CN106685843B

CN106685843B - Method for safely strengthening router

Info

Publication number: CN106685843B
Application number: CN201710117754.9A
Authority: CN
Inventors: 赵彩
Original assignee: Xian Jiaotong University City College
Current assignee: Xian Jiaotong University City College
Priority date: 2017-03-01
Filing date: 2017-03-01
Publication date: 2020-06-02
Anticipated expiration: 2037-03-01
Also published as: CN106685843A

Abstract

A method for strengthening the router safely, set up WiFi to log on and verify in the end of the router, when the apparatus tries to access the router, trigger the verification, the host computer end obtains the apparatus information, judge whether the apparatus has already been listed in the blacklist, if yes, finish verifying, refuse to access; if not, entering the next step; the host side judges whether the equipment logs in the router before, if not, an alarm is triggered, and then the next verification is carried out; if yes, directly carrying out next verification; in the verification process, if the WiFi password passes once verification, an IP address is distributed by a DHCP of the router, whether a notification is triggered or not and in which manner the notification is determined according to user configuration information, and the notification content is an event that equipment logs in an intranet; if the WiFi password is not verified, a verification failure strategy is triggered, and access is refused, and the method and the device for the WiFi password authentication trigger reminding when a new client accesses WiFi by integrating related hardware and software for the router, so that a user can master the use condition of the router at any time.

Description

Method for safely strengthening router

Technical Field

The invention belongs to the technical field of wireless internet security application, relates to wireless terminal routing equipment, and particularly relates to a method for strengthening a router in security.

Background

In a real WiFi application scenario, if it is just a network-off, it is not enough to bring people's security into the attention in most cases, but if privacy disclosure is involved, security holes even further cause the loss of economic benefits, personal reputation and business secrets, and it is feared that it is too late. The wireless router is a terminal for a user to access the internet, and is also the weakest link in security and the link which is easy to cause problems. Here the safety issues are in two steps: firstly, a WiFi password is cracked (or leaked), and an opportunity is created for unauthorized local area network access; in the second step, the router itself is attacked, and thereafter, not only the security of the intranet of the lan supported by the router is flushed, but also the personal security of the user system (including but not limited to PC, mobile phone, etc.) is armed.

It is not new at all about the break of the WiFi password, which is just a matter of time why? The network of the wireless router is arranged in the following way:

WPS: for simplifying security setup and network management for wireless WiFi, it supports two modes: a Personal Identification Number (PIN) mode and a Push Button (PBC) mode. The PIN mode only has 11000 groups of passwords, and a large amount of cracking software on the network can crack the WiFi network encrypted in the mode by 100 percent; the PBC mode requires a client to be externally connected with a wireless network card and has a WPS button, and the WPS button is useless for internet access equipment, mobile phones, tablets and the like comprising a built-in network card, such as a PC (personal computer), a notebook and the like, and is almost useless in reality.

WPA-PSK (TKIP), WPA2-PSK (AES), WPA-PSK (TKIP) + WPA2-PSK (AES): WPA2 is the most used and highest encryption mode in wireless routing today. After grasping the 'handshake packet' with data, the common packet can run the password by itself, the diamond treasure can be handed to black products for running, the GPU speed of the diamond treasure is hundreds of times higher than that of the common equipment, and social library resources are added, application teammates such as WiFi universal keys (which can automatically upload and share hot-spot WiFi passwords) and the like are installed for assisting in attacking, and even if the WiFi passwords in the WPA2 mode are cracked, the probability event is also realized;

the Mac address is bound by the white name and the dhcp is closed, so that the problems are not solved, and all the problems are solved by corresponding means and determined by technical strength. So "defense is only one step and security is one system".

Once the WiFi password is broken, the second step mentioned above-router security is switched from two wires to one wire. The router is not protected by the https protocol, can be intercepted by monitoring and packet capturing, can be attacked by intranet running passwords, and is more difficult to protect.

Disclosure of Invention

In order to overcome the disadvantages of the prior art, the present invention provides a method for enhancing security of a router, which converts the concept without technically performing a positive countermeasure against an intruder, so that a general user can also improve the security of the router.

