WO2016062113A1

WO2016062113A1 - Wireless network access security detection method and terminal

Info

Publication number: WO2016062113A1
Application number: PCT/CN2015/082094
Authority: WO
Inventors: 方明勇
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-10-20
Filing date: 2015-06-23
Publication date: 2016-04-28
Also published as: CN105516074A

Abstract

A wireless network access security detection method and terminal, the method comprising: when a network terminal detects access by a wireless network client, recording related information of the accessing wireless network client, comparing the same to a secure client list, and when the related information of the wireless network client is not in the secure client list, marking the wireless network client as an insecure client; transmitting the related information of the wireless network client side to a management client; when client security information confirmed by the management client is received, updating the accessing wireless network client to be a secure client. The technical solution of the present invention can recognize an attack or an illegitimate access of a WLAN side at any time, thus minimizing security risk.

Description

Method and terminal for detecting wireless network access security

Technical field

This document relates to the technical field of detecting wireless network access security, and in particular to a method and terminal for detecting wireless network access security.

Background technique

At present, the operator access service is developing rapidly, the usage rate of the home terminal equipment is getting higher and higher, and the user group is also getting larger and larger. In addition, because of the large-scale application of wifi and smart phones, the home terminal or the router basically supports the wireless network. The function of access, but the security of the wireless network has always been a problem that needs to be paid attention to during the application process of the user. Because the key problem or some cracking technology causes the attack on the network and the WLAN side to occur, therefore, the wireless network Safety has become a prominent problem in use.

Summary of the invention

The main object of the present invention is to provide a method and terminal for detecting wireless network access security. It aims to solve the problem of illegal user access in wireless networks and improve the access security of wireless networks.

In order to solve the above technical problems, the following technical solutions are adopted:

A method for detecting wireless network access security includes:

When detecting the access of the wireless network client, the network terminal records the related information of the wireless network client that is accessed, and determines whether the related information of the wireless network client exists in the security client list, when the security client When the related information of the wireless network client does not exist in the list, the wireless network client is identified as a non-secure client;

Sending related information of the wireless network client to the management client;

When the client security information confirmed by the management client is received, the accessed wireless network client is updated to a secure client.

Optionally, after the step of identifying the wireless network client as a non-secure client, the method further includes: updating the accessed wireless network client to a locally maintained dangerous client. List

The step of updating the accessed wireless network client as a secure client when receiving the client security information confirmed by the management client includes: receiving client security confirmed by the management client When the information is received, the accessed wireless network client is updated to a locally maintained security client list, and the wireless network client confirming security is removed from the dangerous client list.

Optionally, the step of sending the related information of the wireless network client to the management client includes:

When detecting that the management client's MAC address is accessed to the network terminal, initiate a socket connection with the management client;

After the socket connection is successfully established, the related information of the wireless network client is encapsulated into alarm information and sent to the management client, where the management client is installed with an APP for confirming whether the client is secure.

Optionally, the alarm information is in a table field format; the alarm information includes: a MAC address, an access time, and/or an access duration of the wireless network client.

Optionally, the method further includes:

If the client security information confirmed by the management client is not received within the predetermined time, the alarm information is pushed again when the to-be-managed client re-accesses.

Optionally, before the step of the network terminal recording the information about the wireless network client that is accessed when the wireless network client access is detected, the method further includes:

The network terminal performs initial configuration, and the related information is configured on the network terminal, and the related information includes: information about the WAN connection, the SSID of the wireless network, the password configuration information, whether the security protection switch is enabled, and the management client. MAC address information of the access.

A terminal for detecting wireless network access security includes a detection module, an alarm module, and an update module, wherein:

The detecting module is configured to: when detecting the access of the wireless network client, record related information of the accessed wireless network client, and determine whether the wireless is present in the security client list. Corresponding information of the network client, when the information about the wireless network client does not exist in the security client list, identifying the wireless network client as a non-secure client;

The alarm module is configured to: send related information of the wireless network client to a management client;

The update module is configured to: when the client security information confirmed by the management client is received, update the accessed wireless network client as a secure client.

Optionally, the detecting module is further configured to: update the wireless network client confirmed as the non-secure client to the locally maintained dangerous client list;

The update module is further configured to: when receiving the client security information confirmed by the management client, update the accessed wireless network client to a locally maintained security client list, and from the danger The client list removes the wireless network client that confirms security.

Optionally, the alarm module is further configured to: initiate a socket connection with the management client when detecting that the management client's MAC address is accessed to the network terminal; after the socket connection is successfully established Encapsulating related information of the wireless network client as alarm information is sent to the management client, and the management client is installed with a function for confirming whether the client is a secure APP.

