WO2016082500A1

WO2016082500A1 - Wireless network access method and apparatus

Info

Publication number: WO2016082500A1
Application number: PCT/CN2015/079836
Authority: WO
Inventors: 李伟
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-11-24
Filing date: 2015-05-26
Publication date: 2016-06-02
Also published as: CN105704780A

Abstract

A wireless network access method and apparatus, which relate to the field of wireless networks. The method comprises: when an authenticated terminal accesses a wireless network, acquiring terminal information of the authenticated terminal; reporting the terminal information of the authenticated terminal to a user, and waiting to receive an access control instruction from the user; and determining whether to break the wireless network connection of the authenticated terminal according to the access control instruction from the user. The technical scheme of the present invention can effectively prevent an unauthenticated terminal from accessing a wireless network.

Description

Wireless network access method and device

Technical field

This paper relates to the field of network security for wireless networks, and in particular to a wireless network access method and related devices.

Background technique

With the development of wireless network technology, Wi-Fi access hotspots are increasing. Whether in the home or city shopping malls, restaurants, or movie theaters, Wi-Fi networks have been deployed in large numbers. This presents a problem: in the mall. In public places such as restaurants, movie theaters, and movie theaters, the wireless network is open to the public, and any user within its coverage can access it. However, in the home, network traffic often requires payment, and we may not want neighbors within the coverage of the hotspot. User access, and more importantly, a large number of external users access, exerting great pressure on limited network traffic and affecting their own network experience. However, there are many softwares and technologies for cracking wireless passwords on the market, so this situation is not easy to avoid.

At present, the wireless network limits the access of unknown users (illegal users) mainly:

1. Using the black and white list function, put the MAC address of the terminal into the whitelist, and pull the MAC address of the unknown terminal (illegal terminal) into the blacklist, thereby isolating the unknown terminal in the pre-authentication phase;

2. Use the account password function for secondary authentication at the application layer to enhance security;

The shortcoming of the above mechanism is that some technologies can modify the MAC address of the terminal at present. Therefore, relying solely on the MAC address to limit the failure; and the secondary authentication of the application layer only increases the difficulty of cracking by adding a layer of insurance, and cannot fundamentally Restrict users.

Summary of the invention

An object of the present invention is to provide a wireless network access method and apparatus, which can better solve the problem of illegal users accessing a wireless network.

In order to solve the above technical problems, the following technical solutions are adopted:

A wireless network access method includes:

Obtaining terminal information of the authenticated terminal when accessing the authenticated terminal in the wireless network;

And uploading the terminal information of the authenticated terminal to the user interface, and receiving an access control instruction input by the user through the user interface;

Disconnecting or maintaining a wireless network connection of the authenticated terminal according to the access control instruction.

Optionally, the step of disconnecting or maintaining the wireless network connection of the authenticated terminal according to the access control instruction includes:

When the access control instruction is an instruction for restricting terminal access, disconnecting the wireless network connection of the authenticated terminal, and saving terminal information and disconnection information of the authenticated terminal to an access record table .

Optionally, the step of confirming whether to disconnect the wireless network connection of the authenticated terminal according to the access control instruction includes:

And when the access control instruction is an instruction for maintaining terminal access, maintaining a wireless network connection of the authenticated terminal, and saving the terminal information and the hold information of the authenticated terminal to an access record table.

Optionally, the method further includes:

If the access control command from the user is not received within the preset time, the wireless network connection of the authenticated terminal is disconnected.

Optionally, the method further includes:

When the authenticated terminal is re-accessed in the wireless network, the terminal information of the authenticated terminal is searched in the access record table;

And disconnecting the wireless network connection of the authenticated terminal according to the disconnected information corresponding to the found terminal information, or maintaining the wireless network connection of the authenticated terminal according to the retained information corresponding to the found terminal information.

A wireless network access device includes an information acquisition module, an information transceiver module, and an access control module, wherein:

The information acquiring module is configured to: when the authenticated terminal is accessed in the wireless network, obtain the Terminal information of the authenticated terminal;

The information transceiver module is configured to: report terminal information of the authenticated terminal to a user interface, and receive an access control instruction input by the user through the user interface;

The access control module is configured to: disconnect or maintain a wireless network connection of the authenticated terminal according to the access control instruction.

