WO2016131289A1

WO2016131289A1 - Method, device and user equipment for testing security of wireless hotspot

Info

Publication number: WO2016131289A1
Application number: PCT/CN2015/092218
Authority: WO
Inventors: 邵敏茹; 王伟
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-07-28
Filing date: 2015-10-19
Publication date: 2016-08-25
Also published as: CN106385683A

Abstract

Provided are a method, device and user equipment (UE) for testing security of a wireless hotspot. The method comprises: receiving a broadcast message of at least one wireless hotspot, wherein the broadcast message comprises security information of a first wireless hotspot; and according to the security information, determining the security of the first wireless hotspot. The present invention addresses the problem in the related art in which the security of the wireless hotspot cannot be tested, and realizes testing of the security of the wireless hotspot.

Description

Wireless hotspot security detection method, device and user equipment

Technical field

The present invention relates to the field of communications, and in particular to a wireless hotspot security detection method, apparatus, and user equipment.

Background technique

Currently, when using a mobile terminal to access the Internet, users often use Wireless-Fidelity (WIFI) for network connection. With the increasing popularity of WIFI, there are already a large number of public places that provide free WIFI for users to use, which greatly facilitates users' use. However, the security risks caused by this cannot be ignored. For example, some criminals are on the WIFI hotspot device, stealing the user's password, small text files (Cookies), and traffic by listening to all the plaintext traffic of the mobile terminal. Hijacking compromises the security of mobile devices that access the hotspot. Among them, the so-called traffic hijacking is the request sent by the user. When receiving the reply from the target website, the received content is inflowed or replaced by malicious hotspots, scripts, and then steals the user's website account authority.

For the user, when using WIFI for network connection, the WIFI hotspot is trusted by default, that is, the mobile terminal transparently transmits all network use requests to the hotspot through WIFI, and then sends requests and data to the Internet through the hotspot, which is highly likely in the data. The disclosure of private information during the transmission process poses a security risk.

In the existing technology, when a mobile terminal (also referred to as a client or a user equipment) accesses a WIFI hotspot, it is more likely to verify the validity of the client to prevent the illegal user from accessing the WIFI hotspot or the WIFI hotspot or It is protected by other clients of the Wireless Local Area Network (WLAN). However, the legality and security of WIFI hotspots have not been considered.

In view of the problem that the security of the wireless hotspot cannot be detected in the related art, an effective solution has not been proposed yet.

Summary of the invention

The invention provides a wireless hotspot security detection method, device and user equipment, so as to at least solve the problem that the security of the wireless hotspot cannot be detected in the related art.

According to an aspect of the present invention, a method for detecting a wireless hotspot security includes: receiving a broadcast message of at least one wireless hotspot, wherein the broadcast message includes: security information of a first wireless hotspot; Determining the security information to determine the security of the first wireless hotspot.

Optionally, determining, according to the security information, the security of the first wireless hotspot includes: determining, in the case that the security information indicates that the security of the first wireless hotspot is non-secure The security of a wireless hotspot is non-secure; and/or the security of the first wireless hotspot is determined to be secure if the security information indicates that the security of the first wireless hotspot is secure.

Optionally, after determining that the security of the first wireless hotspot is non-secure, the method further includes: When the user equipment is requested to access the first wireless hotspot, the operation of requesting the user equipment to access the first wireless hotspot is not performed; and/or the user equipment has been requested to access the first In the case of a wireless hotspot, the operation of terminating the access of the user equipment to the first wireless hotspot is terminated.

Optionally, after determining that the security of the first wireless hotspot is non-secure, the method further includes: initiating a hotspot broadcast of the user equipment, and broadcasting the broadcast message.

Optionally, after determining that the security of the first wireless hotspot is secure, the method further includes: accessing the user equipment to the first wireless hotspot.

Optionally, before or after the user equipment is accessed by the first wireless hotspot, the method further includes: sending a pre-association request to the first wireless hotspot, wherein the pre-association request is used for the request The identity information of the first wireless hotspot; the pre-association response of the first wireless hotspot in response to the pre-association request, wherein the pre-association response carries the identity information of the first wireless hotspot The identity information is used to determine a security level of the first wireless hotspot.

Optionally, sending the pre-association request to the first wireless hotspot further includes: starting a timer when sending the pre-association request; wherein, after sending the pre-association request to the first wireless hotspot The method further includes: determining whether the pre-association response is received after the timer expires; determining the first wireless if the timer expires and the pre-association response is not received The security level of the hotspot is a low security level.

Optionally, in a case that the security level of the first wireless hotspot accessed by the user equipment is the low security level, the method further includes: initiating a networking request in a process of the user equipment In the case, it is determined whether the security level of the first wireless hotspot is lower than a security level required by the process; if the security level is lower than a security level required by the process, through a cellular network pair The process is networked.

Optionally, after the user equipment is accessed by the first wireless hotspot, the method further includes: sending a security evaluation of the first wireless hotspot to a server.

According to another aspect of the present invention, a wireless hotspot security detecting apparatus is provided, including: a receiving module, configured to receive a broadcast message of at least one wireless hotspot, wherein the broadcast message includes: a first wireless hotspot The security information; the determining module is configured to determine the security of the first wireless hotspot according to the security information.