Optionally, the alarm module is further configured to: if the client security information confirmed by the management client is not received within a predetermined time, the alarm information is pushed again when the to-be-managed client re-accesses.

Optionally, the terminal further includes a configuration module, where:

The configuration module is configured to: perform initialization configuration on the terminal, and configure related information on the network terminal, where the related information includes: related information of the WAN connection, wireless network SSID, password configuration information, and whether the security is enabled. Protection switch, and management MAC address information for client access.

A computer program comprising program instructions that, when executed by a terminal, cause the terminal to perform any of the above methods of detecting wireless network access security.

A carrier carrying the computer program as described.

A method and a terminal for detecting wireless network access security according to an embodiment of the present invention, when detecting a wireless network client access, the network terminal records related information of the accessed wireless network client, and compares the security client. The end list, when the information about the wireless network client does not exist in the security client list, the wireless network client is identified as a non-secure client; the related information of the wireless network client is sent to the management client; When the client security information confirmed by the management client is received, the wireless network client that has been accessed is updated to be a secure client, so that the attack on the WLAN side and the illegal access can be grasped at any time, and the security risk is lowered. To the lowest.

BRIEF abstract

1 is a schematic flow chart of an embodiment of a method for detecting wireless network access security according to the present invention;

2 is a networking diagram of an application of a related art wireless network terminal device;

3 is a schematic diagram of a specific process of an embodiment of the present invention;

4 is a schematic flow chart of another embodiment of a method for detecting wireless network access security according to the present invention;

5 is a schematic diagram of functional modules of an embodiment of a terminal for detecting wireless network access security according to the present invention;

FIG. 6 is a schematic diagram of functional modules of another embodiment of a terminal for detecting wireless network access security according to the present invention.

Preferred embodiment of the invention

The solution of the embodiment of the present invention is mainly: when the network terminal detects that there is a wireless network client access, the related information of the accessed wireless network client is recorded, and the security client list is compared in the security client list. When the related information of the wireless network client does not exist, the wireless network client is identified as a non-secure client; the related information of the wireless network client is sent to the management client; when the management client is received, the confirmation is received. When the client security information is updated, the accessed wireless network client is updated to a secure client, so that the WLAN side attack and illegal access can be grasped at any time, and the security risk is minimized.

As shown in FIG. 1, an embodiment of the present invention provides a method for detecting wireless network access security, including:

Step S101: The network terminal records the related information of the accessed wireless network client when the wireless network client access is detected, and compares the security client list, when the wireless network client does not exist in the security client list. Identifying the wireless network client as a non-secure client when the related information is end;

The method operating environment of this embodiment relates to a wireless network, and particularly relates to a home wireless network terminal system, including a home gateway or a small router for home or enterprise, and the terminal system has a wifi wireless network.

At present, the application of home gateways and home routers and enterprise routers is very common, but the security problems of network terminal equipment are also becoming increasingly serious.

As shown in FIG. 2, FIG. 2 is a network diagram of an application of a related wireless network terminal device. For the wireless network terminal device, the WAN side and the LAN side are included, wherein the WAN side is used to access the carrier network, and the general WAN side can reduce the risk of security attacks by turning on the firewall. The LAN side is divided into wired (accessing the PC) and WLAN, and the attack on the LAN side mainly comes from the WLAN.

Although the WLAN wireless network can encrypt or set a relatively complicated wireless password, the encryption method is set to prevent unauthorized users from accessing. However, the cracking technology has been updated. If some illegal users crack the password and access the WALN network, with the current technology, users or administrators who are normally authorized to use it are not easy to find, only discover network congestion or other problems during use. When you are concerned, you will be concerned about whether there is a network or an attack.

In the solution of the embodiment, the attack identification or the network identification is completed through the system of the home gateway (or router) + APP with wifi, and the attack on the WLAN side and the illegal access can be grasped at any time, and the security risk is minimized.

Specifically, first, the network terminal (in the embodiment of the home network terminal), when initializing the configuration, sets related information of the router WAN connection, configuration information such as the SSID and password of the wireless network, and sets whether to open the security protection switch.

In addition, the MAC address information of the management client (administrator side) needs to be set on the home network terminal, and one or more management client MAC address information can be set.

After the security switch is turned on on the home network terminal, the home network terminal monitors whether it is real-time. There is wireless network client access.

When the wireless network client access is detected, the home network terminal records related information such as the MAC address, the access time, and/or the access duration of the accessed wireless network client.

Comparing the locally maintained security client list, when the information about the wireless network client does not exist in the security client list, the wireless network client is identified as a non-secure client.

