WO2014161277A1

WO2014161277A1 - Method and system for connecting portable wlan hotspot

Info

Publication number: WO2014161277A1
Application number: PCT/CN2013/083574
Authority: WO
Inventors: 陈普查
Original assignee: 中兴通讯股份有限公司
Priority date: 2013-07-10
Filing date: 2013-09-16
Publication date: 2014-10-09
Also published as: CN104284331B; CN104284331A

Abstract

Disclosed are a method and system for connecting a portable wireless local area network (WLAN) hotspot. The method comprises: after receiving a WLAN hotspot access request initiated by a WLAN device according to device sliding track data (DSD), a WLAN hotspot detects a sliding operation which is conducted by a user in response to the WLAN hotspot access request; when it is detected that the user conducts the sliding operation, the WLAN hotspot generates hotspot sliding track data (HSD) and replies with an access request response; the WLAN hotspot uses the HSD to generate an asymmetric key pair and uses the asymmetric key pair to obtain the DSD of the WLAN device; and the WLAN hotspot compares the obtained DSD with the HSD, and, if the two match, sends an authentication certificate to the WLAN device so that the WLAN device can access the WLAN hotspot. The present invention can enable a user to more conveniently and safely establish a wireless local area network connection.

Description

Portable WLAN hotspot connection method and system

The present invention relates to the field of wireless communications, and in particular, to a method and system for connecting a wireless local area network (WLAN) hotspot. The process of configuring a WLAN hotspot and establishing a connection is complicated. The steps include: the user needs to first configure a service set identifier (Service Set Identifier, SSID), authentication and decryption mode, and set a password on the hotspot side. Remember and enter the password on the device side, and finally, the wireless LAN can be established. To avoid these complex processes, the Wi-Fi Alliance defines a Wi-Fi Protected Setup (WPS) standard for connecting Wi-Fi hotspots and Wi-Fi devices, as well as Wi-Fi Direct. Among the peer-to-peer devices, the latest standard "Wi-Fi Simple Configuration Technical Specification v2.0.2" defines three basic connection methods:

1. Push Button Configuration (PBC) mode adopts this mode. In the connection of Wi-Fi connection, the user can establish a Wi-Fi connection very conveniently. Specifically, the user only needs to press Wi. - The specific button on the Fi device and the Wi-Fi hotspot can complete the connection without going through a complicated configuration process. However, this approach has the disadvantage that an undesired Wi-Fi device and/or Wi-Fi hotspot may inadvertently or maliciously establish Wi-Fi with the desired hotspot and/or device between two push operations. connection. In other words, the existence of the method itself cannot effectively prevent the defect of the undesired connection process, which brings certain security risks to the actual use of the user.

2. The Personal Identification Number (PIN) method is adopted. The user only needs to input the PIN of the Wi-Fi hotspot on the Wi-Fi device to complete the connection. At the same time, the user can also enter the PIN of the Wi-Fi device on the Wi-Fi hotspot. However, a requirement for the latter is that the Wi-Fi hotspot must have a display or control client for input operations. The PIN method can better overcome the security flaws of the PBC mode, but the PIN needs to be remembered, and the password needs to be manually entered. At the same time, PINs generally have length requirements. This will undoubtedly increase the probability of error. 3. Near Field Communication (NFC) adopts this method. You only need to gently touch the Wi-Fi device and the Wi-Fi hotspot, or bring the Wi-Fi device and Wi-Fi hotspot closer to a certain distance. , you can complete the connection. However, this approach also poses a security risk that undesired Wi-Fi devices will also be connected to Wi-Fi hotspots because they are close enough. The three methods are described in detail above. It should also be noted that the first two methods need to go through a complicated 802.1x authentication process to obtain the authenticator's certificate of trust (Credentials). During the actual test, it was found that when multiple Wi-Fi devices are connected to a Wi-Fi hotspot at the same time, the status of the Wi-Fi hotspot is often abnormal, which greatly affects the user experience. For the PBC mode and device PIN, the hotspot is the role of the authenticator; for the hotspot PIN, the device is the authenticator role. After obtaining Credentials, a "probe-authentication-association" process is required to finally establish a Wi-Fi connection based on WPA or WPA-2.

