CN1728637A

CN1728637A - Method for identifying physical uniqueness of networked terminal, and access authentication system for terminals

Info

Publication number: CN1728637A
Application number: CN 200510041041
Authority: CN
Inventors: 陈相宁
Original assignee: Individual
Current assignee: Individual
Priority date: 2005-07-15
Filing date: 2005-07-15
Publication date: 2006-02-01
Anticipated expiration: 2025-07-15
Also published as: CN100512108C

Abstract

The invention belongs to method for accessing communication service network from user terminal and implementation system. Characters are that the method divides bi-directional information exchange for authenticating legal identity of user terminal logged to network into following five parts: network access terminal broadcasts for competing time window of logging on network; user terminal to be logged on network initiates request for logging on network at pointed time window; network access terminal broadcasts logging token for terminals in cipher text mode; user terminal to be logged on network feeds back information of logging token for terminals to network access terminal; network access terminal authenticates information of logging token from terminal.

Description

Go into uniqueness recognition methods of network termination physics and terminal access authentication system

Technical field

The invention belongs to a kind of method and realization system thereof of user terminal access communication service network, especially a kind of be used to guarantee Network Communicate Security go into the uniqueness recognition methods of network termination physics and terminal access authentication is realized system.

Background technology

Be accompanied by the Rapid Expansion of development of internet technology and communication network, network security has become the focus that people pay close attention to day by day.The security threat that current network faces mainly comes from assault, network defective, software vulnerability and management shortcoming etc.The Denial of Service attack of being initiated by network hacker or computer virus is wherein difficult take precautions against a kind of.

Denial of Service attack is a kind of like this network attack: be subjected to when communication network partly or entirely having lost the normal service responding ability after the attack of this form, no longer continuing to " the legal authorization user provides the network service of promise ".The principal mode of Denial of Service attack comprises at present: the synchronous storm attack of TCP, ICMP broadcast storm are attacked, UDP serves attack, intrusion detection attack etc.

In the synchronous storm attack of TCP, the assailant sends half a large amount of connections, and the source address that connects is forged, server will can not be received cook source address user's affirmation when acknowledge message is returned to the user like this, at this moment acknowledge message can only be waited for and constantly be retransmitted to server, up to this partly connect overtime.The assailant continue to send and to have forged half of source address and connect, and must make server overload and service can not be provided.

In ICMP broadcasting is attacked, the assailant sends a large amount of destination addresses and points to the high-speed local area network broadcast address, source address is pointed to the ICMP reflection request broadcast packet of victim host, reflexes to victim host thereby cause a large amount of broadcast packets of purpose local area network (LAN), causes the victim host network congestion.

In the UDP service was attacked, the assailant sent the not UDP bag of speed limit by a plurality of servers to victim host magnanimity, and victim host is submerged in the junk data that constantly pours in.

In intrusion detection is attacked, the assailant deliberately sends the packet that contains special string, make the intruding detection system of victim host think the discovery invasion by mistake and produce a large amount of warnings, finally make intruding detection system surpass the record ability and transship or collapse, thereby cover real network intrusions behavior.

Sum up the various forms of Denial of Service attack and be not difficult to find that the principle of Denial of Service attack is exactly to utilize the defective of procotol, make the victim host overload and lose the service response ability.In order to guarantee " authorized user can obtain the network service " of communication network, communications network system must be resisted Denial of Service attack to a certain extent.

Communication network accesses terminal and is designed to provide service to a plurality of user terminals.As a rational hypothesis, its configuration should be satisfied the design maximum number of users and apply for the peak traffic demand that networks simultaneously.If overload has still taken place putting the network insertion terminal before this, must be to have arrived the application that networks of a large amount of fictitious users simultaneously, handle these fictitious users terminals needed operand of application that networks and exceeded the disposal ability of network insertion terminal configuration.Therefore in order to resist Denial of Service attack, can not allow single terminal to palm off a plurality of physical terminal identity.

Present system adopts the mode of sequence number and password protection to carry out authentication more, guarantees the physics uniqueness of terminal.This mode requires user and the network terminal to share identical password data, and sequence number and password data need very easily be intercepted and captured and palm off with the clear-text way transmission in network.If set up encryption channel in advance, sequence number and password data are transmitted in encryption channel, no doubt can take precautions against sensitive data and illegally be intercepted and captured, but the own amount of calculation of process of setting up encryption channel is very big, is enough to be used to initiate Denial of Service attack by the disabled user.

Other systems adopt the cryptography authentication to guarantee unique legitimacy of user identity.Such as identity authorization system, private key for user and network PKI have been stored in the smart card based on smart card.The user uses the private key of oneself that verify data is signed, and with the network PKI digital signature is encrypted again; Network terminal must be used the private key data decryption of oneself, signs with user's public key verifications again.Yet this cryptography authentication operand is very big, for example produces or verify the digital signature of one 1024 RSA public key algorithm encryption, and the desktop computer of Pentium IV-2G needs 1～2 second time.Therefore authentication process itself often becomes the target of Denial of Service attack.

For example the user carries out authentication with the data that produce at random as the identity data requirement of oneself, and the network insertion terminal need spend big energy-handling capability could confirm that this identity data is illegal.If the user uses the random data that constantly changes to be used as the identity sign of oneself, continue to require the network insertion terminal to carry out the cryptography checking of macrooperation amount.The assailant only needs expense seldom like this, just can force the network insertion terminal to have to carry out large-scale computing, and the overload that finally causes accessing terminal reaches denial of service purpose.

In IP-based router network,, user terminal and server correctly be forwarded to user terminal if not at the same network segment, having only the destination address grouping bag identical with user terminal address just can be routed device so.Server can send one " sweet cake " by giving the user terminal that requires to serve like this, and requires user terminal to postback the uniqueness of verifying user terminal to server.This cooky is associated with the network address of user terminal.If the user provides the false network address, it can not receive the cooky that server generates so, thereby avoid follow-up network answer operation.

But this method is not suitable for radio network, or is in the network in the same broadcast domain.Because this moment, the user can receive the cooky that server generates, make and to proceed into network process.Along with the expansion of local area network (LAN) scale with to the transformation of metropolitan area network, need provide services on the Internet to the various different identity users in increasing radio network or the Web broadcast territory, no longer valid based on the terminal uniqueness verification method of cooky exchange.

Summary of the invention

Purpose of the present invention just provide a kind of be applicable to simultaneously route network and radio network, stable and reliable for performance and simple easy to implement based on amount of calculation go into the uniqueness recognition methods of network termination physics and terminal access authentication is realized system.

Of the present inventionly go into network termination physics uniqueness ensuring method and be: the network insertion terminal by with user-network access terminal exchange message repeatedly, guarantee that same user's physical terminal can only be with unique identity accesses network resource, it is characterized in that, this method is divided into five steps with the information exchange between network insertion terminal and the user-network access terminal, first step network insertion terminal is with clear-text way broadcasting competition networking time window, the second step user-network access terminal sends the networking request message of the terminal address fragment that comprises oneself with clear-text way at the competition networking time window of appointment, after the 3rd step network insertion terminal is received the networking request message that the user-network access terminal sends, be user-network access terminal distribution terminal login token, the networking response message that comprises user-network access request message summary and terminal login token with encrypted test mode broadcasting, described ciphertext encryption key comprises user-network access terminal address frag info, the 4th step user-network access terminal is according to its address fragment information generating solution decryption key, each networking response message that deciphering is received, by relatively deciphering the user-network access request message summary in the cleartext information of back, identify networking response message at oneself, the terminal login token of oneself is distributed in discovery, the 5th step user-network access terminal sends the login message that comprises terminal login token information to the network insertion terminal, after the network insertion terminal is received the login message, by comprising the terminal login token information of oneself distributing to prospective users in the checking login message, confirm that the user-network access terminal is legal.