Optionally, the access control module is configured to disconnect or maintain the wireless network connection of the authenticated terminal according to the access control instruction as follows:

When the access control instruction is an instruction for maintaining terminal access, the wireless network connection of the authenticated terminal is maintained, and the terminal information and the hold information of the authenticated terminal are saved to the access record table.

Optionally, when the information transceiver module does not receive an access control command from the user within a preset time, the access control module is further configured to: disconnect the wireless network connection of the authenticated terminal.

Optionally, the device further includes an information query module and an access determination module, where:

The information querying module is configured to: when the authenticated terminal is re-accessed in the wireless network, look up the terminal information of the authenticated terminal in the access record table;

The access determination module is configured to: disconnect the wireless network connection of the authenticated terminal according to the disconnection information corresponding to the found terminal information, or keep the already-maintained information according to the found terminal information The wireless network connection of the authentication terminal.

A computer program comprising program instructions that, when executed by a computer, cause the computer to perform any of the wireless network access methods described above.

A carrier carrying the computer program.

Compared with the related art, the beneficial effects of the present invention are:

The restricted access mechanism proposed by the technical solution of the present invention can "catch out" by illegal judgment even if an illegal user accesses a hot spot, although human-computer interaction brings extra work, but when the machine is powerless, the human operation more reliable.

BRIEF abstract

1 is a schematic block diagram of a wireless network access method according to a first embodiment of the present invention;

2 is a block diagram of a wireless network access apparatus according to a first embodiment of the present invention;

3 is a flowchart of wireless network access according to a first embodiment of the present invention;

4 is a schematic block diagram of a wireless network access method according to a second embodiment of the present invention;

FIG. 5 is a block diagram of a wireless network access apparatus according to a second embodiment of the present invention; FIG.

6 is a flowchart of wireless network access according to a second embodiment of the present invention;

7 is a flowchart of wireless network access according to a third embodiment of the present invention;

FIG. 8 is a schematic diagram of interaction between functional modules of a wireless network access according to a third embodiment of the present invention.

Preferred embodiment of the invention

The preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings.

First embodiment

1 is a schematic block diagram of a wireless network access method according to a first embodiment of the present invention. As shown in FIG. 1, the steps include:

Step S11: When the authenticated terminal is accessed in the wireless network, the terminal information of the authenticated terminal is obtained.

When the terminal accesses the wireless network through identity authentication and/or password authentication, the terminal information of the terminal is obtained, and the terminal information includes a MAC address and a host name of the terminal.

Step S12: Reporting the terminal information of the authenticated terminal to the user, and waiting to receive an access control instruction from the user;

Step S13: Confirm whether to disconnect the wireless network connection of the authenticated terminal according to the access control instruction from the user.

When the access control command is an instruction for restricting access by the terminal, confirming that the authenticated terminal performs the access restriction process, that is, confirming that the wireless network connection of the authenticated terminal is disconnected, and the terminal information of the authenticated terminal is The confirmation information used to reject the terminal access is saved to the access record table.

When the access control command is an instruction for maintaining terminal access, confirming that the authenticated terminal does not perform access restriction processing, that is, confirming that the wireless network connection of the authenticated terminal is maintained, and the terminal information of the authenticated terminal is The confirmation information used to keep the terminal access is saved to the access record table.

When the access control instruction from the user is not received within the preset time in step S12, it is confirmed that the access restriction processing is performed on the authenticated terminal, that is, the wireless network connection of the authenticated terminal is disconnected. At this time, the terminal information of the authenticated terminal and the confirmation information for denying the terminal access may be saved to the access record table, or may not be saved.

The present embodiment is based on the defects and deficiencies of the current limited access terminal (ie, an illegal terminal) accessing the wireless network, and the information of the terminal accessing the wireless network is used to determine the legality of the terminal again, so that the user is protected from the traffic loss caused by the wireless network. And the experience of rate diversion brings down the problem.

