WO2016115807A1 - 无线路由器的接入处理、接入方法及装置 - Google Patents

无线路由器的接入处理、接入方法及装置 Download PDF

Info

Publication number
WO2016115807A1
WO2016115807A1 PCT/CN2015/080919 CN2015080919W WO2016115807A1 WO 2016115807 A1 WO2016115807 A1 WO 2016115807A1 CN 2015080919 W CN2015080919 W CN 2015080919W WO 2016115807 A1 WO2016115807 A1 WO 2016115807A1
Authority
WO
WIPO (PCT)
Prior art keywords
wireless router
channel
user
terminal
information
Prior art date
Application number
PCT/CN2015/080919
Other languages
English (en)
French (fr)
Inventor
温海龙
张大吴
李建锋
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016115807A1 publication Critical patent/WO2016115807A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present invention relates to the field of communications, and in particular, to an access processing, access method, and apparatus for a wireless router.
  • WIFI has been rapidly developed and widely used due to its support for wireless hotspot coverage, high transmission rate and low price.
  • smartphones, tablets and routers have WIFI function, and they use the mobile phone or computer to access the Internet through a wireless router at home. It has become part of people's daily lives.
  • WIFI brings convenience to us, it may also bring risks and problems. For example, if the router's WIFI encryption method and password are simple, the network may be cracked and stolen, and even the user information may be leaked; if the encryption method and password are used. The settings are too complicated and make it difficult for users to remember.
  • an embodiment of the present invention provides an access processing, access method, and apparatus for a wireless router.
  • a method for accessing a wireless router including: receiving user identity information of a terminal user sent by a terminal by using a first channel, where the user identity information is used to uniquely identify the End user; performing identity authentication on the terminal user according to the user identity information; after the authentication is passed, sending, by using the first channel, connection parameters required by the terminal to access the second channel used by the wireless router to the Said terminal.
  • the method before receiving the user identity information sent by the terminal by using the first channel, the method further includes: sending the identity feature information of the wireless router to the terminal by using the first channel, where The identity feature information is used to determine the legitimacy of the wireless router.
  • the sending the identity feature information to the terminal includes: encrypting the identity feature information; and transmitting the encrypted identity feature information to the terminal.
  • the encrypting the identity feature information includes: encrypting the identity feature information by using at least two pairs of asymmetric keys, wherein one pair of the at least two pairs of asymmetric keys a root key, and among the at least two pairs of asymmetric keys, other key pairs except the root key are random key pairs, and the public key of the random key pair carries the Identity information.
  • the identity feature information is generated by: determining a digest value corresponding to the public key in the random key pair; and connecting the following information in series to form concatenation data in a specified order: the digest value, the a media access control (MAC) address of the first channel, a part or all characters of a service set identifier (SSID) of the first channel, and a root key
  • the private key encrypts the serial data to obtain the identity feature information.
  • the method further includes: encrypting the communication data of the first channel according to a pre-negotiated encryption algorithm and/or a communication key.
  • the user identity information includes at least one of the following: fingerprint information of the user, voiceprint information of the user, and facial feature information of the user.
  • connection parameter includes at least one of the following: an SSID name of the second channel, an encryption mode used by the wireless router, and a password used by the wireless router.
  • a method for accessing a wireless router comprising: reporting, by a first channel, user identity information of an end user to a wireless router, wherein the user identity information is used for unique identification
  • a second channel established by the connection parameter is connected to the wireless router.
  • the method before the user identity information is reported to the wireless router by using the first channel, the method further includes: receiving identity feature information that is sent by the wireless router by using the first channel; Determine whether the wireless router is legal.
  • an access processing apparatus for a wireless router which is applied to a wireless router, and includes: a receiving module, configured to receive, by using the first channel, user identity information of the terminal user sent by the terminal, where The user identity information is used to uniquely identify the terminal user; the authentication module is configured to perform identity authentication on the terminal user according to the user identity information; and the sending module is configured to pass the first after the authentication is passed.
  • the channel sends the connection parameters required by the terminal to the second channel used by the wireless router to the terminal.
  • the device further includes: a sending module, configured to send the identity feature information of the wireless router to the terminal by using the first channel, where the identity feature information is used Judging the legitimacy of the wireless router.
  • an access device of a wireless router is further applied to the terminal, and the method includes: a reporting module, configured to report the user identity information of the terminal user to the wireless router by using the first channel, where The user identity information is used to uniquely identify the terminal user; and the receiving module is configured to: after the wireless router authenticates the user identity information, receive the establishment terminal connection sent by the wireless router by using the first channel. a connection parameter required for the wireless router; the access module is configured to access the wireless router by using a second channel established according to the connection parameter.
  • the terminal accessing the wireless router is authenticated according to the user identity information of the user receiving the first channel, and the technical means of accessing the wireless router according to the second channel is used to solve the WIFI password in the related art.
  • the contradiction between complexity and ease of use realizes a method of authenticating and automatically accessing wireless routers using user identity information such as fingerprints, voiceprints or faces, ensuring user identity authentication is safe and reliable, and ensuring users. Internet access is safe and efficient, while also improving the user experience.
  • FIG. 1 is a flowchart of an access processing method of a wireless router according to an embodiment of the present invention
  • FIG. 2 is a structural block diagram of an access processing apparatus of a wireless router according to an embodiment of the present invention
  • FIG. 3 is a block diagram showing still another structure of an access processing apparatus of a wireless router according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of a method for accessing a wireless router according to an embodiment of the present invention.
  • FIG. 5 is a structural block diagram of an access device of a wireless router according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a system for secure access of a wireless router according to a preferred embodiment of the present invention.
  • FIG. 7 is a schematic flowchart of an implementation process of a wireless router secure access according to a preferred embodiment of the present invention.
  • FIG. 8 is a schematic flowchart of a process for negotiating a line router identity verification and encryption protection mechanism between a client and a server according to a preferred embodiment of the present invention
  • FIG. 9 is a schematic flowchart of generating identity feature information of a wireless router carried by a public key of a random key pair according to a preferred embodiment of the present invention.
  • FIG. 10 is a flow diagram showing the legality of a client verifying the identity of a wireless router in accordance with a preferred embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for accessing a wireless router according to an embodiment of the present invention, as shown in FIG. The following steps:
  • Step S102 receiving user identity information of the terminal user sent by the terminal by using the first channel, where the user identity information is used to uniquely identify the terminal user;
  • Step S104 Perform identity authentication on the terminal user according to the user identity information.
  • step S106 after the authentication is passed, the connection parameters required for the second channel used by the terminal to access the wireless router are sent to the terminal through the first channel.
  • the terminal accessing the wireless router can be authenticated according to the first channel receiving the user identity information that uniquely identifies the user, and the WIFI password is solved in the related art according to the technical means of accessing the wireless router by the second channel.
  • the contradiction between complexity and ease of use realizes a method of using the user identity information such as fingerprint, voiceprint or face for authentication and automatic secure access to the wireless router, ensuring the user identity authentication is safe and reliable, and ensuring User Internet access is safe and efficient, while also improving the user experience.
  • the access process of the wireless router is more secure, and the following technical solution is provided in the embodiment of the present invention: before performing the technical solution embodied in step S102, the identity information of the wireless router is sent through the first channel.
  • the identity characteristic information is used to determine the legitimacy of the wireless router, that is, before authenticating the terminal according to the user identity information, the validity of the wireless router needs to be detected, but related In technology, some illegal websites can obtain the user's identity information (for example, voiceprints, fingerprints, and facial features of the user), and these identity information are private information of the user. Once leaked, it may cause huge damage to the customer. loss,.
  • the legality of the current wireless router can be monitored before the user identity information is obtained, which greatly reduces the risk of user identity information leakage.
  • the following technical solution may be performed to encrypt the identity feature information, and the encrypted identity feature information is sent to the terminal.
  • the foregoing identification of the identity information may be implemented by using at least two pairs of asymmetric keys to encrypt the identity feature information, wherein one of the at least two pairs of asymmetric keys is a root key, and Among the at least two pairs of asymmetric keys, the other key pairs except the above-mentioned root key are random key pairs, and the public key of the random key pair carries the above-mentioned identity feature information.
  • the following embodiments of the present invention provide the following technical solutions: determining the digest value corresponding to the public key in the random key pair; and connecting the following information in series to form the concatenation data in the specified order: the digest value, The MAC address of the first channel, part or all of the characters of the SSID of the first channel, and the serial data is encrypted by using the private key of the root key to obtain the identity feature information.