Optionally, the determining module is configured to: determine that the security of the first wireless hotspot is non-secure if the security information indicates that the security of the first wireless hotspot is non-secure; and Or determining that the security of the first wireless hotspot is secure if the security information indicates that the security of the first wireless hotspot is secure.

Optionally, the device further includes: a processing module, configured to: after determining that the security of the first wireless hotspot is non-secure: in a case that the user equipment is not requested to access the first wireless hotspot, And performing an operation of requesting the user equipment to access the first wireless hotspot; and/or, if the user equipment is requested to access the first wireless hotspot, terminate the execution request to access the user equipment The operation of the first wireless hotspot.

Optionally, the device further includes: a broadcast module, configured to determine that the security of the first wireless hotspot is non-security After all, the hotspot broadcast of the user equipment is started, and the broadcast message is broadcast.

Optionally, the device further includes: an access module, configured to: after determining that the security of the first wireless hotspot is secure, access the user equipment to the first wireless hotspot.

Optionally, the device further includes: a pre-association request sending module, configured to send a pre-association request to the first wireless hotspot before or after the user equipment is accessed by the first wireless hotspot, where The pre-association request is used to request identity information of the first wireless hotspot; the pre-association response receiving module is configured to receive a pre-association response of the first wireless hotspot in response to the pre-association request, where the pre- The association response carries the identity information of the first wireless hotspot, and the identity information is used to determine a security level of the first wireless hotspot.

Optionally, the pre-association request sending module is further configured to: when the pre-association request is sent, start a timer; wherein the device further includes: a pre-association response determining module, configured to send the pre-association After requesting to the first wireless hotspot, determining whether the pre-association response is received after the timer expires; the security level determining module is configured to time out the timer and not receive the pre-association response In case, the security level of the first wireless hotspot is determined to be a low security level.

Optionally, the device further includes: a security level determining module, configured to: the security level of the first wireless hotspot accessed by the user equipment is the low security level, and the process of the user equipment is initiated In the case of a networked request, determining whether the security level of the first wireless hotspot is lower than a security level required by the process; the networking module is configured to be lower than the security level required by the process In the case, the process is networked through a cellular network.

Optionally, the device further includes: a security evaluation sending module, configured to send a security evaluation of the first wireless hotspot to the server after the user equipment is accessed by the first wireless hotspot.

According to another aspect of the embodiments of the present invention, a user equipment is provided, including: the foregoing wireless hotspot security detecting apparatus.

The broadcast message of the at least one wireless hotspot is used in the embodiment of the present invention, where the broadcast message includes: security information of the first wireless hotspot; and the manner of determining the security of the first wireless hotspot according to the security information, and the related In the technology, the security of the wireless hotspot cannot be detected, and the security of the wireless hotspot is detected.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flowchart of a method for detecting a wireless hotspot security according to an embodiment of the present invention;

2 is a schematic structural diagram of a wireless hotspot security detecting apparatus according to an embodiment of the present invention;

3 is a flowchart of a method for a STA to securely access a WIFI hotspot according to an optional embodiment of the present invention;

4 is a schematic structural diagram of an early warning frame of a high-risk hot spot warning information according to an alternative embodiment of the present invention;

FIG. 5 is a schematic diagram of a frame structure of pre-association request information according to an optional embodiment of the present invention; FIG.

6 is a schematic diagram of a frame structure of pre-association response information according to an optional embodiment of the present invention;

7 is a flowchart of accessing the Internet when the security attribute of the target AP is an intermediate security according to an alternative embodiment of the present invention;

FIG. 8 is a schematic structural diagram of an apparatus for securely accessing a WIFI hotspot according to an alternative embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

It is to be understood that the terms "first", "second" and the like in the specification and claims of the present invention are used to distinguish similar objects, and are not necessarily used to describe a particular order or order.

In this embodiment, a wireless hotspot security detection method is provided. FIG. 1 is a flowchart of a wireless hotspot security detection method according to an embodiment of the present invention. As shown in FIG. 1 , the flow includes the following steps:

Step S102: Receive a broadcast message of the at least one wireless hotspot, where the broadcast message includes: security information of the first wireless hotspot;

Step S104: Determine security of the first wireless hotspot according to the security information.

Through the foregoing steps, the security information of the wireless hotspot can be obtained through the broadcast message of the at least one wireless hotspot, and the security of the first wireless hotspot is determined according to the security information, thereby solving the problem that the security of the wireless hotspot cannot be detected in the related art. , to achieve the detection of wireless hotspot security.

The wireless hotspots in the embodiments of the present invention include, but are not limited to, a WIFI-based wireless hotspot, a ZigBee based wireless hotspot, and a Bluetooth (BlueTooth) based wireless hotspot. Depending on the protocol based on the protocol, the hotspot identifier may have different names, but the essence is used as the wireless hotspot identification information, which is used to uniquely identify a wireless hotspot or provide the wireless hotspot in the network.

