WO2017121159A1

WO2017121159A1 - Authentication method and system for accessing home gateway in wpa /wpa2 authentication mode

Info

Publication number: WO2017121159A1
Application number: PCT/CN2016/102804
Authority: WO
Inventors: 王志军; 李长春
Original assignee: 烽火通信科技股份有限公司
Priority date: 2016-01-14
Filing date: 2016-10-21
Publication date: 2017-07-20
Also published as: CN105554023A; CN105554023B

Abstract

The present invention relates to the field of home gateway access authentication, and discloses an authentication method and system for accessing a home gateway in a WPA /WPA2 authentication mode. The method comprises the following steps: S1: acquiring feature information of an access device that needs to access a home gateway, and storing the feature information in the home gateway; S2: after the access device that needs to access the home gateway is turned on, requesting the home gateway to perform access authentication; and S3: determining, by the home gateway, whether the feature information of the current access device is stored therein, if so, determining, by the home gateway, that authentication of the current access device succeeds, and otherwise, determining, by the home gateway, that authentication of the current access device fails, and performing again, by the home gateway and using WPA/WPA2 authentication, authentication on the current access device. The present invention can ensure network security while simplifying an authentication process when a device accesses a home gateway, so that an implementation process is simple and use costs are controlled, providing good extensibility of an authentication method for a home gateway.

Description

Home gateway authentication method and system for accessing WPA/WPA2 authentication mode

Technical field

The present invention relates to the field of home gateway access authentication, and in particular to a method and system for authenticating a home gateway that accesses the WPA/WPA2 authentication mode.

Background technique

The home gateway is a high-tech product brought to people by the information age. With the existing computer network technology, the home gateway can connect various home appliances and devices in the home and provide various services through the network. With the development of communication technology, home gateway products have been widely used in social families. Mobile phones, PADs, and intelligent OTTs (Over The Top, which provide various application services to users through the Internet) are all communication devices that people often use. These communication devices use wireless technologies such as WiFi to access the home gateway, thereby realizing the Internet. Features.

At present, the communication device needs to be authenticated when accessing the home gateway by wireless. The authentication method is generally WPA/WPA2 (Wi-Fi Protected Access), which requires an input access password. Complete WPA/WPA2 authentication to access the communication device to the home gateway. The authentication method can identify the identity of the accessor, and only allows legitimate persons to access the network, and the security is high.

However, when the above authentication method is used, there are the following disadvantages:

When the access device accesses the home gateway through the wireless network and authenticates, the access device needs to search for or enter the SSID (Service Set Identifier) of the home gateway, and then input the access password (for example, pop up the Web on the communication device). The page allows the user to enter a username and password, the set-top box device needs to enter a password via the remote control, etc.). The above certification The process is cumbersome and inconvenient for people to use.

Summary of the invention

The technical problem solved by the present invention is to simplify the authentication process when the device accesses the home gateway and ensure network security. The invention not only has a simple implementation process, but also controls the use cost, and provides a good expandability for the authentication method of the home gateway in the future.

To achieve the above objective, the present invention provides a method for authenticating a home gateway that accesses a WPA/WPA2 authentication mode, and the method includes the following steps:

S1: acquiring feature information of an access device that needs to access the home gateway, storing the feature information to the home gateway, and going to S2;

S2: After the access device that needs to access the home gateway is started, request the access authentication from the home gateway, and go to S3;

S3: The home gateway determines whether the feature information of the current access device is stored, and if yes, go to S4, otherwise go to S5;

S4: The home gateway authenticates the current access device successfully.

S5: The home gateway fails to authenticate the current access device, and the home gateway re-authenticates the current access device by using WPA/WPA2 authentication.

On the basis of the foregoing technical solution, the specific process of the S1 is: binding the mobile phone to the home gateway set with the WPA/WPA2 authentication mode, and obtaining the access device that needs to access the home gateway through the mobile phone.

On the basis of the foregoing technical solution, the method for obtaining the feature information of the access device of the access device by using the mobile phone is: scanning or photographing the two-dimensional code label of the access device by using the mobile phone, and acquiring the characteristics of the access device information.