A very important milestone was reached in the third quarter of 2012. A study conducted by Strategy Analytics estimated that since the launch of smartphones in 1996, the total number of smartphone users worldwide has exceeded 1 billion. In the third quarter of 2011, this figure was only 700 million. At the same time, researchers at Strategy Analytics believe that this number will exceed the 2 billion mark by 2015 at the latest. According to a report by market research firm ABI Research, by 2016, 97% of smartphone users worldwide will use touch-screen phones. At the same time, coupled with the hot sale of Apple Ipad and many manufacturers' tablet PCs, the popularity of touch screens has increased dramatically. As one of the electronic input devices, the touch screen is the simplest, most convenient and natural human-computer interaction method. The touch screen includes a touch detecting component and a touch screen controller, wherein: the touch detecting component is installed in front of the display screen for detecting a touch position of the user, and then sending the touch information to the touch screen controller; and the main function of the touch screen controller is from the touch point The detecting device receives the touch information, converts it into contact coordinates, and sends it to the CPU, which can simultaneously receive and execute the command sent by the CPU. Moreover, based on these features of the touch screen, many innovative technologies can be implemented to enhance the user experience, such as sliding unlocking, sliding multiple selection, sliding page turning, and the like. As a result, touch screens dominate the smartphone and tablet. In addition, coupled with the increase in consumer demand for information sharing and the increased demand for shared information privacy, higher requirements are placed on the wireless connection method. There are two main requirements, namely, the convenience and connection of the connection. Security. SUMMARY OF THE INVENTION Embodiments of the present invention provide a method and system for connecting a portable WLAN hotspot. According to an aspect of the present invention, a method for connecting a portable WLAN hotspot is provided, including: the WLAN hotspot receiving a WLAN hotspot initiated by a WLAN device according to Device Slide Data (DSD) After the access request, detecting a sliding operation performed in response to the WLAN hotspot access request; when detecting the sliding operation, the WLAN hotspot generates a hotspot sliding track data (Host Slide Data, referred to as HSD), and replies An access request response; the WLAN hotspot generates an asymmetric key pair by using the HSD, and obtains a DSD of the WLAN device by using the asymmetric key pair; the WLAN hotspot compares the obtained DSD with the HSD, if matched, Sending an authentication certificate to the WLAN device, and accessing the WLAN hotspot with the WLAN device. Preferably, the asymmetric key pair includes a public key and a private key, and the WLAN hotspot generates an asymmetric key pair by using the HSD, and the step of obtaining the DSD of the WLAN device by using the asymmetric key pair includes: The WLAN hotspot generates the public key and the private key by using the HSD, and sends the public key to the WLAN device; the WLAN hotspot receives the first ciphertext E1 obtained by the WLAN device by using the public key to encrypt the DSD and the access parameter; The hotspot decrypts E1 using the private key to obtain the decrypted DSD and access parameters. Preferably, the WLAN hotspot compares the obtained DSD with the HSD, and if yes, sends an authentication certificate to the WLAN device, and the step of accessing the WLAN hotspot by the WLAN device includes: the WLAN hotspot compares the obtained DSD with the HSD, If the matching is performed, the access parameter is used to encrypt the authentication certificate to obtain the second ciphertext E2; the WLAN hotspot sends the second ciphertext E2 to the WLAN device, and the WLAN device decrypts the E2 by using the access parameter to obtain Decrypt the authentication certificate and access the WLAN hotspot. Preferably, the access parameter includes a MAC address of the WLAN device and a random number sequence generated by the WLAN device. Preferably, if the DSD does not match the HSD, the WLAN hotspot generates a control frame for indicating termination of the WLAN hotspot access authentication, and sends the control frame to the WLAN device. According to another aspect of the present invention, a connection system for a portable WLAN hotspot is provided, including: a detecting unit, configured to: after receiving a WLAN hotspot access request initiated by the WLAN device according to the device sliding trajectory data DSD, The sliding operation is performed in response to the WLAN hotspot access request; the response unit is configured to generate hotspot sliding track data HSD and reply to the access request response when the sliding operation is detected; and the track acquiring unit is configured to utilize the Said HSD generates an asymmetric key pair and uses the asymmetric key pair The DSD to the WLAN device; the hotspot access unit is configured to compare the obtained DSD with the HSD, and if yes, send an authentication certificate to the WLAN device, and access the WLAN hotspot with the WLAN device. Preferably, the asymmetric key pair includes a public key and a private key, and the trajectory obtaining unit includes: an asymmetric key generating module, configured to generate a public key and a private key by using the HSD, and the public key Sending to the WLAN device; the WLAN hotspot receiving module is configured to receive the first ciphertext E1 obtained by the WLAN device by using the public key to encrypt the DSD and the access parameter; the WLAN hotspot decryption module is configured to decrypt the E1 by using the private key , get the decrypted DSD and access parameters. Preferably, the hotspot access unit includes: a WLAN hotspot core control module, configured to compare the obtained DSD with the HSD; and the WLAN hotspot encryption module is configured to use the access parameter to encrypt the authentication certificate when matching Obtaining a second ciphertext E2 _{; the} WLAN hotspot sending module is configured to send the second ciphertext E2 to the WLAN device, and the WLAN device decrypts the E2 by using the access parameter to obtain a decrypted authentication certificate, and accesses Wi-Fi hotspot. Preferably, the access parameter includes a MAC address of the WLAN device and a random number sequence generated by the WLAN device. Preferably, the hotspot access unit is further configured to: when the DSD and the HSD do not match, generate a control frame for indicating termination of the WLAN hotspot access authentication, and send the control frame to the WLAN device. Compared with the prior art, the beneficial effects of the embodiments of the present invention are: based on the analysis of the prior art and the consideration of the user's needs, the touch hotspot sliding technology is used to connect the portable hotspot, so that the user can conveniently and safely Establish a wireless connection. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a flow chart of a connection method of a portable WLAN hotspot according to an embodiment of the present invention; FIG. 2 is a schematic diagram of an operation interface of a portable WLAN hotspot according to an embodiment of the present invention; FIG. 4 is a system functional block diagram of a WLAN hotspot function and a WLAN device function according to an embodiment of the present invention; FIG. 5 is an SCP authentication protocol interaction diagram provided by an embodiment of the present invention: FIG. 6 is a flowchart of a WLAN device side according to an embodiment of the present invention; FIG. 7 is a flowchart of a portable WLAN hotspot side according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings. Embodiments of the present invention prevent the occurrence of an undesired connection process by touch screen sliding technology, asymmetric key technology, and encryption and decryption technology, thereby achieving connection security. At the same time, by simplifying the interaction process, the connection convenience is achieved, and the problem of hotspot state abnormality caused by competition of multiple devices in the related technology is reduced. The embodiment of the present invention acquires the user's sliding track data (HSD) on a portable WLAN hotspot with a touch screen or a touch pad, and calculates an asymmetric key pair, that is, a public key and a private key (also referred to as an encryption key and a decryption key). ). The public key can be broadcasted to encrypt the sliding track data on the device side. The WLAN device to be connected acquires the user's sliding track data (DSD) and encrypts the "DSD, MAC address, random number sequence" with the public key obtained by the interception. The ciphertext is then sent to the WLAN hotspot with the private key. The WLAN hotspot decrypts the DSD with the private key and compares it with the HSD obtained by itself to determine whether it matches. After the match, the "MAC address, random number sequence" is used as a symmetric key to encrypt the trust certificate and send it to the WLAN device. After receiving the ciphertext, the WLAN device decrypts the trust certificate using its own "MAC address, random number sequence". Finally, the WLAN device completes the establishment of the WLAN connection and can exchange data with the portable WLAN hotspot based on the trust certificate. It should be noted that the "portable" WLAN hotspot here refers to a certain type of WLAN hotspot, that is, a scene when a touch screen mobile terminal is used as a WLAN hotspot, and does not include an ordinary SOHO (home office) wireless router. The main difference between the "portable" WLAN hotspot and the ordinary LAN hotspot is that the "portable" WLAN hotspot has a touch screen, such as an Android smart phone. The hotspot is a function point of the mobile terminal, but not all functions; and the ordinary WLAN hotspot, for example TP-Link's various SOHO wireless routers generally do not have a touch screen, and are mainly used for routing functions. The embodiments of the present invention are described in detail below with reference to FIGS. 1 through 7. 1 is a flowchart of a method for connecting a portable WLAN hotspot according to an embodiment of the present invention. As shown in FIG. 1, the steps include: Step 101: After receiving the WLAN hotspot access request initiated by the WLAN device according to the device sliding trajectory data DSD, the WLAN hotspot detects the sliding operation performed by the user in response to the WLAN access request. 2 is a schematic diagram of an operation interface of a portable WLAN hotspot according to an embodiment of the present invention. As shown in FIG. 2, when a user prepares to connect one or more devices, a connection mode for acquiring sliding track data is started through a connection option, such as "Slide". Option. Then, the user can perform a certain sliding operation on the screen area where the sliding track is acquired, and can also be acquired by a similar application such as a handwriting panel of the input method. Step 102: When detecting that the user performs a sliding operation, the WLAN hotspot generates hotspot sliding track data HSD and returns an access request response. 3 is a schematic diagram of an operation interface of a WLAN device requesting connection to a portable WLAN hotspot according to an embodiment of the present invention. As shown in FIG. 3, the WLAN hotspot operation interface of FIG. 2 is basically the same, and the difference is that the WLAN device requesting the connection can select the search. A hotspot in the list is connected. Step 103: The WLAN hotspot generates an asymmetric key pair by using the HSD, and obtains a DSD of the WLAN device by using the asymmetric key pair. The asymmetric key pair includes a public key and a private key, and the step 103 includes: using a WLAN hotspot to use the