The foregoing security information indicates whether the security of the first wireless hotspot is a security level of the recommended access. For example, the security information may include two indications: a secure access indication, an unsecure access indication, or respectively: a secure wireless hotspot indication, a dangerous wireless hotspot indication. Certainly, the security information may also include security level grading information for the wireless hotspot. For example, the security level may be classified into three levels: a high security level, a low security level, and no security level, wherein high security may be adopted. The level, low security level is used as a secure access indication, and the security level of the layout security is regarded as an unsecure access level.

The wireless hotspot for broadcast message broadcast may be provided by a fixed hotspot providing device, or may be provided by other mobile terminals. For example, the current mobile terminals have the function of turning on the hotspot and setting up the wireless local area network, and the mobile hotspot function can open the wireless hotspot and broadcast the broadcast message.

The foregoing method can be applied to a user equipment. The user equipment referred to in the embodiment of the present invention includes a fixed or portable device with a wireless hotspot access function. Preferably, the embodiment of the present invention is applied to a portable user equipment, such as a mobile terminal such as a smart phone or a tablet computer. However, the application is also applicable to a fixed device such as a desktop personal computer having a wireless hotspot access function, which is not limited in the embodiment of the present invention. The user equipment is taken as an example for description and description in the embodiment of the present invention.

Optionally, in step S104, if the security information indicates that the security of the first wireless hotspot is non-secure, determining that the security of the first wireless hotspot is non-secure; and/or indicating that the security information is first When the security of the wireless hotspot is secure, it is determined that the security of the first wireless hotspot is safe.

Optionally, the foregoing step is applied to the access process of the wireless hotspot, and the wireless hotspot security may be detected before or after the authentication request is sent to the wireless hotspot, and before the access of the wireless hotspot is completed. If the security of the first wireless hotspot is determined to be non-secure, and the user equipment is not requested to access the first wireless hotspot, the operation of requesting to access the user equipment to the first wireless hotspot is not performed; optionally In the case that it is determined that the security of the first wireless hotspot is non-secure and the user equipment is requested to access the first wireless hotspot, the operation of requesting to access the user equipment to the first wireless hotspot may also be terminated.

At the same time, when the user operates the user equipment to request access to the first wireless hotspot, the user may display the alarm information of the first wireless hotspot to the user, and if the user confirms that the first wireless hotspot is no longer accessed according to the alarm information, the user equipment No access is requested to the first wireless hotspot. Preferably, the user equipment may also store the hotspot identifier and the security information of the first wireless hotspot locally, and establish a blacklist of the wireless hotspot, so that the next time the wireless hotspot is accessed, the wireless hotspot blacklist may be matched first. For the matching wireless hotspot, the access can be denied directly. In addition, after the user receives the alarm information, if the user still selects to access the first wireless hotspot, the user may finally confirm whether to access the first wireless hotspot according to the pre-configured security policy.

Optionally, after determining that the security of the first wireless hotspot is non-secure, the user equipment may also initiate a hotspot broadcast of the user equipment and broadcast a broadcast message. When the user equipment enables the hotspot to broadcast the broadcast message, it may be broadcast periodically or only once or several times. Preferably, the user equipment may also decide whether to broadcast and broadcast the period according to the status of the device. For example, in the case where the power of the user equipment is low, a longer periodic broadcast may be selected, or no broadcast may be performed.

Optionally, when the broadcast message is broadcast, only the security information of the wireless hotspot that the user equipment can detect may be broadcasted, and the wireless hotspot that is not detected by the user equipment may not broadcast the security information.

Optionally, after determining that the security of the first wireless hotspot is secure, the user equipment may be accessed to the first wireless hotspot if the wireless hotspot needs to be accessed according to the indication of the user.

Optionally, before or after the user equipment is connected to the first wireless hotspot, the user equipment may send a pre-association request to the first wireless hotspot through the cellular network or the first wireless hotspot, where the pre-association request is used to request the first Identity information for wireless hotspots; these identity information includes hotspot identifiers, as well as other information used to confirm the security of hotspots. For example, a wireless hotspot provider can apply for authentication from a server, and the authentic identity information of the wireless hotspot provider can be provided as a guarantee during authentication. After passing the authentication, the server will issue a certificate to the wireless hotspot provider, where the server can root The security level of the wireless hotspot provider is generated according to the credit rating of the wireless hotspot provider (such as bank credit rating, illegal violation record) or asset information, and the security level is recorded in the authentication certificate. After receiving the pre-association request, the wireless hotspot may respond to the user equipment, and receive a pre-association response of the first wireless hotspot in response to the pre-association request, where the pre-association response may carry the authentication certificate of the first wireless hotspot. Or other identity information, so that the user equipment can determine the security level of the first wireless hotspot according to the authentication certificate or the identity information.

Optionally, the user equipment may also start a timer when sending the pre-association request; after sending the pre-association request to the first wireless hotspot, the user equipment determines whether the pre-association response is received after the timer expires; In case of timeout and no pre-association response is received, it is determined that the security level of the first wireless hotspot is a low security level. At this time, the user equipment can also access the first wireless hotspot, but will protect the highly secure process.