  • the foregoing user identity information includes at least one of the following: a fingerprint information of the user, voiceprint information of the user, and facial feature information of the user;
  • the connection parameter includes at least one of the following: an SSID name of the second channel, and wireless The encryption method used by the router and the password used by the wireless router.
  • the foregoing technical solution provided by the embodiment of the present invention can be summarized as follows: providing authentication and network (Internet) access service for the user terminal, using the authentication channel to interact with the client to complete the encryption protection mechanism negotiation, and starting the authentication channel encryption.
  • the protection function and the user terminal identity authentication are performed, and after the authentication is passed, the connection parameters such as the service set identifier SSID, the encryption mode, and the password of the Internet channel are sent to the client, and the MAC address of the user terminal is added to the whitelist of the wireless router.
  • the connection parameters such as the service set identifier SSID, the encryption mode, and the password of the Internet channel are sent to the client, and the MAC address of the user terminal is added to the whitelist of the wireless router.
  • an access processing device for a wireless router is also provided, which is applied to a wireless router, and is used to implement the foregoing embodiments and preferred embodiments.
  • the module to be explained.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or The implementation of a combination of software and hardware is also possible and conceived.
  • 2 is a structural block diagram of an access processing apparatus of a wireless router according to an embodiment of the present invention. As shown in Figure 2, the device comprises:
  • the receiving module 20 is configured to receive the user identity information of the terminal user sent by the terminal by using the first channel, where the user identity information is used to uniquely identify the terminal user;
  • the authentication module 22 is connected to the receiving module 20 and configured to perform identity authentication on the terminal user according to the user identity information.
  • the sending module 24 is connected to the authentication module 22, and is configured to send, to the terminal, the connection parameters required for the second channel used by the terminal to access the wireless router through the first channel after the authentication is passed.
  • the terminal accessing the wireless router can be authenticated by receiving the user identity information uniquely identifying the user through the first channel, and the technical means of accessing the wireless router according to the second channel is solved in the related art.
  • the contradiction between the complexity and ease of use of the WIFI password realizes a method of using the user identity information such as fingerprint, voiceprint or face for authentication and automatic secure access to the wireless router mode, while ensuring the user identity authentication is safe and reliable, It also ensures that users' Internet access is safe and efficient, while also improving the user experience.
  • FIG. 3 is a block diagram showing another structure of an access processing device of a wireless router according to an embodiment of the present invention.
  • the device further includes: a sending module 26, which is connected to the receiving module 20, and is configured to pass the foregoing And transmitting the identity information of the wireless router to the terminal, where the identity feature information is used to determine the legitimacy of the wireless router.
  • FIG. 4 is a flowchart of a method for accessing a wireless router according to an embodiment of the present invention. As shown in FIG. 4, the following steps are included. :
  • Step S402 the user identity information of the terminal user is reported to the wireless router by using the first channel, where the user identity information is used to uniquely identify the terminal user;
  • Step S404 after the wireless router authenticates the user identity information, receiving, by using the first channel, the connection parameters required by the wireless router to establish the terminal to access the wireless router;
  • Step S406 accessing the wireless router by using a second channel established according to the connection parameter.
  • the user identity information for uniquely labeling the user is reported through the first channel, and after the wireless router authenticates the user identity information, the second channel can be established according to the received connection parameter.
  • the above wireless router adopts such a technical solution to solve the related technology, WIFI
  • the contradiction between the complexity of the password and the ease of use realizes a method of using the user identity information such as fingerprint, voiceprint or face for authentication and automatic secure access to the wireless router. While ensuring the user identity authentication is safe and reliable, Ensuring that users' Internet access is safe and efficient, while also improving the user experience.
  • the following technical solution may be further implemented: receiving identity feature information sent by the wireless router by using the first channel; and determining, according to the identity feature information, Is the wireless router legal?
  • the foregoing technical solution provided by the embodiment of the present invention can be summarized as user identity information input or collection, establishing an authentication channel to the wireless router (ie, the first channel), and then performing information with the server of the wireless router through the authentication channel. Interact, complete the wireless router authentication and encryption protection mechanism negotiation, then start the authentication channel encryption protection function, and then send the user's identity information to the wireless router for user identity authentication, and then use the Internet channel connection returned by the wireless router after the authentication is successful.
  • the parameter establishes an Internet access channel (ie, the second channel) of the user terminal to the wireless router.
  • the technical solution provided by the embodiment of the present invention implements a process of authenticating a user identity or a wireless router through an authentication channel through a dual channel mechanism, and implementing a terminal accessing the wireless router through the second channel
  • the second channel is preferably an Internet access channel
  • the terminal accesses the wireless router through the Internet access channel, which can quickly and efficiently implement the access process of the wireless router, thereby greatly improving the user experience.
  • the wireless router provides two service set identification SSID access services, wherein one SSID is an authentication channel (corresponding to the first channel of the foregoing embodiment), and is used to provide identity for the user terminal.
  • Authentication service another SSID is an Internet channel (equivalent to the second channel of the above embodiment), which is used to provide an Internet access service for the user terminal, and the client performs user identity information entry or collection.
  • the user identity information may be a fingerprint or a voiceprint. Or type of face.
  • Step 1) The client connects to the wireless router by using the connection parameters pre-configured by the authentication channel;
  • Step 2) The client and the server communicate through the authentication channel, use at least two pairs or pairs of asymmetric keys to negotiate the wireless router authentication and encryption protection mechanism, and then start the authentication by using the negotiated encryption algorithm and the communication key.
  • the channel encryption protection function encrypts the communication data of the subsequent client and the server on the authentication channel;
  • all communication data on the authentication channel can be encrypted according to a pre-negotiated encryption algorithm and/or communication key, that is, an authentication process for the user identity or the wireless router implemented by the authentication channel.
  • the embodiment of the present invention performs encryption on the communication data in the authentication channel to ensure the security of data on the authentication channel, and avoids the risk of the connection parameters of the Internet access channel being stolen in the subsequent process, thereby fundamentally improving the risk.
  • the two or more pairs of asymmetric keys used above one pair is a root key, the remaining key pairs are random keys, and the public keys of all random key pairs carry a wireless router.
  • Identity feature information so that the client verifies the validity of the wireless router identity, and the random key pair is used for authentication channel encryption parameter negotiation.
  • the convention of the root key pair is stored on the client, and the private key of the root key pair is secretly stored by the wireless router manufacturer, and the external leakage is prohibited.
  • the convention of the random key is stored in the router, and the server can send the message to the user in clear text. But the private key of the random key must be encrypted and stored in the router to prevent external leakage.
  • the identity feature information of the wireless router carried by the public key of the random key pair may be generated in the following manner:
  • calculate the digest value of the public key of the random key pair and the algorithm for calculating the digest may be MD5 or SHA-1 or other algorithm, and then the digest is combined with the MAC address of the wireless router authentication channel and the SSID name of the authentication channel or All the strings are linked together, and then the serialized data is encrypted by using the private key of the root key pair, and the encrypted ciphertext is the identity information of the wireless router.
  • the validity of the identity of the wireless router by the client may be implemented by the following scheme:
  • the client After receiving the public key of the random key pair sent by the server and the corresponding wireless router identity feature information, the client first calculates the public key of the random key pair by using the same digest algorithm as the identity feature information generating method.
  • the digest value X1 is then decrypted using the public key of the root key pair saved locally by the client, from which the digest, MAC address, and SSID name are decrypted, and then the decrypted digest, MAC address, and SSID are decrypted. Compare with the locally calculated digest, the MAC address of the current authentication channel, and some or all of the characters of the SSID name. If they are consistent, the wireless router is legal, otherwise it is illegal.
  • Step 3 The client sends the identity information data of the user to the wireless router through the authentication channel, and the wireless router performs comparison authentication according to the locally saved identity database. If the authentication succeeds, the connection parameters such as the SSID name, encryption mode, and password of the Internet channel are sent. To the client, and add the MAC address of the user terminal to the whitelist of the wireless router to allow the user terminal to access the Internet through the Internet channel; if the authentication is unsuccessful, the failure is returned;