The HSD generates a public key and a private key, and sends the public key to the WLAN device. The WLAN device encrypts the DSD and the access parameter by using the public key to obtain a first ciphertext E1; the WLAN hotspot decrypts the E1 by using the private key. , get the decrypted DSD and access parameters. The access parameter includes a MAC address of the WLAN device and a random number sequence generated by the WLAN device. Step 104: The WLAN hotspot compares the obtained DSD with the HSD, and if yes, sends an authentication certificate to the WLAN device, and the WLAN device accesses the WLAN hotspot. The step 104 includes: the WLAN hotspot compares the obtained DSD with the HSD, and if yes, uses the access parameter to encrypt the authentication certificate, obtains the second ciphertext E2, and sends the second ciphertext E2 to the WLAN device; The access parameter decrypts E2, obtains the decrypted authentication certificate, and accesses the WLAN hotspot with the WLAN device. Further, if the DSD does not match the HSD, the WLAN hotspot generates a control frame for indicating termination of the WLAN hotspot access authentication, and sends the control frame to the WLAN device. Embodiments of the present invention are required to be applied to a portable WLAN hotspot and a WLAN device having a touch screen or a touch panel, which enables a user to establish a wireless local area network connection more conveniently and securely. If the WLAN hotspot and the WLAN device have a storage function, the HSD and DSD that successfully establish the WLAN connection can be cached. When the connection needs to be established next time, both the HSD and the DSD active can immediately establish a WLAN connection without re-sliding. The embodiment of the invention further provides a connection system for a portable WLAN hotspot, comprising: a detecting unit, configured to be initiated when receiving the WLAN device according to the device sliding trajectory data DSD