In the specific implementation, the following scheme can be adopted:

When the home network terminal is powered on, or the SSID or password of the wireless wifi is re-modified, the process of device initialization is turned on.

After the home network terminal is initialized, three tables are generated and maintained, including:

1. Administrator information table;

2. A list of secure clients;

3. List of dangerous clients.

The above three tables may be empty or may contain one or more records.

The administrator information table and the security client list include fields that identify client information, such as a client MAC address.

The dangerous client list contains fields that identify client information, such as the client MAC address, as well as time information to access the device.

When a new wireless network client accesses the home network terminal device, the above three table information will be updated, wherein: the dangerous client list of the device is updated, and the MAC address of the current dangerous client access is recorded, and the access is recorded. Information such as time, the incoming wireless network client is updated as a dangerous client to the list of dangerous clients maintained locally.

The home network terminal device queries the dangerous client list. If the table record is empty, it means that there is no dangerous client access, and the process exits; if the table record is not empty, it indicates that there is dangerous client access, and the home network terminal device will The security administrator information table is detected, and the client MAC information of the security administrator is queried, so that when the security management client accesses the device, the related information of the dangerous client is sent to the security management client.

Step S102, sending related information of the wireless network client to the management client;

After detecting the security management client access device, the home network terminal sends related information such as the MAC address, the access time, and/or the access duration of the wireless network client to the management client as the alarm information.

Specifically adopt the following scheme:

When the security management client accesses the device, it sends an alert to the APP application of the security management client to the dangerous account. The alarm information includes the MAC information and access time of the dangerous client.

The home network terminal initiates a socket connection with the management client when detecting that the management client's MAC address is accessed to the home network terminal.

After the socket connection is successfully established, the home network terminal encapsulates the related information of the wireless network client into alarm information and sends the information to the management client, where the management client is installed with a corresponding APP.

The alarm information may be encapsulated into a format that facilitates interaction with the mobile phone client, and uses a table field format, which may include a client MAC address, an access time, an access time, and the like, as shown in Table 1 below:

Table 1

Step S103: When receiving the client security information confirmed by the management client, update the accessed wireless network client as a security client.

When receiving the client security information confirmed by the management client, the home network terminal updates the security client list, updates the accessed wireless network client to the locally maintained security client list, and moves from the dangerous client list. In addition to confirming the security of the wireless network client. Subsequently, when the management client takes corresponding measures, such as resetting the wifi password on the home network terminal, after the home network terminal is powered on or restarted again, the home network terminal will clear the dangerous client list, or the family. If the network terminal does not detect the dangerous client that was last accessed, the corresponding dangerous client is removed from the dangerous client list.

The specific process of the solution of this embodiment is described in detail below with reference to FIG. 3:

As shown in Figure 3, the implementation process on the home network terminal is as follows:

10. When the home network terminal is powered on, or the SSID or password of the wireless Wifi is repaired. When changing, start the process of device initialization;

11. After the terminal device is initialized, three tables are generated and maintained, including: administrator information table, security client list, and dangerous client list.

These three tables can be empty or contain one or more records.

The Dangerous Clients list contains fields that identify client information, such as client MAC addresses, as well as time information to access the device.

12. When a new wireless client accesses the home network terminal device, the above three table information will be updated, wherein: the dangerous client list of the device is updated, and the MAC address of the current dangerous client access is recorded, and the MAC address is accessed. Information such as time of entry;

13. The device queries the dangerous client record table. If the table record is empty, it means that there is no dangerous client access, and the process exits; if the table record is not empty, it indicates that there is dangerous client access, and the device will detect security management. Member information table, query the client MAC information of the security administrator.

14. When the security management client accesses the device, the alarm is sent to the APP application of the security management client, and the alarm information includes the MAC information and access time of the dangerous client.

15. The security detection module of the home network terminal, if the confirmation message of the dangerous client list fed back by the security client is not received within a certain period of time, the process proceeds to step 14, and the security administrator client re-accesses the device again. Push. If you receive confirmation of the list of dangerous clients that the security client is responding to, the process proceeds to step 11, updating the list of secure clients and clearing the identified dangerous clients.

16. The process ends.

In this embodiment, when the network terminal detects that there is a wireless network client access, the network terminal records related information of the accessed wireless network client, and identifies the non-secure client; and associates the wireless network client. The information transmission management client; when receiving the client security information confirmed by the management client, updating the accessed wireless network client as a security client, thereby grasping the attack and the illegality on the WLAN side at any time Access to minimize security risks.