  • Step 4) The client detects the authentication result returned by the wireless router. If the authentication is successful, the user disconnects the authentication channel of the router first, and then establishes the Internet channel connection of the user terminal to the router by using the connection parameter of the Internet channel returned by the router. At this time, the user terminal where the client is located can access the Internet through the connection; if the authentication fails, the user is prompted to re-enter the identity information to retry or directly disconnect the authentication channel from the router.
  • the foregoing technical solution provided by the embodiment of the present invention can prevent user identity information from being stolen, user data leakage, and network by using dual SSID channel access, unique wireless router identity verification, encryption protection negotiation mechanism, and user identity authentication technologies. It is used, etc.
  • the user does not have to memorize the complex WIFI password parameters. After selecting a specific wireless router, it is only necessary to use fingerprints, voiceprints or people by simple touch/voice control/photographing. User identity information such as face is authenticated and automatically securely connected to the wireless router.
  • FIG. 5 is a structural block diagram of an access device of a wireless router according to an embodiment of the present invention. As shown in Figure 5, the device includes:
  • the reporting module 50 is configured to report the user identity information of the terminal user to the wireless router by using the first channel, where the user identity information is used to uniquely identify the terminal user;
  • the receiving module 52 is connected to the reporting module 50, and is configured to receive, by using the first channel, the connection parameters required by the wireless router to establish the terminal to access the wireless router after the wireless router authenticates the user identity information;
  • the access module 54 is connected to the receiving module 52 and configured to access the wireless router by using a second channel established according to the connection parameter.
  • the user identity information for uniquely tagging the user is reported, and after the wireless router authenticates the user identity information, the wireless channel can access the wireless channel through the network channel established according to the received connection parameter.
  • the router adopts such a technical solution to solve the contradiction between the complexity and the usability of the WIFI password in the related technology, and realizes the authentication and automatic secure access wireless using the user identity information such as fingerprint, voiceprint or face.
  • the router mode ensures that the user identity authentication is secure and reliable, and ensures that the user's Internet access is safe and efficient, and also improves the user experience.
  • FIG. 6 is a schematic structural diagram of a system for secure access of a wireless router according to a preferred embodiment of the present invention.
  • the system includes a client 60 running on a user terminal and a server 62 running on a wireless router.
  • the client 60 is responsible for user identity information input or collection, establishes an authentication channel to the wireless router, and then performs information interaction with the server of the wireless router through the authentication channel, completes wireless router identity verification and encryption protection mechanism negotiation, and then starts authentication channel encryption.
  • the protection function sends the user's identity information to the wireless router for user identity authentication. After the authentication is successful, the Internet channel connection parameters returned by the wireless router are used to establish an Internet access channel from the user terminal to the wireless router;
  • the server side 62 is responsible for providing authentication and Internet access services for the user terminal, using the authentication channel to interact with the client to complete the encryption protection mechanism negotiation, the authentication channel encryption protection function, and the user terminal identity authentication, and the Internet channel after the authentication is passed.
  • the connection parameters such as the SSID, the encryption method, and the password are sent to the client, and the MAC address of the user terminal is added to the whitelist of the wireless router to allow the user terminal to access the Internet through the Internet channel.
  • FIG. 7 is a schematic flowchart of implementing a secure access of a wireless router according to a preferred embodiment of the present invention, where the specific process includes:
  • Step S702 After the wireless router is powered on, the dual SSID access channel service and the server are started, one SSID provides the identity authentication service for the user terminal, and the other SSID provides the Internet access service for the user terminal;
  • Step S704 The client performs user identity information entry or collection, and the user identity information may be a fingerprint, a voiceprint or a face type;
  • Step S706 The client connects to the wireless router by using the connection parameter pre-configured by the authentication channel.
  • Step S708 The client and the server of the wireless router perform information interaction through the authentication channel, complete the wireless router identity verification and the encryption protection mechanism negotiation, and then start the authentication channel encryption protection function;
  • Step S710 The client sends the identity information data of the user to the wireless router server through the authentication channel, and the server performs comparison authentication according to the locally saved identity database. If the authentication succeeds, the SSID name/encryption mode and password of the Internet channel are connected. The parameter is sent to the client, and the MAC address of the user terminal is added to the whitelist of the wireless router to allow the user terminal to access the Internet through the Internet channel; if the authentication is unsuccessful, the return fails;
  • Step S712 The client checks the authentication result returned by the server. If the authentication succeeds, the user disconnects the authentication channel of the router first, and then establishes the Internet channel connection of the user terminal to the router by using the connection parameter of the Internet channel returned by the server; If the authentication fails, the user is prompted to re-enter the identity information to retry or directly disconnect the authentication channel from the router.
  • FIG. 8 is a schematic flowchart of a process of negotiating a line router identity verification and encryption protection mechanism between a client and a server according to a preferred embodiment of the present invention.
  • the specific process includes:
  • Step S802 Send a handshake request to the server, which has an encryption algorithm supported by itself;
  • Step S804 The server selects a self-supported security encryption algorithm from the handshake request message, and locally selects a random key pair K1 for the encryption mechanism negotiation.
  • Step S806 Send the selected encryption algorithm and the public key of the random key pair K1 and the corresponding wireless router identity feature information to the client;
  • Step S808 The client performs the validity verification of the identity of the wireless router. If it is legal, the process proceeds to step S812. Otherwise, step S810 is performed.
  • Step S810 The router identity is untrusted, and the encryption protection mechanism negotiation process is terminated.
  • Step S812 The wireless router identity is trusted to generate a communication key
  • Step S814 encrypting the communication key to the server by using the public key of the random key pair K1;
  • Step S816 The server decrypts the encrypted communication key by using the random key pair K1's private key
  • Step S818 The client and the server start the authentication channel encryption protection mechanism, and encrypt the communication data of the subsequent client and the server on the authentication channel by using the encryption algorithm and the communication key that have just been negotiated.
  • FIG. 9 is a flow chart showing the generation of identity feature information of a wireless router carried by a public key of a random key pair according to a preferred embodiment of the present invention.
  • the specific process includes:
  • Step S902 Calculate a digest value of the public key of the random key pair, and the algorithm for calculating the digest may be MD5 or SHA-1 or other algorithms;
  • Step S904 Link the digest to a part or all of the string of the MAC address of the wireless router authentication channel and the SSID name of the authentication channel;
  • Step S906 encrypting the serialized data by using the private key of the root key pair, and the encrypted ciphertext is the identity characteristic information of the wireless router.
  • FIG. 10 is a schematic flowchart of a client verifying the validity of a wireless router identity according to a preferred embodiment of the present invention.
  • the specific process includes:
  • Step S1002 The client receives the public key of the random key pair sent by the server and its corresponding wireless router identity feature information;
  • Step S1004 Calculate a summary X1 of the public key of the random key pair using the same digest algorithm as in the identity information generating method;
  • Step S1006 Decrypt the identity feature information by using the public key of the root key pair saved locally by the client, and decrypt the summary, the MAC address, and the SSID name therefrom;
  • Step S1008 Comparing the decrypted digest, MAC address, and SSID with some or all of the locally calculated digest value X1, the current authentication channel's MAC address, and the SSID name. If they are consistent, the wireless router is legal, otherwise Unlawful.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the embodiment of the present invention achieves the following technical effects: the contradiction between the complexity and the usability of the WIFI password in the related art is solved, and a user identity information such as a fingerprint, a voiceprint or a face is implemented.
  • Authentication and automatic secure access to the wireless router mode ensures user authentication and security while ensuring user Internet access is safe and efficient, while also improving the user experience.
  • a storage medium is further provided, wherein the software includes the above-mentioned software, including but not limited to: an optical disk, a floppy disk, a hard disk, an erasable memory, and the like.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the foregoing technical solution provided by the present invention can be applied to the access processing process of the wireless router, and the terminal that accesses the wireless router is authenticated according to the user identity information of the user received according to the first channel, and the wireless device is accessed according to the second channel.
  • the technical means of the router solves the contradiction between the complexity and the usability of the WIFI password in the related technology, and realizes a method of using the fingerprint, voiceprint or face and other user identity information for authentication and automatic secure access to the wireless router. While ensuring that user authentication is secure and reliable, it also ensures that users' Internet access is safe and efficient.