After the WLAN hotspot access request, the sliding operation performed by the user in response to the WLAN hotspot access request is detected. The response unit is configured to generate the hotspot sliding track data HSD when the user performs the sliding operation, and reply the access request response. The trajectory obtaining unit is configured to generate an asymmetric key pair by using the HSD, and obtain the DSD of the WLAN device by using the asymmetric key pair. The asymmetric key pair includes a public key and a private key, and the trajectory acquiring unit includes an asymmetric key generating module, a WLAN hotspot receiving module, and a WLAN hotspot decrypting module. The asymmetric key generation module generates a public key and a private key by using the HSD, and sends the public key to the WLAN device; the WLAN hotspot receiving module receives the WLAN device to encrypt the DSD and the access parameter by using the received public key. Obtaining a first ciphertext E1; the WLAN hotspot decryption module decrypts the received E1 by using the private key to obtain a decrypted DSD and an access parameter. The access parameter includes a MAC address of the WLAN device and a random number sequence generated by the WLAN device. The hotspot access unit is configured to compare the obtained DSD with the HSD, and if yes, send an authentication certificate to the WLAN device, and the WLAN device accesses the WLAN hotspot; otherwise, generate a control frame for indicating termination of the WLAN hotspot access authentication. And sent to the WLAN device. The hotspot access unit includes a WLAN hotspot core control module, a WLAN hotspot encryption module, and a WLAN hotspot sending module. The WLAN hotspot core control module compares the obtained DSD with the HSD. If the WLAN hotspot encryption module matches the access parameter, the ciphertext encryption module obtains the second ciphertext E2 and the WLAN hotspot sending module. The second ciphertext E2 is sent to the WLAN device, and the WLAN device decrypts the E2 by using the access parameter to obtain a decrypted authentication certificate, and accesses the WLAN hotspot. The embodiment of the present invention relates to an interaction between two entities, that is, a WLAN hotspot and a WLAN device. Starting from the two entities, the basic functional modules or components of the WLAN hotspot include: a WLAN hotspot human-computer interaction module, and an asymmetric key. a generating module, a WLAN hotspot decryption module, a WLAN hotspot encryption module, a WLAN hotspot core control module, a WLAN hotspot receiving module, and a WLAN hotspot sending module, wherein the basic functional modules or components of the WLAN device include: a WLAN device human-computer interaction module, and a WLAN device Decryption module, WLAN device encryption module, WLAN device core control module, WLAN device receiving module, WLAN device sending module. The WLAN hotspot human-computer interaction module is a touch screen or a human-machine interaction hardware device capable of acquiring Hot Slide Sliding Track Data (HSD). Specifically, the option of providing the user with a connection mode on the operation interface should at least include a startup option for acquiring the sliding track data, such as the "Slide" option shown in FIG. 2. When the user selects this option, the WLAN hotspot can initiate the virtual sub-interface or special control of the HSD. The asymmetric key generation module generates an asymmetric key pair, that is, a public key and a private key (or an encryption key and a decryption key) according to the HSD acquired from the human-machine interaction module. The WLAN hotspot decryption module decrypts the ciphertext El requesting to connect to the WLAN device by using a private key to obtain

