WO2012113225A1 - 安全访问wapi网络的方法、装置及系统 - Google Patents

安全访问wapi网络的方法、装置及系统 Download PDF

Info

Publication number
WO2012113225A1
WO2012113225A1 PCT/CN2011/079469 CN2011079469W WO2012113225A1 WO 2012113225 A1 WO2012113225 A1 WO 2012113225A1 CN 2011079469 W CN2011079469 W CN 2011079469W WO 2012113225 A1 WO2012113225 A1 WO 2012113225A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
terminal
source terminal
session
request
Prior art date
Application number
PCT/CN2011/079469
Other languages
English (en)
French (fr)
Inventor
张嘉伟
张小军
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2012113225A1 publication Critical patent/WO2012113225A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the present invention relates to the field of communications, and in particular, to a method, apparatus and system for securely accessing a WAPK Wireless LAN Authentication and Privacy Infrastructure, a wireless local area network authentication and privacy infrastructure network. Background technique
  • Wireless Local Area Network uses the WAPI protocol and is a computer network that uses wireless transmission media. Because WLAN has the advantages of convenient installation, flexibility, economy and easy expansion, it has developed very rapidly in recent years. It has been developed from the original 802.11, 802.11b and other protocols to today's 802.11 ⁇ , and the transmission speed can reach more than 100M. . As the technology continues to mature, product costs continue to decline, wireless LAN applications are more and more, and the scope is wider and wider, so that the majority of people enjoy convenient, simple and convenient network services. In particular, wireless digital home networks allow users to access resources such as the Internet through wireless LANs anytime, anywhere. However, WLANs are also convenient for users, and there are also security flaws. In the prior art, WLANs generally do not adopt any information security protection measures and are vulnerable to attacks. Summary of the invention
  • the main object of the present invention is to provide a method, device and system for securely accessing a WAPI network, and to improve the security of WAPI network access through two-factor authentication.
  • a method of securely accessing a WAPI network including:
  • the wireless AP of the WAPI network authenticates the source terminal according to the authentication request sent by the source terminal; when the authentication passes, the source terminal sends a session request for the session with the target terminal to the AP; The AP authenticates the target terminal according to the session request. When the authentication passes, the AP allows the source terminal to access the target terminal.
  • the process of authenticating the source terminal by the AP of the WAPI network according to the authentication request sent by the source terminal includes:
  • the AAA server of the mobile communication network authenticates the source terminal according to the authentication request sent by the source terminal; when the authentication passes, the source terminal sends a WLAN access request for the session with the AP to the AAA server;
  • the AAA server authenticates the AP according to the WLAN access request and the WLAN access right of the source terminal. When the authentication passes, the AAA server allows the source terminal to access the AP.
  • the method further includes: the source terminal and the target terminal perform session negotiation.
  • a terminal comprising:
  • An authentication request module configured to send an authentication request to a wireless AP of the WAPI network
  • the session requesting module is configured to send a session request to the AP to perform a session with the target terminal, so that the AP authenticates the target terminal according to the session request, and allows the local end to access the target terminal after the authentication is passed.
  • the terminal further includes:
  • the session negotiation module is configured to perform session negotiation with the target terminal after the AP allows the local end to access the target terminal.
  • a terminal comprising:
  • a receiving requesting module configured to receive an authentication activation request sent by a wireless AP of the WAPI network
  • a sending module configured to send an authentication request according to the authentication activation request, so that the AP authenticates the local end, and allows the source terminal to access after the authentication is passed Local end.
  • the session negotiation module is configured to perform a meeting with the source terminal after the AP allows the source terminal to access the local end. Negotiate.
  • a wireless AP for a WAPI network including:
  • a first authentication module configured to authenticate the source terminal according to the authentication request sent by the source terminal
  • a receiving module configured to: after the first authentication module authenticates the source terminal, the receiving source terminal sends a session with the target terminal. Session request
  • the second authentication module is configured to perform authentication on the target terminal according to the session request, and the access module is configured to allow the source terminal to access the target terminal when the second authentication module authenticates the target terminal.
  • a system for securely accessing a WAPI network including a source terminal, a target terminal, and a wireless AP of a WAPI network, where
  • the AP is configured to authenticate the source terminal according to the authentication request sent by the source terminal, and after the source terminal is authenticated, the receiving source terminal sends a session request for the session with the target terminal, according to the session request, to the target The terminal performs authentication; and when the target terminal is authenticated, the source terminal is allowed to access the target terminal;
  • the source terminal is configured to send an authentication request to the AP; and when the AP authentication passes, send a session request to the AP to perform a session with the target terminal, so that the AP authenticates the target terminal according to the session request, and allows the authentication after the authentication is passed.
  • the local end accesses the target terminal;
  • the target terminal is configured to receive an authentication activation request sent by the AP, and send an authentication request according to the authentication activation request, so that the AP authenticates the local end, and allows the source terminal to access the local end after the authentication is passed.
  • the source terminal includes:
  • An authentication request module configured to send an authentication request to a wireless AP of the WAPI network
  • a session requesting module configured to: when the AP is authenticated, send a session request to the AP to perform a session with the target terminal, so that the AP authenticates the target terminal according to the session request, and allows the local end to access the target terminal after the authentication is passed; or ,
  • the source terminal further includes: a session negotiation module, configured to perform session negotiation with the target terminal after the AP allows the local end to access the target terminal;
  • the target terminal includes:
  • a receiving requesting module configured to receive an authentication activation request sent by a wireless AP of the WAPI network
  • a sending module configured to send an authentication request according to the authentication activation request, so that the AP authenticates the local end, and allows the source terminal to access after the authentication is passed Local end;
  • the target terminal further includes:
  • the session negotiation module is configured to perform session negotiation with the source terminal after the AP allows the source terminal to access the local end.
  • the AP includes:
  • a first authentication module configured to authenticate the source terminal according to the authentication request sent by the source terminal
  • a receiving module configured to: after the first authentication module authenticates the source terminal, the receiving source terminal sends a session with the target terminal. Session request
  • the second authentication module is configured to perform authentication on the target terminal according to the session request, and the access module is configured to allow the source terminal to access the target terminal when the second authentication module authenticates the target terminal.
  • the method, device and system for securely accessing a WAPI network proposed by the present invention can ensure not only the two terminals and the wireless access node (Access Point, AP) in the access process through the dual authentication of the source terminal and the target terminal.
  • the identity security and also ensures the data confidentiality of the session between the source terminal and the accessed target terminal, between the AP and the terminal, and ensures the security of the local wireless local area network.
  • FIG. 2 is a system architecture diagram of an embodiment of the present invention
  • 3 is a schematic diagram of signaling according to an embodiment of the present invention
  • 4 is a schematic flowchart of remote access in an embodiment of the present invention
  • FIG. 5 is a schematic diagram of signaling of remote access according to an embodiment of the present invention.
  • FIG. 6 is a schematic flow chart of another embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of a terminal according to still another embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a terminal according to another embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of a terminal according to still another embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of an AP according to an embodiment of the present invention.
  • FIG. 12 is a schematic structural diagram of a system for securely accessing a WAPI network according to an embodiment of the present invention. detailed description
  • an embodiment of a method for securely accessing a WAPI network including: S10: An AP authenticates a source terminal according to an authentication request sent by a source terminal;
  • the wireless local area network in this embodiment may be a wireless home digital network, that is, a home network in a general sense, for example, a user may operate and manage a home appliance system through a wireless local area network and obtain a security status of a door and window gas pipeline.
  • Figure 2 shows the structure of the entire WLAN.
  • the user can use a mobile terminal such as a computer or mobile phone to access the WLAN and access network resources, that is, operate and manage each node of the local network.
  • the network center includes the AP, the mobile terminal or computer accessing the wireless local area network, and each node in the wireless local area network are used as terminals, and these elements constitute a structured wireless local area network.
  • the source terminal accesses the target terminal of the WLAN
  • the source terminal sends an authentication request to the AP, that is, the access authentication request, and sends the certificate to the AP for authentication.
  • the AP authenticates the certificate of the source terminal, which can be connected to the AP.
  • the authentication server AS performs authentication: The AP puts the certificate of the source terminal and the AP's own certificate into the certificate authentication request, and sends it to the AS for certificate authentication.
  • the AS first authenticates whether the AP certificate is valid. If it is valid, it continues to verify the certificate of the source terminal. . After the verification is completed, the AS puts the verification result into the certificate authentication response and identifies the certificate. The response is sent back to the AP.
  • the AP authenticates the signature of the AS in the response by the certificate, obtains the certificate authentication result of the source terminal, determines whether the authentication of the source terminal is passed according to the result, and sends the certificate authentication response to the source terminal.
  • the source terminal determines whether to access the AP according to the certificate authentication response.
  • the source terminal and the AP perform session key negotiation: first, the source terminal locally generates a key parameter and puts it into the key agreement request, and The key negotiation request is sent to the AP, and the AP receives the key negotiation request sent by the source terminal, and sends the locally generated key parameter into the key negotiation response to the source according to the key parameter of the source terminal in the key negotiation request.
