CN1444386A - Safe inserting method of wide-band wireless IP system mobile terminal - Google Patents

Safe inserting method of wide-band wireless IP system mobile terminal Download PDF

Info

Publication number
CN1444386A
CN1444386A CN 01145395 CN01145395A CN1444386A CN 1444386 A CN1444386 A CN 1444386A CN 01145395 CN01145395 CN 01145395 CN 01145395 A CN01145395 A CN 01145395A CN 1444386 A CN1444386 A CN 1444386A
Authority
CN
China
Prior art keywords
certificate
access point
wireless access
portable terminal
certificate server
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN 01145395
Other languages
Chinese (zh)
Other versions
CN1191703C (en
Inventor
王育民
铁满霞
唐厚俭
熊静
李延伟
张变玲
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Iwncomm Co Ltd
Original Assignee
China Iwncomm Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Iwncomm Co Ltd filed Critical China Iwncomm Co Ltd
Priority to CNB011453958A priority Critical patent/CN1191703C/en
Publication of CN1444386A publication Critical patent/CN1444386A/en
Application granted granted Critical
Publication of CN1191703C publication Critical patent/CN1191703C/en
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Landscapes

  • Mobile Radio Communication Systems (AREA)

Abstract

A safity cut-in method for a broadband radio IP system mobile terminal is based on public key certificate structure. When MT logs-into AP, an identify certification should be carried out, if it is successful, AP will permit MT log-in, or refuse it. After successful log-in, the two sides will generate a session crytographic key from its own cryptographic key and opposite public cryptographic key locally to processes in encipher or decipher transfer to data message to realize MT log-in control and secerete communication to realize communication secrete function of WLAN, MT can be log-in locally or in other places to ensure the communication panning function of MT.