Optionally, in a case that the security level of the first wireless hotspot accessed by the user equipment is a low security level, if the process of the user equipment initiates the networking request, the user equipment determines whether the security level of the first wireless hotspot is lower than The security level required by the process; in the case that the security level is lower than the security level required by the process, the user equipment can switch to the cellular network to network the process to implement information exchange between the process and the network through the cellular network. When switching to a cellular network, you can turn off the wireless hotspot and then enable the data transfer function of the cellular network. The cellular network includes, but is not limited to, a general packet radio service (General Packet Radio Service, GPRS for short), an enhanced data rate (GSM), and an enhanced data rate (Enhanced Date Rate for GSM Evolution, EDGE for short). High-Speed Packet Access (HSPA), High-Speed Packet Access Technology Evolution (HSPA+), fourth-generation mobile communication technology (4G) wireless data communication network, and subsequent evolution of wireless data communication networks .

Optionally, after the user equipment is connected to the first wireless hotspot, the user equipment may further send a security evaluation of the first wireless hotspot to the server. Among them, the security evaluation is input by the user to the user equipment. When the user inputs the security evaluation, it may be actively input, for example, when the user uses the first wireless hotspot or after using the first wireless hotspot, according to the usage experience and the security status of the user account, by calling the user equipment. A user interface that enters a security rating. The user input security evaluation may also be passive. For example, when the user equipment terminates the access of the first wireless hotspot, the user interface provides an interface for the user to input the security evaluation. The security evaluation may be a text comment or a security level description for the server.

For the server, the security level of the first wireless hotspot may be determined or updated according to the security evaluation; for example, when the server receives a predetermined number/predetermined proportion of the security rating of the unsecured level of the first wireless hotspot, The security level of a wireless hotspot is updated to be unsecure. As an auxiliary means, the server may also provide security information of the first wireless hotspot to the user equipment through the cellular network.

Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.

In the embodiment, a wireless hotspot security detection device is also provided, which is used to implement the above-mentioned embodiments and optional embodiments, and has not been described again. As used below, the term "module" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

2 is a structural block diagram of a wireless hotspot security detecting apparatus according to an embodiment of the present invention. As shown in FIG. 2, the apparatus includes: a receiving module 22 and a determining module 24, wherein the receiving module 22 is configured to receive at least one wireless hotspot. The broadcast message includes: the security information of the first wireless hotspot; the determining module 24 is connected to the receiving module 22, and is configured to determine the security of the first wireless hotspot according to the security information.

Optionally, the determining module 24 includes: a first determining unit, configured to determine that the security of the first wireless hotspot is non-secure if the security information indicates that the security of the first wireless hotspot is non-secure; and/or The second determining unit is configured to determine that the security of the first wireless hotspot is safe if the security information indicates that the security of the first wireless hotspot is secure.

Optionally, the device further includes: a processing module, configured to: after determining that the security of the first wireless hotspot is non-secure: if the user equipment is not requested to access the first wireless hotspot, the request is no longer performed. The operation of accessing the first wireless hotspot; and/or the operation of requesting the user equipment to access the first wireless hotspot if the user equipment has been requested to access the first wireless hotspot.

Optionally, the device further includes: a broadcast module, connected to the first determining unit, configured to start a hotspot broadcast of the user equipment, and broadcast a broadcast message.

Optionally, the device further includes: an access module, connected to the second determining unit, configured to access the user equipment to the first wireless hotspot.

Optionally, the device further includes: a pre-association request sending module, where the connection provided by the first wireless hotspot is connected to the first wireless hotspot, and is configured to send a pre-association request to the first wireless hotspot, where the pre-association request is used for the request a pre-association response receiving module, configured to receive a pre-association response of the first radio hotspot in response to the pre-association request, wherein the pre-association response is connected by the connection provided by the first wireless hotspot to the first wireless hotspot The identity information of the first wireless hotspot is carried in the identity information, and the identity information is used to determine the security level of the first wireless hotspot.

Optionally, the pre-association request sending module is further configured to: when the pre-association request is sent, start a timer; wherein the device further includes: a pre-association response determining module, connected to the pre-association request sending module, and configured to send the pre-association After requesting to the first wireless hotspot, determining whether a pre-association response is received after the timer expires; the security level determining module is connected to the pre-association response determining module, and when the timer expires and the pre-association response is not received, It is determined that the security level of the first wireless hotspot is a low security level.

Optionally, the device further includes: a security level determining module, configured to determine that the security level of the first wireless hotspot accessed by the user equipment is a low security level, and in the case that the process of the user equipment initiates the networking request, Whether the security level of the first wireless hotspot is lower than the security level required by the process; the networking module is connected with the security level determining module, and is set to perform the process through the cellular network when the security level is lower than the security level required by the process. networking.

Optionally, the device further includes: a security evaluation sending module, configured to send the security evaluation of the first wireless hotspot to the server after the user equipment accesses the first wireless hotspot.

It should be noted that each of the above modules may be implemented by software or hardware. For the latter, the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the modules are located in multiple In the processor.

The embodiment of the present invention further provides a user equipment, including the above-mentioned wireless hotspot security detecting apparatus, for implementing the above wireless hotspot security detecting method.