  • the source terminal After receiving the key negotiation response, the source terminal generates a session key according to the key parameter of the AP and the key parameter local to the source terminal, and the session key is only suitable for the source terminal and the AP.
  • the source terminal sends a session request to the AP for a session with the target terminal.
  • the source terminal After the AP authenticates the source terminal, that is, after the source terminal and the AP perform session key negotiation, the source terminal sends a session request to the AP to perform a session with the target terminal, for example, a device (such as a microwave oven) in the wireless local area network.
  • a device such as a microwave oven
  • the AP performs authentication on the target terminal according to the session request.
  • the AP authenticates the target terminal according to the session request sent by the source terminal.
  • the authentication process is as follows:
  • the Ap sends an authentication activation request to the target terminal, such as a microwave oven, according to the session request, and the AP authenticates the target terminal, and the target terminal receives the AP.
  • the certificate is placed in the authentication request and sent to the AP.
  • the AP authenticates the target terminal.
  • the authentication process is the same as the AP authentication process.
  • the AP allows the source terminal to access the target terminal.
  • the secure link between the AP and the target terminal is established between the source terminal and the AP.
  • the AP allows the source terminal to access the target terminal.
  • step S10 may include:
  • Step S101 When the source terminal remotely accesses the AP, the AAA server of the mobile communication network authenticates the source terminal according to the authentication request sent by the source terminal.
  • a mobile communication network module such as a 3G module needs to be embedded in the AP, and the AP can access the mobile communication network through the module.
  • the source terminal needs to establish a secure connection with the AP of the WLAN. That is, by establishing a secure tunnel, the WAPI protocol is run under the tunnel to access the target terminal in the WLAN. Therefore, the focus of the remote access WLAN is on the establishment of the secure tunnel between the source terminal and the AP.
  • the tunnel establishment of the 3GPP EAP-AKA security protocol is taken as an example. Specific steps are as follows:
  • the source terminal accesses the mobile communication network through the local access network, and sends an authentication request to the AAA server of the core network.
  • the AAA server interacts with the HLR to obtain the authentication vector of the current session.
  • the AAA server authenticates the source terminal based on this authentication vector and negotiates the session key between the two. After the authentication is passed, the access authentication response is sent to the source terminal. At this point, the source terminal and the AAA server establish a secure link.
  • Step S102 When the authentication is passed, the source terminal sends a WLAN access request for the session with the AP to the AAA server.
  • the source terminal After the authentication is passed, the source terminal sends a WLAN access request to the AAA server to request a session with the AP of the wireless LAN.
  • Step S103 The AAA server authenticates the AP according to the WLAN access request and the WLAN access right of the source terminal.
  • the AAA server sends the IMSI of the source terminal to the HLR, and determines whether the source terminal has the right to access the wireless local area network. If the source terminal has rights, the AAA server obtains the authentication vector of the wireless local area network AP directly from the HLR.
  • the AAA server performs the access authentication process according to the obtained authentication vector and the AP, and negotiates the session key between the two. At this time, a secure link is established between the AP and the AAA server.
  • Step S104 When the authentication is passed, the AAA server allows the source terminal to access the AP.
  • the response to the WLAN is returned to the source terminal.
  • a secure tunnel has been established between the source terminal and the AP through the mobile communication network.
  • the source terminal can communicate securely with the AAA server, and the AAA server and the AP can communicate securely.
  • the AAA server constructs a secure tunnel connecting the source terminal and the AP to the secure relay station.
  • the source terminal accesses the wireless local area network and establishes a session link according to the WAPI protocol through the secure tunnel.
  • step S13 Another method embodiment of the secure access WAPI network of the present invention is provided. After performing the foregoing step S13, the method further includes:
  • Step S14 The source terminal and the target terminal perform session negotiation.
  • the AP After the source terminal establishes a secure link with the AP, the AP, and the target terminal, the AP sends a session request of the source terminal to the target terminal.
  • the target terminal receives the session request of the source terminal, and needs to negotiate the key for the session between the two.
  • the target terminal generates its own key parameters and forwards them to the AS through the AP.
  • the AS sends a session key negotiation request to the source terminal through the AP, and the source terminal is required to provide relevant parameters, and simultaneously sends the key parameters of the target terminal to the source terminal.
  • the source terminal generates its own key parameters and sends them to the AS in cipher text via the AP.
  • the key parameter of the source terminal is sent to the target terminal via the AP.
  • the source terminal and the target terminal locally calculate the session key and start the session initiated by the source terminal.
  • the source terminal and the target terminal can directly negotiate through the session key negotiation, thereby avoiding the interception caused by the AP being transited, thereby further improving the security of the wireless local area network access.
  • an embodiment of a terminal of the present invention including:
  • the authentication request module 11 is configured to send an authentication request to the AP.
  • the session requesting module 12 is configured to send a session request to the AP to perform a session with the target terminal, so that the AP authenticates the target terminal according to the session request, and allows the local end to access the target terminal after the authentication is passed.
  • the wireless local area network in this embodiment may be a wireless home digital network, that is, a home network in a general sense, for example, a user may operate and manage a home appliance system through a wireless local area network and obtain a security status of a door and window gas pipeline.
  • Figure 2 shows the structure of the entire WLAN.
  • the user can use a mobile terminal such as a computer or mobile phone to access the WLAN and access network resources, that is, operate and manage each node of the local network.
  • the network center includes the AP, the mobile terminal or computer accessing the wireless local area network, and each node in the wireless local area network are used as terminals, and these elements constitute a structured wireless local area network.
  • the authentication requesting module 11 sends an authentication request to the AP, and sends the certificate to the AP for authentication.
  • the AP authenticates the certificate of the terminal 10, and the authentication server can be connected to the AP.
  • the AS performs authentication: The AP puts the certificate of the terminal 10 and the AP's own certificate into the certificate authentication request, and sends it to the AS for certificate authentication.
  • the AS first authenticates whether the AP certificate is valid, and if it is valid, continues to verify the certificate of the terminal 10. After the verification is completed, the AS puts the verification result into the certificate authentication response and sends the certificate authentication response back to the AP.
  • the AP authenticates the signature of the AS in the response by the certificate, obtains the certificate authentication result for the terminal 10, determines whether the authentication of the terminal 10 is passed according to the result, and sends the certificate authentication response to the terminal 10.
  • the terminal 10 determines whether to access the AP according to the certificate authentication response.
  • the session key negotiation is performed between the terminal 10 and the AP: firstly generated by the terminal 10 locally.
  • the key parameter is placed in the key negotiation request, and the key negotiation request is sent to the AP.
  • the AP receives the key negotiation request sent by the terminal 10, and generates the locally generated key according to the key parameter of the terminal 10 in the key negotiation request.
  • the key parameter is sent to the terminal 10 in the key negotiation response.
  • the terminal 10 After receiving the key negotiation response, the terminal 10 generates a session key according to the key parameter of the AP and the key parameter of the local terminal 10, and the session key is generated.
  • the key is only suitable for the terminal 10 and the AP.
  • the session requesting module 12 After the AP authenticates the terminal 10, that is, after the terminal 10 and the AP perform session key negotiation, the session requesting module 12 sends a session request to the AP to perform a session with the target terminal, such as a device (microwave oven, etc.) in the wireless local area network, as needed.
  • the target terminal such as a device (microwave oven, etc.) in the wireless local area network, as needed.
  • the AP authenticates the target terminal according to the session request sent by the terminal 10.
  • the authentication process is as follows:
  • the Ap sends an authentication activation request to the target terminal, such as a microwave oven, according to the session request, and enables the AP to authenticate the target terminal, and the target terminal receives the AP.
  • the certificate is placed in the authentication request and sent to the AP.
  • the AP authenticates the target terminal.
  • the authentication process is the same as the authentication process performed by the AP to the terminal 10.
  • a secure link between the AP and the target terminal is established between the terminal 10 and the AP.
  • the AP allows the terminal 10 to access the target terminal.
  • the method further includes:
  • the session negotiation module 13 is configured to perform session negotiation with the target terminal after the AP allows the local end to access the target terminal.
  • the AP After the terminal 10 establishes a secure link with the AP, the AP, and the target terminal, the AP sends a session request of the terminal 10 to the target terminal.
  • the target terminal receives the session request of the terminal 10, and needs to negotiate a key for the session between the two.
  • the target terminal generates its own key parameters and forwards them to the AS through the AP.
  • the AS sends a session key negotiation request to the terminal 10 via the AP, and the terminal 10 is expected to provide relevant parameters, and simultaneously transmits the key parameters of the target terminal to the terminal 10.
  • the session negotiation module 13 generates its own key parameters and sends them to the ciphertext via the AP.
  • the key parameter of the terminal 10 is sent to the target terminal via the AP.
  • the session negotiation module 13 of the terminal 10 and the target terminal locally calculate the session key and start the session initiated by the terminal 10.
  • the terminal 10 and the target terminal can directly negotiate through the session key negotiation, thereby avoiding the interception caused by the transit of the AP, thereby further improving the security of the wireless local area network access.
  • FIG. 9 another embodiment of the terminal of the present invention is provided, including:
  • the receiving request module 21 is configured to receive an authentication activation request sent by the AP.
