WO2014201766A1

WO2014201766A1 - Emergency communication method, mobile terminal, authentication server and wireless access point

Info

Publication number: WO2014201766A1
Application number: PCT/CN2013/082324
Authority: WO
Inventors: 张正阳
Original assignee: 中兴通讯股份有限公司
Priority date: 2013-06-20
Filing date: 2013-08-27
Publication date: 2014-12-24
Also published as: CN104244210A

Abstract

An emergency communication method comprises: user terminal (UE) transmitting to a wireless access point (AP) a request for emergency communication; after receiving the request for emergency communication transmitted by the UE, the AP transmitting to the UE a response message for requesting a user name information; after receiving the response message transmitted by the AP, the UE transmitting to the authentication server (AS) an emergency communication message containing the user name information through the AP; and the AS receiving the emergency communication message and judging whether the received emergency communication message is an emergency communication frame or not, and if so, setting the user name as an emergency communication user and notifying that the AP is an open access port for the user. Further disclosed are a mobile terminal, an authentication server and a wireless access point. The embodiment of the present invention remedies the abovementioned defects effectively, and opens up an emergency channel in the existing WiFi network in order to help users in need acquire the desired information at any time and any place.

Description

Emergency communication method, mobile terminal, authentication server and wireless access point

Technical field

The present invention relates to emergency communication technologies, and in particular to an emergency communication method, a mobile terminal, an authentication server, and a wireless access point. Background technique

With the increasing popularity of WiFi networks, WiFi has become synonymous with wireless local area networks (WLANs). It provides a technical way for people to access wireless networks at any time and anywhere. With convenient and flexible networking, it is more convenient than cellular networks. Fast transmission rate and free frequency band without any telecom operation license worldwide, WiFi is more and more widely used in various terminals, and it becomes a basic function of mobile terminals including mobile phones and tablets, and users can cover in WiFi. Realize services such as browsing the web, answering and making calls in the area.

In general, access to the WiFi network requires authentication through the WiFi hotspot to ensure the security and legitimacy of the network. In an emergency, especially in the event of an emergency such as a disaster/medical/accident site, it is urgent to provide A method and method for emergency communication and emergency rescue based on WiFi wireless local area network.

Related patent documents include: Chinese Patent Application No. CN200310112944.X, "An 802. lx Authentication Method" and Patent No. CN200810147953.5, "Chinese Patent Application "Safe Access Method Based on Extended 802.1x Authentication System" .

The Chinese patent application No. CN200310112944.X has the following deficiencies: The purpose of the patent is to meet the authentication requirements of multiple users under the same port, and to meet the diverse needs and resources of enterprises and group users.

The Chinese patent application No. CN200810147953.5 has the following deficiencies: The patent is to extend the EAPOL protocol and increase the security access mark, so that the authentication requester, that is, the end user accesses the device through the Layer 2 access device securely and trustedly, the purpose is to improve The security considerations of the access user, that is, the authenticity of the edge device accessing the network is ensured without changing the traditional access authentication mode. It is also impossible to achieve rapid public authentication through the wireless LAN in an emergency and to securely use network resources. Summary of the invention

In order to solve the above technical problem, the present invention discloses an emergency communication method, a mobile terminal, an authentication server, and a wireless access point, which can quickly authenticate through a wireless local area network in an emergency and securely use network resources.

The emergency communication method disclosed by the present invention includes:

The user terminal UE sends an emergency communication request to the wireless access point AP;

After receiving the emergency communication request sent by the UE, the AP sends a response requesting the user name information to the UE;

After receiving the response packet sent by the AP, the UE sends an emergency communication message including the user name information to the authentication server AS through the AP;

Receiving, by the AS, the emergency communication message, and determining whether the received emergency communication message is an emergency communication frame, and if yes, setting the user name as an emergency communication user, and notifying the AP to open an access port for the user .

Preferably,

After the AS notifies the AP to open the access port for the user, the AS includes:

The AP limits the target address of the emergency communication user connection to be within a preset IP address or a web address range.

Preferably, the AS receives the emergency communication message, and determines whether the received emergency communication message is an emergency communication frame, and if not, initiates identity authentication to the UE.