Device Slide Data (DSD), device MAC address, and random number sequence on the WLAN device. The WLAN hotspot encryption module encrypts the MAC address and the random number sequence R of the WLAN device obtained by decrypting the E1 as a symmetric key, and encrypts the Credentials issued to the WLAN device to obtain the ciphertext E2. The main function of the WLAN hotspot core control module is to control the processing of other modules, coordinate the cooperative operation before each module, and complete data caching, comparison, and the like. One of the important functions is to compare the DSD of the WLAN device obtained by decrypting E1 with the HSD obtained on the hot spot. If it matches, the authentication process is continued. Otherwise, an error is returned and the authentication process is terminated. The WLAN device human-computer interaction module is the same human-computer interaction device as the WLAN hotspot, that is, the touch screen or the human-machine interaction hardware device capable of acquiring the DSD, and also provides the user with the option of the connection mode on the operation interface. The difference is that this connection option is valid only after you have selected a WLAN hotspot to be connected.

The WLAN device encryption module encrypts the DSD, the device MAC address, and the random number sequence R by using the public key of the WLAN hotspot that the WLAN device is ready to connect to obtain the ciphertext El.

The WLAN device decryption module uses its own MAC address and random number sequence R as symmetric keys, and decrypts the ciphertext E2 to obtain a trusted certificate (Credentials) of the hotspot to be connected. The main function of the WLAN device core control module is to control the processing of other modules, coordinate the cooperative operation before each module, and complete the buffering and comparison of data. In addition to this, the module is also arranged to generate a sequence of random numbers R, which together with its own MAC are used as a symmetric key. The embodiments of the present invention provide basic functional modules or components of two entities of a WLAN device and a WLAN hotspot, and these modules can also be included in one physical entity. 4 is a functional block diagram of a system having a WLAN hotspot function and a WLAN device function according to an embodiment of the present invention. As shown in FIG. 4, the device includes a human-machine interaction module, an asymmetric key generation module, an encryption module, a decryption module, and a sending module. Receive modules, which have the functions of all the functional modules and components described above, except that when they are used as a specific role (WLAN hotspot or WLAN device), different functional modules need to be enabled. FIG. 5 is a flowchart of interaction performed by using a Slide Configuration Protocol (SCP) according to an embodiment of the present invention. As shown in FIG. 5, the steps include: Step A: Requesting a WLAN connected WLAN device (ie, requesting a device) ) Get the user's sliding track data DSD. Step B: The WLAN device requests authentication by the Open System authentication method, and the WLAN hotspot performs authentication and confirms. Specifically, the WLAN device sends an authentication request frame authentication request with an authentication mode of 'Open System' to the WLAN hotspot. After receiving the authentication request frame, the WLAN hotspot determines whether to receive the authentication request frame, and after receiving, to the WLAN. The device sends an authentication response frame (Authentication Response), indicating that the WLAN terminal accepts the authentication. Step C: The WLAN device Dev initiates an association request, that is, sends an association request frame to the WLAN hotspot.