  • the sending module 22 is configured to send an authentication request according to the authentication activation request, so that the AP authenticates the local end, and allows the source terminal to access the local end after the authentication is passed.
  • the wireless local area network in this embodiment may be a wireless home digital network, that is, a home network in a general sense, for example, a user may operate and manage a home appliance system through a wireless local area network and obtain a security status of a door and window gas pipeline.
  • Figure 2 shows the structure of the entire WLAN.
  • the user can use a mobile terminal such as a computer or mobile phone to access the WLAN and access network resources, that is, operate and manage each node of the local network.
  • the network center includes the AP, the mobile terminal or computer accessing the wireless local area network, and each node in the wireless local area network are used as terminals, and these elements constitute a structured wireless local area network.
  • the source terminal accesses the terminal 20 of the wireless local area network
  • the source terminal sends an authentication request to the AP, and sends its own certificate to the AP for authentication.
  • the AP authenticates the certificate of the source terminal.
  • the authentication can be performed by the authentication server AS connected to the AP.
  • the AP puts the certificate of the source terminal and the AP's own certificate into the certificate authentication request, and sends the certificate to the AS for certificate authentication.
  • the AS first authenticates whether the AP certificate is valid. Continue to verify the certificate of the source terminal. After the verification is completed, the AS puts the verification result into the certificate authentication response and sends the certificate authentication response back to the AP.
  • the AP authenticates the signature of the AS in the response by the certificate, obtains the certificate authentication result of the source terminal, determines whether the authentication of the source terminal is passed according to the result, and sends the certificate authentication response to the source terminal.
  • the source terminal determines whether to access the AP according to the certificate authentication response.
  • the source terminal and the AP perform session key negotiation: first, the source terminal locally generates a key parameter and puts it into the key agreement request, and The key negotiation request is sent to the AP, and the AP receives the key negotiation request sent by the source terminal, and sends the locally generated key parameter into the key negotiation response to the source according to the key parameter of the source terminal in the key negotiation request.
  • the source terminal After receiving the key negotiation response, the source terminal generates a session key according to the key parameter of the AP and the key parameter local to the source terminal, and the session key is only suitable for the source terminal and the AP.
  • the source terminal After the AP authenticates the source terminal, that is, after the source terminal and the AP perform session key negotiation, the source terminal sends a session request to the AP to perform a session with the terminal 20, for example, a device (such as a microwave oven) in the wireless local area network.
  • a device such as a microwave oven
  • the AP authenticates the terminal 20 according to the session request sent by the source terminal.
  • the authentication process is as follows:
  • the Ap sends an authentication activation request to the terminal 20, such as a microwave oven, according to the session request, and the AP authenticates the terminal 20, and the receiving request module 21 of the terminal 20 receives the authentication request.
  • the authentication certificate is sent to the AP, and the authentication module sends the authentication request to the AP.
  • the AP authenticates the terminal 20, and the authentication process is the same as the authentication process of the source terminal by the AP.
  • the secure link between the AP and the terminal 20 is established between the source terminal and the AP.
  • the AP allows the source terminal to access the terminal 20.
  • the method may further include:
  • the session negotiation module 23 is configured to perform session negotiation with the source terminal after the AP allows the source terminal to access the local end.
  • the AP After the source terminal establishes a secure link with the AP, the AP, and the terminal 20, the AP sends a session request to the terminal 20 to the terminal 20.
  • the terminal 20 receives the session request of the source terminal, and the session negotiation module 23 and the source terminal negotiate a key for the session between the two.
  • the session negotiation module 23 generates its own key parameters and forwards them to the AS through the AP.
  • the AS sends a session key negotiation request to the source terminal through the AP, and the source terminal is required to provide relevant parameters, and simultaneously sends the key parameters of the terminal 20 to the source terminal.
  • the source terminal generates its own key parameters and sends them to the AS in cipher text via the AP.
  • the key parameter of the source terminal is sent to the terminal 20 via the AP.
  • the source terminal and terminal 20 calculate the session key locally and start the session initiated by the source terminal.
  • the source terminal and the terminal 20 can directly negotiate through the session key negotiation, avoiding the interception caused by the transit of the AP, and further improving the security of the wireless local area network access.
  • an embodiment of an AP of the present invention including:
  • the first authentication module 31 is configured to authenticate the source terminal according to the authentication request sent by the source terminal;
  • the receiving module 32 is configured to: after receiving the authentication of the source terminal, the receiving source terminal sends a session request for the session with the target terminal;
  • a second authentication module 33 configured to perform authentication on the target terminal according to the session request;
  • the access module 34 is configured to allow the source terminal to access the target terminal when the authentication succeeds.
  • the wireless local area network in this embodiment may be a wireless home digital network, that is, a home network in a general sense, for example, a user may operate and manage a home appliance system through a wireless local area network and obtain a security status of a door and window gas pipeline.
  • Figure 2 shows the structure of the entire WLAN.
  • the user can use a mobile terminal such as a computer or mobile phone to access the WLAN and access network resources, that is, operate and manage each node of the local network.
  • the network center includes the AP30, the mobile terminal or computer accessing the wireless local area network, and each node in the wireless local area network are used as terminals, and these elements constitute a structured wireless local area network.
  • the source terminal When the source terminal accesses the target terminal of the WLAN, the source terminal sends an authentication request to the AP 30, and sends the certificate to the AP 30 for authentication.
  • the first authentication module 31 authenticates the certificate of the source terminal, and may be connected to the AP 30.
  • the authentication server AS performs authentication: The AP 30 puts the certificate of the source terminal and the AP30's own certificate into the certificate authentication request, and sends it to the AS for certificate authentication.
  • the AS first authenticates whether the certificate of the AP 30 is valid, and if it is valid, continues to verify the certificate of the source terminal. After the verification is completed, the AS puts the verification result into the certificate authentication response and sends the certificate authentication response back to the AP30.
  • the AP 30 authenticates the signature of the AS in the response, obtains the certificate authentication result of the source terminal, determines whether the authentication of the source terminal is passed according to the result, and sends the certificate authentication response to the source terminal.
  • the source terminal determines whether to access the AP 30 according to the certificate authentication response.
  • the source terminal and the AP 30 perform session key negotiation: first, the source terminal locally generates a key parameter and puts it into the key agreement request, and The key negotiation request is sent to the AP 30, and the AP 30 receives the key negotiation request sent by the source terminal, and sends the locally generated key parameter into the key negotiation response to the source according to the key parameter of the source terminal in the key negotiation request.
  • the source terminal After receiving the key negotiation response, the source terminal generates a session key according to the key parameter of the AP 30 and the key parameter local to the source terminal.
  • the session key is only applicable to the source terminal and the AP 30.
  • the source terminal After the AP 30 authenticates the source terminal, that is, after the source terminal and the AP 30 perform session key negotiation, the source terminal sends the target terminal, such as a device in the wireless local area network, to the AP 30 as needed (microwave oven). Etc.) A session request to make a session.
  • the receiving module 32 receives the session request sent by the source terminal, and the second authentication module 33 authenticates the target terminal according to the session request.
  • the authentication process is as follows: The second authentication module 33 sends an authentication activation request to the target terminal, such as a microwave oven, according to the session request, and starts. After the target terminal receives the authentication activation request sent by the second authentication module 33, the target terminal puts its own certificate into the authentication request and sends it to the second authentication module 33, and the second authentication module 33 targets the target terminal.
  • the authentication process is the same as the authentication process of the AP30 to the source terminal.
  • the access module 34 allows the source terminal to access the target terminal.
  • the source terminal and the target terminal by performing dual authentication on the source terminal and the target terminal, not only the identity security between the two terminals and the AP 30 in the access process can be ensured, but also the source terminal and the accessed target terminal can be ensured.
  • the data confidentiality of the session between the AP30 and the terminal ensures the security of the local wireless LAN.
  • the AP 60 is configured to authenticate the source terminal 40 according to the authentication request sent by the source terminal 40; and after the source terminal 40 is authenticated, the receiving source terminal 40 sends a session request for the session with the target terminal 50, according to the The session request, the target terminal 50 is authenticated; and when the target terminal 50 is authenticated, the source terminal 40 is allowed to access the target terminal 50.
  • the source terminal 40 is configured to send an authentication request to the AP 60; and when the AP 60 passes the authentication, send a session request for the session with the target terminal 50 to the AP 60, so that the AP 60 authenticates the target terminal 50 according to the session request, and is authenticated.
  • the source terminal 40 is allowed to access the target terminal 50 after passing.
  • the target terminal 50 is configured to receive an authentication activation request sent by the AP 60;
  • the authentication activation request sends an authentication request, so that the AP 60 authenticates the target terminal 50, and allows the source terminal 40 to access the target terminal 50 after the authentication is passed.
  • the source terminal 40 has the same structure and working principle as the terminal 10 of FIG. 7 or FIG. 8; the target terminal 50 has the same structure and working principle as the terminal 20 of FIG. 9 or FIG. 10; the AP 60 has the same structure and working principle as the AP 30 of 11; I will not repeat them here.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明揭示了一种安全访问WAPI网络的方法、装置及系统，可由WAPI网络的无线AP根据源终端发送的认证请求，对源终端进行认证；当认证通过时，所述源终端向AP发送和目标终端进行会话的会话请求；AP根据所述会话请求，对目标终端进行认证；当认证通过时，AP允许源终端接入目标终端。本发明提出的安全访问WAPI网络的方法、装置及系统，通过双重认证，提高WAPI网络访问的安全性。