The improved method of the present invention is: the network insertion terminal by with user-network access terminal exchange message repeatedly, guarantee that same user's physical terminal can only be with unique identity accesses network resource, it is characterized in that, this method is divided into five steps with the information exchange between network insertion terminal and the user-network access terminal, the first step is competed networking time window and netkey initial value by the network insertion terminal with clear-text way broadcasting, the user-network access terminal receives and writes down described competition networking time window and netkey initial value, the second step user-network access terminal sends the networking request message of the terminal address fragment that comprises oneself with clear-text way at the competition networking time window of appointment, after the 3rd step network insertion terminal is received the networking request message that the user-network access terminal sends, be user-network access terminal distribution terminal login token, the networking response message that comprises user-network access request message summary and terminal login token with encrypted test mode broadcasting, described ciphertext encryption key comprises user-network access terminal address frag info and the first value information of netkey, the 4th step user-network access terminal is according to its address fragment information and netkey initial value generating solution decryption key, and each networking response message of receiving of deciphering, by relatively deciphering the user-network access request message summary in the cleartext information of back, identify networking response message at oneself, find the terminal login token of assignment to oneself, the 5th step user-network access terminal sends the login message that comprises terminal login token information to the network insertion terminal, after the network insertion terminal is received the login message, comprise the terminal login token information of oneself distributing to prospective users in the checking login message, confirm that the user-network access terminal is legal.

The further improved method of the present invention is: the network insertion terminal by with user-network access terminal exchange message repeatedly, guarantee that same user's physical terminal can only be with unique identity accesses network resource, it is characterized in that, this method is divided into five steps with the information exchange between network insertion terminal and the user-network access terminal, first step network insertion terminal is with clear-text way broadcasting competition networking time window and netkey initial value, the user-network access terminal receives and writes down described competition networking time window and netkey initial value, the second step user-network access terminal generates the user key initial value, and in the competition networking time window of appointment, comprise the terminal address fragment of oneself and the networking request message of user key initial value with the clear-text way transmission, after the 3rd step network insertion terminal is received the networking request message that the user-network access terminal sends, be user-network access terminal distribution terminal login token, the networking response message that comprises user-network access request message summary and terminal login token with encrypted test mode broadcasting, described ciphertext encryption key comprises user-network access terminal address frag info, netkey is value information and the first value information of user key just, the 4th step user-network access terminal is according to its address fragment information, user key initial value and netkey initial value generating solution decryption key, and each networking response message of receiving of deciphering, by relatively deciphering the user-network access request message summary in the cleartext information of back, identify networking response message at oneself, find the terminal login token of assignment to oneself, the 5th step user-network access terminal sends the login message that comprises terminal login token information to the network insertion terminal, after the network insertion terminal is received the login message, comprise the terminal login token information of oneself distributing to prospective users in the checking login message, confirm that the user-network access terminal is legal.

The further improved method of the present invention is characterised in that: in the third step of described method, the network insertion terminal is except giving user-network access terminal distribution terminal login token, also distributing user access channel and networking time, and it is included in the networking response message, the user-network access terminal sends the login message that comprises this terminal login token information at the access channel of appointment with in the networking time to the network insertion terminal in the 5th step after finding to distribute to the terminal login token of oneself.

The further more improved method of the present invention is characterised in that: in the first step of described method, the network insertion terminal is except competing the networking time window with clear-text way broadcasting, also broadcast timing information, the user-network access terminal is according to the timing information Adjustment System clock that receives.

The feature of the improved method of the present invention also is: described netkey initial value is generated at random by the network insertion terminal, and described user key initial value is generated at random by the user-network access terminal.

The invention allows for a kind of communication system, comprise user-network access terminal and network insertion terminal, wherein network insertion terminal by with user-network access terminal switch information, guarantee that same user's physical terminal can only be with unique identity accesses network resource.Described network insertion terminal comprises: data source and sink (131), be used for clear-text way broadcasting competition networking time window, receive the networking request message that the user-network access terminal sends, comprising user-network access terminal address frag info, the login message that the networking response message of broadcast enciphering and reception user-network access terminal send; Microprocessor module (132) is used for after the networking request message that receives the transmission of user-network access terminal, is user-network access terminal distribution terminal login token; With after the login message that receives the transmission of user-network access terminal, comprise the terminal login token information of oneself distributing to prospective users in the checking login message, confirm that the user-network access terminal is legal; With crypto-operation co-processor module (136), be used for after the networking request message that receives the transmission of user-network access terminal, use the ciphertext encryption keys to comprise the networking response message of user-network access request message summary, terminal login token, described ciphertext encryption key comprises the user-network access terminal address frag info that comprises in the described networking request message.Described user-network access terminal comprises: data source and sink (113), be used to receive competition networking time window by the broadcasting of network insertion terminal, in going into the competition networking time window of network termination appointment, network sends the networking request message of the terminal address fragment that comprises oneself with clear-text way, receive each networking response message that the network insertion terminal sends, and send the login message that comprises terminal login token information to the network insertion terminal; Crypto-operation coprocessor (115) is used for according to described address fragment information generating solution decryption key, and deciphers each the networking response message that receives from the network insertion terminal; And microprocessor module (112), according to above-mentioned decrypted result, identify networking response message at oneself, find to distribute to the terminal login token information of oneself, and described terminal login token information is included in the described login message.

Improved communication system of the present invention comprises user-network access terminal and network insertion terminal, wherein network insertion terminal by with user-network access terminal switch information, guarantee that same user's physical terminal can only be with unique identity accesses network resource.Described network insertion terminal comprises: data source and sink (131), be used for clear-text way broadcasting competition networking time window and netkey initial value, receive the networking request message that the user-network access terminal sends, comprising user-network access terminal address frag info, the login message that the networking response message of broadcast enciphering and reception user-network access terminal send; Microprocessor module (132) is used for after the networking request message that receives the transmission of user-network access terminal, is user-network access terminal distribution terminal login token; With after the login message that receives the transmission of user-network access terminal, comprise the terminal login token information of oneself distributing to prospective users in the checking login message, confirm that the user-network access terminal is legal; With crypto-operation co-processor module (136), be used for after the networking request message that receives the transmission of user-network access terminal, use the ciphertext encryption keys to comprise the networking response message of user-network access request message summary, terminal login token, described ciphertext encryption key comprises user-network access terminal address frag info and the first value information of netkey that comprises in the described networking request message.Described user-network access terminal comprises: data source and sink (113), be used to receive competition networking time window and netkey initial value by the broadcasting of network insertion terminal, in going into the competition networking time window of network termination appointment, network sends the networking request message of the terminal address fragment that comprises oneself with clear-text way, receive each networking response message that the network insertion terminal sends, and send the login message that comprises terminal login token information to the network insertion terminal; Random data memory (114) is used to store described netkey initial value; Crypto-operation coprocessor (115) is used for according to described address fragment information and described netkey initial value generating solution decryption key, and deciphers each the networking response message that receives from the network insertion terminal; And microprocessor module (112), according to above-mentioned decrypted result, identify networking response message at oneself, find to distribute to the terminal login token information of oneself, and described terminal login token information is included in the described login message.

