WO2016029668A1

WO2016029668A1 - Secure connection method, device and system, and computer storage medium

Info

Publication number: WO2016029668A1
Application number: PCT/CN2015/073292
Authority: WO
Inventors: 余庆平
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-08-27
Filing date: 2015-02-26
Publication date: 2016-03-03
Also published as: CN105472606A

Abstract

Disclosed in an embodiment of the present invention are a secure connection method, device and system, and computer storage medium, the method comprising: a terminal in the process of connecting to a WiFi hotspot transmits a request message to the WiFi hotspot; the terminal receives a response message transmitted by the WiFi hotspot; and when the terminal determines, according to the response message, that the WiFi hotspot is trustworthy, the terminal completes the connection to the WiFi hotspot.

Description

Method, device and system for safe connection, computer storage medium

Technical field

The present invention relates to wireless local area network technology, and in particular, to a method, device and system for secure connection, and a computer storage medium.

Background technique

Wireless Fidelity (WiFi) connection is the most commonly used wireless network connection for terminals. The specific connection process is: after the terminal searches for the WiFi hotspot, the terminal initiates a connection request to the WiFi hotspot, and the WiFi hotspot performs password verification on the terminal; after the terminal passes the password verification of the WiFi hotspot, the WiFi hotspot completes the connection with the terminal.

Referring to FIG. 1 , an application scenario in which a terminal is connected to a WiFi hotspot in the prior art is shown. In the scenario shown in FIG. 1 , both the hotspot A and the hotspot B are WiFi hotspots, and the terminal and the terminal are connected through a wireless channel. Connection and interaction, as shown by the lightning-like connecting line in FIG. 1; the coverage of the hot spot A and the hot spot B is as shown by the elliptical solid line in FIG.

When the terminal is connected to a WiFi hotspot A for the first time, the terminal automatically records the Service Set Identifier (SSID), the encryption method, and the password of the hotspot A, so that the terminal searches for the hotspot A again according to the SSID of the hotspot A. The connection request is initiated to the hotspot A by the SSID, encryption method, and password of the hotspot that has been automatically recorded, and the connection with the hotspot A is automatically completed.

However, if the SSID, encryption mode, and password of the hotspot A are all simulated by the third party's WiFi hotspot B, when the terminal opens the WiFi connection and expects to connect with the hotspot A, the terminal searches for the simulated hotspot having the same SSID as the hotspot A. B. At this time, the terminal will automatically complete the connection according to the SSID, encryption mode and password of the hotspot A and the simulated hotspot B. Therefore, the terminal cannot connect with the desired WiFi hotspot, thereby reducing the connection between the terminal and the WiFi hotspot. Security.

Summary of the invention

To solve the above technical problem, the embodiment of the present invention is to provide a method, device, and system for secure connection, which can improve the security of establishing a connection between a terminal and a WiFi hotspot.

The technical solution of the present invention is implemented as follows:

In a first aspect, an embodiment of the present invention provides a method for securely connecting, and the method may include:

Sending, by the terminal, a request message to the WiFi hotspot in a process of connecting to the WiFi hotspot; wherein the request message includes an authentication content identifier;

Receiving, by the terminal, a response message sent by the WiFi hotspot;

When the terminal determines, according to the response message, that the WiFi hotspot is a trusted WiFi hotspot, the terminal completes connection with the WiFi hotspot.

In a specific embodiment, the method further includes: when the terminal determines, according to the response message, that the WiFi hotspot is a non-trusted WiFi hotspot, the terminal terminates the connection with the WiFi hotspot.

In a specific embodiment, the response message includes a first response message or a second response message, where the first response message includes an authentication content corresponding to the authentication content identifier; and the second response message represents a The authentication content corresponding to the authentication content identifier does not exist in the WiFi hotspot;

Correspondingly, when the terminal determines that the WiFi hotspot is a trusted WiFi hotspot according to the response message, the terminal completes the connection with the WiFi hotspot, including:

When the terminal receives the first response message, the terminal compares the authentication content in the first response message with the authentication content saved by itself;

When the authentication content in the first response message is consistent with the authentication content saved by the terminal itself, the terminal determines that the WiFi hotspot is a trusted WiFi hotspot.

In a specific embodiment, the terminal determines, according to the response message, that the WiFi hotspot is a non-trusted WiFi hotspot, including:

When the authentication content in the first response message is inconsistent with the authentication content saved by the terminal itself, the terminal determines that the WiFi hotspot is a non-trusted WiFi hotspot; or

When the terminal receives the second response message, the terminal determines that the WiFi hotspot is a non-trusted WiFi hotspot.

In a specific embodiment, before the terminal sends a request message to the WiFi hotspot, the method further includes:

The terminal generates a pair of public and private keys, and saves the private key;

Receiving, by the terminal, original authentication content;

After the terminal is connected to the trusted WiFi hotspot, the original authentication content is encrypted by the public key, and the encrypted authentication content and the authentication content identifier are obtained;

The terminal sends the encrypted authentication content and the authentication content identifier to the trusted WiFi hotspot.

