TW201504843A - Network certification system and method thereof - Google Patents

Abstract

A network certification system and method thereof are provided. The network certification system includes a first communication device, a second communication device and a certification center. The method includes the following steps. Before the first communication device establishes a direct connection with the second communication device, the first communication device sends a first identity information encrypted by a first key to the certification center, and the second communication device sends a second identity information encrypted by a second key to the certification center. After certifying the first and the second communication device, the certification center generates a third key, and respectively sends the first key encrypted by the third key and the second key encrypted by the third key to the first and the second communication device. After the first and the second communication device respectively decrypts the encrypted third key with the first and the second key, the first and the second communication device establish the direct connection according to the third key.

Description

Network authentication system and method thereof

The disclosure relates to an authentication system and method thereof, and in particular to a network authentication system and method thereof.

With the advancement of technology and the changing times, wireless networks have become an indispensable part of people's lives. In addition to connecting to the Internet through third-generation (3 ^rd generation, 3G) wireless communication technology, wireless network provided by accessing a wireless base station (Wireless Base Station) or a wireless access point (Wireless Access Point) Connecting to the Internet is also a common way of surfing the Internet. In order to meet the needs of users to use Internet services anytime and anywhere (Ubiquitous), the deployment of wireless base stations has become more widespread.

For example, in order to make it easier for users to use wireless networks, many public places, schools, and corporate organizations offer Wireless Fidelity (Wi-Fi) hotspots for users to use. However, because users can't verify the identity of these wireless access points when using these wireless access points, many people who are interested in taking advantage of, for example, setting up malicious wireless base stations are used. Conduct malicious acts such as stealing data or cyber attacks. Specifically, a conventional wireless access point can authenticate a user by means of an Authentication, Authorization and Accounting (AAA) mechanism in a wireless network, but the user cannot verify the connection. The identity of the wireless access point. Therefore, a person with a heart (such as a hacker) can easily set up a malicious wireless base station to induce a user to establish a connection with the malicious wireless base station, thereby performing, for example, a Man-In-The-Middle Attack. behavior. The man-in-the-middle attack is a network attack that can steal and tamper with all information communicated by the user and the outside.

In order to defend against the aforementioned Rogue Access Point Attack, scholars and experts have proposed many defense methods in recent years, and these defense methods are mainly divided into detection and prevention. The detection method is to find and block the malicious wireless base station, and the advantage is that the user does not need to bear any cost. However, the detection rate of the detection is not 100%, and there is also the possibility of cats and mice (that is, after the malicious wireless base station is blocked, other malicious wireless base stations are successively generated), so it is not practical. Improve the practice. The prevention method is that the user exchanges keys with the wireless access point to be connected, and establishes a connection after successfully exchanged the keys. In the prevention method, since the wireless base station and the user need to perform mutual authentication before the connection, it is ensured that the wireless base station and the user can accurately establish the wireless access point to be connected. Secure connection. However, since the prevention method conventionally requires the user to be able to view the wireless base station, the aforementioned mutual authentication operation can be performed (ie, Face to face verification, thus increasing the cost of implementation correspondingly.

In view of this, the present disclosure provides a network authentication system and method thereof for authenticating an access point before the communication device is connected to the access point to ensure the security of the communication device when using the wireless network service.

The present disclosure provides a network authentication system including a communication device, an access point, a servo device, and a certification center. The communication device has first identity information. The access point is connected to the communication device and has the second identity information. The servo is connected to the access point. The authentication center connects the server device and the communication device, and stores a first key and a second key respectively associated with the communication device and associated with the access point. After determining that the access point receives the network connection request from the communication device, the server assists the access point to send the first identity information and the second identity information encrypted by the second key to the authentication center. The communication device transmits the first identity information encrypted by the first key to the authentication center. After authenticating the communication device and the access point, the authentication center generates a third key, and respectively transmits a third key encrypted with the first key and a third key encrypted with the second key to the communication device and the servo device. . After decrypting the encrypted third key with the second key, the servo device sends a third key to the access point. After decrypting the encrypted third key with the first key, the communication device establishes a secure connection with the access point according to the third key.