Embodiments of the present invention also provide a software for performing the technical solutions described in the foregoing embodiments and optional embodiments.

Embodiments of the present invention also provide a storage medium. In this embodiment, the above storage medium may be configured to store program code for performing the following steps:

S1. The broadcast message of the at least one wireless hotspot is received, where the broadcast message includes: a hotspot identifier, and security information of the first wireless hotspot with the hotspot identifier;

S2. Determine security of the first wireless hotspot according to the security information.

Optionally, in the embodiment, the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM). A variety of media that can store program code, such as a hard disk, a disk, or an optical disk.

For example, the specific examples in this embodiment may refer to the examples described in the foregoing embodiments and the optional embodiments, and details are not described herein again.

In order to make the description of the embodiments of the present invention more clear, the following description and description are made in conjunction with the exemplary embodiments.

In the related art, the security of the WIFI hotspot cannot be detected before the attack of the client by the illegal WIFI hotspot, and the illegal WIFI hotspot cannot be shared to other clients in time (in the optional embodiment of the present invention) Called Station (referred to as STA).

For the deficiencies of the WIFI hotspot, in the optional embodiment of the present invention, a method and a device for securely accessing a WIFI hotspot are provided. The method for securely accessing a WIFI hotspot includes the following steps:

Step 1. The client receives a broadcast message from a target WIFI hotspot (corresponding to the first wireless hotspot) and a broadcast message from other hotspots around;

Step 2: The client parses the broadcast message and extracts the high-risk hotspot warning information therein.

It should be noted that, in addition to this step, the client can also query the credit rating of the target hotspot through the cloud server as a supplement to the security diagnosis of the target access point (AP, ie, hotspot). source.

Step 3: The client performs the judgment according to the high-risk hotspot warning information queried in step 1, if the target WIFI is hot Point to a high-risk hot spot, go to step 4; otherwise, go to step 5.

Step 4: The client refuses to access the target WIFI hotspot, stops the authentication request, and starts the high-risk hotspot broadcast, and reports the high-risk hotspot to other nearby clients by sending the broadcast information.

Step 5: The client initiates an authentication request to the target WIFI hotspot;

Step 6: After receiving the authentication response from the target WIFI hotspot, the client initiates a pre-association request to the target WIFI hotspot, where the key information is requested from the target WIFI hotspot, wherein the key information refers to the WIFI hotspot device and the holder. Identity information, for example, the International Mobile Equipment Identity (IMEI) of the WIFI hotspot, the valid ID number of the holder, etc.;

Step 7. The client waits for a pre-association response from the target WIFI hotspot and starts a timer. If a valid pre-association response from the target WIFI hotspot is received before the timer expires, the process proceeds to step 8; otherwise, the process proceeds to step 9.

In step 8, the client receives a valid pre-association response from the target WIFI hotspot before the timer expires, and extracts key information in the authentication response information, and saves the information to the local database. According to this key information, the security attributes of the target WIFI hotspot are defined and uploaded to the cloud server.

Step 9: The client fails to receive a valid pre-association response from the target WIFI hotspot before the timer expires, and defines the target WIFI hotspot security attribute as intermediate security, and proceeds to step 10.

Step 10: The client defines a security level for an application that needs to be networked;

Step 11: When the client initiates the networking request, the process determines whether the process corresponding to the networking request belongs to a sensitive process; wherein the sensitive process refers to a process that requires high security performance.

Step 12: Determine the application of the step 11, when the client's networking request comes from the sensitive application, disconnect the target WIFI hotspot, and switch to the cellular mobile network, otherwise the application's networking request is transparently transmitted to the target WIFI hotspot. .

Step 13: When the client ends the connection with the target WIFI hotspot, the client prompts the user to evaluate the security of the connection through the display module.

In step 14, the client combines the security evaluation of the user in step 13, defines the credit level of the target WIFI hotspot, and uploads it to the cloud server.

It should be noted that the security evaluation of the target WIFI hotspot by the client may be initiated by the user actively, that is, when the user finds that the security of the target AP has been compromised during the connection to the target AP at a later time, the user may initiate the security. Upload the security of the target hotspot to update the previously uploaded security evaluation of the target AP.

Correspondingly, the embodiment of the present invention further provides a device for securely accessing a WIFI hotspot (hereinafter referred to as a client device), and the client device includes:

Transceiver module: set to send and receive messages with servers, WIFI hotspots or other clients.

Parsing module: Set to parse client messages from the server, WIFI hotspot or other for sending and receiving.

Control module: set to control the local process to access the network, according to the security level of the currently connected WIFI hotspot, control some sensitive processes to access the network through WIFI; or switch to the cellular mobile network to control the sensitive process to access the Internet through the cellular mobile network. Among them, the sensitive process refers to the process that requires high security performance.

Display module: set to display the security level of the WIFI hotspot to the user; set to collect the security information of the relevant WIFI hotspot to the user.

The foregoing solution provided by the optional embodiment of the present invention can intelligently select an optimal access and data transmission policy according to the security level of the WIFI hotspot to be accessed, effectively protect the privacy and security of the client user, and improve the product. safety.