In an embodiment, the authentication content in the first response message is the encrypted authentication content;

Correspondingly, the terminal compares the authentication content in the first response message with the authentication content saved by itself, including:

The terminal decrypts the authentication content in the first response message by using the private key, and compares the decrypted authentication content with the authentication content saved by the terminal itself.

In a second aspect, an embodiment of the present invention provides another method for secure connection, where the method includes:

The WiFi hotspot receives a request message sent by the terminal, where the request message includes an authentication content identifier;

The WiFi hotspot searches for the saved content according to the authentication content identifier in the request message. Authentication content;

When the WiFi hotspot finds the authentication content corresponding to the authentication content identifier, the first response message is sent to the terminal, where the first response message includes the authentication content corresponding to the authentication content identifier. .

In a specific embodiment, the method further includes:

When the WiFi hotspot cannot find the authentication content corresponding to the authentication content identifier, send a second response message to the terminal, where the second response message is used to represent that the WiFi hotspot does not exist. The authentication content corresponding to the authentication content identifier is described.

In a specific embodiment, before the WiFi hotspot receives the request message sent by the terminal, the method further includes:

Receiving, by the WiFi hotspot, the encrypted authentication content and the authentication content identifier sent by the terminal;

Correspondingly, the authentication content in the first response message is the encrypted authentication content.

In a third aspect, an embodiment of the present invention provides a terminal, where the terminal includes: a sending unit, a receiving unit, a determining unit, and a connection control unit, where

The sending unit is configured to send a request message to the WiFi hotspot in the process of connecting to the WiFi hotspot; wherein the request message includes an authentication content identifier;

The receiving unit is configured to receive a response message sent by the WiFi hotspot;

The determining unit is configured to determine, according to the response message received by the receiving unit, that the WiFi hotspot is a trusted WiFi hotspot, and trigger the connection control unit;

The connection control unit is configured to complete a connection with the WiFi hotspot when the determining unit determines that the WiFi hotspot is a trusted WiFi hotspot according to the response message.

In a specific embodiment, the determining unit is further configured to determine, according to the response message, that the WiFi hotspot is a non-trusted WiFi hotspot, and trigger the connection control unit;

The connection control unit is further configured to determine, when the determining unit is determined according to the response message When the WiFi hotspot is a non-trusted WiFi hotspot, the connection with the WiFi hotspot is terminated.

Correspondingly, the determining unit is configured to:

When the receiving unit receives the first response message, compare the authentication content in the first response message with the authentication content saved by the terminal itself;

And determining, when the authentication content in the first response message is consistent with the authentication content saved by the terminal itself, the WiFi hotspot is a trusted WiFi hotspot.

In a specific embodiment, the determining unit is configured to:

Determining that the WiFi hotspot is a non-trusted WiFi hotspot when the authentication content in the first response message is inconsistent with the authentication content saved by the terminal itself; or

And when the receiving unit receives the second response message, determining that the WiFi hotspot is a non-trusted WiFi hotspot.

In a specific embodiment, the terminal further includes a generating unit and an encrypting unit;

The generating unit is configured to generate a pair of public and private keys, and save the private key;

The receiving unit is further configured to receive the original authentication content;

The encryption unit is configured to encrypt the original authentication content by using the public key after the terminal is connected to the trusted WiFi hotspot, and obtain the encrypted authentication content and the authentication content identifier;

The sending unit is further configured to send the encrypted authentication content and the authentication content identifier to the trusted WiFi hotspot.

Correspondingly, the determining unit is configured to decrypt the authentication content in the first response message by using a private key, and compare the decrypted authentication content with the authentication content saved by the terminal itself.

In a fourth aspect, the embodiment of the present invention provides a WiFi hotspot, where the WiFi hotspot includes: a receiving unit, a searching unit, and a sending unit, where

The receiving unit is configured to receive a request message sent by the terminal, where the request message includes an authentication content identifier;

The searching unit is configured to search, according to the authentication content identifier in the request message, the authentication content that has been saved by the WiFi hotspot itself;

The sending unit is configured to: when the searching unit searches for the authentication content corresponding to the authentication content identifier, send a first response message to the terminal; where the first response message includes the authentication The content of the authentication corresponding to the content identifier.

In a specific embodiment, the sending unit is further configured to: when the searching unit cannot find the authentication content corresponding to the authentication content identifier, send a second response message to the terminal; The second response message is used to identify that the authentication content corresponding to the authentication content identifier does not exist in the WiFi hotspot.

In a specific embodiment, the receiving unit is further configured to receive the encrypted authentication content and the authentication content identifier sent by the terminal;

In a fifth aspect, an embodiment of the present invention provides a secure connection system, where the system includes a terminal and a WiFi hotspot, where

The terminal is configured to:

Sending a request message to the WiFi hotspot in a process of connecting to the WiFi hotspot; wherein the request message includes an authentication content identifier;

And receiving a response message sent by the WiFi hotspot;

And determining, by the terminal, that the WiFi hotspot is trusted according to the response message When the WiFi hotspot is connected, the connection with the WiFi hotspot is completed.

