WO2016169142A1 - 识别无线接入点合法性的方法、终端、系统及存储介质 - Google Patents

识别无线接入点合法性的方法、终端、系统及存储介质 Download PDF

Info

Publication number
WO2016169142A1
WO2016169142A1 PCT/CN2015/084485 CN2015084485W WO2016169142A1 WO 2016169142 A1 WO2016169142 A1 WO 2016169142A1 CN 2015084485 W CN2015084485 W CN 2015084485W WO 2016169142 A1 WO2016169142 A1 WO 2016169142A1
Authority
WO
WIPO (PCT)
Prior art keywords
identification information
database
legality
terminal
information
Prior art date
Application number
PCT/CN2015/084485
Other languages
English (en)
French (fr)
Inventor
徐懋鹏
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016169142A1 publication Critical patent/WO2016169142A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud
    • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
    • H04W12/122—Counter-measures against attacks; Protection against rogue devices

Definitions

  • the present invention relates to the field of mobile communication security technologies, and in particular, to a method, a terminal, a system, and a storage medium for identifying the legitimacy of an access point (AP).
  • AP access point
  • Wi-Fi is being deployed in a large amount. Due to the cheap deployment of Wi-Fi access point AP, ordinary users can easily deploy APs. Therefore, many criminals illegally deploy malicious APs for illegal criminal activities. , illegally stealing user information, seriously threatening users' information security.
  • the solution to the rogue AP in the prior art mainly includes two types: one is to detect and locate the rogue AP, and then to ban or block the AP; the second is that the operator judges the legitimacy of the AP connected to the operator user terminal and then notifies The user; however, for the first solution, the direct purpose is not to protect the information security of the terminal but the security of the network itself, and the real-time performance is poor, especially for the illegally deployed APs, before the APs are discovered, the terminals are It may have been attacked for a long time. For the second solution, the versatility is poor, and only the information security of the user of an operator can be protected. It is important that the user terminal is connected to the AP even if the AP is found to be a rogue AP. User information is actually at risk and the implementation cost is high.
  • the embodiment of the present invention is to provide a method, a terminal, a system, and a storage medium for identifying an AP's legality, which can accurately identify an illegal AP, effectively maintain information security of the terminal, enhance user experience, and have strong versatility. Good real-time and low cost.
  • the embodiment of the invention provides a method for identifying the legitimacy of a wireless access point AP, the method include:
  • the terminal acquires identification information of the AP to be connected;
  • the identification information is matched with the identification information stored in the first database, and when the matching is successful, the legality of the AP is determined.
  • the identification information includes: a service set identifier SSID of the AP, a medium access control MAC address of the AP, and an encryption authentication algorithm of the AP;
  • matching the identification information with the identification information stored in the first database comprises:
  • the SSID, the MAC address, and the encryption authentication algorithm of the AP are matched with the SSID, the MAC address, and the encryption authentication algorithm stored in the first database respectively.
  • the AP is determined.
  • the identification information is successfully matched with the identification information stored in the first database; otherwise, it is determined that the identification information of the AP fails to match the identification information stored in the first database.
  • the method further includes:
  • the legality query request of the AP is sent to the server, and a connection with the AP is established or refused according to the query result returned by the server.
  • the query result includes: the AP is information of an unknown AP;
  • the method further includes:
  • the query result includes: the AP is information of an unknown AP;
  • the method further includes:
  • the scoring result is used as a query result returned when the server receives the legality query request of the AP again.
  • the query result includes: legality information of the AP;
  • the method further includes: recording the identification information of the AP and the legality information of the AP to the first database and updating the first database.
  • the legality query request of the AP includes the identification information of the AP;
  • the identification information is used by the server to match the identification information with the identification information stored in the second database.
  • the matching is successful, determining the legality of the AP; when the matching fails, determining that the AP is an unknown AP;
  • the method further includes:
  • the server matches the identification information with the identification information stored in the second database.
  • the matching is successful, the validity of the AP is determined.
  • the AP is determined to be an unknown AP.
  • the embodiment of the present invention further provides a terminal, where the terminal includes: an acquiring module and a matching module;
  • the acquiring module is configured to obtain identification information of the AP to be connected;
  • the matching module is configured to match the identification information with the identification information stored in the first database, and when the matching is successful, determine the legality of the AP.