Description

The safety access method of wide-band wireless IP system mobile terminal
The present invention relates to a kind of safety access method of wide-band wireless IP system mobile terminal, it is the product that wireless communication technology combines with cryptographic technique.
The target of personal communication makes people at any time write to each other arbitrarily with all other men exactly, freely enjoys the multiple business that network provides.The wide-band wireless IP technology will be at present the most popular two big technology---IP technology and wireless communication technology organically merge, and comply with broadband development trend, for mobile host or portable terminal is provided convenience, fast, Internet access service at a high speed, to adapt to people to express network and the ever-increasing demand of multimedia communication service.WLAN (wireless local area network) WLAN (Wireless Local Area Network) not only supports mobile computing, and have flexibility, agility and an extensibility of framework, based on WLAN, as shown in Figure 1 based on the BRAN structural representation of Internet.Mainly (wireless client, portable terminal MT (Mobile Terminal), wireless access point AP (Acces s Point) and wireless access server WAS equipment such as (Wireless Access Server) are formed by the broadband wireless access terminal for it, wherein the wireless access terminal can be moved arbitrarily in net, WAP (wireless access point) realizes comprising the cell management of handover, to the management and the bridging functionality of wireless access terminal, the wireless access server is realized the internetwork roaming management of wireless access terminal.Insert Internet from fixedly being linked into mobile wireless, the wide-band wireless IP technology has been brought new idea and huge impact for world's network environment.The application of this system will be more extensive, and the occasion that is difficult in commerce NET (mainly being company intranet), organization user's network (as public security, finance, Government departments etc.), cell networks (as school, hospital, residential area etc.), remote monitoring or centralized monitor etc., casual network (as temporary meeting etc.), outdoor mobile subscriber, wiring, the occasion that needs often change etc. are all very useful.Because must consider in bank, security, public security etc. has applicable broadband radio IP system under the environment of safety requirements, therefore, its level security is extremely important.
For WLAN (wireless local area network), its safety problem is more than serious many of wired ethernet, and the WLAN means of having introduced several levels solve safety problem for this reason.At first be to utilize service set identifier SSID (Service Set ID), be called the group of networks identifier again, this is the most a kind of authentication mode, by each wireless access point AP is provided with different SSID, and provide SSID when forcing portable terminal to insert, thereby can allow the user of different groups to insert, and the authority of resource access is distinguished restriction.But this is more low-level safety certification, as long as because anyone knows that SSID just can access network.Next is an address limitation, promptly stops unauthorized visit by the mac address table that the portable terminal wireless network card that is authorized to is set on wireless access point AP.But the not so difficult acquisition of the MAC Address of wireless network card, and can forge in theory, so this also belongs to more low-level authorization identifying.In a word, above dual mode can not be controlled the access of portable terminal effectively, more can't ensure the confidentiality of communication.
Except that above-mentioned two kinds of methods, a kind of measure of more employings at present is the international standards (IEEE802.11) according to WLAN, introduces in WLAN (wireless local area network) and with WEP wired equivalence (WiredEquivalent Privacy) privacy mechanism data is carried out encrypted transmission based on RC-4.The WEP algorithm adopts single key system, and promptly encryption and decryption is same key, and its length is 64 or 128.Wherein 40 or 104 is standing part, be called initialization key, the i.e. key that is provided with at wireless access point AP and portable terminal MT, remaining 24 is variable part, be called initialization vector, this vector is changed by the drive software of network interface card in communication process, that is to say that to be used for encrypted secret key variable, and this has guaranteed the confidentiality of radio communication to a certain extent.But because the regularity that initialization vector changes, the PC-4 algorithm be subject to merit, therefore the safe coefficient of WEP algorithm is not high, prior to discovery in March calendar year 2001, they point out to adopt the WLAN of WEP algorithm only can be broken at 5 hours to this point by one research group of California, USA university.Reason wherein is explained as follows: suppose that the initialization vector value increases progressively 1 rapid change with every frame, every frame length is 1500 bytes, and data transmission rate is 11 megabit per seconds, and then the cycle of initialization vector repetition is:
1500 byte/frame * 8/byte * 1 second/(11 * 10 6The position) * 2 2418300 seconds ≈ of frame ≈ 5 hours promptly just can obtain two frame ciphertexts through same secret key encryption every 5 hours, just can guess or calculate initial key values thus.Here it must be noted that the length of key does not influence the time of its decoding, the complexity that has just increased conjecture or calculated.Show according to data, pointed out to exist the WLAN of security breaches to be subjected to more serious strike recently again, August calendar year 2001 two Israel Zi Man Wei research institutes the expert and the researcher of a Cisco System Co.---three whole world top decoding experts have carried out the WEP safety test, they are according to the sub-fraction data of stealing in the network, less than promptly cracking the key that WLAN uses, AT﹠amp simultaneously in one hour; T laboratory research group also successfully cracks with same method.Therefore, safety problem becomes one of major obstacle that hinders the application popularization of wireless IP technology, how to insert the most important thing that Internet just becomes wide-band wireless IP system research safely.
The objective of the invention is to overcome above-mentioned weak point of the prior art, and a kind of safety access method of wide-band wireless IP system mobile terminal is provided.It has solved, and portable terminal does not have access control and safe access problem in the radio IP system, has not only realized mobile terminal access control, and has ensured the fail safe that inserts, the confidentiality of communication.But portable terminal MT can also login in the strange land this locality, thereby has ensured the roaming function of portable terminal MT.
Design of the present invention is as follows:
A kind of safety access method of wide-band wireless IP system mobile terminal, its key step is:
1. set up certificate management system
Certificate management system comprises root certificate server and sub level certificate server composition, and the sub level certificate server comprises the sub-certificate server of one-level, the sub-certificate server of secondary or multistage sub-certificate server.Wherein the root certificate server is responsible for the management of the sub-certificate server certificate of all one-levels, and the sub-certificate server of one-level is responsible for the management of the sub-certificate server certificate of secondary, has the public key information that higher level's certificate server is a root certificate server certificate simultaneously.
The certificate server position can be in local area network (LAN) or the gateway place, certificate management software is installed on it, constitute a sub level certificate server, this server manages and provides service to wireless access point AP, and each wireless access point AP is all known the public key information of local certificate server simultaneously.
2. application certificate
Portable terminal wants to insert Internet, at first must be by wireless access point AP to local certificate server application certificate.The certificate request process is as follows:
(1). portable terminal MT produces a pair of original public and private key in this locality;
(2). ask the PKI of local certificate server;
(3). certificate request.At first, portable terminal MT forms ciphertext with the public key encryption of application information with certificate server, and this ciphertext and the PKI of oneself are together mail to wireless access point AP.After receiving, wireless access point AP submits to certificate server, certificate server is untied applicant's information with the private key of oneself, generate the valid certificate and the private key information of communicating by letter of portable terminal MT, and, be recycled to portable terminal MT by wireless access point AP again this original public key encryption with the applicant.Original private keys with oneself after portable terminal MT receives is untied message, then obtains valid certificate and the private key information of oneself, and this stylish public and private key will replace original a pair of public and private key.