The optional embodiments of the present invention are described and illustrated below with reference to the accompanying drawings.

3 is a schematic flow chart of a method for securely accessing a WIFI hotspot in an alternative embodiment of the present invention. As shown in FIG. 3, the method includes:

In step S3001, the STA receives a beacon frame (Beacon) message and a pre-alarm message sent by the hotspot around the local device to detect an AP that is available around the STA.

Step S3002: The STA parses the Beacon message received in step S3001 and the pre-alert message to extract the high-risk hot spot warning information therein, and determines whether the pointed AP is the target AP.

4 is an early warning frame structure of a high-risk hotspot warning information in an alternative embodiment of the present invention, as shown in FIG. 4, including:

Frame Control field: The Frame Control field of the standard frame is improved. As can be seen from the Type=00 of the field, the frame belongs to the management frame.

Standard definition of each field in the standard management frame:

The Frame Control field includes: protocol version (Protocol) bit, distributed system uplink (To DS) bit and distributed system downlink (From DS) bit, more Fragment bit, retry bit, Power Management bit, More Data bit, Protected Frame bit and Order bit; Duration/ID field, Address 1 field, Address 2 (Address2) Field, Address 3 field, Sequence Control field Address 4 (Address 4) field, Frame Check Sequence (FCS) field.

The definitions of the above fields are the same as the existing standards, and are not described here.

In an alternative embodiment of the present invention, a standard management frame is modified to enable broadcast of high-risk hotspot warning information. The modified management frame includes:

Sub Type field: The Sub Type field of the standard frame is modified to form a special frame of the embodiment, which is set as the connection information of the broadcast wireless AP itself, and the wireless AP that receives the radio frame can also perform the same. Analysis. Since the Sub Type values 0110 to 0111 and 1101 to 1111 of the management frame in the standard protocol are not defined, any one of them can be used here to distinguish it from other standard values. Optionally, this embodiment may assign a value of 0110 to the Sub Type, indicating that the The management frame is a high risk alert frame.

Frame body field: The frame body field is the data field of the frame. In this alternative embodiment, the identity of the high-risk AP, for example, Media Access Control (MAC) address, service set An Service Set Identifier (SSID) information is encapsulated in this field.

In step S3003, the STA queries the cloud server for the security credit rating of the target hotspot.

The security credit rating is data generated and uploaded to the server according to the STA that has been connected to the AP. Optionally, STA1 is used as an example. Once connected to the target AP and connected to the Internet through the AP, after the user completes the use, the user objectively evaluates the security of the target AP through STA1, and considers that the security credit rating of the target AP is some Level Security_Level_STA1, at the same time STA1 uploads this security credit rating to the cloud server. If the STA has previously uploaded the security credit rating of the target AP, the newly uploaded security credit rating overwrites the previous old security credit rating.

Optionally, the security credit rating may be set to 0, 1, 2, where 0 indicates that the security credit level of the target AP is low, 1 indicates that the security credit level of the target AP is medium, and 2 indicates the security credit rating of the target AP. High.

It should be noted that, in this step, when the STA queries the cloud server for the security credit level of the target AP, the STA extracts the MAC address in the standard Beacon frame, and uses the index as the index to request the cloud server to obtain the security credit rating of the device represented by the MAC.

In step S3004, the STA determines the security attribute of the target AP, and determines whether the target AP belongs to the high-risk AP. When the STA determines that the target AP does not belong to the high-risk AP, the process goes to step S3101, otherwise to step S3201.

It should be noted that, when determining the AP security attribute here, the input is the high-risk warning information in step S3002 and the security credit level in step S3003. That is, once the high-risk warning information is detected in step S3002 or the credit security level of the target AP is low in step S3003, the target AP is determined to be a high-risk AP, and the security is defined as low-level security.

Step S3101: The STA initiates an authentication request to the target AP.

Step S3102: The STA receives an authentication response message from the target AP.

In step S3103, the STA initiates a pre-association request to the target AP, and sets a timer.

The pre-association request means that the STA requests key information about the target AP from the target AP. The key information refers to the ability to effectively identify the target AP device or its holder. For example, the IMEI information of the AP device or valid document information in the traditional sense of the AP holder.

5 is a frame structure of pre-association request information in an alternative embodiment of the present invention, as shown in FIG. 5, including:

Frame Control field: Improves the Frame Control field of the standard frame. As can be seen from Type=00 of the field, this frame belongs to the management frame.

Standard definition of each field in the standard management frame:

The Frame Control field includes: Protocol bit, To DS and From DS bits, More Fragment bit, Retry bit, Power Management bit, More Data bit, Protected Frame bit and Order bit; Duration/ID field, Address1 field, Address2 field, Address3 Field, Sequence Control field Address4 field, FCS field.

The following is a field for modifying a standard management frame in an optional embodiment of the present invention, including:

Sub Type: The Sub Type field of the standard frame is modified to form a special frame of the optional embodiment, so that the STA sends a pre-association request to the AP.