  • the identifier information includes: an SSID of the AP, a MAC address of the AP, and an encryption authentication algorithm of the AP;
  • the matching module is configured to match the SSID, the MAC address, and the encryption authentication algorithm of the AP with the SSID, the MAC address, and the encryption authentication algorithm stored in the first database, respectively, when the SSID, the MAC address, and the encryption are performed.
  • the authentication algorithm is successfully matched, it is determined that the identification information of the AP is successfully matched with the identification information stored in the first database; otherwise, determining that the identification information of the AP matches the identification information stored in the first database fails.
  • the matching module is further configured to: when determining that the identification information fails to match, send the legality query request of the AP to the server;
  • the terminal further includes a first control module, configured to establish or refuse to establish a connection with the AP according to the query result returned by the server.
  • the query result includes: the AP is information of an unknown AP;
  • the terminal further includes a warning module configured to generate and display the primary or secondary warning of the AP as an unknown AP.
  • the query result includes: the AP is information of an unknown AP;
  • the terminal further includes a scoring module, configured to perform credibility scoring for the AP, and report the scoring result to the server; the scoring result is used as a server to receive the legality query request of the AP again. When returning the reference information in the query results.
  • a scoring module configured to perform credibility scoring for the AP, and report the scoring result to the server; the scoring result is used as a server to receive the legality query request of the AP again.
  • the query result includes: legality information of the AP;
  • the terminal further includes an update module configured to record the identification information of the AP and the legality information of the AP to the first database and update the first database.
  • the embodiment of the present invention further provides a system for identifying the legitimacy of an AP, where the system includes: a terminal and a server;
  • the terminal is configured to obtain the identification information of the AP to be connected, and match the identification information with the identification information stored in the first database.
  • determine the legality of the AP determines the legality of the AP; if the matching fails, send the The legality query request of the AP is sent to the server;
  • the server is configured to receive a legality query request of the AP, and return a query result to the terminal.
  • the identifier information includes: an SSID of the AP, a MAC address of the AP, and an encryption authentication algorithm of the AP;
  • the terminal is configured to separately input the SSID, the MAC address, and the encryption authentication algorithm of the AP into the SSID, the MAC address, and the encryption authentication algorithm stored in the first database. Matching, when the SSID, the MAC address, and the encryption authentication algorithm are all matched successfully, determining that the identification information of the AP matches the identification information stored in the first database successfully; otherwise, determining the identification information of the AP and the first database The stored identification information failed to match.
  • the legality query request of the AP includes the identification information of the AP;
  • the server is further configured to match the identification information with the identification information stored in the second database, and when the matching is successful, determine the legality of the AP; when the matching fails, determine that the AP is an unknown AP. .
  • the query result includes: the AP is information of an unknown AP;
  • the terminal is further configured to generate and display a primary or secondary warning that the AP is an unknown AP.
  • the query result includes: the AP is information of an unknown AP;
  • the terminal is further configured to perform a credibility score for the AP, and report the scoring result to the server; and the scoring result is used when the server receives the legality query request of the AP again, and returns Reference information in the results of the query.
  • the query result includes: legality information of the AP;
  • the terminal is further configured to record the identification information of the AP and the legality information of the AP to the first database and update the first database.
  • the server is further configured to acquire and record the legality information and the identification information of the AP to the second database.
  • the embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores a computer program for performing the foregoing method for identifying the legality of an AP according to an embodiment of the present invention.
  • the terminal acquires the identification information of the AP to be connected; and matches the identification information with the identification information stored in the first database; Determine the legitimacy of the AP. So, it can be accurate Identifying illegal APs, effectively maintaining the information security of the terminal, enhancing the user experience, and having strong versatility, good real-time performance, and low cost.
  • FIG. 1 is a schematic flowchart of a method for identifying the legality of an AP according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a method for identifying the legality of an AP according to Embodiment 2 of the present invention
  • FIG. 3 is a schematic flowchart of a method for identifying the legality of an AP according to Embodiment 3 of the present invention.
  • FIG. 4 is a schematic flowchart of a method for identifying the legality of an AP according to Embodiment 4 of the present invention.
  • FIG. 5 is a schematic structural diagram of a terminal of an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a system for identifying the legitimacy of an AP according to an embodiment of the present invention.