3. the authentication between wireless access point AP and the portable terminal MT.
The mutual authentication of above-mentioned wireless access point AP and portable terminal MT can be adopted the local access authentication of portable terminal MT, and its flow process flow process comprises:
1.. insert request.Portable terminal MT sends the request of inserting to wireless access point AP, and oneself certificate is passed to wireless access point AP;
2.. authentication request.After wireless access point AP receives that portable terminal MT inserts request, send authentication request to local certificate server, pass to local certificate server in the lump with portable terminal MT certificate, wireless access point AP certificate and with the signing messages that the private key of wireless access point AP carries out them;
3.. checking wireless access point AP and portable terminal MT.After local certificate server is received the authentication request of wireless access point AP, the signature of checking wireless access point AP, if incorrect, if then verification process failure is correct, then further verify portable terminal MT certificate, server is judged portable terminal MT certificate whether in local list of cert, if do not exist, and then verification process failure, if, then wireless access point AP certificate, portable terminal MT certificate, authentication result are reached the signing messages that they are carried out and send back to wireless access point AP in the lump;
4.. the access authentication result.Wireless access point AP is carried out signature verification to the message that local certificate server returns, and just obtains portable terminal MT certificate, knows the PKI of portable terminal MT, and allows portable terminal MT to insert; Wireless access point AP is recycled to portable terminal MT with AP certificate, authentication result and signature, and terminal obtains the certificate of wireless access point AP, knows the PKI of wireless access point AP.So far portable terminal MT just inserts wireless access point AP.
The mutual authentication of above-mentioned wireless access point AP and portable terminal MT can be adopted portable terminal MT strange land access authentication, and its flow process flow process comprises:
1.. insert request.Portable terminal MT sends the request of inserting to wireless access point AP, and oneself certificate is passed to wireless access point AP;
2.. authentication request.After wireless access point AP receives that portable terminal MT inserts request, send authentication request to local certificate server, pass to local certificate server in the lump with portable terminal MT certificate, wireless access point AP certificate and with the signing messages that the private key of wireless access point AP carries out them;
3.. checking wireless access point AP and portable terminal MT.After local certificate server is received the authentication request of wireless access point AP, the signature of checking wireless access point AP, if incorrect, then verification process failure, otherwise further verify portable terminal MT certificate.Local certificate server outwards certificate server sends authentication request, is about to the certificate of wireless access point AP certificate, portable terminal MT certificate, local certificate server and their signature is sent to nonlocal certificate server by Internet.The other places certificate server is received the signature of the local certificate server of checking behind the message, if incorrect, and authentification failure then, otherwise judge that portable terminal MT certificate is whether in list of cert.If do not exist, then verification process failure is if the signature that reaches them at the certificate with wireless access point AP certificate, portable terminal MT certificate, authentication result, nonlocal certificate server sends back to local certificate server by Internet again;
4.. the access authentication result.Local certificate server is received the message that nonlocal certificate server returns, and this is changed signature, is transmitted back to wireless access point AP.Wireless access point AP is carried out signature verification after receiving the passback message, just obtains the certificate of portable terminal MT, promptly knows the PKI of terminal, allows portable terminal MT to insert.Wireless access point AP is recycled to portable terminal MT with AP certificate verification result and signature then, and portable terminal MT just obtains the certificate of wireless access point AP, promptly knows the PKI of wireless access point AP.So far portable terminal MT just successfully inserts wireless access point AP.
The PKI of the local certificate server of above-mentioned request is that portable terminal MT sends the PKI solicited message to wireless access point AP, promptly returns the PKI of local certificate server after wireless access point AP is received.
The present invention compared with prior art has following advantage:
The Verification System of public-key cryptosystem will become the main developing direction of future network safety system, so the present invention adopts public key certificate to realize that the safety of WLAN portable terminal inserts.It has solved, and portable terminal does not have access control and safe access problem in the radio IP system, has not only realized mobile terminal access control, and has ensured the fail safe that inserts, the confidentiality of communication.But portable terminal MT can also login in the strange land this locality, thereby has ensured the roaming function of portable terminal MT.
The accompanying drawing drawing is described as follows:
Fig. 1 is a wide-band wireless IP system structural representation of the present invention;
Fig. 2 is a certificate server system configuration schematic diagram of the present invention;
Fig. 3 is a certificate format of the present invention;
Fig. 4 is a certificate request flow chart of the present invention;
Fig. 5 is the local access authentication schematic diagram of the present invention;
Fig. 6 is a strange land of the present invention access authentication schematic diagram;
Fig. 7 is the local access authentication flow chart of the present invention;
Fig. 8 is a strange land of the present invention access authentication flow chart.
The invention will be further described below in conjunction with drawings and Examples:
The present invention is based on public key certificate mechanism, must carry out authentication when portable terminal MT logins to wireless access point AP, if authentication success, then wireless access point AP allows portable terminal MT to insert, otherwise refuses its login.After successfully inserting, both sides all produce session key in this locality by private key of oneself and the other side's PKI, according to this data message are carried out the encryption and decryption transmission.The art of this patent has not only been finished mobile terminal access control, and has realized the communication security function of WLAN.The portable terminal MT that holds certificate not only can locally insert, and can login in the strange land, has ensured the communication roaming function of portable terminal MT.
Realize that key step of the present invention is as follows:
1. set up certificate management system
Certificate management system mainly finish certificate generation, issue, nullify, management function such as inquiry.The certificate management system that the present invention sets up has strict hierarchical structure, as shown in Figure 2.Wherein the root certificate server is responsible for the management of the sub-certificate server certificate of all one-levels, and the one-level child servers is responsible for the management of secondary child servers certificate, has the public key information that higher level's server is a root certificate server certificate simultaneously.Whole certificate management system is minimum to be two-stage, and along with the expansion of scale, it can become complicated more, and the number of plies is more.
When newly purchasing a collection of wireless network card and wireless access point AP, promptly obtain a certificate management software simultaneously.Certificate server should be the server of a platform independent, its position can be in local area network (LAN) or the gateway place, install certificate management software on the server, promptly constitute a sub level certificate server, this server manages and provides service to this batch wireless access point AP, for example issue certificate etc. for wireless access point AP, each wireless access point AP is all known the public key information of local certificate server simultaneously.The certificate main contents that this patent uses, as shown in Figure 3.Wherein signature algorithm adopts elliptic curve ECC algorithm.
2. application certificate