As shown in FIG. 4, another embodiment of the present invention provides a method for detecting wireless network access security. According to the foregoing method embodiment, when the network terminal detects that there is a wireless network client access, the network access is recorded. The steps for information about the wireless network client also include:

Step S100: The network terminal performs initial configuration, and the related information is configured on the network terminal.

Compared with the foregoing embodiment, the embodiment further includes a solution for initial configuration of the network terminal.

First, the network terminal (in the embodiment of the home network terminal), when initializing the configuration, sets the router WAN connection related information and the wireless network SSID, password and other configuration information, and sets whether to open the security protection switch.

In this embodiment, the initial configuration of the network terminal is implemented by the foregoing solution.

As shown in FIG. 5, an embodiment of the present invention provides a terminal for detecting wireless network access security, including: a detection module 201, an alarm module 202, and an update module 203, where:

The detecting module 201 is configured to: when the wireless network client access is detected, record related information of the accessed wireless network client, compare the security client list, and the wireless client does not exist in the security client list. Identifying the wireless network client as a non-secure client when the network client has relevant information;

The alarm module 202 is configured to: send related information of the wireless network client to the management client;

The update module 203 is configured to: when receiving the client security information confirmed by the management client, update related information of the accessed wireless network client to a security client.

Specifically, the terminal in this embodiment includes, but is not limited to, a home gateway or a small router for home or business, and the terminal system has a wifi wireless network.

After the security protection switch is turned on on the home network terminal, the detection module 201 of the home network terminal monitors in real time whether there is a wireless network client access.

The detecting module 201 records related information such as the MAC address, the access time, and/or the access duration of the accessed wireless network client when the wireless network client access is detected. Comparing the security client list, when the information about the wireless network client does not exist in the security client list, the wireless network client is identified as a non-secure client.

In the specific implementation, the following scheme can be adopted:

1. Administrator information table;

2. A list of secure clients;

3. List of dangerous clients.

The above three tables may be empty or may contain one or more records.

After detecting the security management client access device, the alarm module 202 of the home network terminal sends related information such as the MAC address, the access time, and/or the access duration of the wireless network client to the management client as the alarm information.

Specifically adopt the following scheme:

After detecting the security management client accessing the device, the alarm module 202 pushes the alarm of the dangerous account to the APP application of the security management client, and the alarm information includes the MAC information and the access time of the dangerous client.

The alarm module 202 of the home network terminal initiates a socket connection with the management client when detecting that the management client's MAC address is accessed to the home network terminal.

After the socket connection is successfully established, the alarm module 202 of the home network terminal encapsulates the related information of the wireless network client into alarm information and sends the information to the management client, where the management client is installed with a corresponding APP.

The alarm information can be encapsulated in a table field format, including the client MAC address, access time, access time, and the like, as shown in Table 1 above:

When receiving the client security information confirmed by the management client, the update module 301 of the home network terminal updates the security client list, updates the accessed wireless network client to the locally maintained security client list, and is dangerous The client list removes the wireless network client that confirms security. Subsequently, when the management client takes corresponding measures, such as resetting the wifi password on the home network terminal, the home network terminal is restarted after the home network terminal is powered on or restarted. The dangerous client list will be emptied, or if the home network terminal does not detect the dangerous client that was last accessed, the corresponding dangerous client is removed from the dangerous client list.

It should be noted that the functions of the foregoing functional modules in this embodiment are not limited to being implemented by the foregoing three modules, for example, may be further divided into more or fewer modules, as the function of the foregoing update module 203 may be The detection module 201 is completed, which is not limited herein.

As shown in FIG. 6 , another embodiment of the present invention provides a terminal for detecting wireless network access security.

The configuration module 200 is configured to: perform initial configuration on the terminal, and configure related information on the network terminal, where the related information includes: information about the WAN connection, the SSID of the wireless network, and the password configuration information, whether the security is enabled. Protection switch, and management MAC address information for client access.

The embodiment of the invention also discloses a computer program, including program instructions, when the program instruction When executed by the terminal, the terminal can perform any of the above methods for detecting wireless network access security.

The embodiment of the invention also discloses a carrier carrying the computer program.

The method and the terminal for detecting the security of the wireless network access in the embodiment of the present invention, when the network terminal detects the access of the wireless network client, the network terminal records the related information of the accessed wireless network client, and identifies the non-secure client; Transmitting the related information of the wireless network client to the management client; when receiving the client security information confirmed by the management client, updating the accessed wireless network client as a secure client, thereby passing The home gateway (or router) + APP system with wifi can complete the attack identification or network identification, and can grasp the attack and illegal access on the WLAN side at any time, and minimize the security risk. For the administrator of the device or the user who is normally authorized, as long as the WALN wireless network is connected, it can immediately obtain whether there is an illegal user access or an illegal user access.