The mobile terminal disclosed by the present invention includes:

The emergency communication request module is configured to: send an emergency communication request to the wireless access point AP; the emergency communication message sending module is configured to: after receiving the response message of the requesting user name information sent by the wireless access point AP, The AP sends an emergency communication message including the user name information to the authentication server AS. The wireless access point disclosed by the present invention includes:

The emergency communication request receiving module is configured to: after receiving the emergency communication request sent by the user terminal UE, send a response requesting the user name information to the UE;

The emergency communication message forwarding module is configured to: receive an emergency communication message sent by the UE and including the user name information, and forward the message to the authentication server AS;

The access port open module is configured to: when the AS determines that the emergency communication message sent by the UE is an emergency communication frame, open an access port for the user according to the instruction of the AS.

Preferably,

The wireless access point further includes:

The access restriction module is configured to: after opening the access port for the user, restrict the destination address of the emergency communication user connection to be within a preset IP address or URL range.

The authentication server disclosed by the present invention includes:

The emergency communication message receiving module is configured to: receive an emergency communication message that is sent by the UE and includes the user name information;

The emergency communication frame determining module is configured to: determine whether the received emergency communication message is an emergency communication frame, and if yes, set the user name as an emergency communication user, and notify the AP to open an access port for the user.

Preferably,

The authentication server further includes:

The identity authentication module is configured to: initiate identity authentication to the user terminal UE; the emergency communication frame determination module is further configured to: notify the identity authentication module to the user terminal UE when determining that the received emergency communication message is not an emergency communication frame Initiate identity authentication.

BRIEF abstract

Figure 1 is a TCP/WLAN based emergency communication method using the IEEE 802.1x recommended client/server architecture; 2 is an EAP protocol packet data structure transmitted between a client STA and a wireless access point AP;

3 is a flow chart of an emergency communication method based on a WiFi wireless local area network according to an embodiment of the present invention;

4 is a structural block diagram of a mobile terminal according to an embodiment of the present invention;

FIG. 5 is a structural block diagram of a wireless access point according to an embodiment of the present invention; FIG.

6 is a structural block diagram of an authentication server in accordance with an embodiment of the present invention. Preferred embodiment of the invention

An emergency communication access authentication method based on WiFi wireless local area network is proposed in the embodiment of the present invention. The method is based on an access control mechanism defined by IEEE 802. lx, and an "emergency communication" is added by extending EAPOL and EAP standard protocol authentication messages. The startup message and frame type enable fast and secure access to the WLAN for emergency and timely communication in an emergency.

The emergency communication method based on the WiFi wireless local area network of the present invention will be described below with reference to the accompanying drawings.

As shown in FIG. 1 , the method for emergency communication based on WiFi wireless local area network proposed by the embodiment of the present invention uses a client/server architecture recommended by IEEE 802.1x, which includes three entities, namely, a client STA, a wireless access point AP. And the authentication server AS, their respective roles are as follows:

* The client STA, as the applicant for the authentication request, is a terminal requesting access to network resources, thereby initiating an authentication request.

• Wireless Access Point AP, also known as the Authenticator, functions as a “transparent pass” during the authentication process. • The authentication server AS is an entity that provides authentication services for the authenticator. The authentication and authorization functions are usually implemented by the RADIUS server.

The IEEE 802.lx authentication system uses the EAP protocol (Extensible Authentication Protocol) to exchange emergency communication messages between the client STA and the authentication server AS. The EAP protocol packet is directly encapsulated in the WLAN environment by using the EAPOL (EAP Over LAN) encapsulation format between the client STA and the AP. EAP protocol packets are encapsulated in EAPOR (EAP Over RADIUS) between the wireless access point AP and the authentication server AS. The format is contained in the RADIUS (Remote Authentication Dial In User Service) protocol.

The working mechanism of the IEEE 802. lx is: The client STA initiates an authentication request, and the corresponding username/password or digital certificate is transmitted to the authentication server AS for authentication through the wireless access point AP. After the user passes the authentication, the authentication server AS The authentication result and related information are transmitted to the wireless access point AP, and the wireless access point AP determines the authorized/unauthorized status of the controlled port according to the indication (accept or reject) of the authentication server AS.