Association Request, and carries the connection mode in the association request frame, that is, the Slide mode. Step D: After receiving the association request frame, the WLAN hotspot detects the sliding operation of the user. When detecting that the user operates the WLAN hotspot, the hotspot sliding track data HSD is generated, and the Slide mode is also selected, and the WLAN is indicated in the associated response frame. Hotspots also use the Slide method. That is, the WLAN hotspot access request initiated by the WLAN device according to the DSD includes an authentication request frame Authentication Request and an association request frame Association Request sent by the WLAN device to the WLAN hotspot. The WLAN hotspot replying to the WLAN device's hotspot access request response includes an association response frame sent by the WLAN hotspot to the WLAN device. Step F: After receiving the association response frame, the WLAN device sends an SCP-Start frame of the sliding configuration protocol SCP to the WLAN hotspot to start the sliding authentication process. Step G: After receiving the SCP-Start, the WLAN hotspot uses an asymmetric key generation algorithm (such as RSA, Elgamal, etc.) to calculate the HSD on the WLAN hotspot to generate an asymmetric key pair, that is, a public key and a private key (or It is called encryption key and decryption key). Step H: The WLAN hotspot sends an SCP-Request frame carrying the public key to the WLAN device. Step I: The WLAN device encrypts the DSD, the MAC address, and the random number sequence R with the public key to obtain the ciphertext E1. Step J: The WLAN device sends an SCP-Response frame carrying E1 to the WLAN hotspot. Step K: The WLAN hotspot decrypts El with the private key, and obtains the DSD, MAC address, and random number sequence R of the WLAN device. Then, it is judged whether the HSD and the DSD match. If the match is made, the MAC and R of the WLAN device are used as the symmetric key to encrypt the trust certificate C to generate the ciphertext E2. Otherwise, the WLAN device is considered to be illegal, and the authentication process is terminated. Step L: The WLAN hotspot sends an SCP-Request carrying E2 to the WLAN device. Step M: The WLAN device decrypts its own MAC address and the stored random number sequence R as a key.

E2, get the trust certificate C of the WLAN hotspot. Step N: The WLAN device sends the SCP-Response frame to the WLAN hotspot and carries the authentication success identifier, such as Done. The entire processing flow based on the sliding configuration protocol ends normally. Step 0: After the WLAN device obtains the trust certificate C, it can perform secure data exchange with the hotspot, that is, the two parties use the authentication certificate to encrypt and decrypt the data frame. FIG. 6 is a flowchart of a WLAN device side according to an embodiment of the present invention. As shown in FIG. 6, the steps include: Step A: A user selects a Slide connection mode. Step B: The WLAN device waits for the user's sliding track data DSD, such as track 2 in Figure 3 (sliding from left to right). If the DSD is successfully obtained, go to step C. Otherwise, go to step 0. Step C: The WLAN device sends an authentication request frame with the authentication mode 'Open System' to the WLAN hotspot.