The communication system of further improvement of the present invention comprises user-network access terminal and network insertion terminal, wherein network insertion terminal by with user-network access terminal switch information, guarantee that same user's physical terminal can only be with unique identity accesses network resource.Described network insertion terminal comprises: data source and sink (131), be used for clear-text way broadcasting competition networking time window and netkey initial value, receive the networking request message that the user-network access terminal sends, comprising user-network access terminal address frag info and the first value information of user key, the login message that the networking response message of broadcast enciphering and reception user-network access terminal send; Microprocessor module (132) is used for after the networking request message that receives the transmission of user-network access terminal, is user-network access terminal distribution terminal login token; With after the login message that receives the transmission of user-network access terminal, comprise the terminal login token information of oneself distributing to prospective users in the checking login message, confirm that the user-network access terminal is legal; With crypto-operation co-processor module (136), be used for after the networking request message that receives the transmission of user-network access terminal, use the ciphertext encryption keys to comprise the networking response message of user-network access request message summary, terminal login token, described ciphertext encryption key comprises user-network access terminal address frag info, user key just value information and the first value information of netkey.Described user-network access terminal comprises: data source and sink (113), be used to receive competition networking time window and netkey initial value by the broadcasting of network insertion terminal, in network is gone into the competition networking time window of network termination appointment, send and comprise the terminal address fragment of oneself and the networking request message of user key initial value with clear-text way, receive each networking response message that the network insertion terminal sends, and send the login message that comprises terminal login token information to the network insertion terminal; Random data memory (114) is used to store described netkey initial value; Crypto-operation coprocessor (115) is used for according to described address fragment information, the first value information of user key and the first value information generating solution decryption key of netkey, and deciphers each the networking response message that receives from the network insertion terminal; And microprocessor module (112), according to above-mentioned decrypted result, identify networking response message at oneself, find to distribute to the terminal login token information of oneself, and described terminal login token information is included in the described login message.

The invention has the advantages that:

1. can resist Denial of Service attack:

The network insertion terminal of providing services on the Internet among the present invention receives only the plaintext message that user side is sent, and the amount of calculation of analyzing and handle message is little, receives work of treatment and can be done in real time, and also can not transship even arrive a large amount of application messages.

The network insertion terminal only need keep few user state informations such as user terminal address fragment, terminal login token, user key initial value, predesignated subscriber's login time, and these information only need keep from receiving that the user applies message is to the very short time predesignated subscriber's login time, the user state information of overtime can be removed immediately, therefore the buffer memory spillover can not occur.

Cryptographic calculation only need carry out at the actual application response message data of sending of needs, and only need adopt the very fast symmetric encipherment algorithm of computational speed, even be not can realize real-time operation, can not cause the treating capacity overload because having carried out crypto-operation with hardware-accelerated yet.

2. a plurality of terminal identity very expensive of user counterfeit:

The network insertion terminal uses encrypted test mode to send the networking response message in the 3rd step of the present invention.The user must use and the corresponding decruption key of own terminal address identifier, each networking response message that real time decrypting is received, could obtain information such as user terminal login token, access channel and networking time, proceed later information exchange step.For the user who has palmed off a plurality of physical terminal identity, it must use a plurality of decruption keys corresponding with a plurality of terminal address identifiers simultaneously, each networking response message that real-time parallel deciphering is simultaneously received.When the physical terminal number of personation increased, amount of calculation and memory data output increased superlinearity, to the requirement of real-time operation ability also with the corresponding raising of ratio near quadratic relationship.For example for a user terminal of palming off 100 false terminals, the network insertion terminal that its influence just makes design serve 1000 networking login users has simultaneously increased by 10% live load, moment enters fuller operating state at the most, but disabled user's terminal oneself has been produced nearly ten thousand times amount of calculation and memory data output requirement.

3. the scope of application is extensive:

The information exchange that five steps of the present invention are carried out is all supposed under unsafe broadcast environment and is carried out.If under the router network environment, the broadcast message of network insertion terminal can be sent to the router at terminal use place smoothly by the broadcasting route of router, is broadcast to the user terminal of application authentication.Therefore no matter be that the wireless communication network environments of broadcast-type or the cable network environment of shared bus can operate as normal, can be used to adopt the isomery hybrid network of multiple network technology, play effectively and stop the purpose that the unique user terminal is palmed off a plurality of false terminals, need not the hypothetical network structure type is specific route network.Compare with traditional authentication method based on " sweet cake exchange ", " sweet cake exchange " authentication protocol has only when user terminal and certificate server during not in same routing broadcast territory, personation address user terminal just can not receive " the sweet cake " that certificate server sends, and authentication method is just effective.The present invention program does not suppose provides personation physical terminal address user terminal can not receive replying of network insertion terminal, does not therefore have the restriction of " sweet cake exchange " agreement to the route broadcast domain.

4. be easy to combine with other identity identifying technologies:

Most of identity identifying technologies all need to use the great asymmetric cryptographic algorithm of amount of calculation, perhaps use complicated key distribution technology.If can not guarantee verification process in advance is to carry out in real time one to one, be easy to cause Denial of Service attack.Network insertion terminal of the present invention need not to know in advance that Any user goes into the knowledge of network termination, just can stop single terminal and palm off a plurality of physical terminal identity, do not need other common identity identifying technologies to make any change, just can remedy and be easy to the deficiency that the service of going whistle is attacked.

5. easy to implement:

Adopt method of the present invention, only need between user-network access terminal and network insertion terminal, divide 5 steps, carry out round message switching 2 times, just can finish terminal uniqueness identification work.All working only needs a common embedded microprocessor system just can be competent at.If employing personal computer system or other high-performance computer systems realize then are convenient.

Description of drawings

Fig. 1 is one embodiment of the invention system configuration and data information transfer schematic diagram.

Fig. 2 is method step of the present invention and each step institute transfer data information schematic diagram.

Fig. 3 is the improved method step of the present invention and each step institute transfer data information schematic diagram.

Fig. 4 is the further improved method step of the present invention and each step institute transfer data information schematic diagram.

Fig. 5 is used for network insertion terminal timing information broadcast frame content of the present invention to constitute schematic diagram.

Fig. 6 is used for the improved timing information broadcast frame of network insertion terminal of the present invention content to constitute schematic diagram.

Fig. 7 is used for user-network access terminal networking request message content schematic diagram of the present invention.

Fig. 8 is used for the improved networking request message of user-network access terminal of the present invention content schematic diagram.

Fig. 9 is the network entry response message content schematic diagram that is used for network insertion terminal of the present invention.

Figure 10 is the login authentication message content schematic diagram that is used for user-network access terminal of the present invention.

Figure 11 is improved embodiment system configuration of the present invention and data information transfer schematic diagram.

Figure 12 is further improved embodiment system configuration of the present invention and data information transfer schematic diagram.

Specific embodiments

Embodiment of the present invention are as follows:

One embodiment of the invention system as shown in Figure 1, comprising user-network access terminal 11, network insertion terminal 13, and the transmission link 12 between user-network access terminal 11 and network insertion terminal 13, described user-network access terminal 11 inside comprise user terminal config memory 111 again, microprocessor module 112, data source and sink 113 and random data memory 114, described network insertion terminal 13 comprises data source and sink 131 again, microprocessor module 132, gateway transceiver module 133, network insertion terminal configuration memory 134 and login user database module 135.

An improved embodiment system of the present invention as shown in figure 11, comprising user-network access terminal 11A, network insertion terminal 13A, and the transmission link 12 between user-network access terminal and the network insertion terminal, described user-network access terminal 11A inside comprises user terminal config memory 111 again, microprocessor module 112, data source and sink 113, random data memory 114 and crypto-operation coprocessor 115, described network insertion terminal 13A comprises data source and sink 131 again, microprocessor module 132, data transmit-receive module 133 between net, network insertion terminal configuration memory 134, login user database module 135 and crypto-operation co-processor module 136.

The further improved embodiment of the present invention system as shown in figure 12, comprising user-network access terminal 11B, network insertion terminal 13B, and the transmission link 12 between user-network access terminal and the network insertion terminal, described user-network access terminal 11B inside comprises data source and sink 113 again, system broadcasts receiving system 11B2, networking request unit 11B3, deciphering searcher 11B4, login authentication dispensing device 11B5 and random data memory 114, described network insertion terminal 13B comprises data source and sink 131 again, fixed time broadcast device 13B2, networking answering device 13B3, message encryption device 13B4, login authentication device 13B5 and login user database module 135.

First embodiment

The login process that is connected between user-network access terminal 11 and the network insertion terminal 13 comprises as shown in Figure 2 step S11-S15.