The WiFi hotspot is configured as:

Receiving a request message sent by the terminal, where the request message includes an authentication content identifier;

And searching for the authentication content that has been saved according to the authentication content identifier in the request message;

And, when the WiFi hotspot finds the authentication content corresponding to the authentication content identifier, sending a first response message to the terminal, where the first response message includes a reference corresponding to the authentication content identifier. Right content.

In a fifth aspect, an embodiment of the present invention further provides a computer storage medium, wherein computer executable instructions are stored, and the computer executable instructions are used to execute the foregoing method.

The embodiment of the invention provides a method, a device and a system for securely connecting, and a computer storage medium. The terminal can improve the terminal by performing a security verification on the WiFi hotspot during the connection process with the target WiFi hotspot to be connected. The security of establishing a connection with a WiFi hotspot.

DRAWINGS

FIG. 1 is a schematic diagram of an application scenario in which a terminal is connected to a WiFi hotspot in the prior art;

2 is a schematic flowchart of a method for secure connection according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of a process of setting and establishing authentication content between a terminal and a WiFi hotspot according to an embodiment of the present invention;

4 is a schematic flowchart of another method for secure connection according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of a process of setting and establishing authentication content between another terminal and a WiFi hotspot according to an embodiment of the present invention;

FIG. 6 is a schematic flowchart of a method for secure connection according to an embodiment of the present invention;

FIG. 7 is a schematic flowchart of determining a security of a WiFi hotspot by a terminal according to an embodiment of the present disclosure;

FIG. 8 is a diagram of another terminal for determining the security of a WiFi hotspot according to an embodiment of the present invention. Schematic diagram of the process;

FIG. 9 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure;

FIG. 10 is a schematic structural diagram of another terminal according to an embodiment of the present disclosure;

FIG. 11 is a schematic structural diagram of a WiFi hotspot according to an embodiment of the present disclosure;

FIG. 12 is a schematic structural diagram of a system for secure connection according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention will be clearly and completely described in the following with reference to the accompanying drawings.

The basic idea of the embodiment of the present invention is to verify the target WiFi hotspot when the terminal is connected to the WiFi hotspot, so that the terminal can be connected with the WiFi hotspot that is desired to be connected, thereby improving the connection between the terminal and the WiFi hotspot. Security.

It should be noted that, in the description of the embodiments of the present invention and the accompanying drawings, the "WiFi hotspot" and the "hotspot" are expressed in the same meaning, and the description of the embodiments of the following description and the drawings will not be repeated.

In order to be able to clearly illustrate the technical solution of the embodiment of the present invention, the embodiment of the present invention is still described by using the application scenario shown in FIG. 1 as an example. It is noted that the scenario is only used to detail the technical solution of the embodiment of the present invention. It is to be understood that the technical solution of the embodiments of the present invention can be applied to other scenarios without any labor in a person skilled in the art.

Referring to FIG. 2, a method for secure connection according to an embodiment of the present invention is shown. The method can be applied to a terminal having a WiFi connection function. The enumeration, but not limited, may be an intelligent connection with a WiFi connection function. Mobile phones, tablets, PDAs, e-book readers, personal digital assistants (PDAs), POS (Point of Sale), on-board computers, motion picture experts, compressed standard audio level 3 players (MP3, Moving Picture Experts Group Audio Layer III), Motion Picture Experts Group Audio Layer IV (MP4), Mobile Internet Device (MID), Digital Media Player (DMP, Digital) Media Player) and other electronic devices. The method can include:

S201: The terminal sends a request message to the WiFi hotspot during the process of connecting with the WiFi hotspot;

Illustratively, the request message includes an authentication content identifier, so that the WiFi hotspot sends the authentication content that has been saved by the WiFi hotspot to the terminal according to the authentication content identifier;

Specifically, the authentication content may be any one of information for characterizing that the terminal has established a WiFi connection with the WiFi hotspot. In this embodiment, the authentication content may preferably be a security password saved by the terminal and the WiFi hotspot in the previous connection process.

It can be understood that, after the WiFi hotspot receives the request message, it searches for the authentication content that has been saved according to the authentication content identifier in the request message, so that the following two situations may occur: the WiFi hotspot cannot find the authentication content. Identifying the corresponding authentication content and the WiFi hotspot to find the authentication content corresponding to the authentication content identifier. According to these two different situations, the WiFi hotspot will feedback the response message to the terminal:

S202: The terminal receives a response message sent by the WiFi hotspot.

Illustratively, the response message includes a first response message or a second response message, according to the two different situations in which the WiFi hotspot searches for the authentication content that has been saved by the user according to the authentication content identifier.

The first response message includes the authentication content corresponding to the authentication content identifier, and indicates that the WiFi hotspot stores the authentication content corresponding to the authentication content identifier.

The second response message indicates that the authentication content corresponding to the authentication content identifier does not exist in the WiFi hotspot, and the WiFi hotspot does not save the authentication content corresponding to the authentication content identifier.