Abstract

本发明提供了一种无线路由器的接入处理、接入方法及装置，其中，所述方法包括：通过第一通道接收终端发送的终端用户的用户身份信息，其中，所述用户身份信息用于唯一标识所述终端用户；根据所述用户身份信息对所述终端用户进行身份认证；在认证通过后，通过所述第一通道将所述终端接入无线路由器所使用的第二通道需要的连接参数发送至所述终端。采用本发明提供的上述技术方案，解决了相关技术中，WIFI密码的复杂性与易用性的矛盾，实现了一种使用指纹、声纹或人脸等用户身份信息进行认证和自动安全接入无线路由器方式，在确保身份认证安全可靠的同时，又可确保用户Internet访问安全高效传输，同时提高了用户体验。

Description

无线路由器的接入处理、接入方法及装置 技术领域
本发明涉及通信领域，具体而言，涉及一种无线路由器的接入处理、接入方法及装置。
背景技术
WIFI因支持无线热点覆盖、传输速率高和价格低廉而得到迅猛发展和广泛使用，当前几乎所有的智能手机、平板电脑和路由器都带有WIFI功能，在家里使用手机或电脑通过无线路由器进行上网已经成了人们日常生活的一部分。但是WIFI在给我们带来便利的同时也可能带来风险和问题，例如路由器的WIFI加密方式和密码如果设置简单则可能导致网络被破解和盗用，甚至用户信息被泄漏；而如果加密方式和密码设置太复杂又导致用户不易记住。
针对相关技术中，WIFI密码的复杂性与易用性的矛盾，尚未提出有效的解决方案。
发明内容
为了解决上述技术问题，本发明实施例提供了一种无线路由器的接入处理、接入方法及装置。
根据本发明的一个实施例，提供了一种无线路由器的接入处理方法，包括：通过第一通道接收终端发送的终端用户的用户身份信息，其中，所述用户身份信息用于唯一标识所述终端用户；根据所述用户身份信息对所述终端用户进行身份认证；在认证通过后，通过所述第一通道将所述终端接入无线路由器所使用的第二通道需要的连接参数发送至所述终端。
在本发明实施例中，通过所述第一通道接收终端发送的用户身份信息之前，还包括：通过所述第一通道将所述无线路由器的身份特征信息下发至所述终端，其中，所述身份特征信息用于判断所述无线路由器的合法性。
在本发明实施例中，将所述身份特征信息下发至所述终端，包括：对所述身份特征信息进行加密；将加密后的所述身份特征信息下发至所述终端。
在本发明实施例中，对所述身份特征信息进行加密，包括：采用至少两对不对称密钥对所述身份特征信息进行加密，其中，所述至少两对不对称密钥的其中一对为根密钥，且在所述至少两对不对称密钥中，除所述根密钥外的其他密钥对为随机密钥对，所述随机密钥对的公钥均携带有所述身份特征信息。
在本发明实施例中，通过以下方式生成所述身份特征信息：确定所述随机密钥对中公钥对应的摘要值；按照指定顺序将以下信息串联形成串联数据：所述摘要值、所述第一通道的媒体接入控制(Media Access Control，简称为MAC)地址、所述第一通道的服务集标识(Service Set Identifier，简称为SSID)的部分或全部字符；使用所述根密钥的私钥对所述串联数据进行加密得到所述身份特征信息。
在本发明实施例中，所述方法还包括：按照预先协商好的加密算法和/或通信密钥对所述第一通道的通信数据进行加密。
在本发明实施例中，所述用户身份信息包括以下至少之一：用户的指纹信息、用户的声纹信息、用户的脸部特征信息。
在本发明实施例中，所述连接参数包括以下至少之一：所述第二通道的SSID名称、所述无线路由器所采用的加密方式、所述无线路由器所采用的密码。
根据本发明的另一个实施例，还提供了一种无线路由器的接入方法，包括：通过第一通道将终端用户的用户身份信息上报至无线路由器，其中，所述用户身份信息用于唯一标识所述终端用户；在所述无线路由器对所述用户身份信息认证通过后，通过所述第一通道接收所述无线路由器发送的建立终端接入所述无线路由器所需要的连接参数；通过根据所述连接参数建立的第二通道接入所述无线路由器。
在本发明实施例中，通过第一通道将所述用户身份信息上报至无线路由器之前，还包括：接收所述无线路由器通过所述第一通道下发的身份特征信息；根据所述身份特征信息判断所述无线路由器是否合法。
根据本发明的另一个实施例，还提供了一种无线路由器的接入处理装置，应用于无线路由器，包括：接收模块，设置为通过第一通道接收终端发送的终端用户的用户身份信息，其中，所述用户身份信息用于唯一标识所述终端用户；认证模块，设置为根据所述用户身份信息对所述终端用户进行身份认证；发送模块，设置为在认证通过后，通过所述第一通道将所述终端接入无线路由器所使用的第二通道需要的连接参数发送至所述终端。
在本发明实施例中，所述装置还包括：下发模块，设置为通过所述第一通道将所述无线路由器的身份特征信息下发至所述终端，其中，所述身份特征信息用于判断所述无线路由器的合法性。
根据本发明的另一个实施例，还提供了一种无线路由器的接入装置，应用于终端，包括：上报模块，设置为通过第一通道将终端用户的用户身份信息上报至无线路由器，其中，所述用户身份信息用于唯一标识所述终端用户；接收模块，设置为在所述无线路由器对所述用户身份信息认证通过后，通过所述第一通道接收所述无线路由器发送的建立终端接入所述无线路由器所需要的连接参数；接入模块，设置为通过根据所述连接参数建立的第二通道接入所述无线路由器。
通过本发明实施例，采用根据第一通道接收用户的用户身份信息来对接入无线路由器的终端进行认证，并根据第二通道接入无线路由器的技术手段，解决了相关技术中，WIFI密码的复杂性与易用性的矛盾，实现了一种使用指纹、声纹或人脸等用户身份信息进行认证和自动安全接入无线路由器方式，在确保用户身份认证安全可靠的同时，又可确保用户Internet访问安全高效，同时还提高了用户体验。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的无线路由器的接入处理方法的流程图；
图2为根据本发明实施例的无线路由器的接入处理装置的结构框图；
图3为根据本发明实施例的无线路由器的接入处理装置的再一结构框图；
图4是根据本发明实施例的无线路由器的接入方法的流程图；
图5为根据本发明实施例的无线路由器的接入装置的结构框图；
图6为根据本发明优选实施例的无线路由器安全接入的系统结构示意图；
图7为根据本发明优选实施例的无线路由器安全接入的实现流程示意图；
图8为本发明优选实施例的客户端与服务端进行线路由器身份验证和加密保护机制协商的流程示意图；
图9为根据本发明优选实施例的随机密钥对的公钥携带的无线路由器的身份特征信息生成的流程示意图；
图10为根据本发明优选实施例的客户端验证无线路由器身份的合法性的流程示意图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
本发明的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本发明而了解。本发明的目的和其他优点可通过在所写的说明书、权利要求书、以及附图中所特别指出的结构来实现和获得。
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
为了解决上述技术问题，在本实施例中提供了一种无线路由器的接入处理方法，图1是根据本发明实施例的无线路由器的接入处理方法的流程图，如图1所示，包括以下步骤：
步骤S102，通过第一通道接收终端发送的终端用户的用户身份信息，其中，上述用户身份信息用于唯一标识上述终端用户；
步骤S104，根据上述用户身份信息对上述终端用户进行身份认证；
步骤S106，在认证通过后，通过第一通道将上述终端接入无线路由器所使用的第二通道需要的连接参数发送至上述终端。
通过上述各个步骤，能够根据第一通道接收唯一标识用户的用户身份信息来对接入无线路由器的终端进行认证，并根据第二通道接入无线路由器的技术手段，解决了相关技术中，WIFI密码的复杂性与易用性的矛盾，实现了一种使用指纹、声纹或人脸等用户身份信息进行认证和自动安全接入无线路由器方式，在确保用户身份认证安全可靠的同时，又可确保用户Internet访问安全高效，同时还提高了用户体验。为了使 得上述无线路由器的接入过程更加安全，在本发明实施例中还提供了以下技术方案：在执行步骤S102所体现的技术方案之前，通过上述第一通道将上述无线路由器的身份特征信息下发至上述终端，其中，上述身份特征信息用于判断上述无线路由器的合法性，也就是说，在根据用户身份信息对终端进行验证之前，是需要对无线路由器的合法性进行检测的，而在相关技术中，一些非法站点能够获取到用户的身份信息(例如，声纹、指纹、用户的脸部特征信息)，而这些身份信息都是用户私密信息，一旦泄密，有可能会对客户造成巨大的损失，。采用上述技术方案，能够在获取到用户身份信息之前对当前的无线路由器的合法性进行监测，大大降低了用户身份信息泄露的危险。