The user-network access terminal is used the network service for logging in network, and the first step (S11) is a fixed time broadcast of listening to the network insertion terminal.Microprocessor module 132 in the network insertion terminal 13 takes out configuration parameters such as airtime interval and current system time from config memory 134, determine a period of time as competition networking time window according to the current network traffic carrying capacity, then by data source and sink 131 with the broadcasting of clear-text way ground.Timing information 211 and other broadcast parameters 214 that message 21 contents of broadcasting comprise determined competition networking time window 213, determine according to system time.After user-network access terminal 11 is received broadcasting packet 21 from data source and sink 113, under the control of microprocessor module 112, according to the timing information 211 preliminary system clocks of adjusting oneself, the current competition networking time window of receiving 213 of record in random data memory 114 simultaneously.

Second step (S12), user-network access terminal 11 is under the control of microprocessor module 112, in random data memory 114, in the competition networking time window 213 of record, send networking request message 22 with clear-text way to network insertion terminal 13 by data source and sink 113.Comprise user-network access terminal address fragment 221 and out of Memory 223 in the described networking request message 22.Microprocessor module 112 calculates the summary 224 of networking request message 22 and deposits in the random data memory 114 subsequently.

Third step (S13), after network insertion terminal 13 is received networking request message 22 from data source and sink 131, channel resource according to record in configuration of the system channel in the network insertion terminal configuration memory 134 and the login user database module 135 takies situation, be user-network access terminal 11 distributing terminals login token 232, user-network access channel 233 and the networking time 234, and be recorded in the login user database module 135, microprocessor module 132 also calculates the summary 231 of user-network access request message 22, and forms network entry response message 23.Comprise user-network access request message summary 231, terminal login token 232, user-network access channel 233, user-network access time 234 and out of Memory 235 in the described network entry response message 23.Form broadcasting with ciphertext comprises user-network access request message summary 231, the networking response message 230 of terminal login token 232, user-network access channel 233 and user-network access time 234, the frag info 221 that employed ciphertext encryption key is the user-network access terminal address then.

The 4th step (S14), user-network access terminal 11 is whenever received a network entry response message ciphertext 230, the decruption key of all attempting using user-network access terminal oneself (being the frag info 221 of user-network access terminal address) obtains network entry response message plaintext 23 to 230 deciphering of network entry response message ciphertext.Microprocessor module 112 in the user-network access terminal 11, the network entry response message that obtains by the networking request message summary 224 preserved in the random data memory 114 relatively and the deciphering expressly user-network access request message in 23 is made a summary and 231 is consistent, identify at own networking response message, obtain 13 assignments of network insertion terminal and give oneself terminal login token 232, user-network access channel 233, user-network access time 234, deposit random data memory 114 in.

The 5th step (S15), microprocessor module 112 control data R-T units 113 send login authentication message 24 in the access channel 233 and the networking time 234 of appointment to network insertion terminal 13.Described login authentication message 24 comprises terminal login token 232 and the out of Memory 242 that network insertion terminal 13 is issued, and this terminal login token 232 in the login authentication message 24 is represented as 241.Network insertion terminal 13 is in predetermined access channel 233 and networking time 234, after receiving the login authentication message 24 that user-network access terminal 11 beams back from data source and sink 131, microprocessor module 132 is consistent by relatively being kept at terminal login token 241 information that comprise in terminal login token 232 information and the login authentication message 24 in the login user database module 135, and affirmation user-network access terminal is legal.

Through above-mentioned steps S1-S5, network insertion terminal 13 has been finished the physics uniqueness authentication to user-network access terminal 11, can provide needed other network services for user-network access terminal 11, as by data transmit-receive module 133 between net to other target node data, maybe will give user-network access terminal 11 from the data forwarding of other network nodes of receiving of data transmit-receive module 133 between net.

Second embodiment

In order to improve the physics uniqueness authenticating safety of user-network access terminal, can do following improvement, step S21-S25 as shown in Figure 3 with the login process that is connected between the network insertion terminal 13 to user-network access terminal 11.The user-network access terminal is used the network service for logging in network, and the first step (S21) is a fixed time broadcast of listening to the network insertion terminal.Microprocessor module 132 in the network insertion terminal 13 takes out configuration parameters such as airtime interval and current system time from config memory 134, calculate a netkey initial value at random, determine that according to the current network traffic carrying capacity a period of time as competition networking time window, broadcasts with clear-text way by data source and sink 131 subsequently.Timing information 211 and other broadcast parameters 214 that message 21 contents of broadcasting comprise the determined netkey initial value of this fixed time broadcast 212 and competition networking time window 213, determine according to system time.After user-network access terminal 11 is whenever received a broadcasting packet 21 from data source and sink 113, all under the control of microprocessor module 112, according to the timing information 211 preliminary system clocks of adjusting oneself, in random data memory 114, write down current netkey initial value of receiving 212 and competition networking time window 213 simultaneously.

Second step (S22), user-network access terminal 11 send networking request message 22 with clear-text way to network insertion terminal 13 by data source and sink 113 in the competition networking time window 213 that random data memory 114 is write down.Comprise user-network access terminal address fragment 221 and out of Memory 223 in the described networking request message 22.Microprocessor module 112 calculates the summary 224 of networking request message 22 and deposits in the random data memory 114 subsequently.

Third step (S23), after network insertion terminal 13 is received networking request message 22 from data source and sink 131, channel resource according to record in configuration of the system channel in the network insertion terminal configuration memory 134 and the login user database module 135 takies situation, be user-network access terminal 11 distributing terminals login token 232, user-network access channel 233 and the networking time 234, and record in the login user database module 135, microprocessor module 132 also calculates the summary 231 of user-network access request message 22, and forms network entry response message 23.Comprise user-network access request message summary 231, terminal login token 232, user-network access channel 233, user-network access time 234 and out of Memory 235 in the described network entry response message 23.Microprocessor module 132 is selected the suitable fixed time broadcast cycle then, write down a symmetrical encryption and decryption key K of the common generation of netkey initial value 212, use user-network access terminal address fragment 221 and netkey initial value 212 information in this fixed time broadcast cycle, and use this symmetric key K that network entry response message 23 is encrypted, the ciphertext 230 that is generated is broadcast to user-network access terminal 11 by data source and sink 131.

The 4th step (S24), user-network access terminal 11 use in user-network access terminal address fragments 221, the random data memory 114 netkey initial value 212 information and with network insertion terminal 13 corresponding algorithm, produce a symmetrical encryption and decryption key K, each network entry response message ciphertext 230 of receiving with this symmetric key K deciphering obtains network entry response message plaintext 23 then.Microprocessor module 112 in the user-network access terminal 11, the network entry response message that obtains by the networking request message summary 224 preserved in the random data memory 114 relatively and the deciphering expressly user-network access request message in 23 is made a summary and 231 is consistent, identify networking response message at oneself, obtain 13 assignments of network insertion terminal and give oneself terminal login token 232, user-network access channel 233, user-network access time 234, and deposit random data memory 114 in.

The 5th step (S25) microprocessor module 112 control data R-T units 113 send login authentication message 24 in the access channel 233 and the networking time 234 of appointment to network insertion terminal 13.Described login authentication message 24 comprises terminal login token 232 and the out of Memory 242 that network insertion terminal 13 is issued, and this terminal login token 232 in the login authentication message 24 is represented as 241.Network insertion terminal 13 is in predetermined access channel 233 and networking time 234, after receiving the login authentication message 24 that user-network access terminal 11 beams back from data source and sink 131, microprocessor module 132 is consistent by relatively being kept at terminal login token 241 information that comprise in terminal login token 232 information and the login authentication message 24 in the login user database module 135, and affirmation user-network access terminal is legal.

Through above-mentioned steps S21-S25, network insertion terminal 13 has been finished the physics uniqueness authentication to user-network access terminal 11.

The 3rd embodiment

In order further to improve the physics uniqueness authenticating safety of user-network access terminal, can also do following improvement, step S31-S35 as shown in Figure 3 with the login process that is connected between the network insertion terminal 13 to user-network access terminal 11.