Description

安全访问 WAPI网络的方法、 装置及系统 技术领域
本发明涉及到通信领域，特别涉及到一种安全访问 WAPK Wireless LAN Authentication and Privacy Infrastructure , 无线局域网鉴别和保密安全 )网络 的方法、 装置及系统。 背景技术
无线局域网 （WLAN )使用 WAPI协议， 是采用无线传输媒体的计算 机网络。 由于无线局域网具有安装方便， 灵活性好， 经济节约和易于扩展 等优点， 最近几年其发展非常迅速， 已经由最初的 802.11、 802.11b等协议 发展到今天的 802.11η,传输速度可以达到 100M以上。 随着技术不断成熟， 产品成本不断下降， 无线局域网的应用越来越多， 范围越来越广， 使广大 人民享受到便捷、 简单、 方便的网络服务。 特别是无线数字家庭网络， 用 户随时随地可以通过无线局域网访问互联网等资源。 然而， 无线局域网在 给大家带来便利的同时， 也存在安全缺陷， 在现有技术中， 无线局域网一 般都没有采用任何信息安全保护措施， 容易受到攻击。 发明内容
本发明的主要目的为提供一种安全访问 WAPI 网络的方法、 装置及系 统， 通过双重认证， 提高 WAPI网络访问的安全性。
为了达到上述目的， 本发明的技术方案是这样实现的：
一种安全访问 WAPI网络的方法， 包括：
WAPI网络的无线 AP根据源终端发送的认证请求，对源终端进行认证； 当认证通过时， 所述源终端向 AP发送和目标终端进行会话的会话请求； AP根据所述会话请求， 对目标终端进行认证； 当认证通过时， AP允 许源终端接入目标终端。
其中， 所述 WAPI网络的 AP根据源终端发送的认证请求，对源终端进 行认证的过程包括：
当源终端远程访问 AP时， 移动通讯网络的 AAA服务器根据源终端发 送的认证请求， 对源终端进行认证； 当认证通过时， 源终端向 AAA服务器 发送和 AP进行会话的 WLAN访问请求；
AAA服务器根据所述 WLAN访问请求和源终端的 WLAN访问权限， 对 AP进行认证； 当认证通过时， AAA服务器允许源终端接入 AP。
其中，在执行所述 AP允许源终端接入目标终端之后，所述方法还包括： 源终端和目标终端进行会话协商。
一种终端， 包括：
认证请求模块， 用于向 WAPI网络的无线 AP发送认证请求；
会话请求模块， 用于当 AP认证通过时， 向 AP发送和目标终端进行会 话的会话请求， 以便 AP根据该会话请求对目标终端进行认证， 并在认证通 过后允许本端接入目标终端。
其中， 该终端还包括：
会话协商模块， 用于在 AP允许本端接入目标终端之后，和目标终端进 行会话协商。
一种终端， 包括：
接收请求模块， 用于接收 WAPI网络的无线 AP发送的鉴别激活请求； 发送模块， 用于根据所述鉴别激活请求发送认证请求， 以便 AP对本端 进行认证， 并在认证通过后允许源终端接入本端。
其中， 还包括：
会话协商模块， 用于在 AP允许源终端接入本端之后，和源终端进行会 话协商。
一种 WAPI网络的无线 AP, 包括：
第一认证模块， 用于根据源终端发送的认证请求， 对源终端进行认证； 接收模块， 用于在所述第一认证模块对源终端认证通过后， 接收源终 端发送和目标终端进行会话的会话请求；
第二认证模块， 用于根据所述会话请求， 对目标终端进行认证； 接入模块， 用于在所述第二认证模块对目标终端认证通过时， 允许源 终端接入目标终端。
一种安全访问 WAPI网络的系统， 包括源终端、 目标终端和 WAPI网 络的无线 AP, 其中，
所述 AP, 用于根据源终端发送的认证请求， 对源终端进行认证； 以及 当对源终端认证通过后， 接收源终端发送和目标终端进行会话的会话请求， 根据所述会话请求， 对目标终端进行认证； 以及当对目标终端认证通过时， 允许源终端接入目标终端；
所述源终端， 用于向 AP发送认证请求； 以及当 AP认证通过时， 向 AP发送和目标终端进行会话的会话请求， 以便 AP根据该会话请求对目标 终端进行认证， 并在认证通过后允许本端接入目标终端；
所述目标终端， 用于接收 AP发送的鉴别激活请求； 以及根据所述鉴别 激活请求发送认证请求， 以便 AP对本端进行认证， 并在认证通过后允许源 终端接入本端。
其中， 所述源终端包括：
认证请求模块， 用于向 WAPI网络的无线 AP发送认证请求；
会话请求模块， 用于当 AP认证通过时， 向 AP发送和目标终端进行会 话的会话请求， 以便 AP根据该会话请求对目标终端进行认证， 并在认证通 过后允许本端接入目标终端； 或， 所述源终端还包括： 会话协商模块， 用于在 AP允许本端接入目标终端 之后， 和目标终端进行会话协商；
所述目标终端包括：
接收请求模块， 用于接收 WAPI网络的无线 AP发送的鉴别激活请求； 发送模块， 用于根据所述鉴别激活请求发送认证请求， 以便 AP对本端 进行认证， 并在认证通过后允许源终端接入本端； 或，
所述目标终端还包括：
会话协商模块， 用于在 AP允许源终端接入本端之后，和源终端进行会 话协商；
所述 AP包括：
第一认证模块， 用于根据源终端发送的认证请求， 对源终端进行认证； 接收模块， 用于在所述第一认证模块对源终端认证通过后， 接收源终 端发送和目标终端进行会话的会话请求；
第二认证模块， 用于根据所述会话请求， 对目标终端进行认证； 接入模块， 用于在所述第二认证模块对目标终端认证通过时， 允许源 终端接入目标终端。
本发明提出的一种安全访问 WAPI 网络的方法、 装置及系统， 通过对 源终端和目标终端的双重认证， 不仅可以保证接入过程中两个终端和无线 访问节点 （Access Point, AP )之间的身份安全性， 而且还可以保证源终端 和被访问的目标终端之间、 AP和终端之间会话的数据保密性， 确保本地无 线局域网的安全。 附图说明
图 1为本发明实施例的流程示意图；
图 2为本发明实施例的系统架构图；
图 3为本发明实施例的信令示意图； 图 4为本发明实施例中远程访问的流程示意图；
图 5为本发明实施例中远程访问的信令示意图；
图 6为本发明另一实施例的流程示意图；
图 7为本发明实施例的终端结构示意图；
图 8为本发明又一实施例的终端结构示意图；
图 9为本发明另一实施例的终端结构示意图；
图 10为本发明再一实施例的终端结构示意图；
图 11为本发明实施例的 AP结构示意图；
图 12为本发明实施例的安全访问 WAPI网络的系统结构示意图。 具体实施方式
参照图 1至图 3,提出本发明安全访问 WAPI网络的方法实施例，包括： S10、 AP根据源终端发送的认证请求， 对源终端进行认证；