其中，为了更加增加本发明实施例的保密性，还可以执行以下技术方案，对上述身份特征信息进行加密；将加密后的上述身份特征信息下发至上述终端，在本发明实施例中，对上述身份特征信息进行加密可以通过以下技术方案实现：采用至少两对不对称密钥对上述身份特征信息进行加密，其中，上述至少两对不对称密钥的其中一对为根密钥，且在上述至少两对不对称密钥中，除上述根密钥外的其他密钥对为随机密钥对，上述随机密钥对的公钥均携带有上述身份特征信息。
而对于上述身份特征信息的生成方式，本发明实施例还提供了以下技术方案；确定上述随机密钥对中公钥对应的摘要值；按照指定顺序将以下信息串联形成串联数据：上述摘要值、上述第一通道的MAC地址、上述第一通道的SSID的部分或全部字符；使用上述根密钥的私钥对上述串联数据进行加密得到上述身份特征信息。
需要说明的是，上述用户身份信息包括以下至少之一：用户的指纹信息、用户的声纹信息、用户的脸部特征信息；上述连接参数包括以下至少之一：第二通道的SSID名称、无线路由器所采用的加密方式、无线路由器所采用的密码。
综上所述，本发明实施例提供的上述技术方案可以概括总结为：为用户终端提供认证和网络(Internet)接入服务，使用认证通道与客户端交互完成加密保护机制协商、启动认证通道加密保护功能和进行用户终端身份认证，在认证通过之后将Internet通道的服务集标识SSID、加密方式及密码等连接参数发送给客户端，并将用户终端的MAC地址加入到无线路由器的白名单中，以允许该用户终端通过Internet通道进行Internet访问。
在本实施例中还提供了一种无线路由器的接入处理装置，应用于无线路由器，用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述，下面对该装置中涉及到的模块进行说明。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者 软件和硬件的组合的实现也是可能并被构想的。图2为根据本发明实施例的无线路由器的接入处理装置的结构框图。如图2所示，该装置包括：
接收模块20，设置为通过第一通道接收终端发送的终端用户的用户身份信息，其中，上述用户身份信息用于唯一标识上述终端用户；
认证模块22，与接收模块20连接，设置为根据上述用户身份信息对上述终端用户进行身份认证；
发送模块24，与认证模块22连接，设置为在认证通过后，通过上述第一通道将上述终端接入无线路由器所使用的第二通道需要的连接参数发送至上述终端。
通过上述各个模块的综合作用，能够通过第一通道接收唯一标识用户的用户身份信息来对接入无线路由器的终端进行认证，并根据第二通道接入无线路由器的技术手段，解决了相关技术中，WIFI密码的复杂性与易用性的矛盾，实现了一种使用指纹、声纹或人脸等用户身份信息进行认证和自动安全接入无线路由器方式，在确保用户身份认证安全可靠的同时，又可确保用户Internet访问安全高效，同时还提高了用户体验。
图3为根据本发明实施例的无线路由器的接入处理装置的再一结构框图，如图3所示，上述装置还包括：下发模块26，与接收模块20连接，设置为通过预上述第一通道将上述无线路由器的身份特征信息下发至上述终端，其中，上述身份特征信息用于判断上述无线路由器的合法性。
为了完善上述技术方案，在本实施例中提供了一种无线路由器的接入方法，图4是根据本发明实施例的无线路由器的接入方法的流程图，如图4所示，包括以下步骤：
步骤S402，通过第一通道将终端用户的用户身份信息上报至无线路由器，其中，上述用户身份信息用于唯一标识上述终端用户；
步骤S404，在上述无线路由器对上述用户身份信息认证通过后，通过第一通道接收上述无线路由器发送的建立终端接入上述无线路由器所需要的连接参数；
步骤S406，通过根据上述连接参数建立的第二通道接入上述无线路由器。
通过上述各个步骤，通过第一通道将用于唯一标注用户的用户身份信息上报，在上述无线路由器对上述用户身份信息认证通过后，就能够通过根据接收到的连接参数建立的第二通道接入上述无线路由器，采用这样的技术方案，解决了相关技术中，WIFI 密码的复杂性与易用性的矛盾，实现了一种使用指纹、声纹或人脸等用户身份信息进行认证和自动安全接入无线路由器方式，在确保用户身份认证安全可靠的同时，又可确保用户Internet访问安全高效，同时还提高了用户体验。
在本发明实施例的一个示例中，在执行步骤S402所体现的技术方案之前，还可以执行以下技术方案：接收上述无线路由器通过第一通道下发的身份特征信息；根据上述身份特征信息判断上述无线路由器是否合法。
综上所述，本发明实施例提供的上述技术方案可以总结为用户身份信息录入或采集，建立到无线路由器的认证通道(即第一通道)，然后与无线路由器的服务端通过认证通道进行信息交互,完成无线路由器身份验证和加密保护机制协商，然后启动认证通道加密保护功能，再将用户的身份信息发送给无线路由器进行用户身份认证，在认证成功后再使用无线路由器返回的Internet通道的连接参数建立用户终端到无线路由器的Internet访问通道(即第二通道)。
也就是说，本发明实施例所提供的技术方案，通过一种双通道机制：通过认证通道来实现对用户身份或无线路由器进行认证等过程，而通过第二通道实现终端接入无线路由器，在本发明实施例中，第二通道优选Internet访问通道，终端通过Internet访问通道接入无线路由器，能够快速高效的实现无线路由器的接入流程，大大提高用户的体验度。
为了更好的理解上述无线路由器的接入过程，以下结合一个示例从客户端和无线路由器侧进行简单说明：
需要说明的是，在本发明实施例中，无线路由器提供两个服务集标识SSID接入服务，其中一个SSID为认证通道(相当于上述实施例的第一通道)，用于为用户终端提供身份认证服务；另一个SSID为Internet通道(相当于上述实施例的第二通道)，用于为用户终端提供Internet访问服务，客户端进行用户身份信息录入或采集，用户身份信息可以是指纹、声纹或人脸等类型。
步骤1)客户端使用认证通道预配置的连接参数连接无线路由器；
步骤2)客户端与服务端通过认证通道进行通信，采用至少两对或多对不对称密钥来进行无线路由器身份验证和加密保护机制协商，然后使用协商好的加密算法和通信密钥启动认证通道加密保护功能，对后续客户端和服务端在认证通道上的通信数据进行加密；
实际上，在具体实施过程中，在认证信道上的所有通信数据都可以按照预先协商好的加密算法和/或通信密钥进行加密，即对于认证通道实现的对用户身份或无线路由器的认证过程，本发明实施例对上述认证通道中的通信数据执行加密手段，保证了认证通道上数据的安全性，同时，避免了后续过程中Internet访问通道的连接参数被窃取的风险，从根本上提高了终端接入无线路由器的安全性。
需要说明的是，上面采用的两对或多对不对称密钥，其中一对为根密钥，剩余的密钥对为随机密钥，所有随机密钥对的公钥都携带有无线路由器的身份特征信息，以便客户端验证无线路由器身份的合法性，随机密钥对用于认证通道加密参数协商。根密钥对的公约保存在客户端，根密钥对的私钥则由无线路由器制造商秘密保存，禁止对外泄露；随机密钥的公约保存在路由器中，服务端可以用明文方式发送给用户端，但随机密钥的私钥则必须加密保存在路由器中，禁止对外泄露。
可选地，可以通过以下方式生成随机密钥对的公钥携带的无线路由器的身份特征信息：
首先，计算随机密钥对的公钥的摘要值，计算摘要的算法可以为MD5或SHA-1或其他算法，然后将该摘要与无线路由器认证通道的MAC地址和认证通道的SSID名称的部分或全部字符串联在一起，然后使用根密钥对的私钥对这些串联后的数据进行加密，加密得到的密文就是无线路由器的身份特征信息。
在本发明实施例的一个可选示例中，可以通过以下方案实现客户端验证无线路由器身份的合法性：
客户端接收到服务端发送过来的随机密钥对的公钥及其对应的无线路由器身份特征信息后，先使用与身份特征信息生成方法中相同的摘要算法计算该随机密钥对的公钥的摘要值X1，然后使用客户端本地保存的根密钥对的公钥对该身份特征信息进行解密，从中将摘要、MAC地址和SSID名称解密出来，然后再将解密出来的摘要、MAC地址和SSID与本地计算的摘要、当前认证通道的MAC地址和SSID名称的部分或全部字符进行比较，如果一致则该无线路由器为合法的，否则为非法的。
步骤3)客户端将用户的身份信息数据通过认证通道发送给无线路由器，无线路由器根据本地保存的身份数据库进行对比认证，如果认证成功则将Internet通道的SSID名称、加密方式和密码等连接参数发给客户端，并将用户终端的MAC地址加入到无线路由器的白名单中，以允许该用户终端通过Internet通道进行Internet访问；如果认证不成功，则返回失败；