The user is that portable terminal wants to insert Internet, then at first must be by wireless access point AP to local certificate server (certificate server) application certificate.The certificate request process flow diagram is explained as follows as shown in Figure 4:
(1). portable terminal MT produces a pair of original public and private key in this locality, be used for local certificate server valid certificate is carried out the ciphertext granting.
(2). ask the PKI of local certificate server, be used for the ciphertext transmission of portable terminal MT application information.Portable terminal MT sends the PKI solicited message to wireless access point AP, promptly returns the PKI of local certificate server after wireless access point AP is received.
(3). certificate request.At first, portable terminal MT is the public key encryption of application information (as user's ID card No., name, birthdate etc.) with certificate server, and this ciphertext and oneself PKI are together mail to wireless access point AP.After receiving, wireless access point AP submits to certificate server, certificate server is untied applicant's information with the private key of oneself, generate valid certificate and the private key information of portable terminal MT in view of the above, and, be recycled to portable terminal MT by wireless access point AP again this original public key encryption with the applicant.Original private keys with oneself after portable terminal MT receives is untied message, then obtains valid certificate and the private key information of oneself, and this stylish public and private key will replace original a pair of public and private key.Certificate can apply on the net as mentioned above that the agency that also can arrive certificate server handles.
3. the authentication between wireless access point AP and the portable terminal MT
No matter the certificate that portable terminal is held is applied for from this locality or from the other places, all can by and local wireless access point AP between mutual authentication, realize that safety inserts, but promptly portable terminal MT can login in the strange land also this locality, thereby ensured the roaming function of portable terminal MT.
The principle that wireless access point AP and portable terminal MT authenticate mutually such as Fig. 5, shown in Figure 6.Local certificate server and nonlocal certificate server can be realized mutual trust by higher level's certificate server even root certificate server, the wireless access point AP certificate is issued by local certificate server, so wireless access point AP and the mutual trust of local certificate server, therefore portable terminal MT and local certificate server (if holding local certificate) or nonlocal certificate server (holding nonlocal certificate) mutual trust finally obtain wireless access point AP and portable terminal MT can trust each other.The detailed process that wireless access point AP and portable terminal MT authenticate mutually is as follows:
1) the local access authentication flow process of portable terminal MT is explained as follows as shown in Figure 7:
1.. insert request.Portable terminal MT sends the request of access to wireless access point AP, and the certificate that is about to oneself passes to wireless access point AP.
2.. authentication request.After wireless access point AP receives that portable terminal MT inserts request, send authentication request to local certificate server, be about to portable terminal MT certificate, wireless access point AP certificate and pass to local certificate server in the lump with the signing messages that the private key of wireless access point AP carries out them.
3.. checking wireless access point AP and portable terminal MT.After local certificate server is received the authentication request of wireless access point AP, the signature of checking wireless access point AP, if incorrect, then verification process failure, otherwise further verify portable terminal MT certificate.Server judges that portable terminal MT certificate is whether in local list of cert, if do not exist, then verification process failure, if, wireless access point AP certificate, portable terminal MT certificate, authentication result are reached the signing messages that they are carried out send back to wireless access point AP in the lump.
4.. the access authentication result.Wireless access point AP is carried out signature verification to the message that local certificate server returns, and just obtains portable terminal MT certificate, promptly knows the PKI of portable terminal MT, and allows portable terminal MT to insert.Wireless access point AP is recycled to portable terminal MT with AP certificate, authentication result and signature, after the success of terminal certifying signature, obtains the certificate of wireless access point AP, promptly knows the PKI of wireless access point AP.So far portable terminal MT just successfully inserts wireless access point AP.
2) portable terminal MT other places identifying procedure figure is explained as follows as shown in Figure 8:
1.. insert request.Portable terminal MT sends the request of access to wireless access point AP, and the certificate that is about to oneself passes to wireless access point AP.
2.. authentication request.After wireless access point AP receives that portable terminal MT inserts request, send authentication request to local certificate server, be about to portable terminal MT certificate, wireless access point AP certificate and pass to local certificate server in the lump with the signing messages that the private key of wireless access point AP carries out them.
3.. checking wireless access point AP and portable terminal MT.After local certificate server is received the authentication request of wireless access point AP, the signature of checking wireless access point AP, if incorrect, then verification process failure, otherwise further verify portable terminal MT certificate.Local certificate server outwards certificate server sends authentication request, is about to the certificate of wireless access point AP certificate, portable terminal MT certificate, local certificate server and their signature is sent to nonlocal certificate server by Internet.The other places certificate server is received the signature of the local certificate server of checking behind the message, if incorrect, and authentification failure then, otherwise judge that portable terminal MT certificate is whether in list of cert.If do not exist, then verification process failure, if.Send back to local certificate server by Internet again with the certificate of wireless access point AP certificate, portable terminal MT certificate, authentication result, nonlocal certificate server and to their signature.
4.. the access authentication result.Local certificate server is received the message that nonlocal certificate server returns, and this is changed signature, is transmitted back to wireless access point AP.Wireless access point AP is carried out signature verification after receiving the passback message, just obtains the certificate of portable terminal MT, promptly knows the PKI of terminal, allows portable terminal MT to insert.Wireless access point AP is recycled to portable terminal MT with AP certificate verification result and signature then, after the success of portable terminal MT certifying signature, just obtains the certificate of wireless access point AP, promptly knows the PKI of wireless access point AP.So far portable terminal MT just successfully inserts wireless access point AP.
After portable terminal MT and the wireless access point AP authentication success, promptly finished the successful login of portable terminal MT.This moment, both sides all utilized the other side's PKI and the private key of oneself to generate session key at this machine, were used for the encryption and decryption of communication data message, thereby realized the wireless security secure communication between portable terminal MT and the wireless access point AP.Certainly also can be in the communication process without session key symmetry encryption and decryption, but adopt the other side's public key encryption to send, own private key deciphering reception, can realize secure communication equally.
So far, there are three class systems to be proved to be safety and effective, i.e. integer factorization system (RSA), discrete logarithm system (DSA) and elliptic curve cryptosystem (ECC).
Elliptic curve cryptosystem has two significant advantages: (1) key figure place is few, (2) with the condition identical based on the multiplicative group cryptographic system under higher fail safe can be provided.160 elliptic curve cryptosystem can provide and 1024 RSA or the same degree of safety of DSA, thereby allows to design the shorter public-key cryptosystem of key.Present ECC cryptographic system is just cracked the longest 108, and the cost of cost is very expensive.According to the development speed of present computer CPU, the cryptographist estimates that 160 ECC needed for 10 years could decode, 192 about need 20 years, and 224 need 50 years, 256 then need the longer time.This patent adopts the ECC cryptographic system, can guarantee that fully the safety of mobile radio terminal inserts in the wide-band wireless IP system, and compares present present situation and obtain unrivaled safe effect.