  • the illegal APs in the prior art mainly exist in two forms: 1), the same SSID and password as the legal AP, and the user is not threatened by the counterfeit AP; 2), the passwordless AP, and the AP for free Internet access;
  • the working mode of the first type of counterfeit AP is mainly to increase the signal strength of the counterfeit AP and exceed the signal strength of the legal AP. Then, the terminal device that newly enters the network automatically connects to the counterfeit AP, for the terminal device that is already in the normal connection, or The terminal itself will automatically disconnect the currently connected AP to connect to the counterfeit AP; or the attacker actively attacks to destroy the normal connection, causing the terminal device to disconnect the current connection and connect to the counterfeit AP;
  • the second type of AP is completely a phishing mode, or a way of waiting for the rabbit.
  • the end user automatically searches for the counterfeit AP and actively connects. This mode poses the greatest threat to end users with weak security awareness.
  • the terminal acquires the identification information of the AP to be connected; matches the identification information with the identification information stored in the first database; when the matching is successful, determines the legality of the AP; Identify illegal APs and effectively maintain information security of the terminal.
  • FIG. 1 is a schematic flowchart of a method for identifying an AP's legality according to an embodiment of the present invention. As shown in FIG. 1 , a method for identifying an AP's legality according to an embodiment of the present invention includes:
  • Step 101 The terminal acquires identification information of the AP to be connected.
  • the method further includes: searching for and determining the AP to be connected;
  • the terminal performs a search and determines that the operation of the AP to be connected may automatically perform the search and determination of the AP in the case that the terminal does not establish a Wi-Fi connection, and may also be performed on the AP in the case of the user triggering.
  • the search and the determination may also be a passive search and determination of the AP by the currently connected AP when the terminal has established a Wi-Fi connection, or a Wi-Fi connection established at the terminal. In the case of a search and determination of APs with stronger signals.
  • the identification information of the AP includes: a Service Set Identifier (SSID) of the AP, a Media Access Control (MAC) address of the AP, and an encryption of the AP.
  • SSID Service Set Identifier
  • MAC Media Access Control
  • the identification information of the AP may further include: information about the deployer of the AP, the deployment location of the AP, and the like.
  • Step 102 Match the identification information with the identification information stored in the first database, and determine the legitimacy of the AP when the matching is successful.
  • the legality of the AP may be determined according to the legality information corresponding to the AP stored in the first database, that is, whether the AP is legal.
  • Matching the identification information with the identification information stored in the first database includes:
  • the terminal matches the SSID, the MAC address, and the encryption authentication algorithm of the AP with the SSID, the MAC address, and the encryption authentication algorithm stored in the first database respectively.
  • the terminal determines The identification information of the AP is successfully matched with the identification information stored in the first database; otherwise, the identification information of the AP and the first database are determined.
  • the identification information stored in the match fails;
  • the terminal matches the SSID of the AP with the SSID stored in the first database. If the SSID fails to match, it determines that the identification information fails to match. When the SSID matches successfully, the MAC address of the AP is matched. The MAC address corresponding to the SSID is matched. If the MAC address fails to match, the identification information fails to be matched. When the MAC address is successfully matched, the encryption authentication algorithm of the AP is matched with the encrypted authentication algorithm corresponding to the matched MAC address, and the encryption is performed. When the authentication algorithm fails to match, it is determined that the identification information fails to be matched; when the encryption authentication algorithm matches successfully, it is determined that the identification information is successfully matched;
  • the terminal performs the matching of the SSID, the MAC address, and the encryption authentication algorithm to the AP to be connected.
  • the SSID, the MAC address, and the encryption authentication algorithm are all matched successfully, it is determined that the identification information is successfully matched, and the SSID and the MAC address are successfully obtained. If any matching of the encryption authentication algorithm fails, it is considered that the identification information fails to match.
  • the identification information of the AP may further include: information about the deployer of the AP, the deployment location of the AP, and the like. Therefore, when the identification information of the AP includes the optional information, The optional information can be used as keyword information to narrow the range of the foregoing matching, thereby improving the efficiency and accuracy of identifying the legitimacy of the AP, but increasing the identification information increases the recognition cost. Therefore, the AP is Whether the identification information includes the optional information can be set according to actual needs.
  • the identification information of the AP stored in the first database is at least classified into two types: the identification information of the legal AP and the identification information of the illegal AP.
  • matching the identification information with the identification information stored in the first database comprises:
  • the identification information is first matched with the identification information of the legal AP stored in the first database, and the identification information of the illegal AP is matched to the identification information. When the identification information of the legal AP is successfully matched, the identification information is not performed. Matching of illegal AP identification information; To improve the recognition speed of the legitimacy of the AP.