Based on the above technical solution, the two-dimensional code label is dynamically generated by an existing method.

On the basis of the foregoing technical solution, the manner of obtaining the feature information of the access device accessing the home gateway by using the mobile phone is: manually inputting the feature information of the access device on the mobile phone.

On the basis of the foregoing technical solution, the manner of obtaining the feature information of the access device accessing the home gateway by using the mobile phone is: establishing a remote server storing the feature information of the access device that needs to access the home gateway, by using the mobile phone Obtain the feature information of the access device from the remote server.

On the basis of the foregoing technical solution, the specific process of the S2 is: after the access device is started, searching for the SSID of the home gateway, and requesting access authentication for the home gateway according to the SSID.

On the basis of the foregoing technical solution, when the home gateway in the S5 authenticates the current access device by using the WPA/WPA2 authentication mode, if the authentication succeeds, the current access device is accessed. If the authentication fails, the current access device is not accessed. Access device.

The present invention provides an authentication system for a home gateway that accesses a WPA/WPA2 authentication mode based on the above method, the system includes a feature information acquisition module, and a pre-authorization module and an authentication module disposed in the home gateway;

The feature information acquiring module is configured to: bind to a home gateway that is configured with a WPA/WPA2 authentication mode, acquire feature information of an access device that needs to access the home gateway, and send the feature information to the pre-authorization module;

The pre-authorization module is configured to: store feature information sent by the feature information acquiring module; and when receiving the feature information retrieval signal sent by the authentication module, retrieve corresponding feature information, and if the retrieval is successful, send a retrieval success signal to the authentication module, if If the retrieval fails, a retrieval failure signal is sent to the authentication module;

The authentication module is configured to: when the access device requests the access authentication from the home gateway, send the feature information retrieval signal to the pre-authorization module; when the retrieval success signal sent by the pre-authorization module is received, the current access device is authenticated and accessed. Current access device; received pre-authorization module When the search failure signal is sent, the current access device fails to be authenticated, and the current access device is re-authenticated through the WPA/WPA2 authentication mode.

Based on the foregoing technical solution, the feature information acquiring module is disposed in a mobile phone.

The advantages of the present invention over the prior art are:

(1) The present invention stores the feature information code of the access device to the home gateway (ie, pre-authorization) before the access device accesses the home gateway, and the home gateway device can identify the access according to the feature information code of the access device. Whether the device has been pre-authorized. For an access device that has completed the pre-authorization, the user gateway can be accessed without inputting a password or inputting any password. Compared with the authentication method in the prior art that requires an access password, the authentication process of the present invention is compared. Simple and easy for people to use.

At the same time, the present invention still needs to complete the password verification according to the traditional WPA/WPA2 authentication mode for the access device that has not completed the pre-authorization. After the password verification is passed, the Internet access right can be obtained, and the network security is ensured.

(2) The authentication method and system proposed by the present invention are mainly directed to an embedded device in which the input password is inconvenient, a smart home device, etc., by modifying the key negotiation process in the wireless access protocol flow of the device, having a small change, the implementation process It's simpler and controls the cost of use.

(3) The authentication method of the present invention can be applied not only to WiFi access but also to the home gateway to access various devices by other means, such as wired, Zigbee (low-power LAN protocol based on IEEE802.15.4 standard, That is, the purple bee protocol), Bluetooth, and the like. Therefore, the present invention is not only a supplement to the existing authentication method, but also provides a good expandability for the authentication method of the home gateway in the future.

DRAWINGS

FIG. 1 is a schematic diagram of a home gateway connected to a WPA/WPA2 authentication mode according to an embodiment of the present invention; Flow chart of the authentication method.

detailed description

The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

As shown in FIG. 1 , the authentication method of the home gateway that accesses the WPA/WPA2 authentication mode in the embodiment of the present invention is implemented by using a mobile phone, and the method specifically includes the following steps:

S1: Binding the mobile phone to the home gateway that is configured with the WPA/WPA2 authentication mode; pre-authorization: obtaining the feature information of the access device that needs to access the home gateway through the mobile phone (the access device is the set-top box in this embodiment), and the feature information It may be a MAC (Media Access Control, Media Layer) address or other information of the access device; store the feature information to the home gateway, and go to S2.