Since the Sub Type values 0110 to 0111 and 1101 to 1111 of the management frame in the standard protocol are not defined, any one of them can be used here to distinguish it from other standard values. Optionally, in this alternative embodiment, the Sub Type is assigned a value of 0111, indicating that the management frame is a pre-association request frame.

In step S3104, the STA determines whether valid pre-association response information from the target AP is received before the Timer expires. If the STA does not receive the valid secondary response information from the target AP before the Timer expires, the process goes to step S3111, otherwise to step S3121. The valid pre-association response information means that the pre-association response information includes key information about the target AP.

FIG. 6 is a frame structure of pre-association response information according to an alternative embodiment of the present invention. As shown in FIG. 6, the method includes:

Standard definition of each field in the standard management frame:

Sub Type: The Sub Type field of the standard frame is modified to form a special frame of the alternative embodiment, which is set to the connection information of the broadcast wireless AP itself, and the wireless AP that receives the radio frame can also parse it;

Since the Sub Type values 0110 to 0111 and 1101 to 1111 of the management frame in the standard protocol are not defined, any one of them can be used here to distinguish it from other standard values. Optionally, the optional embodiment assigns a value of 0110 to the Sub Type, indicating that the management frame is a pre-association response frame.

Frame body field: The Frame body field is a data field of a frame. In this alternative embodiment, key information is encapsulated in this field. The key information refers to the ability to effectively identify the target AP device or its holder. For example, the IMEI of the AP device Information or valid document information in the traditional sense of the AP holder.

In step S3111, the STA defines the security attribute of the target AP as intermediate security.

In step S3112, the flow shown in FIG. 7 is turned.

In step S3121, the STA defines the security attribute of the target AP as advanced security; and uploads the security attribute to the cloud server.

Step S3122: The STA initiates a connection request to the target AP, and completes data transmission with the target AP according to the existing WIFI technical specification.

It should be noted that the data uploaded to the cloud server also includes the MAC address and IMEI information of the STA.

In step S3201, the STA refuses to access the target AP and stops initiating the authentication request. At the same time, the STA turns off its own WIFI and activates the local hotspot function.

In step S3202, the STA broadcasts the high-risk hotspot warning information through the Beacon frame. It should be noted that the broadcast high-risk hotspot information may be periodic.

FIG. 7 is a flowchart of a method for a STA to access an Internet through a target AP in a method for securely accessing a WIFI hotspot in an alternative embodiment of the present invention.

Step S701: When a process accesses the Internet through the STA, the STA determines the security sensitivity of the process, and determines whether the process belongs to the security-sensitive process.

The security-sensitive process refers to a service that belongs to an application that requires a higher security level, such as an application such as an email, or an application that is temporarily specified by the user. For example, if the user considers that an application has a high security level at a certain time, the application corresponds to A process is a security-sensitive process.

Step S702, when it is determined in step S701 that the process requesting the Internet access belongs to the security-sensitive process, the process goes to step S711, otherwise to step S721.

In step S711, the STA switches the mode of accessing the Internet from the WIFI mode to the cellular network mode, and after the process accesses the Internet, the STA is restored to the WIFI mode.

In step S721, the STA transparently transmits the process data requesting the Internet access to the target AP.

FIG. 8 is a schematic structural diagram of an apparatus for securely accessing a WIFI hotspot according to an alternative embodiment of the present invention. As shown in FIG. 8, the apparatus includes:

Parsing module 801: configured to parse client messages from servers, WIFI hotspots, or others for transmission and reception.

The control module 802 is configured to control the local process to access the network, and according to the security level of the currently connected WIFI hotspot, control some sensitive processes to access the network through the WIFI, switch to the cellular mobile network, and control the sensitive process to access the Internet through the cellular mobile network.

The display module 803 is configured to display a security level of the WIFI hotspot to the user, and is configured to collect security information about the related WIFI hotspot from the user.

The transceiver module 804 is configured to send and receive messages with a server, a WIFI hotspot or other clients.

In summary, the foregoing embodiment or the optional embodiment of the present invention can effectively detect the security attribute of the target WIFI hotspot that the client is about to access, and intelligently access the target hotspot according to the security attribute of the target AP. The WIFI hotspot accesses the Internet, and at the same time, for a WIFI hotspot with a low security level, it is possible to securely access the Internet for security-sensitive applications. In addition, when the client detects an unsafe WIFI hotspot, it can also share this information to other surrounding clients in time. The network security of the client is protected to a large extent, and the privacy of the user is protected.