步骤4)客户端检测路无线由器返回的认证结果，如果认证成功，则先断开与路由器的认证通道连接，然后使用路由器返回的Internet通道的连接参数建立用户终端到路由器的Internet通道连接，此时客户端所在的用户终端可以通过该连接进行Internet访问；如果认证失败，则提示用户重新录入身份信息进行重试或直接断开与路由器的认证通道连接。
采用本发明实施例提供的上述技术方案，通过使用双SSID通道接入、独特的无线路由器身份验证、加密保护协商机制和用户身份认证等技术，可以防止用户身份信息被盗、用户数据泄露和网络被蹭用等，另外，用户不用再死记硬背复杂的WIFI密码参数，在选定特定的无线路由器后，只需通过简单的触摸/声控/拍照等方式就可以实现使用指纹、声纹或人脸等用户身份信息进行认证和自动安全接入无线路由器。
在本实施例中还提供了一种无线路由器的接入装置，应用于终端，用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述，下面对该装置中涉及到的模块进行说明。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。图5为根据本发明实施例的无线路由器的接入装置的结构框图。如图5所示，该装置包括：
上报模块50，设置为通过第一通道将终端用户的用户身份信息上报至无线路由器，其中，上述用户身份信息用于唯一标识上述终端用户；
接收模块52，与上报模块50连接，设置为在上述无线路由器对上述用户身份信息认证通过后，通过上述第一通道接收上述无线路由器发送的建立终端接入上述无线路由器所需要的连接参数；
接入模块54，与接收模块52连接，设置为通过根据上述连接参数建立的第二通道接入上述无线路由器。
通过上述各个模块的综合作用，将用于唯一标注用户的用户身份信息上报，在上述无线路由器对上述用户身份信息认证通过后，就能够通过根据接收到的连接参数建立的网络通道接入上述无线路由器，采用这样的技术方案，解决了相关技术中，WIFI密码的复杂性与易用性的矛盾，实现了一种使用指纹、声纹或人脸等用户身份信息进行认证和自动安全接入无线路由器方式，在确保用户身份认证安全可靠的同时，又可确保用户Internet访问安全高效，同时还提高了用户体验。
为了更好的理解上述客户端与无线路由器在无线路由器的接入过程中的工作流程，以下结合优选实施例进行说明：
图6为根据本发明优选实施例的无线路由器安全接入的系统结构示意图，该系统包括：运行于用户终端的客户端60和运行于无线路由器的服务端62。
客户端60，负责用户身份信息录入或采集，建立到无线路由器的认证通道，然后与无线路由器的服务端通过认证通道进行信息交互,完成无线路由器身份验证和加密保护机制协商，然后启动认证通道加密保护功能，再将用户的身份信息发送给无线路由器进行用户身份认证，在认证成功后再使用无线路由器返回的Internet通道的连接参数建立用户终端到无线路由器的Internet访问通道；
服务器端62，负责为用户终端提供认证和Internet接入服务，使用认证通道与客户端交互完成加密保护机制协商、启动认证通道加密保护功能和进行用户终端身份认证，在认证通过之后将Internet通道的SSID、加密方式及密码等连接参数发送给客户端，并将用户终端的MAC地址加入到无线路由器的白名单中，以允许该用户终端通过Internet通道进行Internet访问。
图7为根据本发明优选实施例的无线路由器安全接入的实现流程示意图，具体流程包括：
步骤S702：无线路由器开机后启动双SSID接入通道服务和服务端,一个SSID为用户终端提供身份认证服务,另一个SSID为用户终端提供Internet访问服务；
步骤S704：客户端进行用户身份信息录入或采集,用户身份信息可以是指纹,声纹或人脸等类型；
步骤S706：客户端使用认证通道预配置的连接参数连接无线路由器；
步骤S708：客户端与无线路由器的服务端通过认证通道进行信息交互,完成无线路由器身份验证和加密保护机制协商，然后启动认证通道加密保护功能；
步骤S710：客户端将用户的身份信息数据通过认证通道发送给无线路由器服务端,服务端根据本地保存的身份数据库进行对比认证，如果认证成功则将Internet通道的SSID名称/加密方式和密码等连接参数发给客户端,并将用户终端的MAC地址加入到无线路由器的白名单中,以允许该用户终端通过Internet通道进行Internet访问；如果认证不成功,则返回失败；
步骤S712：客户端检查服务端返回的认证结果，如果认证成功，则先断开与路由器的认证通道连接，然后使用服务端返回的Internet通道的连接参数建立用户终端到路由器的Internet通道连接；如果认证失败，则提示用户重新录入身份信息进行重试或直接断开与路由器的认证通道连接。
图8为本发明优选实施例的客户端与服务端进行线路由器身份验证和加密保护机制协商的流程示意图。具体流程包括：
步骤S802：向服务端发送握手请求，里面带有自己支持的加密算法；
步骤S804：服务端从握手请求消息中选择一种自己支持的安全加密算法，同时从本地选择一个随机密钥对K1用于加密机制协商；
步骤S806：将选定的加密算法和随机密钥对K1的公钥及其对应的无线路由器身份特征信息发送给客户端；
步骤S808：客户端进行无线路由器身份的合法性验证，如果合法则执行步骤S812，否则执行步骤S810，
步骤S810：该路由器身份不可信任，终止加密保护机制协商流程。
步骤S812：该无线路由器身份是可信的,生成一个通信密钥；
步骤S814：使用随机密钥对K1的公钥将该通信密钥加密发送给服务端；
步骤S816：服务端使用该随机密钥对K1的私钥将已加密的通信密钥解密出来；
步骤S818：客户端与服务端启动认证通道加密保护机制,使用刚才协商好的加密算法和通信密钥对后续客户端和服务端在认证通道上的通信数据进行加密。
图9为根据本发明优选实施例的随机密钥对的公钥携带的无线路由器的身份特征信息生成的流程示意图。具体流程包括：
步骤S902：计算随机密钥对的公钥的摘要值，计算摘要的算法可以为MD5或SHA-1或其他算法；
步骤S904：将该摘要与无线路由器认证通道的MAC地址和认证通道的SSID名称的部分或全部字符串联在一起；
步骤S906：使用根密钥对的私钥将这些串联后的数据进行加密，加密得到的密文就是无线路由器的身份特征信息。
图10为根据本发明优选实施例的客户端验证无线路由器身份的合法性的流程示意图，具体流程包括：
步骤S1002：客户端接收到服务端发送过来的随机密钥对的公钥及其对应的无线路由器身份特征信息；
步骤S1004：使用与身份特征信息生成方法中相同的摘要算法计算该随机密钥对的公钥的摘要X1；
步骤S1006：使用客户端本地保存的根密钥对的公钥对该身份特征信息进行解密，从中将摘要、MAC地址和SSID名称解密出来；
步骤S1008：将解密出来的摘要、MAC地址和SSID与本地计算的摘要值X1、当前认证通道的MAC地址和SSID名称的部分或全部字符进行比较，如果一致则该无线路由器为合法的，否则为非法的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
综上所述，本发明实施例达到了以下技术效果：解决了相关技术中，WIFI密码的复杂性与易用性的矛盾，实现了一种使用指纹、声纹或人脸等用户身份信息进行认证和自动安全接入无线路由器方式，在确保用户身份认证安全可靠的同时，又可确保用户Internet访问安全高效，同时还提高了用户体验。
在另外一个实施例中，还提供了一种软件，该软件用于执行上述实施例及优选实施方式中描述的技术方案。
在另外一个实施例中，还提供了一种存储介质，该存储介质中存储有上述软件，该存储介质包括但不限于：光盘、软盘、硬盘、可擦写存储器等。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的对象在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形， 意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
本发明提供的上述技术方案，可以应用于无线路由器的接入处理过程中，采用根据第一通道接收用户的用户身份信息来对接入无线路由器的终端进行认证，并根据第二通道接入无线路由器的技术手段，解决了相关技术中，WIFI密码的复杂性与易用性的矛盾，实现了一种使用指纹、声纹或人脸等用户身份信息进行认证和自动安全接入无线路由器方式，在确保用户身份认证安全可靠的同时，又可确保用户Internet访问安全高效。