The embodiment of the present invention complies with the client/server architecture recommended by IEEE 802.1x and is compatible with the access authentication process specified in the original protocol. Based on the original protocol, a new message definition is added to the fields in the EAP message and the EAPOL message to ensure the implementation of the emergency communication authentication access procedure described in the present invention. Added field definitions include:

1) In the Type field of the EAPOL packet, the Emergency Start message is added to ensure that the client side initiates the emergency communication authentication, and the system side raises its priority and sets a special emergency channel for it.

2) Add a new EAP packet type in the Code field in the EAP message - emergency communication

Emergency, used to transmit emergency communication messages between the client STA, the wireless access point AP, and the authentication server AS during the authentication process.

As shown in FIG. 2, the EAP protocol packet transmitted between the client STA and the wireless access point AP is based on the EAPOL protocol defined by 802. lx, and the EAP protocol packet is encapsulated in the EAPOL protocol, and the EAPOL message format is used. The individual fields are defined as follows:

• PAE Ethernet Type: Indicates the protocol type of the Port Access Entity (PAE). The protocol type assigned by 802. lx is 0x888E.

• Protocol Version: Indicates the protocol version number supported by the sender of the EAPOL frame.

• Type: frame type

■ EAP-Packet (value 00), an emergency communication message frame, used to carry emergency communication messages;

■ EAPOL-Start (value 01), authentication initiation frame;

■ EAPOL-Logoff (value 02), exit request frame;

■ EAPOL-Key (value is 03), key information frame; ■ EAPOL-EmergencyStart (value FF) for emergency communication authentication initiation frames. The present invention specifically defines new frame types.

• Length: indicates the length of the data, which is the length of the "Packet Body" field. If it is 0, it means there is no data field behind it.

· Packet Body: The packet entity. Different frame types correspond to different data formats. When the frame type is EAP-Packet ( 00 ), this field encapsulates the standard EAP format data packet. The EAP fields are defined as follows:

■ Code: Indicates the type of EAP packet. There are four types of original definitions: Request Request, Response Response, Success Success, Failure Failure. In order to ensure the implementation of emergency communication, a new EAP packet type definition, Emergency Communication Emergency, is used to transmit emergency communication emergency communication messages between the client STA, the wireless access point AP and the authentication server AS.

■ Identifier: An identifier that assists in the request/response message.

■ Length: The length of the EAP packet, including the full length of the Code, Identifier, Length, and Data.

■ Data: EAP data information, the content format is determined by Code. Embodiment 1

As shown in FIG. 3, this embodiment discloses an emergency communication method based on a WiFi wireless local area network. The detailed authentication method is as follows:

Step 1: The client STA sends an emergency communication request initiation message (EAPOL-EmergencyStart) to the wireless access point AP to start the emergency authentication process.

Step 2: The wireless access point sends a response message (EAPOL_EAP_Request) to the client STA requesting the username information.

Step 3: The client STA responds to an emergency communication response message (EAPOL EAP Emergency) including the user name and the like to the wireless access point AP;

Step 4: The AP sends the data frame to the authentication server AS after being processed by the RADIUS protocol packet (RADIUS EAP Emergency).

Step 5: The authentication server AS determines the type of the received EAP frame. If it is an emergency communication frame, The user name is set as the emergency communication user, and the wireless access point AP is notified to open the control port, and the wireless access point AP sends an authentication success message (EAPOL_EAP_Success) to the client STA, and the authentication ends; otherwise, according to 802.1x The standard process performs user authentication.

Step 6: After the authentication succeeds, the authentication server AS sends a session key to the wireless access point AP, and starts the session according to the key client STA.

Step 7: The session starts, the client STA initiates a session connection request, and the wireless access point AP restricts the target address of the connection to the client within the range of the preset IP address or the URL for the client marked as “emergency communication user”.

Embodiment 2

As shown in FIG. 4, this embodiment discloses a mobile terminal, including:

An emergency communication requesting module, configured to send an emergency communication request to the wireless access point AP, and an emergency communication message sending module, configured to: after receiving the response message of the requesting user name information sent by the wireless access point AP, The authentication server AS sends an emergency communication message containing the user name information.

Embodiment 3

As shown in FIG. 5, this embodiment discloses a wireless access point, including:

The emergency communication request receiving module is configured to: after receiving the emergency communication request sent by the user terminal UE, send a response message requesting the user name information to the UE;

The emergency communication message forwarding module is configured to receive the emergency communication message that is sent by the UE and includes the user name information, and forwards the message to the authentication server AS;

The access port open module is configured to: when the AS determines that the emergency communication sent by the UE is an emergency communication frame, open an access port for the user according to the indication of the AS.