2 is a block diagram of a wireless network access device according to a first embodiment of the present invention. As shown in FIG. 2, the information includes an information acquiring module 11, an information transceiver module 12, and an access control module 13.

The information obtaining module 11 is configured to acquire terminal information of the authenticated terminal when the authenticated terminal is first accessed in the wireless network, where the terminal information includes a MAC address and a host name of the terminal.

The information transceiver module 12 is configured to: report the terminal information of the authenticated terminal to the user, and wait to receive an access control instruction from the user.

The access control module 13 is configured to confirm whether to disconnect the wireless network connection of the authenticated terminal according to the access control command from the user.

Specifically, when the access control command is an instruction for restricting terminal access, the access control module Block 13 confirms that the authenticated terminal performs an access restriction process, that is, confirms that the wireless network connection of the authenticated terminal is disconnected, and saves the terminal information of the authenticated terminal and the confirmation information for rejecting the terminal access to the access record. When the access control command is an instruction to maintain terminal access, the access control module 13 confirms that the authenticated terminal does not perform access restriction processing, that is, confirms that the wireless network connection of the authenticated terminal is maintained, and The terminal information of the authenticated terminal and the confirmation information for maintaining the terminal access are saved to the access record table. When the information transceiver module 12 does not receive the access control command from the user within the preset time, the access control module 13 It is confirmed that the access restriction processing is performed on the authenticated terminal, that is, the wireless network connection of the authenticated terminal is disconnected, and the terminal information of the authenticated terminal and the confirmation information for denying the terminal access can be saved to the access record table.

This embodiment is based on some characteristics of the current terminal and hotspot authentication connection process. When a terminal accesses, the user can be prompted to increase the human-computer interaction function, and then the user is judged whether it is a legitimate terminal, and can be fundamentally Eliminate illegal terminal network.

FIG. 3 is a flowchart of wireless network access according to the first embodiment of the present invention. As shown in FIG. 3, the steps include:

Step S21: The user turns on the hotspot, and the system is initialized. The hotspot periodically sends the beacon frame for the terminal to search, and the loop waits for the terminal access event reported by the bottom layer. At this time, when a terminal issues an access request, the authentication connection is performed according to the 802.11 protocol specification. If the terminal user inputs the correct password, the terminal can basically ensure a successful connection. After the terminal successfully accesses the current hotspot, the terminal obtains information about the terminal, such as a MAC address, a host name, and an assigned IP address.

Step S22: The terminal information is reported to the UI interface, and the user confirms whether to refuse to access the terminal. The UI interface pops up a dialog box. In practice, a specific prompt tone can be issued to remind the user to make a selection. The option is divided into whether to allow the current connection or the rejection. The user can basically confirm whether it is himself or not based on the MAC address of the access terminal and the host name. Access terminal.

Step S23: Waiting to receive an access control instruction from the user.

Step S24: It is judged whether an access control instruction is received, and if yes, step S26 is performed, otherwise step S25 is performed.

Step S25: determining whether it is timed out.

If the user is within a preset time, for example, within 1 minute, there is no operation (ie at the preset time) If the access control command is not received, the terminal access is denied by default, and step S28 is performed; otherwise, step S23 is performed.

Step S26: determining whether the received access control command is used to restrict the terminal access instruction or the instruction for maintaining the terminal access. If the instruction is used to restrict the terminal access, step S28 is performed; otherwise, the step is performed. S27.

Step S27: When the access control instruction is an instruction for maintaining terminal access, confirming that the authenticated terminal does not perform access restriction processing, that is, confirming that the current wireless network connection of the authenticated terminal is maintained, and The terminal information and the confirmation information for maintaining the terminal access are saved.

Step S28: When the access control instruction is an instruction for restricting terminal access, confirming that the authenticated terminal performs an access restriction process, that is, confirming disconnection of the current wireless network connection of the authenticated terminal, and The terminal information of the authenticated terminal and the confirmation information for rejecting the terminal access are saved to the access record table.