The present disclosure provides a network authentication method suitable for a network authentication system including a communication device, an access point, a server, and a certificate authority. The method includes the following steps. The communication device sends a network connection request to the access point. In judging the access point After receiving the network connection request, the server assists the access point to send the first identity information and the second identity information encrypted by the second key to the authentication center. The communication device transmits the first identity information encrypted by the first key to the authentication center. After authenticating the communication device and the access point, the authentication center generates a third key, and respectively transmits a third key encrypted with the first key and a third key encrypted with the second key to the communication device and the servo device. . After decrypting the encrypted third key with the second key, the servo device sends a third key to the access point. After decrypting the encrypted third key with the first key, the communication device establishes a secure connection with the access point according to the third key.

The present disclosure provides a network authentication system including a first communication device, a second communication device, and a certification center. The first communication device has first identity information. The second communication device has second identity information. The authentication center connects the first communication device and the second communication device, and stores a first key and a second key respectively associated with the first communication device and associated with the second communication device. Before the first communication device establishes a direct connection with the second communication device, the first communication device sends the first identity information encrypted by the first key to the authentication center, and the second communication device sends the second encryption key. Second identity information to the certification center. After authenticating the first communication device and the second communication device, the authentication center generates a third key, and respectively transmits a third key encrypted with the first key and a third key encrypted with the second key to the first a communication device and a second communication device. After the first communication device and the second communication device respectively decrypt the encrypted third key with the first key and the second key, the first communication device and the second communication device establish a direct connection according to the third key.

The disclosure provides a network authentication method, which is suitable for including a first communication device. The second communication device and the network authentication system of the certification center. The method includes the following steps. Before the first communication device establishes a direct connection with the second communication device, the first communication device sends the first identity information encrypted by the first key to the authentication center, and the second communication device sends the second encryption key. Second identity information to the certification center. After authenticating the first communication device and the second communication device, the authentication center generates a third key, and respectively transmits a third key encrypted with the first key and a third key encrypted with the second key to the first a communication device and a second communication device. After the first communication device and the second communication device respectively decrypt the encrypted third key with the first key and the second key, the first communication device and the second communication device establish a direct connection according to the third key.

Based on the above, the network authentication system and the method thereof according to the embodiments of the present disclosure can authenticate the access point through a trusted third-party authentication center when the communication device wants to connect to the access point, thereby ensuring that the communication device is in use. Security when using wireless network services.

The above described features and advantages of the present invention will be more apparent from the following description.

100, 300‧‧‧Network Authentication System

110‧‧‧Communication device

120‧‧‧ access point

130‧‧‧Servo

140‧‧‧ Certification Center

310‧‧‧First communication device

320‧‧‧Second communication device

S210~S260, S410~S430‧‧‧ steps

FIG. 1 is a schematic diagram of a network authentication system according to an embodiment of the disclosure.

2 is a flow chart of a network authentication method according to an embodiment of the disclosure.

FIG. 3 is a schematic diagram of a network authentication system according to an embodiment of the disclosure.

4 is a flow chart of a network authentication method according to an embodiment of the disclosure.

The disclosed embodiments provide a network authentication system and method thereof for authenticating a communication device and an access point by a trusted third party authentication center before the communication device is connected to the access point. After the third-party authentication center authenticates that the access point is legal (ie, a non-malicious access point), the communication device can connect with the access point to use the network connection service provided by the access point. In this way, the communication device can avoid accidentally connecting to the malicious access point, thereby ensuring the security of the network connection of the communication device.

FIG. 1 is a schematic diagram of a network authentication system according to an embodiment of the disclosure. In the present embodiment, the network authentication system 100 includes a communication device 110, an access point 120, a server 130, and an authentication center 140. The communication device 110 is, for example, an electronic device having a web browsing function, such as a smart phone, a notebook computer, a tablet computer, a personal computer, a workstation, and a personal digital assistant. The access point 120 can be connected to the communication device 110 and can provide the function of the communication device 110, such as a wireless local area network connection. The server 130 is coupled to an access point 120 that assists the access point 120 in performing authentication operations with the authentication center 140, the details of which will be described later. The server 130 is, for example, an Authentication, Authorization and Accounting (AAA) server. Further, the server 130 may be a Remote Authentication Dial In User Service (RADIUS) server that can communicate with the access point 120 through the RADIUS protocol. And the certification center 140 communicates.