本实施例中的无线局域网可以是无线家庭数字网络， 即一般意义上的 家庭网络， 例如用户可以通过无线局域网操作和管理家电系统以及获取门 窗煤气管道等的安全状态。 图 2所示为整个无线局域网的结构， 用户可使 用计算机或手机等移动终端接入无线局域网， 访问网络资源， 即操作和管 理本地网络的各节点。 其中， 网络中心包括 AP, 访问无线局域网的移动终 端或者计算机以及无线局域网中的各节点均作为终端， 这些元素组成了有 结构的无线局域网。
当源终端访问无线局域网的目标终端时 ,源终端向 AP发送认证请求即 接入鉴别请求， 同时将自己的证书发送给 AP进行认证， AP对源终端的证 书进行认证， 具体可以通过与 AP连接的认证服务器 AS进行认证： AP将 源终端的证书以及 AP自己的证书放入证书鉴别请求中，发送到 AS进行证 书鉴别， AS首先鉴别 AP的证书是否有效， 如果有效则继续验证源终端的 证书。 验证完毕后， AS将验证结果放入证书鉴别响应中， 并将该证书鉴别 响应发回至 AP。 AP通过证书鉴别响应中 AS的签名，得到对源终端的证书 鉴别结果， 根据该结果决定对源终端的认证是否通过， 同时， 将该证书鉴 别响应发至源终端。 源终端根据该证书鉴别响应决定是否接入 AP, 证书鉴 别成功后， 源终端和 AP之间进行会话密钥协商： 首先由源终端在本地生成 密钥参数放入密钥协商请求中， 并将密钥协商请求发送至 AP, AP收到源 终端发送的密钥协商请求， 根据密钥协商请求中源终端的密钥参数， 将本 地生成的密钥参数放入密钥协商响应中反馈至源终端， 源终端收到密钥协 商响应后，根据其中 AP的密钥参数并结合源终端本地的密钥参数， 生成会 话密钥， 该会话密钥仅适于源终端和 AP。
511、 当认证通过时， 所述源终端向 AP发送和目标终端进行会话的会 话请求；
当 AP对源终端认证通过后， 即源终端和 AP进行会话密钥协商后， 源 终端根据需要向 AP发送和目标终端例如无线局域网内的设备 (微波炉等 ) 进行会话的会话请求。
512、 AP根据所述会话请求， 对目标终端进行认证；
AP根据源终端发送的会话请求，对目标终端进行认证，认证过程如下： Ap根据会话请求， 向目标终端如微波炉发送鉴别激活请求， 开启 AP对目 标终端的认证， 目标终端收到 AP发来的鉴别激活请求后，将自己的证书放 入认证请求， 发送到 AP, 由 AP对目标终端进行认证， 该认证过程同 AP 对源终端的认证过程。
513、 当认证通过时， AP允许源终端接入目标终端。
当 AP对目标终端认证通过后 , 此时源终端与 AP之间， AP与目标终 端之间的安全链路已经建立。 AP允许源终端接入目标终端。
本实施例中， 通过对源终端和目标终端的双重认证， 不仅可以保证接 入过程中两个终端和 AP之间的身份安全性，而且还可以保证源终端和被访 问的目标终端之间、 AP和终端之间会话的数据保密性， 确保本地无线局域 网的安全。
参照图 4、 图 5, 在安全访问 WAPI网络的方法实施例中， 步驟 S10可 包括：
步驟 S101、 当源终端远程访问 AP时， 移动通讯网络的 AAA服务器根 据源终端发送的认证请求 , 对源终端进行认证；
当源终端远程访问 AP时， 需要在 AP中嵌入移动通信网络模块如 3G 模块， 通过该模块 AP可以接入移动通信网络。
源终端远程访问无线局域网，需要首先和无线局域网的 AP建立安全连 接， 即通过建立一条安全隧道， 在该隧道下运行 WAPI协议， 访问无线局 域网中的目标终端。 因此， 远程访问无线局域网的重点在源终端和 AP之间 安全隧道的建立过程， 本文中以 3GPP EAP-AKA的安全协议进行隧道建立 为例进行说明。 具体步驟如下：
源终端通过本地的接入网访问移动通信网络，向核心网的 AAA服务器 发送认证请求。
AAA服务器与 HLR进行交互， 获取当前会话的认证向量。
AAA服务器根据此认证向量对源终端进行认证， 并协商二者之间的会 话密钥。 认证通过后发送接入鉴别响应给源终端。 此时， 源终端和 AAA服 务器建立了安全链路。
步驟 S102、 当认证通过时， 源终端向 AAA服务器发送和 AP进行会话 的 WLAN访问请求；
认证通过后， 源终端发送 WLAN访问请求给 AAA服务器， 请求和无 线局域网的 AP进行会话。
步驟 S 103、 AAA服务器根据所述 WLAN访问请求和源终端的 WLAN 访问权限， 对 AP进行认证； AAA服务器将源终端的 IMSI发送至 HLR, 判断该源终端是否具有访 问无线局域网的权限。 如果源终端具有权限， 则 AAA服务器直接从 HLR 处获得无线局域网 AP的认证向量。
AAA服务器根据获得的认证向量和 AP进行接入认证过程， 同时协商 二者之间的会话密钥， 此时 AP和 AAA服务器之间建立了安全链路。
步驟 S104、 当认证通过时， AAA服务器允许源终端接入 AP。
AAA服务器和 AP的认证成功后， 将返回访问无线局域网的响应给源 终端。 此时， 源终端和 AP之间已经通过移动通信网建立了一个安全隧道。 源终端可以和 AAA服务器进行安全通信， 而 AAA服务器和 AP之间可以 进行安全通信，这样便以 AAA服务器为安全中转站构建了一条连接源终端 和 AP的安全隧道。 源终端通过该安全隧道， 根据 WAPI协议对无线局域网 进行接入和会话链路建立。
参照图 6, 提出本发明安全访问 WAPI网络的另一方法实施例， 在执行 前述的步驟 S13之后， 还包括：
步驟 S14、 源终端和目标终端进行会话协商。
当源终端与 AP, AP与目标终端的安全链路建立之后， AP向目标终端 发送源终端的会话请求。
目标终端收到源终端的会话请求， 需要协商二者之间进行会话的密钥。 目标终端生成自己的密钥参数通过 AP转发至 AS。
AS经过 AP向源终端发送会话密钥协商请求， 希望源终端提供相关的 参数， 同时将目标终端的密钥参数一起发送给源终端。
源终端生成自己的密钥参数， 并以密文形式经由 AP发送给 AS。
AS验证该信息成功后，将源终端的密钥参数经由 AP发送至目标终端。 源终端和目标终端在本地计算出会话密钥， 并开始由源终端发起的会 话。 本实施例中， 源终端和目标终端可直接通过会话密钥协商进行会话， 避免了由 AP进行中转而导致的被监听，进一步提高了无线局域网访问的安 全性。
参照图 7, 提出本发明终端的实施例， 包括：
认证请求模块 11 , 用于向 AP发送认证请求；
会话请求模块 12, 用于当 AP认证通过时， 向 AP发送和目标终端进行 会话的会话请求， 以便 AP根据该会话请求对目标终端进行认证， 并在认证 通过后允许本端接入目标终端。