Claims (13)

  1. 一种无线路由器的接入处理方法，包括：
    通过第一通道接收终端发送的终端用户的用户身份信息，其中，所述用户身份信息用于唯一标识所述终端用户；
    根据所述用户身份信息对所述终端用户进行身份认证；
    在认证通过后，通过所述第一通道将所述终端接入无线路由器所使用的第二通道需要的连接参数发送至所述终端。
  2. 根据权利要求1所述的方法，其中，通过所述第一通道接收终端发送的终端用户的用户身份信息之前，还包括：
    通过所述第一通道将所述无线路由器的身份特征信息下发至所述终端，其中，所述身份特征信息用于判断所述无线路由器的合法性。
  3. 根据权利要求2所述的方法，其中，将所述身份特征信息下发至所述终端，包括：
    对所述身份特征信息进行加密；
    将加密后的所述身份特征信息下发至所述终端。
  4. 根据权利要求3所述的方法，其中，对所述身份特征信息进行加密，包括：
    采用至少两对不对称密钥对所述身份特征信息进行加密，其中，所述至少两对不对称密钥的其中一对为根密钥，且在所述至少两对不对称密钥中，除所述根密钥外的其他密钥对为随机密钥对，所述随机密钥对的公钥均携带有所述身份特征信息。
  5. 根据权利要求4所述的方法，其中，通过以下方式生成所述身份特征信息：
    确定所述随机密钥对中公钥对应的摘要值；
    按照指定顺序将以下信息串联形成串联数据：所述摘要值、所述第一通道的媒体接入控制MAC地址、所述第一通道的服务集标识SSID的部分或全部字符；
    使用所述根密钥的私钥对所述串联数据进行加密得到所述身份特征信息。
  6. 根据权利要求1所述的方法，其中，所述方法还包括：
    按照预先协商好的加密算法和/或通信密钥对所述第一通道的通信数据进行加密。
  7. 根据权利要求1至6任一项所述的方法，其中，所述用户身份信息包括以下至少之一：用户的指纹信息、用户的声纹信息、用户的脸部特征信息。
  8. 根据权利要求1至6任一项所述的方法，其中，所述连接参数包括以下至少之一：所述第二通道的SSID名称、所述无线路由器所采用的加密方式、所述无线路由器所采用的密码。
  9. 一种无线路由器的接入方法，其中，包括：
    通过第一通道将终端用户的用户身份信息上报至无线路由器，其中，所述用户身份信息用于唯一标识所述终端用户；
    在所述无线路由器对所述用户身份信息认证通过后，通过所述第一通道接收所述无线路由器发送的建立终端接入所述无线路由器所需要的连接参数；
    通过根据所述连接参数建立的第二通道接入所述无线路由器。
  10. 根据权利要求9所述的方法，其中，通过第一通道将所述用户身份信息上报至无线路由器之前，还包括：
    接收所述无线路由器通过所述第一通道下发的身份特征信息；
    根据所述身份特征信息判断所述无线路由器是否合法。
  11. 一种无线路由器的接入处理装置，应用于无线路由器，其中，包括：
    接收模块，设置为通过第一通道接收终端发送的终端用户的用户身份信息，其中，所述用户身份信息用于唯一标识所述终端用户；
    认证模块，设置为根据所述用户身份信息对所述终端用户进行身份认证；
    发送模块，设置为在认证通过后，通过所述第一通道将所述终端接入无线路由器所使用的第二通道需要的连接参数发送至所述终端。
  12. 根据权利要求11所述的装置，其中，所述装置还包括：
    下发模块，设置为通过所述第一通道将所述无线路由器的身份特征信息下发至所述终端，其中，所述身份特征信息用于判断所述无线路由器的合法性。
  13. 一种无线路由器的接入装置，应用于终端，其中，包括：
    上报模块，设置为通过第一通道将终端用户的用户身份信息上报至无线路由器，其中，所述用户身份信息用于唯一标识所述终端用户；
    接收模块，设置为在所述无线路由器对所述用户身份信息认证通过后，通过所述第一通道接收所述无线路由器发送的建立终端接入所述无线路由器所需要的连接参数；
    接入模块，设置为通过根据所述连接参数建立的第二通道接入所述无线路由器。
PCT/CN2015/080919 2015-01-20 2015-06-05 无线路由器的接入处理、接入方法及装置 WO2016115807A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510028076.X 2015-01-20
CN201510028076.XA CN105871777A (zh) 2015-01-20 2015-01-20 无线路由器的接入处理、接入方法及装置