The user-network access terminal is used the network service for logging in network, and the first step (S31) is a fixed time broadcast of listening to the network insertion terminal.Microprocessor module 132 in the network insertion terminal 13 takes out configuration parameters such as airtime interval and current system time from config memory 134, calculate a netkey initial value at random, determine that according to the current network traffic carrying capacity a period of time as competition networking time window, broadcasts with clear-text way by data source and sink 131 subsequently.Timing information 211 and other broadcast parameters 214 that message 21 contents of broadcasting comprise the determined netkey initial value of this fixed time broadcast 212 and competition networking time window 213, determine according to system time.After user-network access terminal 11 is whenever received a broadcasting packet 21 from data source and sink 113, all under the control of microprocessor module 112, according to the timing information 211 preliminary system clocks of adjusting oneself, in random data memory 114, write down current netkey initial value of receiving 212 and competition networking time window 213 simultaneously.

Second step (S32), user-network access terminal 11 is taken out terminal address from user terminal config memory 111, and intercepting part fragment 221 wherein produces a user key initial value 222 more at random.Then in random data memory 114, in the competition networking time window 213 of record, send networking request message 22 with clear-text way to network insertion terminal 13 by data source and sink 113.Comprise user-network access terminal address fragment 221, user key initial value 222 and out of Memory 223 in the described networking request message 22.Microprocessor module 112 calculates the summary 224 of networking request message 22 and deposits in the random data memory 114 subsequently.

Third step (S33), after network insertion terminal 13 is received networking request message 22 from data source and sink 131, channel resource according to record in configuration of the system channel in the network insertion terminal configuration memory 134 and the login user database module 135 takies situation, be user-network access terminal 11 distributing terminals login token 232, user-network access channel 233 and the networking time 234, and record in the login user database module 135, microprocessor module 132 also calculates the summary 231 of user-network access request message 22, and forms network entry response message 23.Comprise user-network access request message summary 231, terminal login token 232, user-network access channel 233, user-network access time 234 and out of Memory 235 in the described network entry response message 23.Microprocessor module 132 is selected the suitable fixed time broadcast cycle then, write down the netkey initial value 212 in this fixed time broadcast cycle, use symmetrical encryption and decryption key K of the common generation of user-network access terminal address fragment 221, user key initial value 222 and netkey initial value 212 information, and use this symmetric key K that network entry response message 23 is encrypted, the ciphertext 230 that is generated is broadcast to user-network access terminal 11 by data source and sink 131.

The 4th step (S34), user-network access terminal 11 use in user-network access terminal address fragments 221, user key initial value 222, the random data memory 114 netkey initial value 212 information and with network insertion terminal 13 corresponding algorithm, produce a symmetrical encryption and decryption key K, each network entry response message ciphertext 230 of receiving with this symmetric key K deciphering obtains network entry response message plaintext 23 then.Microprocessor module 112 in the user-network access terminal 11, the network entry response message that obtains by the networking request message summary 224 preserved in the random data memory 114 relatively and the deciphering expressly user-network access request message in 23 is made a summary and 231 is consistent, identify networking response message at oneself, obtain 13 assignments of network insertion terminal and give oneself terminal login token 232, user-network access channel 233, user-network access time 234, and deposit random data memory 114 in.

The 5th step (S35) microprocessor module 112 control data R-T units 113 send login authentication message 24 in the access channel 233 and the networking time 234 of appointment to network insertion terminal 13.Described login authentication message 24 comprises terminal login token 232 and the out of Memory 242 that network insertion terminal 13 is issued, and this terminal login token 232 in the login authentication message 24 is represented as 241.Network insertion terminal 13 is in predetermined access channel 233 and networking time 234, after receiving the login authentication message 24 that user-network access terminal 11 beams back from data source and sink 131, microprocessor module 132 is consistent by relatively being kept at terminal login token 241 information that comprise in terminal login token 232 information and the login authentication message 24 in the login user database module 135, and affirmation user-network access terminal is legal.

Through above-mentioned steps S31-S35, network insertion terminal 13 has been finished the physics uniqueness authentication to user-network access terminal 11.

In the second and the 3rd step (S12 and S13, S22 and S23, S32 and S33) of above-mentioned five steps, user-network access terminal 11 must be calculated networking request message summary 224 and 231 with identical method with network insertion terminal 13.Concrete computational methods can have multiple choices, and the part of this selection as other information 223 is included in the networking request message 22.Part fragment that for example can selected parts networking request message, typically can choose user-network access terminal physical address fragment 221, perhaps user-network access terminal physical address fragment 221 adds user key initial value 222, and perhaps preceding (or back) several bytes of user-network access terminal physical address fragment 221 are added the user key initial value; It also can be any computing to networking request message content, cyclic redundancy check (CRC) such as the networking request message, the perhaps MD5 hashed value of user-network access terminal physical address fragment 221, be encryption key perhaps, to the cryptographic calculation result of user-network access terminal physical address fragment with user key initial value 222.Usually can only stipulate a kind of straightforward procedure of calculating summary, thereby reduce the data volume that must comprise in the networking request message 22, reach the purpose of simplifying implementation complexity.

In third and fourth step (S13 and S14, S23 and S24, S33 and S34) of above-mentioned five steps, network insertion terminal 13 must adopt identical symmetric key enciphering and deciphering algorithm with user-network access terminal 11.Concrete symmetric key encryption and decryption crypto-operation algorithm can have multiple choices, and the part of this selection as other broadcast messages 214 is included in the fixed time broadcast message 21 of step S1.For example can select very classical international standard cryptographic algorithm RC4, DES, 3DES, IDEA, AES, etc., also can be newly-designed certain unexposed cryptographic algorithm.

When the higher cryptographic algorithm of the intensity that adopts,

microprocessor module

112 and 132 operational capability may be difficult to meet the demands, and can adopt system realization scheme shown in Figure 7 this moment.Wherein increase crypto-operation co-processor module 115 among the user-network access terminal 11A, in network insertion terminal 13A, increased crypto-operation co-processor module 136.In the above five step, all need carry out the work of crypto-operation can hand to the execution of crypto-operation co-processor module by microprocessor module control.

The 4th embodiment

The user-network access terminal is used the network service for logging in network, and the first step (S11) is a fixed time broadcast of listening to the network insertion terminal.Fixed time broadcast device 13B2 among the network insertion terminal 13B determines that according to the current network traffic carrying capacity a period of time is as competition networking time window, subsequently by data source and sink 131, with clear-text way broadcasting " system's fixed time broadcast message ".Timing information 211 and other broadcast parameters 214 that message 21 contents of broadcasting comprise determined competition networking time window 213, determine according to system time.System broadcasts receiving system 11B2 whenever receives a broadcasting packet 21 from data source and sink 113, deliver to 114 preservations of random data memory all according to the timing information 211 preliminary system clocks of adjusting oneself, and with current competition networking time window 213 information of receiving.

Second step (S12), user-network access terminal networking request unit 11B3 is in the competition networking time window 213 that random data memory 114 is write down, send networking request messages 22 with clear-text way to network insertion terminal 13 by data source and sink 113, calculate the summary 224 of networking request message 22 simultaneously and deposit in the random data memory 114.Comprise user-network access terminal address fragment 221 and out of Memory 223 in the described networking request message 22.

Third step (S13), after network insertion terminal 13B receives networking request message 22 from data source and sink 131, networking answering device 13B3 takies situation according to the channel resource of record in the login user database module 135, be user-network access terminal 11B distributing terminals login token 232, user-network access channel 233 and the networking time 234, and be recorded in the login user database module 135; Calculate the summary 231 of user-network access request message 22, and form network entry response message 23.Comprise user-network access request message summary 231, terminal login token 232, user-network access channel 233, user-network access time 234 and out of Memory 235 in the described network entry response message 23.Message encryption device 13B4 is an encryption key with the frag info 221 of user-network access terminal address then, and network entry response message 23 is encrypted, and the ciphertext 230 of generation is broadcasted to user-network access terminal 11B by data source and sink 131.