Authentication Request. Step D: The WLAN device waits for an authentication response frame Authentication Response from the WLAN hotspot. If yes, execute step E. Otherwise, go to step 0. This request-response protocol interaction process is shown in step B of FIG. Step E: The WLAN device initiates an association request frame Association Request to the WLAN hotspot, and carries the connection mode, that is, the Slide mode, in the association request frame. Step F: The WLAN device waits for the association response frame Association Response ₀ from the WLAN hotspot. If it is received, step G is performed. Otherwise, step 0 is performed. Step G: The WLAN device sends an SCP-Start frame of the sliding configuration protocol to the WLAN hotspot to start the sliding authentication process. Step H: The WLAN device waits for the SCP-Request frame carrying the public key. If yes, go to step I. Otherwise, go to step 0. Step I: The WLAN device generates a random number sequence R. Step J: The WLAN device encrypts the DSD, the MAC address, and the random number sequence R by using the public key from the WLAN to obtain the ciphertext E1. Step K: The WLAN device sends an SCP-Response frame carrying the ciphertext E1 to the WLAN hotspot. Step L: The WLAN device waits for the SCP-Request frame carrying the ciphertext E2 from the WLAN hotspot. If yes, go to step M. Otherwise, go to step 0. Step M: The WLAN device decrypts the ciphertext E2 by using its own MAC address and the stored random number sequence R as a symmetric key to obtain a trust certificate C of the WLAN hotspot. Step N: The WLAN device performs data exchange on the successfully established WLAN link based on the trust certificate C, and after the data exchange is completed, the steps are performed! ⁵ . Step 0: The WLAN device displays a failure message on the interface to prompt the user. Step P: End this session. FIG. 7 is a flowchart of a portable WLAN hotspot side according to an embodiment of the present invention. As shown in FIG. 7, the steps include: Step A: The user activates the WLAN hotspot Hotspot, or activates the Hotspot function of the smart device, so that the smart device acts as a WL AN hotspot. Step B: The WLAN hotspot receives an authentication request frame Authentication Request from the WLAN device. Step C: The WLAN hotspot determines whether to receive the authentication request frame. If yes, perform step D; otherwise, perform the step. Step D: The WLAN hotspot sends an authentication response frame Authentication Response to the WLAN device, indicating that the WLAN terminal accepts the authentication. This request-response protocol interaction process is shown in step B of FIG. Step E: The WLAN hotspot receives an association request frame Association Request from the WLAN device, and the association request frame carries a connection mode, that is, a Slide mode. Step F: The WLAN hotspot waits for the user's sliding track data HSD. If it is valid, such as the "2" track shown in Figure 2 (sliding from left to right), step G is performed; otherwise, the steps are performed. Step G: The WLAN hotspot sends an association response frame Association Request to the WLAN device, and the association request frame carries a connection mode, that is, a Slide mode. Step H: The WLAN hotspot receives the SCP-Start frame of the WLAN device and starts the SCP-based authentication process. Step I: The WLAN hotspot uses an asymmetric key generation algorithm (such as RSA, Elgamal, etc.) to calculate the HSD, and generates an asymmetric key pair, that is, a public key and a private key (or an encryption key and a decryption key). Step J: The WLAN hotspot sends an SCP-Request frame carrying the public key to the WLAN device. Step K: The WLAN hotspot waits for the SCP-Request frame carrying the ciphertext E1 from the WLAN device. If yes, go to step L; otherwise, go to step 1. Step L: The WLAN hotspot uses the private key to decrypt the ciphertext E1, and obtains the DSD, the MAC address, and the random number sequence R of the WLAN device. Step M: The WLAN hotspot determines whether the DSD matches its own HSD. If yes, perform step N. Otherwise, perform the step. Step N: The WLAN hotspot uses the MAC address of the WLAN device and the random number sequence R as symmetric keys, encrypts its own trust certificate C, and obtains ciphertext E2. Step O: The WLAN hotspot sends an SCP-Request frame carrying E2 to the WLAN device. Step P: The WLAN hotspot waits for the SCP-Response frame of the WLAN device indicating that the authentication is completed. If yes, go to step Q. Otherwise, go to step 1. Step WLAN hotspot and WLAN device exchange data frames, and then step S is performed. Step R: The WLAN hotspot prompts the user to fail, displays related error information, and sends a control frame carrying the error information to the WLAN device. Step S: End the session. In summary, the embodiments of the present invention have the following technical effects: The embodiment of the present invention can complete the connection authentication of the WLAN with less interaction process, and can effectively prevent unintentional or malicious entry of the illegal or undesired device, and at the same time, based on trust. The certificate can encrypt the data frames of the WLAN hotspot and the WLAN device, thus providing a more secure and convenient communication method. Although the invention has been described in detail above, the invention is not limited thereto, and various modifications may be made by those skilled in the art in accordance with the principles of the invention. Therefore, modifications made in accordance with the principles of the invention should be construed as falling within the scope of the invention.