The authentication center 140 can be connected to the servo device 130 and the communication device 110. The certificate authority 140 is, for example, a trusted third party certificate authority that can store relevant information for authenticating the communication device 110 and the access point 120. For example, the authentication center 140 can store the first key and the second key associated with the communication device 110 and associated with the access point 120, respectively. The first key is, for example, a key assigned to the communication device 110 by the authentication center 140 after the communication device 110 is connected to the authentication center 140 and completing the registration process. In other words, after the communication device 110 completes the registration procedure with the authentication center 140, the communication device 110 and the authentication center 140 can simultaneously hold the first key to facilitate the related authentication procedure between the subsequent communication device 110 and the authentication center 140, but The embodiments of the present disclosure are not limited thereto.

The second key is, for example, the key used by the authentication center 140 to authenticate the access point 120. In an embodiment, after the access point 120 is connected to the server 130, the server 130 can assist the access point 120 in registering with the certificate center 140. Upon completion of this registration procedure, the server 130 may in turn retrieve the second key assigned by the authentication center 140 to the access point 120. In addition, the server 130 can instead hold the second key associated with the access point 120 and assist the access point 120 in performing an associated authentication procedure with the authentication center 140.

2 is a flow chart of a network authentication method according to an embodiment of the disclosure. The network authentication method in this embodiment can be implemented by the network authentication system 100 of FIG. 1, and the following steps, that is, the respective devices of FIG.

In this embodiment, when the user of the communication device 110 wants to control the communication device When the wireless network connected to the access point is connected to the Internet, the user can first find the access point existing in the vicinity through the access point scanning function of the communication device 110, for example. Thereafter, the communication device 110 can in turn generate a Service Set Identifier (SSID) list (which can include the SSID of the access point 120) corresponding to the access points. Assuming that the user of the communication device 110 wants to control the communication device 110 to connect with the access point 120 (eg, a non-malicious access point), the communication device 110 can send a network connection request to the access point 120 in step S210. The network connection request 120 can include, for example, first identity information of the communication device 110.

In an embodiment, after receiving the network connection request from the communication device 110, the access point 120 can forward the first identity information of the communication device 110 and the second identity information of the access point 120 to the server 130 to notify The servo device 130 and the authentication center 140 perform an operation of authenticating the communication device 110. In other embodiments, the server 130 can also actively detect the user login information on the access point 120 or retrieve the log of the access point 120 to instantly grasp the connection to the access point 120. Device identity information, but the embodiments of the disclosure are not limited thereto.

In step S220, after determining that the access point 120 receives the network connection request, the server 130 may assist the access point 120 to send the first identity information and the second identity information encrypted by the second key to the authentication center 140. In an embodiment, the server 130 may apply, for example, an Advanced Encryption Standard (AES), an asymmetric cryptographic algorithm (RSA algorithm), or other encryption technology to the first identity information according to the second key pair. Encryption is performed with the second identity information, but the implementation manner of the disclosure is not limited thereto.

In step S230, the communication device 110 may transmit the first identity information encrypted with the first key to the authentication center 140. In this embodiment, the communication device 110 may also use an encryption technology such as AES or RSA to encrypt the first identity information.

In an embodiment, the first identity information (from the communication device 110) encrypted with the first key and the first identity information and the second identity information encrypted with the second key are received at the authentication center 140 (from the access point) 120) Afterwards, the authentication center 140 may decrypt the first identity information encrypted by the first key with the first key, and decrypt the first identity information and the second identity information encrypted by the second key with the second key. . Then, the authentication center 140 can authenticate the communication device 110 according to the received first identity information, and authenticate the access point 120 according to the received second identity information.

In step S240, after authenticating the communication device 110 and the access point 120, the authentication center 140 generates a third key, and respectively transmits a third key encrypted with the first key and a third encrypted with the second key. The key is transmitted to the communication device 110 and the servo device 130. From another point of view, the third key can be regarded as a key generated by the authentication center 140 for the communication device 110 and the access point 120 to securely connect. Moreover, since the authentication center 140 encrypts the third key with the first key, it can be guaranteed that only the communication device 110 that also holds the first key can decrypt the encrypted third key. Similarly, since the authentication center 140 encrypts the third key with the second key, it can be guaranteed that only the server 130 that also holds the second key can decrypt the encrypted third key.