The 4th step (S14), user-network access terminal 11B whenever receives a network entry response message ciphertext 230, deciphering searcher 11B4 attempts using the decruption key (being the frag info 221 of user-network access terminal address) of user-network access terminal oneself to 230 deciphering of network entry response message ciphertext, obtains network entry response message plaintext 23.If the user-network access request message summary 231 in the network entry response message that deciphering the obtains plaintext 23, be consistent with the networking request message summary of preserving in the random data memory 114 224, then decipher searcher 11B4 judgement and received the networking response message of issuing user-network access terminal 11B oneself, thereby obtain 13 assignments of network insertion terminal and give terminal login token 232, user-network access channel 233, the user-network access time 234 of oneself, deposit random data memory 114 in.

The 5th step (S15), login authentication dispensing device 11B5 in the access channel 233 and the networking time 234 of appointment, sends login authentication message 24 to network insertion terminal 13B by data source and sink 113.Described login authentication message 24 comprises terminal login token 232 and the out of Memory 242 that network insertion terminal 13 is issued, and this terminal login token 232 in the login authentication message 24 is represented as 241.Network insertion terminal 13B is in predetermined access channel 233 and networking time 234, after receiving the login authentication message 24 that user-network access terminal 11B beams back from data source and sink 131, login authentication device 13B5 is consistent by relatively being kept at terminal login token 241 information that comprise in terminal login token 232 information and the login authentication message 24 in the login user database module 135, and affirmation user-network access terminal is legal.

Through above-mentioned steps S1-S5, the network insertion terminal has been finished the physics uniqueness authentication to the user-network access terminal, can provide needed other network services for the user-network access terminal, as by data transmit-receive module 133 between net to other target node data, maybe will give the user-network access terminal from the data forwarding of other network nodes of receiving of data transmit-receive module 133 between net.

The 5th embodiment

In order to improve the physics uniqueness authenticating safety of user-network access terminal, can do following improvement, step S21-S25 as shown in Figure 3 with the login process that is connected between the network insertion terminal 13 to user-network access terminal 11.

The user-network access terminal is used the network service for logging in network, and the first step (S21) is a fixed time broadcast of listening to the network insertion terminal.Fixed time broadcast device 13B2 among the network insertion terminal 13B calculates a netkey initial value at random, determines that according to the current network traffic carrying capacity a period of time as competition networking time window, broadcasts with clear-text way by data source and sink 131 subsequently.Timing information 211 and other broadcast parameters 214 that message 21 contents of broadcasting comprise the determined netkey initial value of this fixed time broadcast 212 and competition networking time window 213, determine according to system time.System broadcasts receiving system 11B2 whenever receives a broadcasting packet 21 from data source and sink 113, all, in random data memory 114, write down current netkey initial value of receiving 212 and competition networking time window 213 simultaneously according to the timing information 211 preliminary system clocks of adjusting oneself.

Second step (S22), networking request unit 11B3 in the user-network access terminal is in the competition networking time window 213 that random data memory 114 is write down, send networking request message 22 with clear-text way to network insertion terminal 13 by data source and sink 113, and the summary 224 of networking request message 22 is deposited in the random data memory 114.Comprise user-network access terminal address fragment 221 and out of Memory 223 in the described networking request message 22.

Third step (S23), after network insertion terminal 13B receives networking request message 22 from data source and sink 131, networking answering device 13B3 takies situation according to the channel resource of record in the login user database module 135, be user-network access terminal 11B distributing terminals login token 232, user-network access channel 233 and the networking time 234, and record in the login user database module 135; Calculate the summary 231 of user-network access request message 22, and form network entry response message 23.Comprise user-network access request message summary 231, terminal login token 232, user-network access channel 233, user-network access time 234 and out of Memory 235 in the described network entry response message 23.Message encryption device 13B4 selects the suitable fixed time broadcast cycle then, write down the netkey initial value 212 in this fixed time broadcast cycle, use symmetrical encryption and decryption key K of the common generation of user-network access terminal address fragment 221 and netkey initial value 212 information, and use this symmetric key K that network entry response message 23 is encrypted, the ciphertext 230 that is generated is broadcast to user-network access terminal 11B by data source and sink 131.

The 4th step (S24), user-network access terminal 11B whenever receives a network entry response message ciphertext 230, deciphering searcher 11B4 all use in user-network access terminal address fragment 221, the random data memory 114 netkey initial value 212 information and with network insertion terminal 13 corresponding algorithm, produce a symmetrical encryption and decryption key K, the network entry response message ciphertext of receiving with this symmetric key K deciphering 230 obtains network entry response message plaintext 23 then.The network entry response message that deciphering searcher 11B4 obtains by the networking request message summary 224 preserved in the random data memory 114 relatively and the deciphering expressly user-network access request message in 23 is made a summary and 231 is consistent, identify networking response message at user-network access terminal 11B oneself, obtain 13 assignments of network insertion terminal and give oneself terminal login token 232, user-network access channel 233, user-network access time 234, and deposit random data memory 114 in.

The 5th step (S25), login authentication dispensing device 11B5 in the access channel 233 and the networking time 234 of appointment, sends login authentication message 24 to network insertion terminal 13B by data source and sink 113.Described login authentication message 24 comprises terminal login token 232 and the out of Memory 242 that network insertion terminal 13B issues, and this terminal login token 232 in the login authentication message 24 is represented as 241.Network insertion terminal 13B is in predetermined access channel 233 and networking time 234, after receiving the login authentication message 24 that user-network access terminal 11B beams back from data source and sink 131, login authentication device 13B5 is consistent by relatively being kept at terminal login token 241 information that comprise in terminal login token 232 information and the login authentication message 24 in the login user database module 135, and affirmation user-network access terminal is legal.

The 6th embodiment

The user-network access terminal is used the network service for logging in network, and the first step (S31) is a fixed time broadcast of listening to the network insertion terminal.Fixed time broadcast device 13B2 among the network insertion terminal 13B calculates a netkey initial value at random, determines that according to the current network traffic carrying capacity a period of time as competition networking time window, broadcasts with clear-text way by data source and sink 131 subsequently.Timing information 211 and other broadcast parameters 214 that message 21 contents of broadcasting comprise the determined netkey initial value of this fixed time broadcast 212 and competition networking time window 213, determine according to system time.System broadcasts receiving system 11B2 whenever receives a broadcasting packet 21 from data source and sink 113, all, in random data memory 114, write down current netkey initial value of receiving 212 and competition networking time window 213 simultaneously according to the timing information 211 preliminary system clocks of adjusting oneself.

Second step (S32), networking request unit 11B3 among the user-network access terminal 11B produces earlier a user key initial value 222 at random, then in the competition networking time window 213 that random data memory 114 is write down, send networking request message 22 with clear-text way to network insertion terminal 13B by data source and sink 113, calculate the summary 224 of networking request message 22 simultaneously and deposit in the random data memory 114.Comprise user-network access terminal address fragment 221, user key initial value 222 and out of Memory 223 in the described networking request message 22.

Third step (S33), after network insertion terminal 13B receives networking request message 22 from data source and sink 131, networking answering device 13B3 takies situation according to the channel resource of record in the login user database module 135, be user-network access terminal 11B distributing terminals login token 232, user-network access channel 233 and the networking time 234, and record in the login user database module 135; Calculate the summary 231 of user-network access request message 22, and form network entry response message 23.Comprise user-network access request message summary 231, terminal login token 232, user-network access channel 233, user-network access time 234 and out of Memory 235 in the described network entry response message 23.Message encryption device 13B4 selects the suitable fixed time broadcast cycle then, write down the netkey initial value 212 in this fixed time broadcast cycle, use symmetrical encryption and decryption key K of the common generation of user-network access terminal address fragment 221, user key initial value 222 and netkey initial value 212 information, and use this symmetric key K that network entry response message 23 is encrypted, the ciphertext 230 that is generated is broadcast to user-network access terminal 11B by data source and sink 131.