  • the method further includes: when determining that the identification information fails to match, sending the legality query request of the AP to the server, and establishing or refusing to establish and refuse to establish between the AP and the AP according to the query result returned by the server Connection;
  • the matching of the identification information by the terminal may fail due to the SSID matching failure, that is, the AP to be connected is an unknown AP, or the MAC address matching may fail, or the matching of the encryption authentication algorithm may fail;
  • the encryption authentication algorithm fails to match, the possibility that the AP is a rogue AP is very high, and it is necessary to seek a re-matching confirmation of the server, but it is also possible that the encryption setting of the AP is modified.
  • the legality query request of the AP includes the identification information of the AP;
  • the method further includes:
  • the server matches the identification information with the identification information stored in the second database, and determines the legality of the AP when the identification information is successfully matched; when the identification information fails to match, the AP is determined to be an unknown AP;
  • the matching the identification information with the identification information stored in the second database includes:
  • the SSID, the MAC address, and the encryption authentication algorithm of the AP are respectively matched with the SSID, the MAC address, and the encryption authentication algorithm stored in the second database, and when the SSID, the MAC address, and the encryption authentication algorithm are all matched successfully, determining the The identification information of the AP is successfully matched with the identification information stored in the second database; otherwise, determining that the identification information of the AP fails to match the identification information stored in the second database;
  • the SSID of the AP is matched with the SSID stored in the second database.
  • the SSID fails to match, it is determined that the identification information fails to match;
  • the MAC address of the AP is matched with the obtained Match the MAC address corresponding to the SSID, MAC
  • the address matching fails, it is determined that the identification information fails to be matched.
  • the encryption authentication algorithm of the AP is matched with the encrypted authentication algorithm corresponding to the matched MAC address.
  • the identification information is determined to match. Failure; when the encryption authentication algorithm matches successfully, it is determined that the identification information is successfully matched;
  • the server may be a cloud server;
  • the second database stores at least two types of identification information of a legal AP and identification information of an illegal AP;
  • matching the identification information with the identification information stored in the second database comprises: matching the identification information with the identification information of the legal AP stored in the second database, and then performing the identification of the illegal AP.
  • the identification information is used to match the identification information.
  • the identification information of the legal AP is successfully matched, the matching of the illegal AP identification information is no longer performed; thus, the recognition speed of the legality of the AP can be improved.
  • the user may trigger the saving of the identification information and legality of the AP to the first database. In this way, the matching process of the identification information and the unnecessary risk reminding performed by the terminal each time the AP is connected are avoided, thereby enhancing the user experience.
  • the method before the matching the identification information with the identification information stored in the second database, the method further includes:
  • the server acquires and records the legality information and the identification information of the AP to the second database, and includes: the server obtains the identification information of the AP by registering the legal AP or the illegal AP by the AP, the organization, or the individual, and then The registration information of the AP is confirmed by the correctness. When the legality of the AP is confirmed, the legality information and the identification information of the AP are recorded to the second database; when the server cannot determine the legality of the AP, the information is not performed. a record of the AP related information;
  • the correctness of the registration information of the AP is confirmed, and the correctness of the registration information of the AP may be confirmed by using technical means and/or a trust mechanism;
  • the confirmation of the correctness of the registration information of the AP by using technical means includes: performing a verification test on the AP, such as whether there is a conflict with a known legal AP; or performing network operation by connecting the AP and monitoring whether the generation occurs. Risk; or through analysis and judgment of relevant information submitted by users;
  • the confirmation of the correctness of the registration information of the AP by the trust mechanism includes: analyzing the user who registers the AP, for example, if the user is a trusted operator, the information provided by the AP is considered to be legal and trusted.
  • the query result returned by the server includes the information that the AP is an unknown AP, and may include: the AP is an unknown AP and the AP is identified.
  • Information matching such as: SSID matching failure / MAC address matching failure / encryption authentication algorithm matching failure;
  • the method further includes:
  • the first-level warning and the second-level warning that the AP is an unknown AP may respectively correspond to different degrees of risk of the AP, that is, the probability that the unknown AP is a rogue AP; for example, when the AP is encrypted and authenticated.
  • the algorithm fails to match, the AP is considered to be in great risk.
  • the terminal displays and generates a first-level warning that the AP is an unknown AP. In this way, the user can be reminded not to connect easily.