Claims (4)

1, a kind of safety access method of wide-band wireless IP system mobile terminal is characterized in that: its key step is:
1). set up certificate management system
Certificate management system comprises root certificate server and sub level certificate server, the sub level certificate server comprises the sub-certificate server of one-level, the sub-certificate server of secondary or multistage sub-certificate server, described certificate server is responsible for the management of the sub-certificate server certificate of all one-levels, the sub-certificate server of one-level is responsible for the management of the sub-certificate server certificate of secondary, has the public key information that higher level's certificate server is a root certificate server certificate simultaneously; The certificate server position can be in local area network (LAN) or the gateway place, certificate management software is installed on it, constitute a sub level certificate server, this server manages and provides service to wireless access point AP, and each wireless access point AP is all known the public key information of local certificate server simultaneously;
2). the application certificate
Portable terminal inserts Internet, at first must be by wireless access point AP to local certificate server application certificate, and the certificate request process is as follows:
(1). portable terminal MT produces a pair of original public and private key in this locality;
(2). ask the PKI of local certificate server;
(3). certificate request, at first, portable terminal MT is with the public key encryption of application information with certificate server, form ciphertext, this ciphertext and the PKI of oneself are together mail to wireless access point AP, after receiving, wireless access point AP submits to certificate server, certificate server is untied applicant's information with the private key of oneself, generate the valid certificate and the private key information of communicating by letter of portable terminal MT, and, be recycled to portable terminal MT by wireless access point AP again with this original public key encryption with the applicant, after receiving, portable terminal MT unties message with the original private keys of oneself, then obtain valid certificate and the private key information of oneself, this stylish public and private key will replace original a pair of public and private key;
3). the authentication between wireless access point AP and the portable terminal MT.
2, the safety access method of wide-band wireless IP system mobile terminal according to claim 1 is characterized in that: the mutual authentication of described wireless access point AP and portable terminal MT is local access authentication, and concrete access authentication flow process comprises:
1.. insert request: portable terminal MT sends the request of access to wireless access point AP, and oneself certificate is passed to wireless access point AP;
2.. authentication request: after wireless access point AP receives that portable terminal MT inserts request, send authentication request to local certificate server, pass to local certificate server in the lump with portable terminal MT certificate, WAP (wireless access point) wireless access point AP certificate and with the signing messages that the private key of wireless access point AP carries out them;
3.. checking wireless access point AP and portable terminal MT, after local certificate server is received the authentication request of wireless access point AP, the signature of checking wireless access point AP, if it is incorrect, then verification process failure, if it is correct, then further verify portable terminal MT certificate, server judges that portable terminal MT certificate is whether in local list of cert, if do not exist, then verification process failure, if, then wireless access point AP certificate, portable terminal MT certificate, authentication result are reached the signing messages that they are carried out and send back to wireless access point AP in the lump;
4.. the access authentication result, wireless access point AP is carried out signature verification to the message that local certificate server returns, and just obtains portable terminal MT certificate, knows the PKI of portable terminal MT, and allows portable terminal MT to insert; Wireless access point AP is recycled to portable terminal MT with AP certificate, authentication result and signature, and terminal obtains the certificate of wireless access point AP, knows the PKI of wireless access point AP, and so far portable terminal MT just inserts wireless access point AP.
3, the safety access method of wide-band wireless IP system mobile terminal according to claim 1 is characterized in that: the mutual authentication of described wireless access point AP and portable terminal MT is the strange land access authentication, and concrete access authentication flow process comprises:
1.. insert request: portable terminal MT sends the request of access to wireless access point AP, and oneself certificate is passed to wireless access point AP;
2.. authentication request: after wireless access point AP receives that portable terminal MT inserts request, send authentication request to local certificate server, pass to local certificate server in the lump with portable terminal MT certificate, wireless access point AP certificate and with the signing messages that the private key of wireless access point AP carries out them;
3.. checking wireless access point AP and portable terminal MT, after local certificate server is received the authentication request of wireless access point AP, the signature of checking wireless access point AP, if it is incorrect, then verification process failure, otherwise further verify portable terminal MT certificate, local certificate server outwards certificate server sends authentication request, be about to the wireless access point AP certificate, portable terminal MT certificate, the signature that the certificate of local certificate server reaches them is sent to nonlocal certificate server by Internet, the other places certificate server is received the signature of the local certificate server of checking behind the message, if it is incorrect, authentification failure then, otherwise judge that portable terminal MT certificate is whether in list of cert, if do not exist, then verification process failure, otherwise with the wireless access point AP certificate, portable terminal MT certificate, authentication result, the signature that the certificate of other places certificate server reaches them sends back to local certificate server by Internet again;
4.. the access authentication result, local certificate server is received the message that nonlocal certificate server returns, this is changed signature, be transmitted back to wireless access point AP, wireless access point AP is carried out signature verification after receiving the passback message, just obtain the certificate of portable terminal MT, promptly know the PKI of terminal, allow portable terminal MT to insert, wireless access point AP is recycled to portable terminal MT with AP certificate verification result and signature then, portable terminal MT just obtains the certificate of wireless access point AP, promptly knows the PKI of wireless access point AP, and so far portable terminal MT just successfully inserts wireless access point AP.
4, according to the safety access method of claim 1 or 2 or 3 described wide-band wireless IP system mobile terminals, it is characterized in that: the PKI of asking local certificate server is that portable terminal MT sends the PKI solicited message to wireless access point AP, promptly returns the PKI of local certificate server after wireless access point AP is received.
CNB011453958A 2001-12-31 2001-12-31 Safe inserting method of wide-band wireless IP system mobile terminal Expired - Lifetime CN1191703C (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CNB011453958A CN1191703C (en) 2001-12-31 2001-12-31 Safe inserting method of wide-band wireless IP system mobile terminal

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CNB011453958A CN1191703C (en) 2001-12-31 2001-12-31 Safe inserting method of wide-band wireless IP system mobile terminal

Publications (2)

Publication Number Publication Date
CN1444386A true CN1444386A (en) 2003-09-24
CN1191703C CN1191703C (en) 2005-03-02

Family

ID=27810675

Family Applications (1)

Application Number Title Priority Date Filing Date
CNB011453958A Expired - Lifetime CN1191703C (en) 2001-12-31 2001-12-31 Safe inserting method of wide-band wireless IP system mobile terminal

Country Status (1)

Country Link
CN (1) CN1191703C (en)