In order to achieve the purpose, the invention adopts the technical scheme that:

a method for strengthening a router safely sets WiFi login verification at a router end, and comprises the following steps:

step 1, when the equipment tries to access the router, the verification is triggered, the host acquires the equipment information, whether the equipment is listed in a blacklist or not is judged, if so, the verification is finished, and the access is refused; if not, entering the next step;

step 2, the host end judges whether the equipment logs in the router before, if not, the alarm is triggered, and then the next step of verification is carried out; if yes, directly carrying out next verification;

step 3, in the verification process, if the WiFi password passes verification once, an IP address is distributed by a router DHCP, whether a notification is triggered or not and in which mode the notification is carried out are determined according to user configuration information, and the notification content is an event that equipment logs in an intranet; and if the WiFi password is not verified, triggering a verification failure strategy and refusing access.

The router always keeps a monitoring state, and when the equipment leaves, whether a notification event is triggered or not is determined according to the read user configuration information, and the notification content is the event that the equipment leaves the intranet.

The host end is a device with a similar wireless/wired network access function, and includes but is not limited to a mobile, wireless, wired, router, power line modem, power line adapter, wireless extender, wireless AP, wireless controller, wireless remote controller, wireless VPN router, wired/wireless monitoring/storage/remote control (including but not limited to webcam/remote security device), and the like.

The authentication failure policy is: when the first verification of the WiFi login of the equipment fails, marking the last verification state of the equipment as failure, starting timing and counting, directly refusing verification according to the read user configuration information if the login verification request of the same equipment is received again, automatically adding the equipment to a blacklist, discarding the verification request sent by the client equipment in the blacklist equipment list later, and not verifying; or starting a delay verification strategy, wherein the nth time of allowed verification time is the delay time of the (n-1) th allowed verification time, a new delay time is obtained through calculation, and the nth time of verification request is accepted only after the new delay time is expired; or controlling according to the total number of allowed verification times set by the user, and after the verification failure times reach a set value, not receiving the WiFi login verification request of the equipment any more, and automatically adding the equipment into the blacklist list; or a combination of a delay strategy and a counting strategy.

At the same time, a manual confirmation button can be arranged on the router, and repeated verification which is immediately effective is directly allowed when the router is manually and physically confirmed by a user. The user can also manage the blacklist through a manual maintenance mode.

And when the notification event is triggered, respectively configuring different types of trigger notifications according to the host event type of the trigger event, and performing according to the read user configuration setting.

The execution of the notification event is performed asynchronously.

The notification is in the form of one or more of sound, light, screen display message, mobile phone message push notification, bracelet/smart watch reminding, short message, mail and voice incoming call notification.

Compared with the prior art, the invention can provide automatic processing and notification according to the user predefined mode when a new client device which is never accessed successfully accesses the WiFi or an event which does not pass the verification strategy appears by bringing in the monitoring mode to finish the safety management of the router, so that a user can master the use condition of the router at any time if the user wants to, the unauthorized invasion can be hidden everywhere and can not be hidden, and the router and the intranet are safe, and the application safety of the user is damaged, refusing to go outside the first gate. The same strategy is valid for wireless mobile routers or for routers with wired access.

Drawings

Fig. 1 is a general flowchart of a router security enforcement method.

Fig. 2 is a WiFi login authentication failure policy flow diagram.

Fig. 3 is a notification [ alarm ] function completed according to user configuration after integrating function modules.

Detailed Description

The embodiments of the present invention will be described in detail below with reference to the drawings and examples.

As shown in fig. 1 above, when a new WiFi login authentication request arrives, the router determines from the MAC address of the client device whether the device is on the black list listed on the router? If so, discarding the authentication request; if not, continuously judging whether the router is logged in before, if not, triggering and informing an alarm event (the legend 1: the explanation of figure 3, the same below) for the new client to log in the network for the first time; if the client which has logged in before logs in again, the event of triggering the notification [ alarm ] is saved, and the authentication processing process is directly started.

If the WiFi password passes once verification, an IP address can be allocated by a DHCP of the router (under the condition of dynamically allocating IP), whether to notify the [ alarm ] and the mode to notify the [ alarm ] to the user that the client successfully logs in the intranet is determined according to the configuration information of the user, the router keeps a monitoring state, and when the client leaves the intranet or other events occur, whether to trigger the notification of the [ alarm ] event is determined according to the read configuration of the user; if the WiFi password is not verified, triggering a verification failure strategy, which is explained by referring to FIG. 2;