Publications (1)

Publication Number Publication Date
WO2016115807A1 true WO2016115807A1 (zh) 2016-07-28

Family

ID=56416338

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/080919 WO2016115807A1 (zh) 2015-01-20 2015-06-05 无线路由器的接入处理、接入方法及装置

Country Status (2)

Country Link
CN (1) CN105871777A (zh)
WO (1) WO2016115807A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018027853A1 (zh) * 2016-08-11 2018-02-15 张焰焰 根据指纹匹配wifi密码的方法和路由器
CN113556736A (zh) * 2021-07-21 2021-10-26 元心信息科技集团有限公司 接入方法、服务端、待接入端、电子设备及存储介质

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106535190A (zh) * 2016-11-24 2017-03-22 北京小米移动软件有限公司 网络连接方法及装置
CN106792693B (zh) * 2016-12-28 2020-10-30 泰州市元和达电子科技有限公司 一种基于声纹认证的智能无线局域网预约接入方法
CN108347730B (zh) * 2017-01-25 2022-12-09 中兴通讯股份有限公司 一种无线通信处理方法及装置
CN107172620B (zh) * 2017-03-30 2020-02-21 中国移动通信集团江苏有限公司 一种无线局域网认证方法和装置
CN107196933A (zh) * 2017-05-18 2017-09-22 西南大学 一种新型指纹认证联网设备及其联网方法
CN108834137A (zh) * 2018-05-17 2018-11-16 四川斐讯信息技术有限公司 一种无线路由器的配网方法及系统
CN108769986A (zh) * 2018-06-08 2018-11-06 廊坊新奥燃气设备有限公司 一种gprs远传燃气表加密通信方法
CN108900306A (zh) * 2018-07-02 2018-11-27 四川斐讯信息技术有限公司 一种无线路由器数字证书的产生方法及系统
CN110858971A (zh) * 2018-08-22 2020-03-03 九阳股份有限公司 一种智能设备配网方法和系统
CN111917746B (zh) * 2020-07-17 2022-06-28 北京世纪互联宽带数据中心有限公司 一种路由协议接入认证方法、设备及介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101621800A (zh) * 2009-08-13 2010-01-06 北京星谷科技有限公司 无线终端与无线路由器之间的认证信息交换方法
CN101668290A (zh) * 2008-09-04 2010-03-10 深圳华为通信技术有限公司 一种wlan网络配置方法及装置
CN101765181A (zh) * 2008-12-25 2010-06-30 上海贝尔阿尔卡特股份有限公司 一种控制移动站点以指定的wlan进行接入的方法、装置及其系统
CN102625303A (zh) * 2011-01-27 2012-08-01 西安龙飞软件有限公司 一种通过指纹进行wfii/3g路由器接入认证方法
CN103327519A (zh) * 2013-07-11 2013-09-25 成都西加云杉科技有限公司 接入点ap和基于ap和接入点控制器ac架构的系统
CN103873359A (zh) * 2012-12-14 2014-06-18 上海斐讯数据通信技术有限公司 移动设备、无线路由器、路由配置方法及系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101227467B (zh) * 2008-01-08 2011-11-30 中兴通讯股份有限公司 黑名单管理方法和装置
CN103369707B (zh) * 2012-03-27 2016-12-14 华为终端有限公司 无线网络连接的建立方法及终端设备
CN103517383B (zh) * 2012-06-18 2017-04-12 华为终端有限公司 移动终端接入家庭网络的方法和设备
CN103929745B (zh) * 2014-04-16 2017-04-12 东北大学 一种基于隐私保护的无线mesh网络接入认证系统及方法
CN103916855A (zh) * 2014-04-28 2014-07-09 太仓市同维电子有限公司 手机连接无线宽带WiFi网络的方法
CN104185181A (zh) * 2014-08-20 2014-12-03 成都千牛信息技术有限公司 一种基于iptables的WiFi用户接入控制方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101668290A (zh) * 2008-09-04 2010-03-10 深圳华为通信技术有限公司 一种wlan网络配置方法及装置
CN101765181A (zh) * 2008-12-25 2010-06-30 上海贝尔阿尔卡特股份有限公司 一种控制移动站点以指定的wlan进行接入的方法、装置及其系统
CN101621800A (zh) * 2009-08-13 2010-01-06 北京星谷科技有限公司 无线终端与无线路由器之间的认证信息交换方法
CN102625303A (zh) * 2011-01-27 2012-08-01 西安龙飞软件有限公司 一种通过指纹进行wfii/3g路由器接入认证方法
CN103873359A (zh) * 2012-12-14 2014-06-18 上海斐讯数据通信技术有限公司 移动设备、无线路由器、路由配置方法及系统
CN103327519A (zh) * 2013-07-11 2013-09-25 成都西加云杉科技有限公司 接入点ap和基于ap和接入点控制器ac架构的系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018027853A1 (zh) * 2016-08-11 2018-02-15 张焰焰 根据指纹匹配wifi密码的方法和路由器
CN113556736A (zh) * 2021-07-21 2021-10-26 元心信息科技集团有限公司 接入方法、服务端、待接入端、电子设备及存储介质

Also Published As

Publication number Publication date
CN105871777A (zh) 2016-08-17

Similar Documents

Publication Publication Date Title
WO2016115807A1 (zh) 无线路由器的接入处理、接入方法及装置
KR102018971B1 (ko) 네트워크 액세스 디바이스가 무선 네트워크 액세스 포인트를 액세스하게 하기 위한 방법, 네트워크 액세스 디바이스, 애플리케이션 서버 및 비휘발성 컴퓨터 판독가능 저장 매체
WO2018076365A1 (zh) 密钥协商方法及装置
CN107040513B (zh) 一种可信访问认证处理方法、用户终端和服务端
KR100729105B1 (ko) 비 유에스아이엠 단말기에서의 이에이피-에이케이에이 인증처리 장치 및 방법
CN105828332B (zh) 一种无线局域网认证机制的改进方法
US20090158033A1 (en) Method and apparatus for performing secure communication using one time password
WO2015192670A1 (zh) 用户身份认证方法、终端和服务端
CA2879910C (en) Terminal identity verification and service authentication method, system and terminal
WO2014180198A1 (zh) 终端接入方法、系统、设备和计算机存储介质
US8397281B2 (en) Service assisted secret provisioning
KR20060049882A (ko) 무선 근거리 네트워크 관계용 디바이스 및 방법과, 이에대응하는 제품
CN112235235A (zh) 一种基于国密算法的sdp认证协议实现方法
CN110690966B (zh) 终端与业务服务器连接的方法、系统、设备及存储介质
CN105282179A (zh) 一种基于cpk的家庭物联网安全控制的方法
US8498617B2 (en) Method for enrolling a user terminal in a wireless local area network
WO2016188053A1 (zh) 一种无线网络接入方法、装置及计算机存储介质
CN105141629A (zh) 一种基于WPA/WPA2 PSK多密码提升公用Wi-Fi网络安全性的方法
CN111901303A (zh) 设备认证方法和装置、存储介质及电子装置
WO2018099407A1 (zh) 账户认证登录方法及装置
WO2006026925A1 (fr) Procede d'etablissement de la cle d'authentification
KR101745482B1 (ko) 스마트홈 시스템에서의 통신 방법 및 그 장치
CN109561431B (zh) 基于多口令身份鉴别的wlan接入访问控制系统及方法
CN115473655B (zh) 接入网络的终端认证方法、装置及存储介质
CN115987655A (zh) 基于用户身份深度识别的远程接入访问方法、系统及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15878481

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15878481

Country of ref document: EP

Kind code of ref document: A1