Second embodiment

4 is a schematic block diagram of a wireless network access method according to a second embodiment of the present invention. Compared with the first embodiment shown in FIG. 1, the second embodiment provided in FIG. 4 adds the following steps:

Step S14: When the authenticated terminal is re-accessed in the wireless network, the terminal information of the authenticated terminal is searched in the access record table.

Step S15: determining to disconnect the wireless network connection of the authenticated terminal according to the acknowledgment information for restricting terminal access corresponding to the found terminal information, or to maintain the terminal access according to the found terminal information. The confirmation information determines that the wireless network connection of the authenticated terminal is maintained.

Since the terminal information of the terminal and the acknowledgment information for maintaining/rejecting the terminal access have been saved in the access record table in the first embodiment, when the terminal accesses the wireless hotspot again through authentication, the access record can be accessed. Find the terminal information in the table, and after finding the terminal information of the terminal, confirm whether to disconnect the wireless network according to the confirmation information corresponding to the terminal information.

FIG. 5 is a block diagram of a wireless network access device according to a second embodiment of the present invention. Compared with the first embodiment shown in FIG. 2, the second embodiment provided in FIG. 5 adds the following modules:

The information querying module 14 is configured to: when the authenticated terminal is re-accessed in the wireless network, look up the terminal information of the authenticated terminal in the access record table.

The access determining module 15 is configured to: determine, according to the found terminal information, the acknowledgment information for restricting the access of the terminal, disconnect the wireless network connection of the authenticated terminal, or use the corresponding terminal information according to the found terminal information. The acknowledgment information of the terminal access is maintained, and it is determined that the wireless network connection of the authenticated terminal is maintained.

Specifically, when the authenticated terminal accesses the wireless hotspot again by the authentication, the information querying module 14 finds the terminal information of the authenticated terminal in the access record table, and the access determining module 14 is configured to: follow the terminal information. Corresponding confirmation information determines whether or not the access restriction process is performed on the authenticated terminal, that is, whether the wireless network connection of the authenticated terminal is disconnected.

FIG. 6 is a flowchart of wireless network access according to a second embodiment of the present invention. As shown in FIG. 6, the steps include:

Step S31: The user turns on the hotspot, and the system initialization is completed. The hotspot periodically sends a beacon frame for the terminal to search for, while waiting for the terminal access event reported by the bottom layer. When a terminal issues an access request, the authentication connection is performed according to the 802.11 protocol specification. If the terminal user inputs the correct password, the terminal can basically ensure a successful connection. After the terminal successfully accesses the current hotspot, the terminal obtains information about the terminal, such as a MAC address, a host name, and an assigned IP address.

Step S32: Find the terminal information in the access record table.

Step S33: determining whether the terminal information is found in the access record table, that is, determining whether the terminal information has been saved, if it is saved in the access record table, executing step S34, otherwise performing the steps of the embodiment shown in FIG. S22.

Step S34: Acquire the confirmation information corresponding to the saved terminal information, and determine whether the confirmation information is confirmation information for rejecting the terminal access. If yes, execute step S36; otherwise, execute step S35.

Step S35: Maintain the current connection.

Step S36: Disconnect the current connection.

Third embodiment

FIG. 7 is a flowchart of wireless network access according to a third embodiment of the present invention. As shown in FIG. 7, the steps include:

Step S201: The user turns on the hotspot, and the system initialization is completed.

Step S202: The hotspot periodically broadcasts the beacon frame for the terminal to search for, while waiting for the event reported by the bottom layer.

Step S203: When a terminal requests access, the authentication connection is performed according to the 802.11 protocol specification. If the terminal user inputs the correct password, the terminal can basically ensure successful connection.

Step S204: After the terminal successfully accesses the current hotspot, obtain the connection information (ie, terminal information) of the terminal, such as a MAC address, a host name, an assigned IP, and the like, and save the information.

Step S205: The information is reported to the UI interface, and the user determines whether to refuse to access the terminal.

The UI interface may be set on the hotspot, or may be set on the legal terminal, or may be set independently. In addition, in order to enable the user to know the terminal accessing the wireless network in time, an audible and/or optical alarm may also be performed.