本实施例中的无线局域网可以是无线家庭数字网络， 即一般意义上的 家庭网络， 例如用户可以通过无线局域网操作和管理家电系统以及获取门 窗煤气管道等的安全状态。 图 2所示为整个无线局域网的结构， 用户可使 用计算机或手机等移动终端接入无线局域网， 访问网络资源， 即操作和管 理本地网络的各节点。 其中， 网络中心包括 AP, 访问无线局域网的移动终 端或者计算机以及无线局域网中的各节点均作为终端， 这些元素组成了有 结构的无线局域网。
当终端 10访问无线局域网的目标终端时，认证请求模块 11向 AP发送 认证请求， 同时将自己的证书发送给 AP进行认证， AP对终端 10的证书进 行认证， 具体可以通过与 AP连接的认证服务器 AS进行认证： AP将终端 10的证书以及 AP自己的证书放入证书鉴别请求中，发送到 AS进行证书鉴 别， AS首先鉴别 AP的证书是否有效，如果有效则继续验证终端 10的证书。 验证完毕后， AS将验证结果放入证书鉴别响应中， 并将该证书鉴别响应发 回至 AP。 AP通过证书鉴别响应中 AS的签名， 得到对终端 10的证书鉴别 结果， 根据该结果决定对终端 10的认证是否通过， 同时， 将该证书鉴别响 应发至终端 10。 终端 10根据该证书鉴别响应决定是否接入 AP, 证书鉴别 成功后， 终端 10和 AP之间进行会话密钥协商： 首先由终端 10在本地生成 密钥参数放入密钥协商请求中， 并将密钥协商请求发送至 AP, AP收到终 端 10发送的密钥协商请求， 根据密钥协商请求中终端 10的密钥参数， 将 本地生成的密钥参数放入密钥协商响应中反馈至终端 10,终端 10收到密钥 协商响应后， 根据其中 AP的密钥参数并结合终端 10本地的密钥参数， 生 成会话密钥， 该会话密钥仅适于终端 10和 AP。
当 AP对终端 10认证通过后， 即终端 10和 AP进行会话密钥协商后， 会话请求模块 12根据需要向 AP发送和目标终端例如无线局域网内的设备 (微波炉等）进行会话的会话请求。
AP根据终端 10发送的会话请求， 对目标终端进行认证， 认证过程如 下： Ap根据会话请求， 向目标终端如微波炉发送鉴别激活请求， 开启 AP 对目标终端的认证， 目标终端收到 AP发来的鉴别激活请求后，将自己的证 书放入认证请求， 发送到 AP, 由 AP对目标终端进行认证， 该认证过程同 AP对终端 10的认证过程。
当 AP对目标终端认证通过后， 此时终端 10与 AP之间， AP与目标终 端之间的安全链路已经建立。 AP允许终端 10接入目标终端。
本实施例中， 通过对终端 10和目标终端的双重认证， 不仅可以保证接 入过程中两个终端和 AP之间的身份安全性， 而且还可以保证终端 10和被 访问的目标终端之间、 AP和终端之间会话的数据保密性， 确保本地无线局 域网的安全。
参照图 8 , 提出本发明终端的又一实施例， 在针对图 7的实施例中， 还 可以包括：
会话协商模块 13, 用于在 AP允许本端接入目标终端之后， 和目标终 端进行会话协商。
当终端 10与 AP, AP与目标终端的安全链路建立之后， AP向目标终 端发送终端 10的会话请求。 目标终端收到终端 10的会话请求，需要协商二者之间进行会话的密钥。 目标终端生成自己的密钥参数通过 AP转发至 AS。
AS经过 AP向终端 10发送会话密钥协商请求， 希望终端 10提供相关 的参数， 同时将目标终端的密钥参数一起发送给终端 10。
会话协商模块 13生成自己的密钥参数， 并以密文形式经由 AP发送给
AS。
AS险证该信息成功后，将终端 10的密钥参数经由 AP发送至目标终端。 终端 10的会话协商模块 13和目标终端在本地计算出会话密钥， 并开 始由终端 10发起的会话。
本实施例中， 终端 10和目标终端可直接通过会话密钥协商进行会话， 避免了由 AP进行中转而导致的被监听，进一步提高了无线局域网访问的安 全性。
参照图 9, 提出本发明终端的另一实施例， 包括：
接收请求模块 21 , 用于接收 AP发送的鉴别激活请求；
发送模块 22, 用于根据所述鉴别激活请求发送认证请求， 以便 AP对 本端进行认证， 并在认证通过后允许源终端接入本端。
本实施例中的无线局域网可以是无线家庭数字网络， 即一般意义上的 家庭网络， 例如用户可以通过无线局域网操作和管理家电系统以及获取门 窗煤气管道等的安全状态。 图 2所示为整个无线局域网的结构， 用户可使 用计算机或手机等移动终端接入无线局域网， 访问网络资源， 即操作和管 理本地网络的各节点。 其中， 网络中心包括 AP, 访问无线局域网的移动终 端或者计算机以及无线局域网中的各节点均作为终端， 这些元素组成了有 结构的无线局域网。
当源终端访问无线局域网的终端 20时， 源终端向 AP发送认证请求， 同时将自己的证书发送给 AP进行认证， AP对源终端的证书进行认证， 具 体可以通过与 AP连接的认证服务器 AS进行认证： AP将源终端的证书以 及 AP自己的证书放入证书鉴别请求中， 发送到 AS进行证书鉴别， AS首 先鉴别 AP的证书是否有效，如果有效则继续验证源终端的证书。验证完毕 后， AS将验证结果放入证书鉴别响应中， 并将该证书鉴别响应发回至 AP。 AP通过证书鉴别响应中 AS的签名， 得到对源终端的证书鉴别结果， 根据 该结果决定对源终端的认证是否通过， 同时， 将该证书鉴别响应发至源终 端。 源终端根据该证书鉴别响应决定是否接入 AP, 证书鉴别成功后， 源终 端和 AP之间进行会话密钥协商：首先由源终端在本地生成密钥参数放入密 钥协商请求中， 并将密钥协商请求发送至 AP, AP收到源终端发送的密钥 协商请求， 根据密钥协商请求中源终端的密钥参数， 将本地生成的密钥参 数放入密钥协商响应中反馈至源终端， 源终端收到密钥协商响应后， 根据 其中 AP的密钥参数并结合源终端本地的密钥参数， 生成会话密钥， 该会话 密钥仅适于源终端和 AP。
当 AP对源终端认证通过后， 即源终端和 AP进行会话密钥协商后， 源 终端根据需要向 AP发送和终端 20例如无线局域网内的设备 (微波炉等 ) 进行会话的会话请求。
AP根据源终端发送的会话请求， 对终端 20进行认证， 认证过程如下： Ap根据会话请求， 向终端 20如微波炉发送鉴别激活请求， 开启 AP对终端 20的认证， 终端 20的接收请求模块 21收到 AP发来的鉴别激活请求后， 将自己的证书放入认证请求， 发送模块 22该认证请求发送到 AP, 由 AP 对终端 20进行认证 , 该认证过程同 AP对源终端的认证过程。