WiFi login authentication failure policy:

as shown in fig. 2, after the client device fails to log in the WiFi for the first time, the last verification status of the client device is marked as failure, and timing and counting are started, if a login verification request of the same client device is received again, according to the read user configuration setting, verification can be directly refused, information such as the MAC address of the client device is automatically added to the blacklist, and the verification request sent by the client device in the blacklist device list is discarded later without verification; or starting a delay verification strategy, wherein the nth time allowed verification time is the delay time of the nth-1 time allowed verification, a new delay time is obtained through an algorithm, and the nth time verification request is accepted only after the new delay time is expired; or controlling according to the total number of allowed verification set by the user, for example, after the verification failure number reaches n, the WiFi login verification request of the client equipment is not accepted any more, and the information such as the MAC address of the client equipment is automatically added into the blacklist; or the combination of the delay strategy and the counting strategy is set by the user;

or when the verification fails each time, a notification [ alarm ] event is triggered, and when the router is designed and manufactured, a manual confirmation button is added, so that the repeated verification which is effective immediately is directly allowed when the user manually and physically confirms.

The policy setting when the WiFi login authentication fails, including but not limited to the above-mentioned ones, may also be used in combination, the device blacklist may be added automatically by the device, and the user may also maintain manually, when the authentication passes again, the next operation returns to the next step of the main process of the WiFi login authentication.

A notification [ alarm ] module:

as shown in fig. 3, when the notification [ alarm ] event is triggered, different types of triggered notifications [ alarm ] may be configured according to the host event type of the trigger event, and this is performed according to the read user configuration setting. The execution of the notification alarm event is asynchronous, so that the response and the performance of the router are not influenced by the interference of other factors. Integrated and expanded modules and functionality that can be used to notify [ alerts ], including but not limited to the following forms: voice-to-voice broadcast, color and flashing frequency of light-to-breath lights, screen display messages (the first three are applicable to mobile wireless routers), mobile message push notifications, bracelet/smart watch reminders, text messages, mail, voice incoming call notifications, etc. The various types of notifications (alarms) can be used in combination with multiple options, so that the user can master any transaction of the WiFi network in the home even if the user is out of thousands of miles.

In conclusion, the method and the device are convenient and easy to implement, are suitable for various scenes, avoid the complexity of white list setting, and facilitate users to timely identify and monitor the use condition of the current network.

Claims

1. A method for strengthening a router safely is characterized by setting WiFi login verification at a router end and comprising the following steps:

step 1, when the equipment tries to access the router, the verification is triggered, the host acquires the equipment information, whether the equipment is listed in a blacklist or not is judged, if so, the verification is finished, and the access is refused; if not, entering the next step; the router always keeps a monitoring state, and when equipment leaves, whether a notification event is triggered or not is determined according to the read user configuration information, and the notification content is the event that the equipment leaves the intranet;

step 3, in the verification process, if the WiFi password passes verification once, an IP address is distributed by a router DHCP, whether a notification is triggered or not and in which mode the notification is carried out are determined according to user configuration information, and the notification content is an event that equipment logs in an intranet; if the WiFi password is not verified, triggering a verification failure strategy and refusing access; the authentication failure policy is: when the first verification of the WiFi login of the equipment fails, marking the last verification state of the equipment as failure, starting timing and counting, directly refusing verification according to the read user configuration information if the login verification request of the same equipment is received again, automatically adding the equipment to a blacklist, discarding the verification request sent by the client equipment in the blacklist equipment list later, and not verifying; or starting a delay verification strategy, wherein the nth time of allowed verification time is the delay time of the (n-1) th allowed verification time, a new delay time is obtained through calculation, and the nth time of verification request is accepted only after the new delay time is expired; or controlling according to the total number of allowed verification times set by the user, and after the verification failure times reach a set value, not receiving the WiFi login verification request of the equipment any more, and automatically adding the equipment into the blacklist list; or the delay strategy is combined with the counting strategy;

when the verification fails, a notification event is triggered, different types of trigger notifications are respectively configured according to the host event types of the trigger events when the notification event is triggered, the notification is performed according to the read user configuration settings, and the execution of the notification event is performed asynchronously.

2. The method of claim 1, wherein the host is a device with wireless/wired network access function.

3. A method for security enhancing a router according to claim 1, wherein a manual confirmation button is provided on the router to directly allow for repeated authentication to be effected immediately upon manual physical confirmation by a user.

4. The method of claim 1, wherein the user manages the blacklist by manual maintenance.

5. A method for security enhancing router according to claim 1, wherein the notification is in the form of one or more of sound, light, on screen message, mobile phone message push notification, bracelet/smart watch alert, short message, email, voice incoming call notification.