S203: When the terminal determines, according to the response message, that the WiFi hotspot is a trusted WiFi hotspot, the terminal completes a connection with the WiFi hotspot;

Optionally, the first response message includes a pair of authentication content identifiers saved by the WiFi hotspot. The authentication content, therefore, when the terminal receives the first response message, the terminal compares the authentication content in the first response message with the authentication content saved by itself, when the authentication in the first response message When the content is consistent with the authentication content saved by the terminal itself, the terminal determines that the WiFi hotspot is a trusted WiFi hotspot.

In a specific embodiment, when the authentication content in the first response message is inconsistent with the authentication content saved by the terminal itself, the terminal determines that the WiFi hotspot is a non-trusted WiFi hotspot.

Optionally, the second response message indicates that the authentication content corresponding to the authentication content identifier does not exist in the WiFi hotspot. Therefore, when the terminal receives the second response message, the terminal determines that the WiFi hotspot is not available. Trusted WiFi hotspots.

Specifically, after the terminal confirms that the WiFi hotspot is a trusted WiFi hotspot, completing the connection with the WiFi hotspot; correspondingly, after the terminal confirms that the WiFi hotspot is a non-trusted WiFi hotspot, terminating the connection with the WiFi hotspot .

For example, before the steps S201 to S203, the process of setting and establishing the authentication content of the terminal and the WiFi hotspot is also required. Referring to FIG. 3, the process may specifically include:

S200a: The terminal generates a pair of public and private keys, and saves the private key.

S200b: the terminal receives the original authentication content;

S200c: After the terminal is connected to the trusted WiFi hotspot, the original authentication content is encrypted by using a public key, and the encrypted authentication content and the authentication content identifier are obtained.

S200d: The terminal sends the encrypted authentication content and the authentication content identifier to the trusted WiFi hotspot;

Specifically, the terminal may encapsulate the encrypted authentication content and the authentication content identifier after the authentication grant message, and send the authentication grant message to the trusted WiFi hotspot.

Preferably, in combination with S200d, in the embodiment shown in FIG. 2, the authentication content in the first response message may be the encrypted authentication content, and correspondingly, the terminal according to the authentication in the first response message The content is compared with the content of the authentication stored by the terminal, and specifically includes: the terminal decrypts the authentication content in the first response message by using the private key, and the decrypted authentication content and the authentication content saved by the terminal itself Control.

The embodiment of the present invention provides a method for securely connecting, and the terminal can secure the connection between the terminal and the WiFi hotspot by performing security verification on the WiFi hotspot during the connection with the target WiFi hotspot to be connected. Sex.

Referring to FIG. 4, there is shown another method for secure connection according to an embodiment of the present invention. The method is applied to a WiFi hotspot, and the method may include:

S401: The WiFi hotspot receives a request message sent by the terminal.

Illustratively, the request message includes an authentication content identification.

S402: The WiFi hotspot searches for the authentication content that has been saved according to the authentication content identifier in the request message.

Illustratively, after the WiFi hotspot receives the request message, it searches for the authentication content that has been saved according to the authentication content identifier in the request message, so that the following two situations may occur: the WiFi hotspot cannot find the authentication content. Identifying the corresponding authentication content and the WiFi hotspot to find the authentication content corresponding to the authentication content identifier. According to these two situations, the WiFi hotspot will feed back different response messages to the terminal:

S403: Send a first response message to the terminal when the WiFi hotspot finds the authentication content corresponding to the authentication content identifier.

Illustratively, the first response message includes the authentication content corresponding to the authentication content identifier, indicating that the WiFi hotspot stores the authentication content corresponding to the authentication content identifier;

In a specific embodiment, when the WiFi hotspot cannot find the authentication content corresponding to the authentication content identifier, the WiFi hotspot does not save the authentication content corresponding to the authentication content identifier, and the method may further include:

When the WiFi hotspot cannot find the authentication content corresponding to the authentication content identifier, The terminal sends a second response message, where the second response message is used to identify that the authentication content corresponding to the authentication content identifier does not exist in the WiFi hotspot.

It can be understood that when the WiFi hotspot identifies two results obtained by searching for the authentication content that has been saved according to the authentication content in the request message, the first response message or the second response message is sent to the terminal, so that the terminal is configured according to the A response message or a second response message is used to determine whether the WiFi hotspot is a trusted WiFi hotspot. The specific determining process is described in the foregoing embodiment, and details are not described herein again.

It should be noted that, before the steps S401 to S403, a process of setting and establishing the authentication content of the WiFi hotspot and the terminal is required. Referring to FIG. 5, the process may specifically include:

S400a: the encrypted authentication content sent by the WiFi hotspot receiving terminal and the authentication content identifier;

Exemplarily, the encrypted authentication content and the authentication content identifier may be sent by the terminal after the authentication grant message to the WiFi hotspot.

Preferably, in combination with the embodiment shown in FIG. 4, the authentication content in the first response message may be the encrypted authentication content.

The embodiment of the present invention provides another method for securely connecting. The terminal can improve the connection between the terminal and the WiFi hotspot by performing security verification on the WiFi hotspot during the connection with the target WiFi hotspot to be connected. safety.