当 AP对终端 20认证通过后， 此时源终端与 AP之间， AP与终端 20 之间的安全链路已经建立。 AP允许源终端接入终端 20。
本实施例中， 通过对源终端和终端 20的双重认证， 不仅可以保证接入 过程中两个终端和 AP之间的身份安全性，而且还可以保证源终端和被访问 的目标终端之间、 AP和终端之间会话的数据保密性， 确保本地无线局域网 的安全。
参照图 10, 提出本发明终端的再一实施例， 在针对图 9的实施例中， 还可以包括：
会话协商模块 23 , 用于在 AP允许源终端接入本端之后， 和源终端进 行会话协商。
当源终端与 AP, AP与终端 20的安全链路建立之后， AP向终端 20发 送源终端的会话请求。
终端 20收到源终端的会话请求， 会话协商模块 23和源终端协商二者 之间进行会话的密钥。 会话协商模块 23生成自己的密钥参数通过 AP转发 至 AS。
AS经过 AP向源终端发送会话密钥协商请求， 希望源终端提供相关的 参数， 同时将终端 20的密钥参数一起发送给源终端。
源终端生成自己的密钥参数， 并以密文形式经由 AP发送给 AS。
AS 3 证该信息成功后， 将源终端的密钥参数经由 AP发送至终端 20。 源终端和终端 20在本地计算出会话密钥 ,并开始由源终端发起的会话。 本实施例中， 源终端和终端 20可直接通过会话密钥协商进行会话， 避 免了由 AP进行中转而导致的被监听，进一步提高了无线局域网访问的安全 性。
参照图 11 , 提出本发明 AP的实施例， 包括：
第一认证模块 31 , 用于根据源终端发送的认证请求， 对源终端进行认 证；
接收模块 32, 用于对源终端认证通过后， 接收源终端发送和目标终端 进行会话的会话请求；
第二认证模块 33 , 用于根据所述会话请求， 对目标终端进行认证； 接入模块 34, 用于当认证通过时， 允许源终端接入目标终端。
本实施例中的无线局域网可以是无线家庭数字网络， 即一般意义上的 家庭网络， 例如用户可以通过无线局域网操作和管理家电系统以及获取门 窗煤气管道等的安全状态。 图 2所示为整个无线局域网的结构， 用户可使 用计算机或手机等移动终端接入无线局域网， 访问网络资源， 即操作和管 理本地网络的各节点。 其中， 网络中心包括 AP30, 访问无线局域网的移动 终端或者计算机以及无线局域网中的各节点均作为终端， 这些元素组成了 有结构的无线局域网。
当源终端访问无线局域网的目标终端时， 源终端向 AP30发送认证请 求， 同时将自己的证书发送给 AP30进行认证， 第一认证模块 31对源终端 的证书进行认证， 具体可以通过与 AP30连接的认证服务器 AS进行认证： AP30将源终端的证书以及 AP30自己的证书放入证书鉴别请求中， 发送到 AS进行证书鉴别， AS首先鉴别 AP30的证书是否有效，如果有效则继续验 证源终端的证书。 验证完毕后， AS将验证结果放入证书鉴别响应中， 并将 该证书鉴别响应发回至 AP30。 AP30通过证书鉴别响应中 AS的签名，得到 对源终端的证书鉴别结果， 根据该结果决定对源终端的认证是否通过， 同 时， 将该证书鉴别响应发至源终端。 源终端根据该证书鉴别响应决定是否 接入 AP30, 证书鉴别成功后， 源终端和 AP30之间进行会话密钥协商： 首 先由源终端在本地生成密钥参数放入密钥协商请求中， 并将密钥协商请求 发送至 AP30, AP30收到源终端发送的密钥协商请求， 根据密钥协商请求 中源终端的密钥参数， 将本地生成的密钥参数放入密钥协商响应中反馈至 源终端， 源终端收到密钥协商响应后，根据其中 AP30的密钥参数并结合源 终端本地的密钥参数， 生成会话密钥， 该会话密钥仅适于源终端和 AP30。
当 AP30对源终端认证通过后，即源终端和 AP30进行会话密钥协商后， 源终端根据需要向 AP30发送和目标终端例如无线局域网内的设备（微波炉 等）进行会话的会话请求。
接收模块 32接收源终端发送的会话请求， 第二认证模块 33根据该会 话请求对目标终端进行认证， 认证过程如下： 第二认证模块 33根据会话请 求，向目标终端如微波炉发送鉴别激活请求，开启 AP30对目标终端的认证， 目标终端收到第二认证模块 33发来的鉴别激活请求后， 将自己的证书放入 认证请求，发送到第二认证模块 33 , 由第二认证模块 33对目标终端进行认 证， 该认证过程同 AP30对源终端的认证过程。
当第二认证模块 33对目标终端认证通过后，此时源终端与 AP30之间， AP30与目标终端之间的安全链路已经建立。 接入模块 34允许源终端接入 目标终端。
本实施例中， 通过对源终端和目标终端的双重认证， 不仅可以保证接 入过程中两个终端和 AP30之间的身份安全性，而且还可以保证源终端和被 访问的目标终端之间、 AP30和终端之间会话的数据保密性， 确保本地无线 局域网的安全。
参照图 12, 提出本发明安全访问 WAPI网络的系统实施例， 包括源终 端 40、 目标终端 50和 AP60, 其中，
所述 AP60, 用于根据源终端 40发送的认证请求， 对源终端 40进行认 证； 以及当对源终端 40认证通过后， 接收源终端 40发送和目标终端 50进 行会话的会话请求， 根据所述会话请求， 对目标终端 50进行认证； 以及当 对目标终端 50认证通过时， 允许源终端 40接入目标终端 50。
所述源终端 40,用于向 AP60发送认证请求；以及当 AP60认证通过时， 向 AP60发送和目标终端 50进行会话的会话请求， 以便 AP60根据该会话 请求对目标终端 50进行认证， 并在认证通过后允许所述源终端 40接入目 标终端 50。
所述目标终端 50, 用于接收 AP60发送的鉴别激活请求； 以及根据所 述鉴别激活请求发送认证请求， 以便 AP60对所述目标终端 50进行认证， 并在认证通过后允许源终端 40接入所述目标终端 50。
源终端 40, 其结构和工作原理同图 7或图 8之终端 10; 目标终端 50, 其结构和工作原理同图 9或图 10之终端 20; AP60, 其结构和工作原理同 11之 AP30; 此处不再赘述。
本实施例中， 通过对源终端 40和目标终端 50的双重认证， 不仅可以 保证接入过程中两个终端和 AP60之间的身份安全性，而且还可以保证源终 端 40和被访问的目标终端 50之间、 AP60和终端之间会话的数据保密性， 确保本地无线局域网的安全。
以上所述仅为本发明的优选实施例， 并非因此限制本发明的专利范围 , 凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换， 或直 接或间接运用在其他相关的技术领域， 均同理包括在本发明的专利保护范 围内。