In step S250, after decrypting the encrypted third key with the second key, the server 130 transmits the third key to the access point 120. Next, in step S260 After decrypting the encrypted third key with the first key, the communication device 110 can establish a secure connection with the access point 120 according to the third key. Specifically, the communication device 110 can encrypt all the data to be transmitted to the access point 120 according to the third key, and at the same time, because the access point 120 also holds the third key, the access point 120 is All data from the communication device 110 can be decrypted in accordance with the third key. On the other hand, when the access point 120 transmits the data encrypted by the third key, the communication device 110 can also decrypt the encrypted data from the access point 120 correspondingly with the third key held by itself. In other words, the third key can be regarded as a secret key belonging to the secret key cryptosystems between the communication device 110 and the access point 120. At this time, since the device to be eavesdropped does not have the information of the third key, the communication content between the communication device 110 and the access point 120 cannot be stolen. Thus, the third key assigned by the authentication center 140 to the communication device 110 and the access point 120 allows the communication device 110 and the access point 120 to establish a secure connection.

From another point of view, when the communication device 110 mistakenly sends a network connection request to a malicious access point (such as an evil twin wireless access point), the malicious access point will not pass the authentication center 140 smoothly. The aforementioned authentication behavior cannot obtain information such as the third key. In other words, the malicious access point will not be able to establish a connection with the communication device 110 in the manner taught in the previous embodiments. In this way, the disclosed embodiment can avoid the situation that the communication device 110 is stolen or maliciously attacked due to misconnection to a malicious access point.

In addition, although the servo device 130 in FIG. 1 only assists the access point 120 The authentication procedure related to the authentication center 140 is performed, but in other embodiments, the server 130 can simultaneously manage multiple access points and individually assist the access points to perform the aforementioned authentication procedures with the authentication center 140, but The embodiments that can be disclosed are not limited thereto.

As can be seen from the above embodiment, when the communication device 110 is to be connected to the access point 120, the communication device 110 can authenticate the access point 120 by the authentication center 140 to ensure the connection security of the communication device 110. In other embodiments, when a communication device wants to establish a direct connection such as a Bluetooth connection with another communication device, the authentication center may also perform a related authentication procedure on the communication device to be connected to the communication center. .

FIG. 3 is a schematic diagram of a network authentication system according to an embodiment of the disclosure. In the present embodiment, the network authentication system 300 includes a first communication device 310, a second communication device 320, and an authentication center 140. 4 is a flow chart of a network authentication method according to an embodiment of the disclosure. The method shown in FIG. 4 can be performed by the network authentication system 300 of FIG. 3, and the various steps in FIG. 4 will be described below in conjunction with the various devices in FIG.

In this embodiment, when the first communication device 310 is to be directly connected to the second communication device 320 (for example, Wireless fidelity direct (Wi-Fi direct) or Bluetooth connection) In the case of the line, the first communication device 310 and the second communication device 320 can first authenticate each other as a malicious device through the authentication center 140, thereby ensuring the security of the direct connection. The authentication center 140 in this embodiment may be stored separately associated with the first communication device 310 and associated with The fourth key of the second communication device 320 and the hardware key. The fourth key and the hardware key are respectively assigned to the first communication device 310 by the authentication center 140 after the first communication device 310 and the second communication device 320 are connected to the authentication center 140 and respectively complete the registration process. The key of the second communication device 320.

Specifically, in step S410, before the first communication device establishes a direct connection with the second communication device, the first communication device 310 may send the third identity information encrypted by the fourth key to the authentication center 140, and the first The second communication device 320 can send the fourth identity information encrypted by the hardware key to the authentication center 140. The third identity information and the fourth identity information are, for example, identity information of the first communication device 310 and the second communication device 320, respectively.

In an embodiment, the first communication device 310 transmits the third identity information encrypted by the fourth key to the authentication center 140, and the second communication device 320 sends the fourth identity information encrypted by the hardware key to the authentication center 140. Thereafter, the authentication center 140 may decrypt the third identity information encrypted by the fourth key with the fourth key, and decrypt the fourth identity information encrypted by the hardware key with the hardware key. Then, the authentication center 140 can authenticate the first communication device 310 according to the received third identity information, and authenticate the second communication device 320 according to the received fourth identity information.

In step S420, after authenticating the first communication device and the second communication device, the authentication center 140 may generate a sixth key, and respectively send the sixth key encrypted with the fourth key and the first encrypted with the hardware key. The six keys are to the first communication device 310 and the second communication device 320. From another point of view, the sixth key can be regarded as being generated by the authentication center 140 for the first communication device 310 and the second communication device. Set 320 a key for secure connection. Moreover, since the authentication center 140 encrypts the sixth key with the fourth key, it can be guaranteed that only the first communication device 310 that also holds the fourth key can decrypt the encrypted sixth key. Similarly, since the authentication center 140 encrypts the sixth key with the hardware key, it can be guaranteed that only the second communication device 320 that also holds the second hardware key can decrypt the encrypted sixth key.