Based on the foregoing embodiment shown in FIG. 2 to FIG. 5 and the application scenario shown in FIG. 1 , referring to FIG. 6 , a detailed flow of a method for secure connection according to an embodiment of the present invention is shown. In this embodiment, The SSID of the WiFi hotspot A that has been connected to the terminal is AA, and the password is 12345678. The WiFi hotspot B is the AID of the WiFi hotspot A, and the SSID of the WiFi hotspot B is also AA, and the password is 12345678. The detailed process of the method can include:

S601: The terminal generates a pair of public and private keys, and saves the private key.

S602: The terminal receives the original authentication content.

It should be noted that, in this embodiment, the original authentication content may be a security password input by the user.

S603: After the terminal is connected to the WiFi hotspot A, the original authentication content is encrypted by using a public key, and the encrypted authentication content and the authentication content identifier are obtained.

At this time, the WiFi hotspot A can be considered as a trusted WiFi hotspot that the terminal can trust.

S604: The terminal sends the encrypted authentication content and the authentication content identifier to the WiFi hotspot A;

Specifically, the terminal may encapsulate the encrypted security password and its identifier after the authentication grant message, and send the authentication grant message to the WiFi hotspot A.

S601 to S604 complete the authentication content setting process of the terminal and the WiFi hotspot A. When the terminal searches for the surrounding WiFi hotspot in the ellipse area shown in FIG. 1, it will find the WiFi hotspot with the SSID AA connected to itself. Therefore, the terminal can connect to the WiFi hotspot with the SSID of AA according to the password 12345678 used when connecting with the WiFi hotspot A. At this time, the terminal considers that the target WiFi hotspot connected to itself is the WiFi hotspot A.

However, in the actual connection process, the terminal may be connected to the WiFi hotspot A, or may be connected to the WiFi hotspot B. The specific connection object is mainly related to the ordering of the WiFi hotspot A and the WiFi hotspot B in the connection list of the terminal. However, the target WiFi hotspot connected to the terminal is the WiFi hotspot A. Therefore, the terminal needs to initiate authentication authentication to the WiFi hotspot whose SSID is AA. In this embodiment, the specific authentication content may be as described in step S604. A security password, and in this embodiment, the authentication process may include:

S605: The terminal sends a request message to the WiFi hotspot in a process of connecting to a WiFi hotspot with an SSID of AA.

Illustratively, the request message includes an authentication content identifier. In this embodiment, the authentication content identifier may be an identifier corresponding to the encrypted security password.

S606: The WiFi hotspot with the SSID of AA is identified according to the authentication content in the request message. Find your own saved authentication content;

Specifically, when the WiFi hotspot with the SSID of AA is the WiFi hotspot A, the WiFi hotspot A can find the encrypted security password saved by itself according to the identifier corresponding to the encrypted security password;

When the WiFi hotspot with the SSID of AA is the WiFi hotspot B, since the WiFi hotspot B only simulates the SSID, encryption mode and password of the WiFi hotspot A, the WiFi hotspot B cannot find the encrypted according to the identifier corresponding to the encrypted security password. Security password.

For the above two different situations, the WiFi hotspot with the SSID of AA will also feed back different response messages to the terminal:

S607a: When the WiFi hotspot with the SSID of AA finds the authentication content corresponding to the authentication content identifier, sending a first response message to the terminal;

In this embodiment, the first response message includes the encrypted security password, indicating that the WiFi hotspot stores the encrypted security password.

S607b: When the WiFi hotspot whose SSID is AA cannot find the authentication content corresponding to the authentication content identifier, send a second response message to the terminal;

In this embodiment, the second response message is used to indicate that the encrypted security password does not exist in the WiFi hotspot.

According to the difference between S607a and S607b, the terminal will correspondingly determine the security of the WiFi hotspot:

Optionally, referring to FIG. 7, when a WiFi hotspot with an SSID of AA sends a first response message to the terminal, the detailed process of the method further includes:

S608a: When the terminal receives the first response message, the terminal compares the authentication content in the first response message with the authentication content saved by the terminal;

Specifically, since the authentication content in the first response message is the encrypted security password, after receiving the first response message, the terminal encrypts the encrypted key through the private key saved by the terminal itself. The full password is decrypted, and the decrypted security password is compared with the security password saved by the terminal itself.

S609a: When the authentication content in the first response message is consistent with the authentication content saved by the terminal itself, the terminal determines that the WiFi hotspot with the SSID AA is a trusted WiFi hotspot, and completes the WiFi hotspot with the SSID AA. connection;

Specifically, in this embodiment, when the decrypted security password is consistent with the security password saved by the terminal itself, the terminal may determine that the WiFi hotspot with the SSID of AA is a trusted WiFi hotspot, that is, the WiFi hotspot A.

S610a: When the authentication content in the first response message is inconsistent with the authentication content saved by the terminal itself, the terminal determines that the WiFi hotspot with the SSID AA is a non-trusted WiFi hotspot, and terminates the WiFi hotspot with the SSID AA. Connection;

Specifically, in this embodiment, when the decrypted security password is inconsistent with the security password saved by the terminal itself, the terminal may determine that the WiFi hotspot with the SSID of AA is a non-trusted WiFi hotspot, that is, the WiFi hotspot B.