Claims

1、一种安全访问无线局域网鉴别和保密安全 WAPI网络的方法，包括： WAPI网络的无线访问节点 AP根据源终端发送的认证请求， 对源终端 进行认证； 当认证通过时， 所述源终端向 AP发送和目标终端进行会话的会 话请求；
AP根据所述会话请求， 对目标终端进行认证； 当认证通过时， AP允 许源终端接入目标终端。
2、 如权利要求 1所述的方法， 其中， 所述 WAPI网络的 AP根据源终 端发送的认证请求 , 对源终端进行认证的过程包括：
当源终端远程访问 AP时， 移动通讯网络的 AAA服务器根据源终端发 送的认证请求， 对源终端进行认证； 当认证通过时， 源终端向 AAA服务器 发送和 AP进行会话的无线局域网 WLAN访问请求；
AAA服务器根据所述 WLAN访问请求和源终端的 WLAN访问权限， 对 AP进行认证； 当认证通过时， AAA服务器允许源终端接入 AP。
3、 如权利要求 1或 2所述的方法， 其中， 在执行所述 AP允许源终端 接入目标终端之后， 所述方法还包括：
源终端和目标终端进行会话协商。
4、 一种终端， 包括：
认证请求模块， 用于向 WAPI网络的无线 AP发送认证请求；
会话请求模块， 用于当 AP认证通过时， 向 AP发送和目标终端进行会 话的会话请求， 以便 AP根据该会话请求对目标终端进行认证， 并在认证通 过后允许本端接入目标终端。
5、 如权利要求 4所述的终端， 其中， 该终端还包括：
会话协商模块， 用于在 AP允许本端接入目标终端之后，和目标终端进 行会话协商。
6、 一种终端， 包括：
接收请求模块， 用于接收 WAPI网络的无线 AP发送的鉴别激活请求； 发送模块， 用于根据所述鉴别激活请求发送认证请求， 以便 AP对本端 进行认证， 并在认证通过后允许源终端接入本端。
7、 如权利要求 6所述的终端， 其中， 还包括：
会话协商模块， 用于在 AP允许源终端接入本端之后，和源终端进行会 话协商。
8、 一种 WAPI网络的无线 AP, 包括：
第一认证模块， 用于根据源终端发送的认证请求， 对源终端进行认证； 接收模块， 用于在所述第一认证模块对源终端认证通过后， 接收源终 端发送和目标终端进行会话的会话请求；
第二认证模块， 用于根据所述会话请求， 对目标终端进行认证； 接入模块， 用于在所述第二认证模块对目标终端认证通过时， 允许源 终端接入目标终端。
9、 一种安全访问 WAPI网络的系统 , 包括源终端、 目标终端和 WAPI 网络的无线 AP, 其中，
所述 AP, 用于根据源终端发送的认证请求， 对源终端进行认证； 以及 当对源终端认证通过后， 接收源终端发送和目标终端进行会话的会话请求， 根据所述会话请求， 对目标终端进行认证； 以及当对目标终端认证通过时， 允许源终端接入目标终端；
所述源终端， 用于向 AP发送认证请求； 以及当 AP认证通过时， 向 AP发送和目标终端进行会话的会话请求， 以便 AP根据该会话请求对目标 终端进行认证， 并在认证通过后允许本端接入目标终端；
所述目标终端， 用于接收 AP发送的鉴别激活请求； 以及根据所述鉴别 激活请求发送认证请求， 以便 AP对本端进行认证， 并在认证通过后允许源 终端接入本端。
10、 如权利要求 9所述的系统， 其中，
所述源终端包括：
认证请求模块， 用于向 WAPI网络的无线 AP发送认证请求；
会话请求模块， 用于当 AP认证通过时， 向 AP发送和目标终端进行会 话的会话请求， 以便 AP根据该会话请求对目标终端进行认证， 并在认证通 过后允许本端接入目标终端； 或，
所述源终端还包括： 会话协商模块， 用于在 AP允许本端接入目标终端 之后， 和目标终端进行会话协商；
所述目标终端包括：
接收请求模块， 用于接收 WAPI网络的无线 AP发送的鉴别激活请求； 发送模块， 用于根据所述鉴别激活请求发送认证请求， 以便 AP对本端 进行认证， 并在认证通过后允许源终端接入本端； 或，
所述目标终端还包括：
会话协商模块， 用于在 AP允许源终端接入本端之后，和源终端进行会 话协商；
所述 AP包括：
第一认证模块， 用于根据源终端发送的认证请求， 对源终端进行认证； 接收模块， 用于在所述第一认证模块对源终端认证通过后， 接收源终 端发送和目标终端进行会话的会话请求；
第二认证模块， 用于根据所述会话请求， 对目标终端进行认证； 接入模块， 用于在所述第二认证模块对目标终端认证通过时， 允许源 终端接入目标终端。
PCT/CN2011/079469 2011-02-23 2011-09-08 安全访问wapi网络的方法、装置及系统 WO2012113225A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2011100442906A CN102104872A (zh) 2011-02-23 2011-02-23 安全访问wapi网络的方法、装置及系统
CN201110044290.6 2011-02-23

Publications (1)

Publication Number Publication Date
WO2012113225A1 true WO2012113225A1 (zh) 2012-08-30

Family

ID=44157321

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/079469 WO2012113225A1 (zh) 2011-02-23 2011-09-08 安全访问wapi网络的方法、装置及系统

Country Status (2)

Country Link
CN (1) CN102104872A (zh)
WO (1) WO2012113225A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102104872A (zh) * 2011-02-23 2011-06-22 中兴通讯股份有限公司 安全访问wapi网络的方法、装置及系统
CN104243467A (zh) * 2014-09-10 2014-12-24 珠海市君天电子科技有限公司 局域网终端的认证方法和装置
CN108989270B (zh) * 2017-06-02 2021-03-05 华为技术有限公司 认证方法、设备以及系统
CN115604705A (zh) * 2022-08-31 2023-01-13 云南电网有限责任公司（Cn） 一种基于wapi技术的通信系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060010484A1 (en) * 2004-06-15 2006-01-12 Nec Corporation Network connection system, network connection method, and switch used therefor
CN101115003A (zh) * 2006-05-05 2008-01-30 美国博通公司 支持传送带有媒体内容的数据包的通信设施及其方法
CN101217372A (zh) * 2008-01-02 2008-07-09 刘小鹏 一种结合网络地址的身份交互认证系统及方法
CN102104872A (zh) * 2011-02-23 2011-06-22 中兴通讯股份有限公司 安全访问wapi网络的方法、装置及系统

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101022260B1 (ko) * 2002-05-13 2011-03-21 톰슨 라이센싱 모바일 무선 통신 디바이스를 인증하기 위한 방법 및 통신 네트워크 시스템과, 액세스 포인트 시스템

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060010484A1 (en) * 2004-06-15 2006-01-12 Nec Corporation Network connection system, network connection method, and switch used therefor
CN101115003A (zh) * 2006-05-05 2008-01-30 美国博通公司 支持传送带有媒体内容的数据包的通信设施及其方法
CN101217372A (zh) * 2008-01-02 2008-07-09 刘小鹏 一种结合网络地址的身份交互认证系统及方法
CN102104872A (zh) * 2011-02-23 2011-06-22 中兴通讯股份有限公司 安全访问wapi网络的方法、装置及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
LI, DAN ET AL.: "Analysis of WAPI security mechanism in WLAN", COMPUTER ENGINEERING AND DESIGN, vol. 27, no. 13, July 2006 (2006-07-01), pages 2393 - 2395 *

Also Published As

Publication number Publication date
CN102104872A (zh) 2011-06-22

Similar Documents

Publication Publication Date Title
EP2445143B1 (en) Method and system for accessing a 3rd generation network
US7450554B2 (en) Method for establishment of a service tunnel in a WLAN
US8533461B2 (en) Wireless local area network terminal pre-authentication method and wireless local area network system
KR101068424B1 (ko) 통신시스템을 위한 상호동작 기능
WO2019017837A1 (zh) 网络安全管理的方法及装置
WO2010108347A1 (zh) 一种数字证书的更新和使用方法及系统
WO2009094942A1 (fr) Procédé et système de réseau de communication pour établir une conjonction de sécurité
WO2008034360A1 (fr) Procédé d'authentification et d'autorisation d'accès au réseau et procédé de mise à jour de clé d'autorisation
WO2010012203A1 (zh) 鉴权方法、重认证方法和通信装置
WO2009089738A1 (fr) Système et procédé d'accès pour authentification destinés à un réseau sans fil à sauts multiples
CN101371550A (zh) 自动安全地向移动通信终端的用户供给在线服务的服务访问凭证的方法和系统
WO2009152749A1 (zh) 一种绑定认证的方法、系统和装置
WO2008098496A1 (fr) Procédé d'application de certificat dans un mécanisme de sécurité wapi d'un réseau local sans-fil
CN101616410A (zh) 一种蜂窝移动通信网络的接入方法和系统
WO2012075863A1 (zh) 无线局域网集中式802.1x认证方法及装置和系统
WO2010127539A1 (zh) 一种流媒体业务的接入认证方法及系统
WO2008080351A1 (fr) Procédé d'exploitation de réseau local sans fil basé sur une infrastructure d'authentification et de confidentialité de wlan (wapi)
WO2009097789A1 (zh) 建立安全关联的方法和通信系统
WO2009074050A1 (fr) Procede, systeme et appareil d'authentification de dispositif de point d'acces
WO2009135445A1 (zh) 一种基于wapi的漫游认证方法
WO2011015060A1 (zh) 一种可扩展的鉴权协议认证方法、基站及鉴权服务器
WO2012075825A1 (zh) 无线局域网中端站的安全配置方法、ap、sta、as及系统
CN101420695B (zh) 一种基于无线局域网的3g用户快速漫游认证方法
WO2012151905A1 (zh) 网络切换方法及装置
WO2010121462A1 (zh) 一种自组网络下wapi站点间安全关联的建立方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11859328

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 11859328

Country of ref document: EP

Kind code of ref document: A1