Claims

Claims, a method of connecting a WLAN hotspot for a portable wireless local area network, including

After receiving the WLAN hotspot access request initiated by the WLAN device according to the device sliding trajectory data DSD, the WLAN hotspot detects the sliding operation in response to the WLAN hotspot access request;

When detecting the sliding operation, the WLAN hotspot generates hotspot sliding track data HSD and responds to the access request response;

The WLAN hotspot generates an asymmetric key pair by using the HSD, and obtains a DSD of the WLAN device by using the asymmetric key pair;

The WLAN hotspot compares the obtained DSD with the HSD, and if yes, sends an authentication certificate to the WLAN device, and the WLAN device accesses the WLAN hotspot. The method according to claim 1, wherein the asymmetric key pair comprises a public key and a private key, and the WLAN hotspot generates an asymmetric key pair by using the HSD, and uses the asymmetric key pair The step of obtaining the DSD of the WLAN device includes:

The WLAN hotspot generates a public key and a private key by using the HSD, and sends the public key to the WLAN device;

Receiving, by the WLAN hotspot, the first ciphertext E1 obtained by the WLAN device by using the public key to encrypt the DSD and the access parameter;

The WLAN hotspot decrypts E1 using the private key to obtain a decrypted DSD and access parameters. The method according to claim 2, wherein the WLAN hotspot compares the obtained DSD with the HSD, and if yes, sends an authentication certificate to the WLAN device, and the WLAN device accesses the WLAN hotspot. The steps include:

The WLAN hotspot compares the obtained DSD with the HSD, and if yes, uses the access parameter to encrypt the authentication certificate to obtain the second ciphertext E2;

The WLAN hotspot sends the second ciphertext E2 to the WLAN device, and the WLAN device decrypts the E2 by using the access parameter to obtain a decrypted authentication certificate, and accesses the WLAN hotspot. The method according to claim 3, wherein the access parameter comprises a MAC address of the WLAN device and a random number sequence generated by the WLAN device. The method according to any one of claims 1-4, wherein, if the DSD does not match the HSD, the WLAN hotspot generates a control frame for indicating termination of the WLAN hotspot access authentication, and sends the control frame to the WLAN device. A system for connecting a portable wireless local area network WLAN hotspot, comprising:

The detecting unit is configured to detect, after receiving the WLAN hotspot access request initiated by the WLAN device according to the device sliding trajectory data DSD, the sliding operation performed in response to the WLAN hotspot access request;

The response unit is configured to generate hotspot sliding track data HSD when the sliding operation is detected, and reply to the access request response;

a trajectory obtaining unit, configured to generate an asymmetric key pair by using the HSD, and obtain a DSD of the WLAN device by using the asymmetric key pair;

The hotspot access unit is configured to compare the obtained DSD with the HSD, and if yes, send an authentication certificate to the WLAN device, and access the WLAN hotspot by the WLAN device. The system according to claim 8, wherein the asymmetric key pair comprises a public key and a private key, and the trajectory obtaining unit comprises:

An asymmetric key generation module is configured to generate a public key and a private key by using the HSD, and send the public key to the WLAN device;

The WLAN hotspot receiving module is configured to receive the first ciphertext E1 obtained by the WLAN device by using the public key to encrypt the DSD and the access parameter;

The WLAN hotspot decryption module is configured to decrypt E1 by using the private key to obtain a decrypted DSD and access parameters. The system of claim 7, wherein the hotspot access unit comprises:

The WLAN hotspot core control module is configured to compare the obtained DSD with the HSD;

The WLAN hotspot encryption module is configured to: when the matching is performed, use the access parameter to encrypt the authentication certificate to obtain the second ciphertext E2; The WLAN hotspot sending module is configured to send the second ciphertext E2 to the WLAN device, and the WLAN device decrypts the E2 by using the access parameter to obtain a decrypted authentication certificate, and accesses the WLAN hotspot. . The system according to claim 8, wherein the access parameter comprises a MAC address of the WLAN device and a random number sequence generated by the WLAN device. The system according to any one of claims 6-9, wherein the hotspot access unit is further configured to generate a control frame for instructing termination of the WLAN hotspot access authentication when the DSD and the HSD do not match, And sent to the WLAN device.