In an actual application, the manner in which the feature information of the access device accessing the home gateway is obtained by using the mobile phone in the S1 includes:

1. The two-dimensional code label (the two-dimensional code label can be dynamically generated by the existing method) of the access device is scanned or photographed by the mobile phone to obtain the feature information of the access device; the method is mainly for the wireless access device, for example, In the present embodiment, mode 1 is used for PAD, mobile phone, and the like.

2. Manually input the feature information of the access device on the mobile phone, and the method is mainly for the wired access device. Taking a PC (Personal Computer) as an example, the pre-authorization link can be added in the absence of any access authentication, and the MAC address of the PC is manually stored as a feature information on the mobile phone to the home gateway.

3. Establish a remote server that stores the feature information of the access device that needs to access the home gateway, and obtain the feature information of the access device from the remote server through the mobile phone, which is mainly used in some applications. For example, when the mobile phone cannot obtain the feature information in the foregoing manners 1 and 2, the mobile phone directly obtains the feature information of the access device from the remote server of the access device, so as to perform fast authorization and authentication.

S2: After the access device that needs to access the home gateway is started, request the access authentication from the home gateway, and go to S3.

The specific process of the S2 is: after the access device is started, searching for the SSID of the home gateway, and requesting access authentication for the home gateway according to the SSID.

S3: The home gateway determines whether the feature information of the current access device is stored, and if yes, go to S4, otherwise go to S5.

S4: The home gateway authenticates the current access device successfully, accesses the current access device, and the current access device works normally.

S5: The home gateway fails to authenticate the current access device, and the home gateway re-authenticates the current access device by using WPA/WPA2 authentication. If the authentication is successful, the home gateway accesses the current access device in the WPA/WPA2 authentication mode. If the authentication fails, the current access device is not accessed.

The working method of the authentication method of the home gateway in the WPA/WPA2 authentication mode in the embodiment of the present invention is as follows: before the access device accesses the home gateway, the mobile phone has stored the feature information of the access device to the home gateway (ie, Authorization). When the access device requests the access authentication from the home gateway, since the home gateway device sets the encrypted WPA/WPA2 authentication mode, the home gateway performs key agreement with the feature information of the access device, and the process is related to the existing WPA. The main difference between the encryption modes is that the access device uses its own feature information as the basis for key negotiation, thus completing the subsequent key negotiation process of WPA and establishing a secure encryption channel.

Since the home gateway has stored the feature information of the access device, the home gateway device can identify whether the access device has been pre-authorized according to the feature information of the access device:

If the home gateway stores the feature information of the (wired and wireless) access device, the access device has completed the pre-authorization. When the access device is authenticated, the home gateway does not need to verify the password input by the user (that is, the user can input any password. ), directly authenticate the access device, And grant access to the device's Internet access.

If the home gateway does not store the feature information of the access device, the access device does not complete the pre-authorization. For the authentication of the access device, the password verification is performed according to the WPA/WPA2 authentication mode. Get Internet access.

The authentication system of the home gateway that accesses the WPA/WPA2 authentication mode based on the above method in the embodiment of the present invention includes a feature information acquisition module installed in the mobile phone, and a pre-authorization module and an authentication module installed in the home gateway.

The feature information obtaining module is configured to: bind to the home gateway that is configured with the WPA/WPA2 authentication mode, obtain feature information of the access device that needs to access the home gateway, and send the feature information to the pre-authorization module.

The pre-authorization module is configured to: store the feature information sent by the feature information acquiring module; when receiving the feature information retrieval signal sent by the authentication module, retrieve the corresponding feature information, and if the retrieval is successful, send a retrieval success signal to the authentication module, if the retrieval fails , a search failure signal is sent to the authentication module.

The authentication module is configured to: when the access device requests the access authentication from the home gateway, send the feature information retrieval signal to the pre-authorization module; when the retrieval success signal sent by the pre-authorization module is received, the current access device is authenticated and accessed. If the current access device fails to receive the search failure signal sent by the pre-authorization module, the current access device fails to be authenticated, and the current access device is re-authenticated through the WPA/WPA2 authentication mode.

