technical solutions of the embodiments of the present invention.

Claims

Claim

A method for delivering initial configuration information of an access point device, the method comprising: receiving an initial configuration information acquisition request from an access point device by using an encrypted channel;

The access point device initial configuration information is sent to the access point device through the encrypted channel.

The method for the initial configuration information of the access point device according to claim 1, wherein the obtaining the initial configuration information of the access point device including the home security gateway address information comprises: the initial function server according to the request, Acquiring corresponding initial configuration information of the access point device from the home server storing the initial configuration information of the access point device.

The method for transmitting the initial configuration information of the access point device according to claim 2, wherein before the receiving the initial configuration information acquisition request of the access point device by using the encrypted channel, the method further includes:

The access point device presets the security gateway address information and the initial function server address information, and the security gateway corresponding to the preset security gateway address information establishes an encryption channel, and the preset initial function server address is preset through the encrypted channel. The corresponding initial function server of the information sends an access point device configuration information acquisition request.

The method for delivering initial configuration information of an access point device according to claim 3, wherein the address information comprises: IP address information.

The method for delivering initial configuration information of an access point device according to claim 3, wherein the address information comprises: full domain address information.

The method for the initial configuration information of the access point device according to claim 5, wherein before the security gateway corresponding to the preset security gateway address information establishes an encryption channel, the method further includes:

Converting the preset security gateway full domain name address information into initial security gateway IP address information.

The method for the initial configuration information of the access point device according to claim 6, wherein after the security gateway corresponding to the preset security gateway address information establishes an encryption channel, the method further includes:

Converting the preset initial function server full domain name address information into initial function server IP address information.

The method for the initial configuration of the access point device according to any one of the preceding claims, wherein after the initial configuration information of the access point device is delivered by the encrypted channel, the method further includes:

The encryption channel is released, and the access point device initiates a service flow to the home security gateway corresponding to the home security gateway address information.

The method for delivering the initial configuration information of the access point device according to claim 8, wherein before the initiating the service flow to the home security gateway, the method further includes:

Determining whether the received home security gateway address information is the same as the preset security gateway address information. If they are the same, the service channel is initiated to the home security gateway corresponding to the home security gateway address information by using the encrypted channel.

10. A network system, comprising: an access point device, a security gateway, and an initial function server, wherein:

The network system according to claim 10, further comprising:

a home server, configured to store initial configuration information of the access point device; The initial function server is further configured to acquire the initial configuration information of the access point device from the home server according to the obtaining request.

The network system according to claim 11, further comprising: a first domain name server, configured to convert the security gateway full domain name address information from the access point device into a corresponding security gateway IP address information And transmitting the converted security gateway IP address information to the access point device.

The network system according to claim 11, further comprising: a second domain name server, configured to convert initial function server full domain name address information from the access point device into a corresponding initial function server IP The address information is sent to the access point device by the converted initial function server IP address information.

14. A network device, comprising:

15. An access point device, comprising:

a startup module, configured to receive initial configuration information of the access point device from the initial function server by using the encrypted channel, and according to the home security gateway address information included in the initial configuration information of the access point device, to the corresponding home security gateway Initiate a business process.

The access point device according to claim 15, wherein the setting module is The first setting module is configured to set security gateway IP address information and initial function server IP address information.

The access point device according to claim 15, wherein the setting module is a second setting module, configured to set a security gateway full domain name address information and an initial function server full domain name address information.

The access point device according to claim 17, wherein the requesting module comprises:

a first query unit, configured to query a security gateway IP address information corresponding to the security gateway full domain name address information preset by the second setting module;

a channel establishing unit, configured to establish an encrypted channel with a security gateway corresponding to the security gateway IP address information;

a second query unit, configured to query an initial function server IP address information corresponding to the initial function server global domain name address information preset by the second setting module;

And a requesting unit, configured to send, by using the encrypted channel, an access point device initial configuration information acquisition request to an initial function server corresponding to the initial function server IP address information.

The access point device according to any one of claims 16-18, wherein the starting module comprises:

a receiving unit, configured to receive initial configuration information of the access point device including the home security gateway address information by using the encrypted channel;

a comparing unit, configured to release an encrypted channel established by the requesting module when the home security gateway address information is different from the preset security gateway address information;

And an initiating unit, configured to initiate a service process to the corresponding home security gateway according to the home security gateway address information included in the initial configuration information of the access point device.