In step S430, after the first communication device 310 and the second communication device 320 respectively decrypt the encrypted sixth key with the fourth key and the hardware key, the first communication device 310 and the second communication device 320 are in accordance with the The six keys establish a direct connection. Specifically, the first communication device 310 can encrypt all the data to be transmitted to the second communication device 320 according to the sixth key, and at the same time, because the second communication device 320 also holds the sixth key, The second communication device 320 can decrypt all the data from the first communication device 310 according to the sixth key. On the other hand, when the second communication device 320 transmits the data encrypted by the sixth key, the first communication device 310 can also decrypt the encryption from the second communication device 320 correspondingly with the sixth key held by itself. After the information. From another point of view, the sixth key can be regarded as a secret key belonging to the secret key cryptosystem between the first communication device 310 and the second communication device 320. Since the device to be eavesdropped does not have the information of the third key, the communication content between the first communication device 310 and the second communication device 320 cannot be stolen. Therefore, the sixth key assigned by the authentication center 140 to the first communication device 310 and the second communication device 320 allows the first communication device 310 and the second communication device 320 to establish a secure connection.

In addition, although only two communication devices are illustrated in FIG. 3, the concept of the present disclosure can also be applied to a plurality of communication devices. Specifically, when a plurality of communication devices are to establish a direct connection with each other (for example, an ad hoc network), the communication devices may obtain a separate authentication process after each of them performs a related authentication process with the certification center. Shared key. In this way, the communication devices can encrypt all the data transmitted by each other according to the shared key, thereby ensuring the security of the direct connection.

In summary, the network authentication system and method thereof according to the embodiments of the present disclosure can authenticate an access point through a trusted third-party authentication center when the communication device wants to connect to the access point. After the third-party authentication center authenticates that the access point is legal (ie, a non-malicious access point), the communication device can connect with the access point to use the network connection service provided by the access point. For the communication device, the system and method proposed by the embodiment can avoid the situation that the error is connected to the malicious access point, thereby ensuring the security of the communication device when using the wireless network service.

Further, the network authentication method of the disclosed embodiment is suitable for application to a public wireless network system provided at a place such as a coffee shop, a library, or a restaurant. In this case, when the user wants to use the communication device to access the Internet through the public wireless network system at the foregoing location, the user can authenticate the access point to be connected through the manner taught in the foregoing embodiment (for example, Providing an access point of the public wireless network system, thereby ensuring the security of the user when surfing the Internet.

In addition, when the communication device and the access point authenticate each other through the network authentication method proposed by the disclosure, the communication device and the access point do not need to be physically (face to Face) verification, and thus does not increase the cost of the implementation correspondingly. Moreover, since the network authentication system of the present disclosure assists the access point to perform various authentication operations described above through the server device, it is not necessary to install additional software on the access point during implementation.

Furthermore, the present disclosure also proposes another network authentication system and method thereof, in which the authentication center can separately authenticate these communication devices when a direct connection is to be established between two (or more) communication devices, thereby Ensure the safety of the direct connection.

The present disclosure has been disclosed in the above embodiments, but it is not intended to limit the disclosure, and any person skilled in the art can make some changes and refinements without departing from the spirit and scope of the disclosure. The scope of protection of this disclosure is subject to the definition of the scope of the appended claims.

S210~S260‧‧‧Steps

Claims (19)