The access restriction module is configured to limit the target address of the emergency communication user connection to be within a preset IP address or a web address range after the access port is opened for the user. Embodiment 4

As shown in FIG. 6, this embodiment discloses an authentication server, including:

An emergency communication message receiving module, configured to receive an emergency communication message that is sent by the UE and includes user name information;

The emergency communication frame determining module is configured to determine whether the received emergency communication message is an emergency communication frame, and if yes, set the user name as an emergency communication user, and notify the AP to open an access port for the user, if not, Informing the identity authentication module to initiate identity authentication to the user terminal UE;

An identity authentication module is configured to initiate identity authentication to the user terminal UE.

It is to be understood that the invention may be embodied in other forms and modifications without departing from the spirit and scope of the invention.

Industrial applicability

The beneficial effects of the embodiments of the present invention are:

One of the advantages of embodiments of the present invention is achievability. At the beginning of the design, WLANs were mainly used for personal, home and enterprise applications, and there were some shortcomings in public services and emergency communications. The present invention effectively compensates for the above drawbacks and opens up an emergency channel from existing WiFi networks, so that users in need can obtain the required information assistance at any time and any place.

The second advantage of the embodiment of the invention lies in security. The embodiment of the present invention provides maximum protection for the privacy and ownership of the wireless network hotspot owner, provides an emergency channel for the random access user, and also prevents malicious and abuse of emergency channel resources by limiting the target access address.

The third advantage of the embodiment of the present invention lies in compatibility. The embodiments of the present invention are compatible with the existing technical standards and the air interface and the frame format requirements to the greatest extent, and do not change the existing WLAN access authentication mode, and only need to upgrade the existing equipment to implement the emergency communication function. .

Claims

claims

1. An emergency communication method, including:

After receiving the emergency communication request sent by the UE, the AP sends a response message requesting user name information to the UE;

After receiving the response message sent by the AP, the UE sends an emergency communication message containing the user name information to the authentication server AS through the AP;

The AS receives the emergency communication message and determines whether the received emergency communication message is an emergency communication frame. If so, sets the user name as an emergency communication user and notifies the AP to open an access port for the user. .

2. The method of claim 1, wherein,

After the AS notifies the AP to open an access port for the user, it includes:

The AP limits the target address of the emergency communication user connection to be within a preset IP address or website range.

3. The method of claim 1, wherein,

The AS receives the emergency communication message and determines whether the received emergency communication message is an emergency communication frame. If not, initiates identity authentication to the UE.

4. A mobile terminal, including:

The emergency communication request module is set to: send an emergency communication request to the wireless access point AP; the emergency communication message sending module is set to: after receiving a response message requesting user name information sent by the wireless access point AP, through The AP sends an emergency communication message containing the user name information to the authentication server AS.

5. A wireless access point, including:

The emergency communication request receiving module is configured to: after receiving the emergency communication request sent by the user terminal UE, send a response message requesting user name information to the UE;

The emergency communication message forwarding module is configured to: receive the emergency communication message containing user name information sent by the UE, and forward it to the authentication server AS; The access port opening module is configured to: when the AS determines that the emergency communication message sent by the UE is an emergency communication frame, open the access port to the user according to the instruction of the AS.

6. The wireless access point as claimed in claim 5, wherein,

The wireless access point also includes:

The access restriction module is set to: after opening the access port for the user, restrict the target address connected by the emergency communication user to a preset IP address or website range.

7. An authentication server, including:

The emergency communication message receiving module is configured to: receive the emergency communication message containing user name information sent by the UE;

The emergency communication frame judgment module is configured to: judge whether the received emergency communication message is an emergency communication frame, and if so, set the user name as an emergency communication user, and notify the AP to open an access port for the user.

8. The authentication server as claimed in claim 7, wherein,

The authentication server also includes:

The identity authentication module is set to: initiate identity authentication to the user terminal UE;

The emergency communication frame judgment module is also configured to: when judging that the received emergency communication message is not an emergency communication frame, notify the identity authentication module to initiate identity authentication to the user terminal UE.