Cited By (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1327648C (en) * 2003-05-16 2007-07-18 华为技术有限公司 Method for realizing high-srate grouped data business identification
WO2007115495A1 (en) * 2006-04-10 2007-10-18 Beijing E-Henxen Authentication Technologies Co., Ltd. Cpk-based gateway authenticating apparatus and method
CN100358326C (en) * 2004-06-04 2007-12-26 西安电子科技大学 Wide-band wireless IP network safety system structure and realizing method
WO2008037144A1 (en) * 2006-09-22 2008-04-03 Wen Zhang Method and system for communication of application fingerprint based on the credit verification
WO2008098496A1 (en) * 2007-02-06 2008-08-21 China Iwncomm Co., Ltd. Application method for certificate in wapi safety mechanism of wireless local area network
CN100428843C (en) * 2004-12-02 2008-10-22 华为技术有限公司 Broad band mobile cut-in net system and its method
CN100450137C (en) * 2003-11-12 2009-01-07 华为技术有限公司 Realizing method for mobile phone user to access to internet
WO2009143765A1 (en) * 2008-05-29 2009-12-03 西安西电捷通无线网络通信有限公司 Key distributing method, public key of key distribution centre online updating method and device
CN1601958B (en) * 2003-09-26 2010-05-12 北京三星通信技术研究有限公司 HRPD network access authentication method based on CAVE algorithm
CN1859097B (en) * 2006-01-19 2010-08-04 华为技术有限公司 Verifying method and system based on general weight discrimination framework
US7792065B2 (en) 2005-09-24 2010-09-07 International Business Machines Corporation Securely establishing sessions over secure paths
CN1951067B (en) * 2004-03-02 2010-10-13 松下电器产业株式会社 System and method for negotiation of wlan entity
CN101243697B (en) * 2003-10-31 2011-01-05 讯宝科技公司 System and method for determining location of rogue wireless access point
CN101335627B (en) * 2008-07-31 2011-01-19 中兴通讯股份有限公司 Network facsimile system and using method thereof
WO2011009268A1 (en) * 2009-07-22 2011-01-27 中兴通讯股份有限公司 Wapi (wlan authentication and privacy infrastructure) -based authentication system and method
CN101272301B (en) * 2008-05-07 2011-02-02 广州杰赛科技股份有限公司 Safety access method of wireless metropolitan area network
CN101183932B (en) * 2007-12-03 2011-02-16 宇龙计算机通信科技(深圳)有限公司 Security identification system of wireless application service and login and entry method thereof
CN101990206A (en) * 2009-08-03 2011-03-23 秦志强 Method and system capable of realizing differentiated access control of air interface of wireless local area network
CN101431455B (en) * 2007-11-09 2011-03-23 北京华旗资讯数码科技有限公司 Method for implementing secret communication of wireless local area network
CN101431453B (en) * 2007-11-09 2011-05-25 北京华旗资讯数码科技有限公司 Method for implementing secret communication between communication terminal and wireless access point
CN1894885B (en) * 2003-10-17 2011-08-03 英特尔公司 Digital certificate to user terminal hardware in a wireless network
CN102158849A (en) * 2010-12-21 2011-08-17 东莞宇龙通信科技有限公司 Method for acquiring certificate and mobile terminal
CN101588245B (en) * 2009-06-24 2012-01-04 成都市华为赛门铁克科技有限公司 Method of identity authentication, system and memory device thereof
CN101262670B (en) * 2007-03-09 2012-01-25 鸿富锦精密工业(深圳)有限公司 Mobile device, communication system and connection establishment method
CN102594568A (en) * 2012-03-23 2012-07-18 南京小网科技有限责任公司 Method for ensuring safety of mobile equipment software mirror image based on multilevel digital certificate
CN102595409A (en) * 2012-03-21 2012-07-18 华为技术有限公司 Method, equipment and system for acquiring encryption information based on wireless access
CN101795263B (en) * 2009-12-28 2012-12-12 中国联合网络通信集团有限公司 Secure broadband access method, authentication method, device and system
CN101015173B (en) * 2004-09-08 2013-06-19 皇家飞利浦电子股份有限公司 Secure pairing for wired or wireless communications devices
CN103167491A (en) * 2011-12-15 2013-06-19 上海格尔软件股份有限公司 Authentication method of mobile terminal uniqueness based on software digital certificate
CN106656933A (en) * 2015-11-03 2017-05-10 阿里巴巴集团控股有限公司 Wireless network access authentication method, terminal, and access point
CN107302544A (en) * 2017-08-15 2017-10-27 迈普通信技术股份有限公司 Certificate request method, wireless access control equipment and wireless access point device
CN114189857A (en) * 2017-05-11 2022-03-15 无线通信与技术公司 Gateway and method implemented by gateway