  • the method when the query result includes the information that the AP is an unknown AP, after the connection between the AP and the AP is established or refused according to the query result returned by the server, the method further includes:
  • the terminal performs credibility scoring for the AP, and reports the scoring result to the server;
  • the second database further stores the identification information of the unknown AP and the corresponding credibility score
  • the scoring result is used as a legality query request for the server to receive the AP again.
  • the result of the scoring is used as reference information in the returned query result when the server receives the legality query request of the AP again, that is, when the other terminal sends the legality query request of the AP to the server, the server returns the terminal to the terminal.
  • the query result includes the rating information of the AP, so as to serve as a reference for whether the user connects to the AP.
  • the query result returned by the server to the terminal includes legality information of the AP
  • the method further includes: recording the identification information of the AP and the legality information of the AP to the first database and updating the first database; so that the terminal completes the connection itself when the terminal connects to the AP again.
  • the identification of the legality of the AP improves the recognition speed;
  • the number of AP information stored in the first database may be set, for example, 1000 pieces of AP information may be stored, and the first database may be updated when the first database is included.
  • the latest information of the AP and the legality information of the AP are used to replace the related information of the AP with the earliest recording time, or the newly recorded identification information of the AP.
  • the legality information of the AP replaces information about the AP that has not been used for the longest time.
  • the terminal when the identification information of the AP that the terminal performs fails to match, and the connection with the server cannot be established, the terminal generates and displays the primary or secondary warning of the AP as an unknown AP.
  • the method further includes:
  • the terminal establishes or refuses to establish a connection with the AP according to the determined legality of the AP.
  • the method includes: if the AP is determined to be a legal AP, the terminal establishes a connection with the AP, and if the AP is determined, If it is a rogue AP, the terminal refuses to establish a connection with the AP.
  • the method for identifying the legality of the AP in the embodiment of the present invention includes:
  • Step 201 The terminal searches for and determines an AP to be connected.
  • the terminal searches for and determines that the AP to be connected may search and determine the available AP that is automatically performed by the terminal, and may also search and determine the available AP when the user triggers.
  • Step 202 Obtain identification information of the AP to be connected.
  • the identification information of the AP includes: an SSID of the AP, a MAC address of the AP, and an encryption authentication algorithm of the AP.
  • Step 203 Match the identification information with the identification information stored in the first database.
  • the method includes: the terminal matches the SSID of the AP with the SSID stored in the first database, and if the SSID fails to match, it determines that the identification information fails to match; when the SSID matches successfully, the MAC address of the AP and the matched SSID are obtained. Corresponding MAC addresses are matched. When the MAC address matching fails, the identification information fails to be matched. When the MAC address is successfully matched, the encryption authentication algorithm of the AP is matched with the encrypted authentication algorithm corresponding to the matched MAC address. The encryption authentication algorithm is used. When the matching fails, it is determined that the identification information fails to be matched; when the encryption authentication algorithm matches successfully, it is determined that the identification information is successfully matched;
  • the identification information of the AP stored in the first database is classified into two types: the identification information of the legal AP and the identification information of the illegal AP.
  • matching the identification information with the identification information stored in the first database for identifying information comprises:
  • the identification information is first matched with the identification information of the legal AP stored in the first database, and the identification information of the illegal AP is matched to the identification information. When the identification information of the legal AP is successfully matched, the identification information is not performed. Matching of illegal AP identification information.
  • the matching of the identification information performed by the terminal determines that the matching is successful.
  • Step 204 The identification information is successfully matched, determining the legality of the AP, and establishing or refusing to establish a connection with the AP according to the legality of the AP;
  • the legality of the AP may be determined according to the legality information corresponding to the AP stored in the first database, that is, whether the AP is legal.
  • the terminal establishes or refuses to establish a connection with the AP according to the determined legality of the AP.
  • the method includes: if the AP is determined to be a legal AP, the terminal establishes a connection with the AP, and if the AP is determined, If the device is a rogue AP, the terminal refuses to establish a connection with the AP.
  • the AP is determined to be legal, that is, the terminal establishes a connection with the AP.
  • FIG. 3 is a schematic flowchart of a method for identifying the legality of an AP according to Embodiment 3 of the present invention; in a scenario where a terminal has established a Wi-Fi connection, as shown in FIG. 3, the method for identifying the legitimacy of an AP in the embodiment of the present invention includes:
  • Step 301 The terminal searches for and determines an AP to be connected.