Optionally, referring to FIG. 8, when the WiFi hotspot with the SSID of AA sends a second response message to the terminal, the detailed process of the method further includes:

S608b: When the terminal receives the second response message, the terminal determines that the WiFi hotspot with the SSID AA is a non-trusted WiFi hotspot, and terminates the connection with the WiFi hotspot with the SSID AA;

Specifically, when the terminal receives the second response message, the terminal may determine that the WiFi hotspot with the SSID of AA is not the WiFi hotspot A.

Through the above detailed process, it can be known that, during the connection with the WiFi hotspot, the terminal determines whether the target WiFi hotspot is trusted by verifying the target WiFi hotspot, so that the terminal can connect with the desired WiFi hotspot, thereby improving The security of establishing a connection between the terminal and the WiFi hotspot.

Based on the same technical concept of the foregoing embodiment, referring to FIG. 9, which illustrates an embodiment of the present invention A terminal 90 is provided. The terminal 90 may include: a sending unit 901, a receiving unit 902, a determining unit 903, and a connection control unit 904, where

The sending unit 901 is configured to send, by the terminal 90, a request message to the WiFi hotspot in a process of connecting with a WiFi hotspot; wherein the request message includes an authentication content identifier;

The receiving unit 902 is configured to receive a response message sent by the WiFi hotspot;

The determining unit 903 is configured to determine, according to the response message received by the receiving unit 902, that the WiFi hotspot is a trusted WiFi hotspot, and trigger the connection control unit 904;

The connection control unit 904 is configured to complete the connection with the WiFi hotspot when the determining unit 903 determines that the WiFi hotspot is a trusted WiFi hotspot according to the response message.

Exemplarily, the determining unit 903 is further configured to determine, according to the response message, that the WiFi hotspot is a non-trusted WiFi hotspot, and trigger the connection control unit 904;

The connection control unit 904 is further configured to terminate the connection with the WiFi hotspot when the determining unit 903 determines that the WiFi hotspot is a non-trusted WiFi hotspot according to the response message.

Specifically, the response message includes a first response message or a second response message, where the first response message includes an authentication content corresponding to the authentication content identifier, and the second response message represents the WiFi hotspot There is no authentication content corresponding to the authentication content identifier;

Correspondingly, the determining unit 903 is configured to:

When the receiving unit 902 receives the first response message, the authentication content in the first response message is compared with the authentication content saved by the terminal 90 itself;

And determining that the WiFi hotspot is a trusted WiFi hotspot when the authentication content in the first response message is consistent with the authentication content saved by the terminal 90 itself.

In a specific embodiment, the determining unit 903 is configured to:

When the authentication content in the first response message and the authentication content saved by the terminal 90 itself In case of inconsistency, determining that the WiFi hotspot is an untrusted WiFi hotspot; or

When the receiving unit 902 receives the second response message, it is determined that the WiFi hotspot is a non-trusted WiFi hotspot.

Illustratively, referring to FIG. 10, the terminal 90 further includes a generating unit 905 and an encrypting unit 906;

The generating unit 905 is configured to generate a pair of public keys and private keys, and save the private keys;

The receiving unit 902 is further configured to receive the original authentication content;

The encryption unit 906 is configured to encrypt the original authentication content by using the public key after the terminal 90 is connected to the trusted WiFi hotspot, and obtain the encrypted authentication content and the authentication content identifier.

The sending unit 901 is further configured to send the encrypted authentication content and the authentication content identifier to the trusted WiFi hotspot.

Correspondingly, the determining unit 903 is configured to decrypt the authentication content in the first response message by using the private key, and compare the decrypted authentication content with the authentication content saved by the terminal 90 itself.

The embodiment of the present invention provides a terminal 90. The terminal 90 can secure the connection between the terminal 90 and the WiFi hotspot by performing security verification on the WiFi hotspot during the connection with the target WiFi hotspot to be connected. Sex.

Based on the same technical concept of the foregoing embodiment, referring to FIG. 11 , a WiFi hotspot 110 is provided, which may include: a receiving unit 1101, a searching unit 1102, and a sending unit 1103, where

The receiving unit 1101 is configured to receive a request message sent by the terminal, where the request is The request message includes an authentication content identifier;

The searching unit 1102 is configured to search for the authentication content that the WiFi hotspot 110 itself has saved according to the authentication content identifier in the request message received by the receiving unit 1101;

The sending unit 1103 is configured to send a first response message to the terminal when the searching unit 1102 finds the authentication content corresponding to the authentication content identifier, where the first response message includes the The authentication content corresponding to the authentication content is identified.

Illustratively, the sending unit 1103 is further configured to: when the searching unit 1102 cannot find the authentication content corresponding to the authentication content identifier, send a second response message to the terminal; The second response message is used to identify that the authentication content corresponding to the authentication content identifier does not exist in the WiFi hotspot 110.