Step S206: The UI interface pops up a dialog box, and in actuality, a specific prompt tone may be issued to remind the user to make a selection; the option is divided into whether to allow the current connection or the rejection, and the user can basically judge according to the MAC address of the access terminal and the host name. Whether it is a terminal that is accessed by itself, if not, it selects rejection, and step S207 is performed. If the user does not have any operation within 1 minute, the default selection is rejected, and step S207 is performed.

If the user determines that he is a terminal that he has accessed, he chooses to keep the current connection.

Step S207: The information of the rejected terminal is saved, including terminal information and confirmation information for denying terminal access.

Step S208: After making a selection, triggering to enter a judgment flow for the current access terminal. If the current access terminal is rejected by the user or rejected by default, a disconnection instruction is issued, that is, an access control instruction for restricting the terminal access, otherwise, A hold command is issued, that is, an access control command that maintains terminal access.

Step S209: After receiving the disconnection instruction, the specific connected terminal can be kicked out and disconnected by a specific command provided by the chip manufacturer during the specific implementation.

Step S210: After receiving the hold command, the current connection is maintained.

It can be seen from the above steps and implementation that the features of the embodiment are: 1. The user participates in judging a legal or illegal terminal; 2. For those users who are maliciously accessed or users of the network, the access just leaks its own terminal. The information, when kicked out of the network by this embodiment, can also effectively prevent the terminal from being accessed again by using the terminal information.

FIG. 8 is a schematic diagram of interaction between functional modules of a wireless network access according to a third embodiment of the present invention. As shown in FIG. 8, the method includes: a Wi-Fi authentication connection module 21, a Wi-Fi monitoring module 22, and a human machine. The interactive interface 23, the restricted terminal information saving module 24, the terminal information determining module 25, and the disconnected terminal module 26 implement the functions of the modules of FIGS. 2 and 5.

The Wi-Fi authentication connection module 21 mainly processes the Wi-Fi connection request, processes the basic authentication process, and finally completes the connection, and mainly records the MAC address of the current access terminal, and parses out the host name and other information of the terminal.

The Wi-Fi monitoring module 22 monitors different states of the Wi-Fi, and reports the information accessed by the client to the human-machine interaction interface 23 when a client access is detected.

The human-computer interaction interface 23 mainly implements a pop-up dialog box for the user to select whether to allow or deny the connection when receiving the information of the client access, and implements an automatic mechanism. The user refuses the connection by default after a period of no operation.

The restriction terminal information saving module 24 saves the rejected terminal information into a specific restriction file after the user selects the rejection terminal to maintain the connection through the user interaction interface.

The terminal information judging module 25 compares the currently accessed terminal information with the terminal information read from the restriction file. If the currently accessed terminal information is found in the restriction file, the command to actively kick off the terminal is immediately sent.

After disconnecting the terminal module 26 to receive the command to kick off the terminal, the disconnected terminal module 26 actively disconnects the current connection.

In this embodiment, when there is a terminal access, the information needs to be fed back to the upper layer, so that the user selects permission or rejection. In addition, information such as the MAC address and the host name of the terminal needs to be marked to prevent the terminal from being accessed again after the user refuses to access the terminal. Trouble.

The above is the specific flow of the embodiment of the present invention, and is of course not limited to this implementation. With the development of wireless networks, the security of the network will also increase, and the technology of cracking the network will also change. The method of the present invention also needs to be changed accordingly, but the idea of user participation judgment introduced in the text is When the mechanism set by the system encounters a bottleneck, it will undoubtedly play an effective role to further ensure network security.

The embodiment of the invention also discloses a computer program, comprising program instructions, which when executed by a computer, enable the computer to perform any of the above wireless network access methods.

The embodiment of the invention also discloses a carrier carrying the computer program.

In summary, the technical solution of the present invention has the following technical effects:

1. When a terminal accesses the wireless network, the terminal information can be reported to the user interaction interface, and even a prompt tone is issued, and the button is selected to maintain or reject the terminal access, which is fast and convenient;

2. The marking function of the terminal information such as the MAC address and the host name causes the unknown terminal (illegal terminal) to expose the identity and is difficult to access again.