Industrial Applicability: It can be seen from the above description that the security information of the wireless hotspot can be obtained by using the broadcast message of the at least one wireless hotspot, and the security of the first wireless hotspot is determined according to the security information, and the related technology cannot be detected. The security of wireless hotspots enables the detection of wireless hotspot security.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only an alternative embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

A wireless hotspot security detection method includes:

Receiving a broadcast message of the at least one wireless hotspot, where the broadcast message includes: security information of the first wireless hotspot;

Determining the security of the first wireless hotspot according to the security information.
The method of claim 1, wherein determining the security of the first wireless hotspot according to the security information comprises:

Determining that the security of the first wireless hotspot is non-secure if the security information indicates that the security of the first wireless hotspot is non-secure; and/or

And determining that the security of the first wireless hotspot is safe if the security information indicates that the security of the first wireless hotspot is secure.
The method of claim 2, wherein after determining that the security of the first wireless hotspot is non-secure, the method further comprises:

If the user equipment is not requested to access the first wireless hotspot, the operation of requesting the user equipment to access the first wireless hotspot is not performed; and/or

In the case that the user equipment is requested to access the first wireless hotspot, the operation of requesting the user equipment to access the first wireless hotspot is terminated.
The method of claim 2, wherein after determining that the security of the first wireless hotspot is non-secure, the method further comprises:

A hotspot broadcast of the user equipment is initiated and the broadcast message is broadcast.
The method according to any one of claims 2 to 4, wherein after determining that the security of the first wireless hotspot is secure, the method further comprises:

The user equipment is accessed to the first wireless hotspot.
The method of claim 5, wherein before or after the user equipment is connected to the first wireless hotspot, the method further comprises:

Sending a pre-association request to the first wireless hotspot, where the pre-association request is used to request identity information of the first wireless hotspot;

Receiving, by the first wireless hotspot, a pre-association response in response to the pre-association request, wherein the pre-association response carries the identity information of the first wireless hotspot, and the identity information is used to determine the The security level of the first wireless hotspot.
The method of claim 6 wherein

The sending the pre-association request to the first wireless hotspot further includes: starting a timer when sending the pre-association request;

After the sending the pre-association request to the first wireless hotspot, the method further includes: determining whether the pre-association response is received after the timer expires; when the timer expires and not When the pre-association response is received, determining that the security level of the first wireless hotspot is a low security level.
The method of claim 7, wherein, in a case that the security level of the first wireless hotspot accessed by the user equipment is the low security level, the method further comprises:

If the process of the user equipment initiates a network connection request, determining whether the security level of the first wireless hotspot is lower than a security level required by the process;

The process is networked over the cellular network if the security level is lower than the security level required by the process.
The method of claim 5, wherein after the user equipment is connected to the first wireless hotspot, the method further comprises:

Sending a security evaluation of the first wireless hotspot to the server.
A wireless hotspot security detecting device includes:

a receiving module, configured to receive a broadcast message of the at least one wireless hotspot, where the broadcast message includes: a hotspot identifier, and security information of the first wireless hotspot having the hotspot identifier;

And a determining module, configured to determine security of the first wireless hotspot according to the security information.
The apparatus of claim 10 wherein said determining module is configured to:

Determining that the security of the first wireless hotspot is non-secure if the security information indicates that the security of the first wireless hotspot is non-secure; and/or

And determining that the security of the first wireless hotspot is safe if the security information indicates that the security of the first wireless hotspot is secure.
The apparatus of claim 11 wherein said apparatus further comprises:

a processing module, configured to: after determining that the security of the first wireless hotspot is non-secure: if the user equipment is not requested to access the first wireless hotspot, the request is not performed to access the user equipment The operation of the first wireless hotspot; and/or the operation of requesting the user equipment to access the first wireless hotspot if the user equipment has been requested to access the first wireless hotspot.
The apparatus of claim 11 wherein said apparatus further comprises:

And a broadcast module, configured to: after determining that the security of the first wireless hotspot is non-secure, initiate a hotspot broadcast of the user equipment, and broadcast the broadcast message.
The device according to any one of claims 11 to 13, wherein the device further comprises:

The access module is configured to: after determining that the security of the first wireless hotspot is secure, access the user equipment to the first wireless hotspot.
The apparatus of claim 14 wherein said apparatus further comprises:

a pre-association request sending module, configured to send a pre-association request to the first wireless hotspot before or after the user equipment accesses the first wireless hotspot, wherein the pre-association request is used to request the Identity information of the first wireless hotspot;

a pre-association response receiving module, configured to receive a pre-association response of the first wireless hotspot in response to the pre-association request, where the pre-association response carries the identity information of the first wireless hotspot, The identity information is used to determine a security level of the first wireless hotspot.
The device according to claim 15, wherein

The pre-association request sending module is further configured to: when the pre-association request is sent, start a timer;

The device further includes: a pre-association response determining module, configured to determine whether the pre-association response is received after the timer expires after sending the pre-association request to the first wireless hotspot; The security level determining module is configured to determine that the security level of the first wireless hotspot is a low security level if the timer expires and the pre-association response is not received.
The apparatus of claim 16 wherein said apparatus further comprises:

a security level determining module, configured to determine that the security level of the first wireless hotspot accessed by the user equipment is the low security level and the process of the user equipment initiates a networking request Whether the security level of a wireless hotspot is lower than a security level required by the process;

A networking module is arranged to network the process over a cellular network if the security level is lower than a security level required by the process.
The apparatus of claim 14 wherein said apparatus further comprises:

The security evaluation sending module is configured to send the security evaluation of the first wireless hotspot to the server after the user equipment is accessed by the first wireless hotspot.
A user equipment comprising: the wireless hotspot security detecting apparatus according to any one of claims 10 to 18.