Illustratively, the receiving unit 1101 is further configured to receive the encrypted authentication content and the authentication content identifier sent by the terminal;

The WiFi hotspot 110 provided by the embodiment of the present invention can improve the security of establishing a connection between the terminal and the WiFi hotspot 110 by performing security verification on the WiFi hotspot 110 during the connection with the WiFi hotspot 110. .

Based on the same technical concept of the foregoing embodiment, referring to FIG. 12, a system 120 for secure connection according to an embodiment of the present invention is provided. The system 120 may include a terminal 90 and a WiFi hotspot 110, where

The terminal 90 is configured to:

Sending a request message to the WiFi hotspot 110 during the process of connecting with the WiFi hotspot 110; wherein the request message includes an authentication content identifier;

And receiving a response message sent by the WiFi hotspot 110;

And when the terminal 90 determines that the WiFi hotspot 110 is a trusted WiFi hotspot 110 according to the response message, completing the connection with the WiFi hotspot 110.

The WiFi hotspot 110 is configured to:

Receiving a request message sent by the terminal 90; wherein the request message includes an authentication content identifier;

And when the WiFi hotspot 110 finds the authentication content corresponding to the authentication content identifier, sending a first response message to the terminal 90, where the first response message includes the identifier corresponding to the authentication content identifier The content of the authentication.

In the system 100 for secure connection provided by the embodiment of the present invention, the terminal 90 can improve the connection between the terminal 90 and the WiFi hotspot 110 by performing security verification on the WiFi hotspot 110 during the connection with the WiFi hotspot 110. safety.

The embodiment of the present invention further provides a computer storage medium, wherein computer executable instructions are stored, the computer executable instructions being used to execute the method described in any one of the foregoing method embodiments.

Each of the above units may be implemented by a central processing unit (CPU), a digital signal processor (DSP), or a field-programmable gate array (FPGA) in an electronic device.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, a special purpose computer, an embedded processor or other programmable data processing device to produce a machine such that Instructions executed by a processor of a computer or other programmable data processing device generate means for implementing the functions specified in a block or blocks of a flow or a flow and/or a block diagram of the flowchart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Claims

A method of securely connecting, wherein the method comprises:

Sending, by the terminal, a request message to the WiFi hotspot in a process of connecting to the WiFi hotspot; wherein the request message includes an authentication content identifier;

Receiving, by the terminal, a response message sent by the WiFi hotspot;

When the terminal determines, according to the response message, that the WiFi hotspot is a trusted WiFi hotspot, the terminal completes connection with the WiFi hotspot.
The method according to claim 1, wherein the method further comprises: when the terminal determines that the WiFi hotspot is a non-trusted WiFi hotspot according to the response message, the terminal terminates with the WiFi hotspot connection.
The method of claim 2, wherein the response message comprises a first response message or a second response message; wherein the first response message comprises an authentication content corresponding to the authentication content identifier; The second response message indicates that the authentication content corresponding to the authentication content identifier does not exist in the WiFi hotspot;

Correspondingly, when the terminal determines that the WiFi hotspot is a trusted WiFi hotspot according to the response message, the terminal completes the connection with the WiFi hotspot, including:

When the terminal receives the first response message, the terminal compares the authentication content in the first response message with the authentication content saved by itself;

When the authentication content in the first response message is consistent with the authentication content saved by the terminal itself, the terminal determines that the WiFi hotspot is a trusted WiFi hotspot.
The method of claim 3, wherein the determining, by the terminal, that the WiFi hotspot is a non-trusted WiFi hotspot according to the response message comprises:

When the authentication content in the first response message is inconsistent with the authentication content saved by the terminal itself, the terminal determines that the WiFi hotspot is a non-trusted WiFi hotspot; or

When the terminal receives the second response message, the terminal determines the WiFi hotspot For non-trusted WiFi hotspots.
The method of claim 3, wherein the method further comprises: before the terminal sends a request message to the WiFi hotspot, the method further comprising:

The terminal generates a pair of public and private keys, and saves the private key;

Receiving, by the terminal, original authentication content;

After the terminal is connected to the trusted WiFi hotspot, the original authentication content is encrypted by the public key, and the encrypted authentication content and the authentication content identifier are obtained;

The terminal sends the encrypted authentication content and the authentication content identifier to the trusted WiFi hotspot.
The method according to claim 5, wherein the authentication content in the first response message is the encrypted authentication content;

Correspondingly, the terminal compares the authentication content in the first response message with the authentication content saved by itself, including:

The terminal decrypts the authentication content in the first response message by using the private key, and compares the decrypted authentication content with the authentication content saved by the terminal itself.
A method of securely connecting, wherein the method comprises:

The WiFi hotspot receives a request message sent by the terminal, where the request message includes an authentication content identifier;

The WiFi hotspot searches for the authentication content that has been saved according to the authentication content identifier in the request message;

When the WiFi hotspot finds the authentication content corresponding to the authentication content identifier, the first response message is sent to the terminal, where the first response message includes the authentication content corresponding to the authentication content identifier. .
The method of claim 7 wherein the method further comprises:

When the WiFi hotspot cannot find the authentication content corresponding to the authentication content identifier, The terminal sends a second response message, where the second response message is used to identify that the authentication content corresponding to the authentication content identifier does not exist in the WiFi hotspot.
The method of claim 7, wherein the method further comprises: before the WiFi hotspot receives the request message sent by the terminal:

Receiving, by the WiFi hotspot, the encrypted authentication content and the authentication content identifier sent by the terminal;

Correspondingly, the authentication content in the first response message is the encrypted authentication content.
A terminal, where the terminal includes: a sending unit, a receiving unit, a determining unit, and a connection control unit, where

The sending unit is configured to send a request message to the WiFi hotspot in the process of connecting to the WiFi hotspot; wherein the request message includes an authentication content identifier;

The receiving unit is configured to receive a response message sent by the WiFi hotspot;

The determining unit is configured to determine, according to the response message received by the receiving unit, that the WiFi hotspot is a trusted WiFi hotspot, and trigger the connection control unit;

The connection control unit is configured to complete a connection with the WiFi hotspot when the determining unit determines that the WiFi hotspot is a trusted WiFi hotspot according to the response message.
The terminal according to claim 10, wherein the determining unit is further configured to determine, according to the response message, that the WiFi hotspot is a non-trusted WiFi hotspot, and trigger the connection control unit;

The connection control unit is further configured to terminate the connection with the WiFi hotspot when the determining unit determines that the WiFi hotspot is a non-trusted WiFi hotspot according to the response message.
The terminal according to claim 11, wherein the response message includes a first response message or a second response message, wherein the first response message includes an authentication content corresponding to the authentication content identifier; The second response message indicates that the authentication content corresponding to the authentication content identifier does not exist in the WiFi hotspot;

Correspondingly, the determining unit is configured to:

When the receiving unit receives the first response message, compare the authentication content in the first response message with the authentication content saved by the terminal itself;

And determining, when the authentication content in the first response message is consistent with the authentication content saved by the terminal itself, the WiFi hotspot is a trusted WiFi hotspot.
The terminal according to claim 12, wherein the determining unit is configured to:

Determining that the WiFi hotspot is a non-trusted WiFi hotspot when the authentication content in the first response message is inconsistent with the authentication content saved by the terminal itself; or

And when the receiving unit receives the second response message, determining that the WiFi hotspot is a non-trusted WiFi hotspot.
The terminal according to claim 12, wherein the terminal further comprises a generating unit and an encrypting unit;

The generating unit is configured to generate a pair of public and private keys, and save the private key;

The receiving unit is further configured to receive the original authentication content;

The encryption unit is configured to encrypt the original authentication content by using the public key after the terminal is connected to the trusted WiFi hotspot, and obtain the encrypted authentication content and the authentication content identifier;

The sending unit is further configured to send the encrypted authentication content and the authentication content identifier to the trusted WiFi hotspot.
The terminal according to claim 14, wherein the authentication content in the first response message is the encrypted authentication content;

Correspondingly, the determining unit is configured to decrypt the authentication content in the first response message by using a private key, and compare the decrypted authentication content with the authentication content saved by the terminal itself.
A WiFi hotspot, where the WiFi hotspot includes: a receiving unit, a searching unit, and a sending unit, where

The receiving unit is configured to receive a request message sent by the terminal, where the request message includes an authentication content identifier;

The searching unit is configured to search, according to the authentication content identifier in the request message, the authentication content that has been saved by the WiFi hotspot itself;

The sending unit is configured to: when the searching unit searches for the authentication content corresponding to the authentication content identifier, send a first response message to the terminal; where the first response message includes the authentication The content of the authentication corresponding to the content identifier.
The WiFi hotspot according to claim 16, wherein the sending unit is further configured to send a second response message to the terminal when the searching unit cannot find the authentication content corresponding to the authentication content identifier. The second response message is used to identify that the authentication content corresponding to the authentication content identifier does not exist in the WiFi hotspot.
The WiFi hotspot according to claim 16, wherein the receiving unit is further configured to receive the encrypted authentication content and the authentication content identifier sent by the terminal;

Correspondingly, the authentication content in the first response message is the encrypted authentication content.
A securely connected system, wherein the system includes a terminal and a WiFi hotspot, wherein

The terminal is configured to:

Sending a request message to the WiFi hotspot in a process of connecting to the WiFi hotspot; wherein the request message includes an authentication content identifier;

And receiving a response message sent by the WiFi hotspot;

And, when the terminal determines, according to the response message, that the WiFi hotspot is a trusted WiFi hotspot, completing a connection with the WiFi hotspot.

The WiFi hotspot is configured as:

Receiving a request message sent by the terminal, where the request message includes an authentication content identifier;

And searching for the saved authentication content according to the authentication content identifier in the request message. Capacity

And, when the WiFi hotspot finds the authentication content corresponding to the authentication content identifier, sending a first response message to the terminal, where the first response message includes a reference corresponding to the authentication content identifier. Right content.
A computer storage medium having stored therein computer executable instructions for performing the method of any one of claims 1 to 6 and 7 to 9.