Although the invention has been described in detail above, the invention is not limited thereto, and various modifications may be made by those skilled in the art in accordance with the principles of the invention. Therefore, modifications made in accordance with the principles of the invention are to be understood as falling within the scope of the invention.

Industrial applicability

The restricted access mechanism proposed by the technical solution of the present invention can "catch out" by illegal judgment even if an illegal user accesses a hot spot, although human-computer interaction brings extra work, but when the machine is powerless, the human operation more reliable. Therefore, the present invention has strong industrial applicability.

Claims

A wireless network access method includes:

Obtaining terminal information of the authenticated terminal when accessing the authenticated terminal in the wireless network;

And uploading the terminal information of the authenticated terminal to the user interface, and receiving an access control instruction input by the user through the user interface;

Disconnecting or maintaining a wireless network connection of the authenticated terminal according to the access control instruction.
The wireless network access method according to claim 1, wherein the step of disconnecting or maintaining the wireless network connection of the authenticated terminal according to the access control instruction comprises:

When the access control instruction is an instruction for restricting terminal access, disconnecting the wireless network connection of the authenticated terminal, and saving terminal information and disconnection information of the authenticated terminal to an access record table .
The wireless network access method according to claim 1, wherein the step of confirming whether to disconnect the wireless network connection of the authenticated terminal according to the access control instruction comprises:

And when the access control instruction is an instruction for maintaining terminal access, maintaining a wireless network connection of the authenticated terminal, and saving the terminal information and the hold information of the authenticated terminal to an access record table.
The wireless network access method according to any one of claims 1 to 3, further comprising:

If the access control command from the user is not received within the preset time, the wireless network connection of the authenticated terminal is disconnected.
The wireless network access method according to claim 2 or 3, further comprising:

When the authenticated terminal is re-accessed in the wireless network, the terminal information of the authenticated terminal is searched in the access record table;

And disconnecting the wireless network connection of the authenticated terminal according to the disconnected information corresponding to the found terminal information, or maintaining the wireless network connection of the authenticated terminal according to the retained information corresponding to the found terminal information.
A wireless network access device includes an information acquisition module, an information transceiver module, and an access control module, wherein:

The information acquiring module is configured to: when accessing the authenticated terminal in the wireless network, acquire terminal information of the authenticated terminal;

The information transceiver module is configured to: report terminal information of the authenticated terminal to a user interface, and receive an access control instruction input by the user through the user interface;

The access control module is configured to: disconnect or maintain a wireless network connection of the authenticated terminal according to the access control instruction.
The wireless network access device according to claim 6, wherein the access control module is configured to disconnect or maintain a wireless network connection of the authenticated terminal according to the access control instruction as follows:

When the access control instruction is an instruction for restricting terminal access, disconnecting the wireless network connection of the authenticated terminal, and saving terminal information and disconnection information of the authenticated terminal to an access record table .
The wireless network access device according to claim 6, wherein the access control module is configured to disconnect or maintain a wireless network connection of the authenticated terminal according to the access control instruction as follows:

When the access control instruction is an instruction for maintaining terminal access, the wireless network connection of the authenticated terminal is maintained, and the terminal information and the hold information of the authenticated terminal are saved to the access record table.
The wireless network access device according to any one of claims 6-8, wherein, when the information transceiving module does not receive an access control instruction from a user within a preset time, the access control module further Set to: disconnect the wireless network connection of the authenticated terminal.
The wireless network access device according to claim 7 or 8, further comprising an information query module and an access decision module, wherein:

The information querying module is configured to: when the authenticated terminal is re-accessed in the wireless network, look up the terminal information of the authenticated terminal in the access record table;

The access determination module is configured to: disconnect the wireless network connection of the authenticated terminal according to the disconnection information corresponding to the found terminal information, or keep the already-maintained information according to the found terminal information The wireless network connection of the authentication terminal.
A computer program comprising program instructions which, when executed by a computer, cause the computer to perform the wireless network access method of any of claims 1-5.
A carrier carrying the computer program of claim 11.