A network authentication system includes: a communication device having a first identity information; an access point connecting the communication device and having a second identity information; a server device connecting the access point; and a certification center Connecting the server device and the communication device, storing a first key associated with the communication device and associated with the access point, and a second key, wherein determining that the access point receives the communication device After a network connection request, the server assists the access point to send the first identity information and the second identity information encrypted by the second key to the authentication center, and the communication device sends the first gold Keyly encrypting the first identity information to the authentication center, after authenticating the communication device and the access point, the authentication center generates a third key, and separately sends the third gold encrypted by the first key Key and the third key encrypted by the second key to the communication device and the server device, after decrypting the encrypted third key with the second key, the server sends the third key Three keys to the access point, after which the third key to decrypt the encrypted first key, the key communication device to establish a secure connection with the access point according to the third gold. The network authentication system of claim 1, wherein the access point is forwarded after the access point receives the network connection request from the communication device. The first identity information and the second identity information are sent to the server. The network authentication system of claim 1, wherein the first identity information encrypted with the first key and the first identity information and the second identity encrypted by the second key are received After the information, the authentication center decrypts the first identity information encrypted by the first key with the first key, and decrypts the first identity information encrypted by the second key with the second key. The second identity information. The network authentication system of claim 1, wherein the server is a verification, authorization, and auditing server. The network authentication system of claim 4, wherein the verification, authorization, and auditing server is a remote authentication dialing user service server. The network authentication system of claim 1, wherein the third key is a secret key belonging to a secret key cryptosystem. The network authentication system of claim 1, wherein the access point belongs to a public network system. A network authentication method is suitable for a network authentication system including a communication device, an access point, a servo device, and a certification center, the method comprising the steps of: the communication device transmitting a network connection request to the An access point; after determining that the access point receives the network connection request, the server assists the access point to send the first identity information and the second identity information encrypted by the second key to the authentication center Transmitting, by the communication device, the first identity information encrypted by the first key to the identity a certificate center; after authenticating the communication device and the access point, the certificate center generates a third key, and separately transmits the third key encrypted by the first key and encrypted by the second key Transmitting the third key to the communication device and the server device; after decrypting the encrypted third key with the second key, the server sends the third key to the access point; After the first key decrypts the encrypted third key, the communication device establishes a secure connection with the access point according to the third key. The network authentication method of claim 8, wherein the access point forwards the first identity information and the second identity after the communication device sends the network connection request to the access point Information to the servo device. The network authentication method of claim 8, wherein after the communication device transmits the first identity information encrypted by the first key to the authentication center, the authentication center respectively uses the first The key decrypts the first identity information encrypted by the first key, and decrypts the first identity information and the second identity information encrypted by the second key with the second key. The network authentication method of claim 8, wherein the third key is a secret key belonging to a secret key cryptosystem. A network authentication system includes: a first communication device having a first identity information; a second communication device having a second identity information; and a certification center connecting the first communication device and the second communication Device Corresponding to a first communication device and a first key associated with the second communication device and a second key, wherein before the first communication device establishes a direct connection with the second communication device The first communication device sends the first identity information encrypted by the first key to the authentication center, and the second communication device sends the second identity information encrypted by the second key to the authentication center. After authenticating the first communication device and the second communication device, the authentication center generates a third key, and separately transmits the third key encrypted by the first key and encrypted by the second key. Transmitting the third key to the first communication device and the second communication device, and decrypting the encrypted third device by the first communication device and the second communication device by using the first key and the second key respectively After the key, the first communication device and the second communication device establish the direct connection according to the third key. The network authentication system of claim 12, wherein the direct connection comprises a wireless fidelity direct connection or a Bluetooth connection. The network authentication system of claim 12, wherein the first communication device transmits the first identity information encrypted by the first key to the authentication center, and the second communication device sends the After the second identity information encrypted by the second key is sent to the authentication center, the authentication center decrypts the first identity information encrypted by the first key with the first key, and decrypts with the second key The second identity information encrypted by the second key. Such as the network authentication system described in claim 12, wherein the The three keys are a secret key belonging to a secret key cryptosystem. A network authentication method, comprising: a first communication device, a second communication device, and a network authentication system of a certification center, the method comprising the steps of: the first communication device and the second communication device Before establishing a direct connection, the first communication device sends a first identity information encrypted by a first key to the authentication center, and the second communication device sends a second identity encrypted by a second key. Receiving information to the certification center, after authenticating the first communication device and the second communication device, the authentication center generates a third key, and respectively sends the third key encrypted by the first key and The third key encrypted by the second key to the first communication device and the second communication device, where the first communication device and the second communication device are decrypted by the first key and the second key respectively After the encrypted third key, the first communication device and the second communication device establish the direct connection according to the third key. The network authentication method of claim 16, wherein the direct connection comprises a wireless fidelity direct connection or a Bluetooth connection. The network authentication method of claim 16, wherein the first communication device transmits the first identity information encrypted by the first key to the authentication center, and the second communication device sends the After the step of encrypting the second identity information of the second key to the authentication center, the authentication center respectively decrypts the first identity information encrypted by the first key with the first key, and uses the second gold Key decryption The second identity information encrypted by the second key. The network authentication method of claim 16, wherein the third key is a secret key belonging to a secret key cryptosystem.