The 4th step (S34), user-network access terminal 11B whenever receives a network entry response message ciphertext 230, deciphering searcher 11B4 all use in user-network access terminal address fragment 221, user key initial value 222, the random data memory 114 netkey initial value 212 information and with network insertion terminal 13 corresponding algorithm, produce a symmetrical encryption and decryption key K, the network entry response message ciphertext of receiving with this symmetric key K deciphering 230 obtains network entry response message plaintext 23 then.The network entry response message that deciphering searcher 11B4 obtains by the networking request message summary 224 preserved in the random data memory 114 relatively and the deciphering expressly user-network access request message in 23 is made a summary and 231 is consistent, identify networking response message at user-network access terminal 11B oneself, obtain network insertion terminal 13B assignment and give oneself terminal login token 232, user-network access channel 233, user-network access time 234, and deposit random data memory 114 in.

The 5th step (S35), login authentication dispensing device 11B5 in the access channel 233 and the networking time 234 of appointment, sends login authentication message 24 to network insertion terminal 13B by data source and sink 113.Described login authentication message 24 comprises terminal login token 232 and the out of Memory 242 that network insertion terminal 13B issues, and this terminal login token 232 in the login authentication message 24 is represented as 241.Network insertion terminal 13B is in predetermined access channel 233 and networking time 234, after receiving the login authentication message 24 that user-network access terminal 11B beams back from data source and sink 131, login authentication device 13B5 is consistent by relatively being kept at terminal login token 241 information that comprise in terminal login token 232 information and the login authentication message 24 in the login user database module 135, and affirmation user-network access terminal is legal.

The concrete function of data source and sink in data source and sink, microprocessor module, crypto-operation co-processor module and the user-network access terminal in the network insertion terminal, microprocessor module, crypto-operation co-processor module is described below, understands the present invention to help those skilled in the art.

Data source and sink 131 in the network insertion terminal, be used for clear-text way broadcasting competition networking time window, receive the networking request message that the user-network access terminal sends, comprising user-network access terminal address frag info, the login message that the networking response message of broadcast enciphering and reception user-network access terminal send.Microprocessor module 132 in the network insertion terminal is used for after the networking request message that receives the transmission of user-network access terminal, is user-network access terminal distribution terminal login token; With after the login message that receives the transmission of user-network access terminal, comprise the terminal login token information of oneself distributing to prospective users in the checking login message, confirm that the user-network access terminal is legal.Crypto-operation co-processor module 136 in the network insertion terminal, be used for after the networking request message that receives the transmission of user-network access terminal, use the ciphertext encryption keys to comprise the networking response message of user-network access request message summary, terminal login token, described ciphertext encryption key comprises the user-network access terminal address frag info that comprises in the described networking request message.

Data source and sink 113 in the user-network access terminal, be used to receive competition networking time window by the broadcasting of network insertion terminal, in going into the competition networking time window of network termination appointment, network sends the networking request message of the terminal address fragment that comprises oneself with clear-text way, receive each networking response message that the network insertion terminal sends, and send the login message that comprises terminal login token information to the network insertion terminal.Crypto-operation coprocessor 115 is used for according to described address fragment information generating solution decryption key, and deciphers each the networking response message that receives from the network insertion terminal.Microprocessor module 112 according to above-mentioned decrypted result, identifies the networking response message at oneself, finds to distribute to the terminal login token information of oneself, and described terminal login token information is included in the described login message.

As improvement, data source and sink 131 in the network insertion terminal, be used for clear-text way broadcasting competition networking time window and netkey initial value, receive the networking request message that the user-network access terminal sends, comprising user-network access terminal address frag info, the login message that the networking response message of broadcast enciphering and reception user-network access terminal send.Microprocessor module 132 is used for after the networking request message that receives the transmission of user-network access terminal, is user-network access terminal distribution terminal login token; With after the login message that receives the transmission of user-network access terminal, comprise the terminal login token information of oneself distributing to prospective users in the checking login message, confirm that the user-network access terminal is legal.Crypto-operation co-processor module 136, be used for after the networking request message that receives the transmission of user-network access terminal, use the ciphertext encryption keys to comprise the networking response message of user-network access request message summary, terminal login token, described ciphertext encryption key comprises user-network access terminal address frag info and the first value information of netkey that comprises in the described networking request message.

Data source and sink 113 in the user-network access terminal, be used to receive competition networking time window and netkey initial value by the broadcasting of network insertion terminal, in going into the competition networking time window of network termination appointment, network sends the networking request message of the terminal address fragment that comprises oneself with clear-text way, receive each networking response message that the network insertion terminal sends, and send the login message that comprises terminal login token information to the network insertion terminal.Random data memory 114 is used to store described netkey initial value.Crypto-operation coprocessor 115 is used for according to described address fragment information and described netkey initial value generating solution decryption key, and deciphers each the networking response message that receives from the network insertion terminal.Microprocessor module 112 according to above-mentioned decrypted result, identifies the networking response message at oneself, finds to distribute to the terminal login token information of oneself, and described terminal login token information is included in the described login message.

As further improvement, data source and sink 131 in the network insertion terminal, be used for clear-text way broadcasting competition networking time window and netkey initial value, receive the networking request message that the user-network access terminal sends, comprising user-network access terminal address frag info and the first value information of user key, the login message that the networking response message of broadcast enciphering and reception user-network access terminal send.Microprocessor module 132, be used for after the networking request message that receives the transmission of user-network access terminal, be user-network access terminal distribution terminal login token, with after the login message that receives the transmission of user-network access terminal, comprise the terminal login token information of oneself distributing to prospective users in the checking login message, confirm that the user-network access terminal is legal.Crypto-operation co-processor module 136, be used for after the networking request message that receives the transmission of user-network access terminal, use the ciphertext encryption keys to comprise the networking response message of user-network access request message summary, terminal login token, described ciphertext encryption key comprises user-network access terminal address frag info, user key just value information and the first value information of netkey.

Data source and sink 113 in the user-network access terminal, be used to receive competition networking time window and netkey initial value by the broadcasting of network insertion terminal, in network is gone into the competition networking time window of network termination appointment, send and comprise the terminal address fragment of oneself and the networking request message of user key initial value with clear-text way, receive each networking response message that the network insertion terminal sends, and send the login message that comprises terminal login token information to the network insertion terminal.Random data memory 114 is used to store described netkey initial value.Crypto-operation coprocessor 115 is used for according to described address fragment information, the first value information of user key and the first value information generating solution decryption key of netkey, and deciphers each the networking response message that receives from the network insertion terminal.Microprocessor module 112 according to above-mentioned decrypted result, identifies the networking response message at oneself, finds to distribute to the terminal login token information of oneself, and described terminal login token information is included in the described login message.

It may be noted that as conspicuous for a person skilled in the art, the microprocessor module in network insertion terminal or the subscriber access termination also can be realized the function of password coprocessor.According to foregoing description, it should be appreciated by those skilled in the art that under the situation that does not break away from spirit of the present invention, can be to making amendment among the various embodiment of the present invention and changing.Just, the description in this specification only is used for illustrative purpose, and not should be understood to limitation of the present invention.Protection scope of the present invention only depends on the protection range of claims.

Claims

1. recognition methods of going into network termination physics uniqueness, wherein network insertion terminal by with user-network access terminal switch information, guarantee that same user's physical terminal can only is characterized in that this method comprises step with unique identity accesses network resource:

The network insertion terminal is competed the networking time window with clear-text way broadcasting,

The user-network access terminal sends the networking request message of the terminal address fragment that comprises oneself with clear-text way in the competition networking time window of appointment,

After the network insertion terminal is received the networking request message that the user-network access terminal sends, be user-network access terminal distribution terminal login token, the networking response message that comprises user-network access request message summary, terminal login token with encrypted test mode broadcasting, described ciphertext encryption key comprises user-network access terminal address frag info

Each networking response message that the user-network access terminal deciphering is received, by relatively deciphering the user-network access request message summary in the cleartext information of back, identify networking response message at oneself, the terminal login token of oneself is distributed in discovery, to the network insertion terminal send the login message comprise terminal login token information and

After the network insertion terminal is received the login message, comprise the terminal login token information of oneself distributing to prospective users in the checking login message, confirm that the user-network access terminal is legal.