The present invention is not limited to the above embodiments, and those skilled in the art can also make several improvements and retouchings without departing from the principles of the present invention. These improvements and retouchings are also considered as protection of the present invention. Within the scope. The contents not described in detail in the present specification belong to the prior art well known to those skilled in the art.

Claims

A method for authenticating a home gateway accessing a WPA/WPA2 authentication mode, the method comprising the steps of:

S1: acquiring feature information of an access device that needs to access the home gateway, storing the feature information to the home gateway, and going to S2;

S2: After the access device that needs to access the home gateway is started, request the access authentication from the home gateway, and go to S3;

S3: The home gateway determines whether the feature information of the current access device is stored, and if yes, go to S4, otherwise go to S5;

S4: The home gateway authenticates the current access device successfully.

S5: The home gateway fails to authenticate the current access device, and the home gateway re-authenticates the current access device by using WPA/WPA2 authentication.
The authentication method of the home gateway accessing the WPA/WPA2 authentication mode according to claim 1, wherein the specific process of the S1 is: binding the mobile phone to the home gateway set with the WPA/WPA2 authentication mode, and obtaining the mobile phone through the mobile phone. An access device that needs to access the home gateway.
The authentication method of the home gateway accessing the WPA/WPA2 authentication mode according to claim 2, wherein the method for obtaining the feature information of the access device accessing the home gateway by using the mobile phone is: accessing through the mobile phone The QR code label of the device is scanned or photographed to obtain the feature information of the access device.
The method for authenticating a home gateway accessing the WPA/WPA2 authentication mode according to claim 3, wherein the two-dimensional code label is dynamically generated by an existing method.
The authentication method of the home gateway accessing the WPA/WPA2 authentication mode according to claim 2, wherein the method for obtaining the feature information of the access device accessing the home gateway by using the mobile phone is: manually inputting on the mobile phone Characteristic information of the access device.
The authentication method of the home gateway accessing the WPA/WPA2 authentication mode according to claim 2, wherein the method for obtaining the feature information of the access device accessing the home gateway by using the mobile phone is as follows: The remote server that enters the feature information of the access device of the home gateway obtains the feature information of the access device from the remote server by using the mobile phone.
The method for authenticating a home gateway that accesses the WPA/WPA2 authentication mode according to claim 1, wherein the specific process of S2 is: after the access device is started, searching for the SSID of the home gateway, and the home gateway according to the SSID Request access authentication.
The authentication method of the home gateway that accesses the WPA/WPA2 authentication mode according to claim 1, wherein when the home gateway is authenticated by the WPA/WPA2 authentication mode in the S5, if the authentication succeeds, The current access device is accessed. If the authentication fails, the current access device is not accessed.
An authentication system for a home gateway accessing a WPA/WPA2 authentication mode according to the method of any one of claims 1 to 8, characterized in that the system comprises a feature information acquisition module and a pre-authorization set in the home gateway Module and authentication module;

The feature information acquiring module is configured to: bind to a home gateway that is configured with a WPA/WPA2 authentication mode, acquire feature information of an access device that needs to access the home gateway, and send the feature information to the pre-authorization module;

The pre-authorization module is configured to: store feature information sent by the feature information acquiring module; and when receiving the feature information retrieval signal sent by the authentication module, retrieve corresponding feature information, and if the retrieval is successful, send a retrieval success signal to the authentication module, if If the retrieval fails, a retrieval failure signal is sent to the authentication module;

The authentication module is configured to: when the access device requests the access authentication from the home gateway, send the feature information retrieval signal to the pre-authorization module; when the retrieval success signal sent by the pre-authorization module is received, the current access device is authenticated and accessed. Current access device; received pre-authorization module When the search failure signal is sent, the current access device fails to be authenticated, and the current access device is re-authenticated through the WPA/WPA2 authentication mode.
The authentication system of the home gateway accessing the WPA/WPA2 authentication mode according to claim 9, wherein the feature information acquiring module is disposed in the mobile phone.