Cited By (39)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1327648C (en) * 2003-05-16 2007-07-18 华为技术有限公司 Method for realizing high-srate grouped data business identification
CN1601958B (en) * 2003-09-26 2010-05-12 北京三星通信技术研究有限公司 HRPD network access authentication method based on CAVE algorithm
CN1894885B (en) * 2003-10-17 2011-08-03 英特尔公司 Digital certificate to user terminal hardware in a wireless network
CN101243697B (en) * 2003-10-31 2011-01-05 讯宝科技公司 System and method for determining location of rogue wireless access point
CN100450137C (en) * 2003-11-12 2009-01-07 华为技术有限公司 Realizing method for mobile phone user to access to internet
CN1951067B (en) * 2004-03-02 2010-10-13 松下电器产业株式会社 System and method for negotiation of wlan entity
CN100358326C (en) * 2004-06-04 2007-12-26 西安电子科技大学 Wide-band wireless IP network safety system structure and realizing method
CN101015173B (en) * 2004-09-08 2013-06-19 皇家飞利浦电子股份有限公司 Secure pairing for wired or wireless communications devices
US8813188B2 (en) 2004-09-08 2014-08-19 Koninklijke Philips N.V. Secure pairing for wired or wireless communications devices
CN100428843C (en) * 2004-12-02 2008-10-22 华为技术有限公司 Broad band mobile cut-in net system and its method
US7792065B2 (en) 2005-09-24 2010-09-07 International Business Machines Corporation Securely establishing sessions over secure paths
CN1859097B (en) * 2006-01-19 2010-08-04 华为技术有限公司 Verifying method and system based on general weight discrimination framework
WO2007115495A1 (en) * 2006-04-10 2007-10-18 Beijing E-Henxen Authentication Technologies Co., Ltd. Cpk-based gateway authenticating apparatus and method
CN1829150B (en) * 2006-04-10 2011-06-01 北京易恒信认证科技有限公司 Gateway identification device and method based on CPK
WO2008037144A1 (en) * 2006-09-22 2008-04-03 Wen Zhang Method and system for communication of application fingerprint based on the credit verification
CN101150390B (en) * 2006-09-22 2013-05-08 周卫 Fingerprint communication method and system based on trust detection
WO2008098496A1 (en) * 2007-02-06 2008-08-21 China Iwncomm Co., Ltd. Application method for certificate in wapi safety mechanism of wireless local area network
CN101262670B (en) * 2007-03-09 2012-01-25 鸿富锦精密工业(深圳)有限公司 Mobile device, communication system and connection establishment method
CN101431455B (en) * 2007-11-09 2011-03-23 北京华旗资讯数码科技有限公司 Method for implementing secret communication of wireless local area network
CN101431453B (en) * 2007-11-09 2011-05-25 北京华旗资讯数码科技有限公司 Method for implementing secret communication between communication terminal and wireless access point
CN101183932B (en) * 2007-12-03 2011-02-16 宇龙计算机通信科技(深圳)有限公司 Security identification system of wireless application service and login and entry method thereof
CN101272301B (en) * 2008-05-07 2011-02-02 广州杰赛科技股份有限公司 Safety access method of wireless metropolitan area network
WO2009143765A1 (en) * 2008-05-29 2009-12-03 西安西电捷通无线网络通信有限公司 Key distributing method, public key of key distribution centre online updating method and device
CN101335627B (en) * 2008-07-31 2011-01-19 中兴通讯股份有限公司 Network facsimile system and using method thereof
CN101588245B (en) * 2009-06-24 2012-01-04 成都市华为赛门铁克科技有限公司 Method of identity authentication, system and memory device thereof
WO2011009268A1 (en) * 2009-07-22 2011-01-27 中兴通讯股份有限公司 Wapi (wlan authentication and privacy infrastructure) -based authentication system and method
CN101990206A (en) * 2009-08-03 2011-03-23 秦志强 Method and system capable of realizing differentiated access control of air interface of wireless local area network
CN101795263B (en) * 2009-12-28 2012-12-12 中国联合网络通信集团有限公司 Secure broadband access method, authentication method, device and system
CN102158849A (en) * 2010-12-21 2011-08-17 东莞宇龙通信科技有限公司 Method for acquiring certificate and mobile terminal
CN103167491A (en) * 2011-12-15 2013-06-19 上海格尔软件股份有限公司 Authentication method of mobile terminal uniqueness based on software digital certificate
CN103167491B (en) * 2011-12-15 2016-03-02 上海格尔软件股份有限公司 A kind of mobile terminal uniqueness authentication method based on software digital certificate
CN102595409A (en) * 2012-03-21 2012-07-18 华为技术有限公司 Method, equipment and system for acquiring encryption information based on wireless access
JP2013198163A (en) * 2012-03-21 2013-09-30 ▲ホア▼▲ウェイ▼技術有限公司 Method, device and system for acquiring encrypted information under radio access
CN102594568A (en) * 2012-03-23 2012-07-18 南京小网科技有限责任公司 Method for ensuring safety of mobile equipment software mirror image based on multilevel digital certificate
CN106656933A (en) * 2015-11-03 2017-05-10 阿里巴巴集团控股有限公司 Wireless network access authentication method, terminal, and access point
CN114189857A (en) * 2017-05-11 2022-03-15 无线通信与技术公司 Gateway and method implemented by gateway
CN114189857B (en) * 2017-05-11 2023-11-28 无线通信与技术公司 Gateway and method implemented by gateway
CN107302544A (en) * 2017-08-15 2017-10-27 迈普通信技术股份有限公司 Certificate request method, wireless access control equipment and wireless access point device
CN107302544B (en) * 2017-08-15 2019-09-13 迈普通信技术股份有限公司 Certificate request method, wireless access control equipment and wireless access point device

Also Published As

Publication number Publication date
CN1191703C (en) 2005-03-02

Similar Documents

Publication Publication Date Title
CN1191703C (en) Safe inserting method of wide-band wireless IP system mobile terminal
CN1191696C (en) Sefe access of movable terminal in radio local area network and secrete data communication method in radio link
CN1124759C (en) Safe access method of mobile terminal to radio local area network
CN1206838C (en) Method for controlling network access in radio environment and its recording medium
WO2020133655A1 (en) Lightweight authentication method supporting anonymous access of heterogeneous terminal in edge computing scenario
CN1846397A (en) Two-factor authenticated key exchange method and authentication method using the same, and recording medium storing program including the same
CN113746632B (en) Multi-level identity authentication method for Internet of things system
CN101056177A (en) Radio mesh re-authentication method based on the WLAN secure standard WAPI
CN100344208C (en) Identification method for preventing replay attack
CN1956376A (en) Broadband access user authentication method
CN100525182C (en) Authentication and encryption method for wireless network
CN1725685A (en) Security identification method for mobiole terminal of radio cocal network
CN115038084A (en) Decentralized trusted access method for cellular base station
CN112437158B (en) Network security identity authentication method based on power Internet of things
CN1728637A (en) Method for identifying physical uniqueness of networked terminal, and access authentication system for terminals
CN1225941C (en) Roaming access method of mobile node in radio IP system
CN1829150A (en) Gateway identification device and method based on CPK
CN1750456A (en) Cookie-based mechanism providing lightweight authentication of layer-2 frames
CN101674576B (en) Key exchange authentication method with no need of hometown network participation when in roaming
CN1329418A (en) Method for authenticating network user identity and method for overcoming user password loophole in Kerberous authentication system
CN1697370A (en) Method for mobile terminal in WLAN to apply for certificate
CN114389808B (en) OpenID protocol design method based on SM9 blind signature
CN1484409A (en) Method for distributing enciphered key in wireless local area network
CN1595897A (en) Method and system for unified process of domain authentication and user network authority control
CN117155692B (en) Smart grid data aggregation method and system based on security mask

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
C56 Change in the name or address of the patentee

Owner name: XI'AN IWNCOMM CO., LTD.