2. recognition methods of going into network termination physics uniqueness, wherein network insertion terminal by with user-network access terminal switch information, guarantee that same user's physical terminal can only is characterized in that this method comprises step with unique identity accesses network resource:

The network insertion terminal is with clear-text way broadcasting competition networking time window and netkey initial value, and the user-network access terminal receives and write down described competition networking time window and netkey initial value,

After the network insertion terminal is received the networking request message that the user-network access terminal sends, be user-network access terminal distribution terminal login token, the networking response message that comprises user-network access request message summary, terminal login token with encrypted test mode broadcasting, described ciphertext encryption key comprises user-network access terminal address frag info and the first value information of netkey

The user-network access terminal is according to its address fragment information and netkey initial value generating solution decryption key, and each networking response message of receiving of deciphering, by relatively deciphering the user-network access request message summary in the cleartext information of back, identify networking response message at oneself, find the terminal login token of assignment to oneself, to the network insertion terminal send the login message comprise terminal login token information and

3. recognition methods of going into network termination physics uniqueness, wherein network insertion terminal by with user-network access terminal switch information, guarantee that same user's physical terminal can only is characterized in that this method comprises step with unique identity accesses network resource:

The user-network access terminal generates the user key initial value, and comprises the terminal address fragment of oneself and the networking request message of user key initial value with the clear-text way transmission in the competition networking time window of appointment,

After the network insertion terminal is received the networking request message that the user-network access terminal sends, be user-network access terminal distribution terminal login token, the networking response message that comprises user-network access request message summary, terminal login token with encrypted test mode broadcasting, described ciphertext encryption key comprises user-network access terminal address frag info, netkey just value information and the first value information of user key

The user-network access terminal is according to its address fragment information, user key initial value and netkey initial value generating solution decryption key, and each networking response message of receiving of deciphering, by relatively deciphering the user-network access request message summary in the cleartext information of back, identify networking response message at oneself, find the terminal login token of assignment to oneself, to the network insertion terminal send the login message comprise terminal login token information and

4. as the described recognition methods of going into network termination physics uniqueness of arbitrary claim among the claim 1-3, its feature also is, the network insertion terminal is except giving user-network access terminal distribution terminal login token, also distributing user access channel and networking time, and it is included in the networking response message, the user-network access terminal sends the login message that comprises this terminal login token information at the access channel of appointment with in the networking time to the network insertion terminal after finding to distribute to the terminal login token of oneself.

5. as the described recognition methods of going into network termination physics uniqueness of arbitrary claim among the claim 1-3, its feature also is the network insertion terminal except competing the networking time window with clear-text way broadcasting, also broadcast timing information, the user-network access terminal is according to the timing information Adjustment System clock that receives.

6. recognition methods of going into network termination physics uniqueness as claimed in claim 2, its feature is that also described netkey initial value is generated at random by the network insertion terminal.

7. recognition methods of going into network termination physics uniqueness as claimed in claim 3, its feature is that also described netkey initial value is generated at random by the network insertion terminal, described user key initial value is generated at random by the user-network access terminal.

8. a communication system comprises user-network access terminal and network insertion terminal, wherein network insertion terminal by with user-network access terminal switch information, guarantee that same user's physical terminal can only is characterized in that with unique identity accesses network resource,

Described network insertion terminal comprises:

Data source and sink (131), be used for receiving the networking request message that the user-network access terminal sends, comprising user-network access terminal address frag info with clear-text way broadcasting competition networking time window, the login message that the networking response message of broadcast enciphering and reception user-network access terminal send;

Microprocessor module (132) is used for after the networking request message that receives the transmission of user-network access terminal, is user-network access terminal distribution terminal login token; With after the login message that receives the transmission of user-network access terminal, comprise the terminal login token information of oneself distributing to prospective users in the checking login message, confirm that the user-network access terminal is legal; With

Crypto-operation co-processor module (136), be used for after the networking request message that receives the transmission of user-network access terminal, use the ciphertext encryption keys to comprise the networking response message of user-network access request message summary, terminal login token, described ciphertext encryption key comprises the user-network access terminal address frag info that comprises in the described networking request message;

Described user-network access terminal comprises:

Data source and sink (113), be used to receive competition networking time window by the broadcasting of network insertion terminal, in going into the competition networking time window of network termination appointment, network sends the networking request message of the terminal address fragment that comprises oneself with clear-text way, receive each networking response message that the network insertion terminal sends, and send the login message that comprises terminal login token information to the network insertion terminal;

Crypto-operation coprocessor (115) is used for according to described address fragment information generating solution decryption key, and deciphers each the networking response message that receives from the network insertion terminal; With

Microprocessor module (112) according to above-mentioned decrypted result, identifies the networking response message at oneself, finds to distribute to the terminal login token information of oneself, and described terminal login token information is included in the described login message.

9. a communication system comprises user-network access terminal and network insertion terminal, wherein network insertion terminal by with user-network access terminal switch information, guarantee that same user's physical terminal can only is characterized in that with unique identity accesses network resource,

Described network insertion terminal comprises:

Data source and sink (131), be used for clear-text way broadcasting competition networking time window and netkey initial value, receive the networking request message that the user-network access terminal sends, comprising user-network access terminal address frag info, the login message that the networking response message of broadcast enciphering and reception user-network access terminal send;

Crypto-operation co-processor module (136), be used for after the networking request message that receives the transmission of user-network access terminal, use the ciphertext encryption keys to comprise the networking response message of user-network access request message summary, terminal login token, described ciphertext encryption key comprises user-network access terminal address frag info and the first value information of netkey that comprises in the described networking request message;

Described user-network access terminal comprises:

Data source and sink (113), be used to receive competition networking time window and netkey initial value by the broadcasting of network insertion terminal, in going into the competition networking time window of network termination appointment, network sends the networking request message of the terminal address fragment that comprises oneself with clear-text way, receive each networking response message that the network insertion terminal sends, and send the login message that comprises terminal login token information to the network insertion terminal;

Random data memory (114) is used to store described netkey initial value;

Crypto-operation coprocessor (115) is used for according to described address fragment information and described netkey initial value generating solution decryption key, and deciphers each the networking response message that receives from the network insertion terminal; With

10. a communication system comprises user-network access terminal and network insertion terminal, wherein network insertion terminal by with user-network access terminal switch information, guarantee that same user's physical terminal can only is characterized in that with unique identity accesses network resource,

Described network insertion terminal comprises:

Data source and sink (131), be used for clear-text way broadcasting competition networking time window and netkey initial value, receive the networking request message that the user-network access terminal sends, comprising user-network access terminal address frag info and the first value information of user key, the login message that the networking response message of broadcast enciphering and reception user-network access terminal send;

Crypto-operation co-processor module (136), be used for after the networking request message that receives the transmission of user-network access terminal, use the ciphertext encryption keys to comprise the networking response message of user-network access request message summary, terminal login token, described ciphertext encryption key comprises user-network access terminal address frag info, user key just value information and the first value information of netkey;

Described user-network access terminal comprises:

Data source and sink (113), be used to receive competition networking time window and netkey initial value by the broadcasting of network insertion terminal, in network is gone into the competition networking time window of network termination appointment, send and comprise the terminal address fragment of oneself and the networking request message of user key initial value with clear-text way, receive each networking response message that the network insertion terminal sends, and send the login message that comprises terminal login token information to the network insertion terminal;

Random data memory (114) is used to store described netkey initial value;

Crypto-operation coprocessor (115) is used for according to described address fragment information, the first value information of user key and the first value information generating solution decryption key of netkey, and deciphers each the networking response message that receives from the network insertion terminal; With