In addition, the real-time security detection system of the present invention can be applied to other devices with WALN, and can be applied to other devices with intrusion detection, and is not limited herein.

The above description is only a preferred embodiment of the present invention, and is not intended to limit the scope of the invention, and the equivalent structure or process changes made by the specification and the drawings of the present invention may be directly or indirectly applied to other related technical fields. The same is included in the scope of patent protection of the present invention.

Industrial applicability

The technical solution of the invention can grasp the attack and illegal access on the WLAN side at any time, and minimize the security risk. Therefore, the present invention has strong industrial applicability.

Claims

A method for detecting wireless network access security includes:

When detecting the access of the wireless network client, the network terminal records the related information of the wireless network client that is accessed, and determines whether the related information of the wireless network client exists in the security client list, when the security client When the related information of the wireless network client does not exist in the list, the wireless network client is identified as a non-secure client;

Sending related information of the wireless network client to the management client;

When the client security information confirmed by the management client is received, the accessed wireless network client is updated to a secure client.
The method of detecting wireless network access security according to claim 1, wherein

After the step of identifying the wireless network client as a non-secure client, the method further includes: updating the accessed wireless network client to a locally maintained dangerous client list;

The step of updating the accessed wireless network client as a secure client when receiving the client security information confirmed by the management client includes: receiving client security confirmed by the management client When the information is received, the accessed wireless network client is updated to a locally maintained security client list, and the wireless network client confirming security is removed from the dangerous client list.
The method for detecting wireless network access security according to claim 1, wherein the step of transmitting the related information of the wireless network client to the management client comprises:

When detecting that the management client's MAC address is accessed to the network terminal, initiate a socket connection with the management client;

After the socket connection is successfully established, the related information of the wireless network client is encapsulated into alarm information and sent to the management client, where the management client is installed with an APP for confirming whether the client is secure.
The method for detecting wireless network access security according to claim 3, wherein the alarm information is in a table field format; the alarm information includes: a MAC address, an access time, and/or an access of the wireless network client. duration.
The method for detecting wireless network access security according to claim 3, the method further comprising:

If the client security information confirmed by the management client is not received within the predetermined time, the alarm information is pushed again when the to-be-managed client re-accesses.
The method for detecting wireless network access security according to any one of claims 1 to 5, wherein the network terminal records the accessed wireless network client when it detects that there is wireless network client access Before the steps of related information, the method further includes:

The network terminal performs initial configuration, and the related information is configured on the network terminal, and the related information includes: information about the WAN connection, the SSID of the wireless network, the password configuration information, whether the security protection switch is enabled, and the management client. MAC address information of the access.
A terminal for detecting wireless network access security includes a detection module, an alarm module, and an update module, wherein:

The detecting module is configured to: when detecting the access of the wireless network client, record related information of the accessed wireless network client, and determine whether the information about the wireless network client exists in the security client list, when When the related information of the wireless network client does not exist in the security client list, the wireless network client is identified as a non-secure client;

The alarm module is configured to: send related information of the wireless network client to a management client;

The update module is configured to: when the client security information confirmed by the management client is received, update the accessed wireless network client as a secure client.
The terminal according to claim 7, wherein

The detecting module is further configured to: update the wireless network client that is confirmed to be a non-secure client to a list of dangerous clients that are locally maintained;

The update module is further configured to: when receiving the client security information confirmed by the management client, update the accessed wireless network client to a locally maintained security client list, and from the danger The client list removes the wireless network client that confirms security.
The terminal according to claim 7, wherein

The alarm module is further configured to: initiate a socket connection with the management client when detecting that the management client's MAC address is accessed to the network terminal; after the socket connection is successfully established, the The related information of the wireless network client is encapsulated as alarm information sent to the management client, and the management client is installed with a function for confirming whether the client is secure.
The terminal according to claim 9, wherein

The alarm module is further configured to: if the client security information confirmed by the management client is not received within a predetermined time, the alarm information is pushed again when the client to be managed re-accesses.
The terminal according to any one of claims 7 to 10, further comprising a configuration module, wherein:

The configuration module is configured to: perform initialization configuration on the terminal, and configure related information on the network terminal, where the related information includes: related information of the WAN connection, wireless network SSID, password configuration information, and whether the security is enabled. Protection switch, and management MAC address information for client access.
A computer program comprising program instructions that, when executed by a terminal, cause the terminal to perform the method of detecting wireless network access security as claimed in any one of claims 1-6.
A carrier carrying a computer program as claimed in claim 12.