Free format text: FORMER NAME: XIDIAN JIETONG WIRELESS NETWORK COMMUNICATION CO LTD, XI'AN

CP01 Change in the name or title of a patent holder

Address after: 710075 No. 12, No. two, hi tech Road, Shaanxi, Xi'an, 4FC

Patentee after: Anxi Dianjietong Wireless Network Communications Co.,Ltd.

Address before: 710075 No. 12, No. two, hi tech Road, Shaanxi, Xi'an, 4FC

Patentee before: Xi'an Xidian Jietong Wireless Network Communication Co., Ltd.

EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: BEIJING ZHIXIANG TECHNOLOGY CO., LTD.

Assignor: Anxi Dianjietong Wireless Network Communications Co.,Ltd.

Contract record no.: 2016610000049

Denomination of invention: Safe inserting method of wide-band wireless IP system mobile terminal

Granted publication date: 20050302

License type: Common License

Record date: 20161117

LICC Enforcement, change and cancellation of record of contracts on the licence for exploitation of a patent or utility model
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: Beijing Fenghuo Liantuo Technology Co., Ltd.

Assignor: China IWNCOMM Co., Ltd.

Contract record no.: 2017610000001

Denomination of invention: Safe inserting method of wide-band wireless IP system mobile terminal

Granted publication date: 20050302

License type: Common License

Record date: 20170106

LICC Enforcement, change and cancellation of record of contracts on the licence for exploitation of a patent or utility model
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: Shanghai Yu Xing Xing Technology Co., Ltd.

Assignor: Anxi Dianjietong Wireless Network Communications Co.,Ltd.

Contract record no.: 2017610000005

Denomination of invention: Safe inserting method of wide-band wireless IP system mobile terminal

Granted publication date: 20050302

License type: Common License

Record date: 20170317

EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: Beijing next Technology Co., Ltd.

Assignor: Anxi Dianjietong Wireless Network Communications Co.,Ltd.

Contract record no.: 2017610000014

Denomination of invention: Safe inserting method of wide-band wireless IP system mobile terminal

Granted publication date: 20050302

License type: Common License

Record date: 20170601

EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: Hytera Comm Corp. Ltd.

Assignor: Anxi Dianjietong Wireless Network Communications Co.,Ltd.

Contract record no.: 2017610000015

Denomination of invention: Safe inserting method of wide-band wireless IP system mobile terminal

Granted publication date: 20050302

License type: Common License

Record date: 20170602

EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: Beijing Hua Xinaotian network technology Co., Ltd

Assignor: Anxi Dianjietong Wireless Network Communications Co.,Ltd.

Contract record no.: 2017610000028

Denomination of invention: Safe inserting method of wide-band wireless IP system mobile terminal

Granted publication date: 20050302

License type: Common License

Record date: 20171122

EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: ALPINE ELECTRONICS, Inc.

Assignor: Anxi Dianjietong Wireless Network Communications Co.,Ltd.

Contract record no.: 2017990000497

Denomination of invention: Safe inserting method of wide-band wireless IP system mobile terminal

Granted publication date: 20050302

License type: Common License

Record date: 20171222

EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: SHENZHEN RUIKE HUILIAN TECHNOLOGY CO., LTD.

Assignor: Anxi Dianjietong Wireless Network Communications Co.,Ltd.

Contract record no.: 2018610000006

Denomination of invention: Safe inserting method of wide-band wireless IP system mobile terminal

Granted publication date: 20050302

License type: Common License

Record date: 20180226

EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: Nanchang shark Technology Co. Ltd.

Assignor: Anxi Dianjietong Wireless Network Communications Co.,Ltd.

Contract record no.: 2018610000012

Denomination of invention: Safe inserting method of wide-band wireless IP system mobile terminal

Granted publication date: 20050302

License type: Common License

Record date: 20180404

EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: Sony Mobile Communications AB

Assignor: Anxi Dianjietong Wireless Network Communications Co.,Ltd.

Contract record no.: 2018990000306

Denomination of invention: Safe inserting method of wide-band wireless IP system mobile terminal

Granted publication date: 20050302

License type: Common License

Record date: 20181123

EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: SHENZHEN UCLOUDLINK NETWORK TECHNOLOGY CO., LTD.

Assignor: Anxi Dianjietong Wireless Network Communications Co.,Ltd.

Contract record no.: X2019610000002

Denomination of invention: Safe inserting method of wide-band wireless IP system mobile terminal

Granted publication date: 20050302

License type: Common License

Record date: 20191010

EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: HANGZHOU STRONG EDUCATION TECHNOLOGY Co.,Ltd.

Assignor: China IWNCOMM Co.,Ltd.

Contract record no.: X2021610000001

Denomination of invention: Secure access method of mobile terminal in broadband wireless IP system

Granted publication date: 20050302

License type: Common License

Record date: 20210125

EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: EKC communication technology (Shenzhen) Co.,Ltd.

Assignor: China IWNCOMM Co.,Ltd.

Contract record no.: X2021610000008

Denomination of invention: Secure access method of mobile terminal in broadband wireless IP system

Granted publication date: 20050302

License type: Common License

Record date: 20210705

EE01 Entry into force of recordation of patent licensing contract
EE01 Entry into force of recordation of patent licensing contract

Application publication date: 20030924

Assignee: Xinruiya Technology (Beijing) Co., Ltd

Assignor: Xi'an Xidian Jietong Wireless Network Communication Co., Ltd

Contract record no.: X2021610000012

Denomination of invention: Secure access method of mobile terminal in broadband wireless IP system

Granted publication date: 20050302

License type: Common License

Record date: 20211104

Application publication date: 20030924

Assignee: Guangzhou nengchuang Information Technology Co., Ltd

Assignor: Xi'an Xidian Jietong Wireless Network Communication Co., Ltd

Contract record no.: X2021610000011

Denomination of invention: Secure access method of mobile terminal in broadband wireless IP system

Granted publication date: 20050302

License type: Common License

Record date: 20211104

CX01 Expiry of patent term
CX01 Expiry of patent term

Granted publication date: 20050302