  • the terminal searches for and determines that the AP to be connected may search and determine the AP that is passively disconnected by the currently connected AP, or the terminal searches and determines the AP of the stronger signal.
  • Step 302 Obtain identification information of the AP to be connected.
  • the identification information of the AP includes: an SSID of the AP, a MAC address of the AP, and an encryption authentication algorithm of the AP.
  • Step 303 Match the identification information with the identification information stored in the first database to perform identification information.
  • the step includes: the terminal matches the SSID of the AP with the SSID stored in the first database, and if the SSID fails to match, it determines that the identification information fails to match; when the SSID matches successfully, The MAC address of the AP is matched with the MAC address corresponding to the matched SSID. If the MAC address fails to match, the identification information fails to be matched. When the MAC address is successfully matched, the AP's encryption authentication algorithm and the matched MAC address are obtained. Corresponding encryption authentication algorithm performs matching. When the encryption authentication algorithm fails to match, it is determined that the identification information fails to be matched; when the encryption authentication algorithm matches successfully, it is determined that the identification information is successfully matched;
  • the identification information of the AP stored in the first database is classified into two types: the identification information of the legal AP and the identification information of the illegal AP.
  • matching the identification information with the identification information stored in the first database for identifying information comprises:
  • the identification information is first matched with the identification information of the legal AP stored in the first database, and the identification information of the illegal AP is matched to the identification information. When the identification information of the legal AP is successfully matched, the identification information is not performed. Matching of illegal AP identification information.
  • the terminal matches the SSID of the AP with the SSID stored in the first database, and the SSID fails to match, that is, the AP is an unknown AP.
  • Step 304 Determine that the identification information fails to match, and send a legality query request of the AP to the server.
  • the legality query request of the AP includes the identification information of the AP.
  • Step 305 The server matches the identification information with the identification information stored in the second database.
  • the method further includes:
  • the server acquires and records the legality information and the identification information of the AP to the second database, and includes: the server obtains the identification information of the AP by registering the legal AP or the illegal AP by the AP, the organization, or the individual, and then The registration information of the AP is confirmed by the correctness. When the legality of the AP is confirmed, the legality information and the identification information of the AP are recorded to the second database; when the server cannot determine the legality of the AP, the information is not performed.
  • the AP related letter Record of interest includes
  • the correctness of the registration information of the AP is confirmed, and the correctness of the registration information of the AP may be confirmed by using technical means and/or a trust mechanism;
  • the confirmation of the correctness of the registration information of the AP by using technical means includes: performing a verification test on the AP, such as whether there is a conflict with a known legal AP; or performing network operation by connecting the AP and monitoring whether the generation occurs. Risk; or through analysis and judgment of relevant information submitted by users;
  • the confirmation of the correctness of the registration information of the AP by the trust mechanism includes: analyzing the user who registers the AP, for example, if the user is a trusted operator, the information provided by the AP is considered to be legal and trusted.
  • the step of the method includes: the server matches the SSID of the AP with the SSID stored in the second database, and if the SSID fails to match, determining that the identification information fails to match; when the SSID is successfully matched, the MAC of the AP is matched. The address matches the MAC address corresponding to the matched SSID. If the MAC address fails to match, the identification information fails to be matched. When the MAC address is successfully matched, the encryption authentication algorithm corresponding to the AP's encrypted authentication algorithm and the matched MAC address is obtained. If the matching of the encryption authentication algorithm fails, it is determined that the identification information fails to be matched; when the encryption authentication algorithm matches successfully, it is determined that the identification information is successfully matched;
  • the server is a cloud server;
  • the second database stores two types of identification information of a legal AP and identification information of an illegal AP;
  • matching the identification information with the identification information stored in the second database comprises: matching the identification information with the identification information of the legal AP stored in the second database, and then performing the illegal The identification information of the AP is matched by the identification information.
  • the identification information of the legal AP is successfully matched, the matching of the illegal AP identification information is no longer performed; thus, the recognition speed of the legality of the AP can be improved.
  • the matching of the identification information is performed to determine that the matching is successful.
  • Step 306 The identification information is successfully matched, the server determines the legality of the AP, and returns a query result including the legality information of the AP to the terminal.
  • Step 307 The terminal establishes or refuses to establish a connection with the AP according to the query result returned by the server.
  • the step includes: if the AP is determined to be a legal AP, the terminal establishes a connection with the AP, and if the AP is determined to be a rogue AP, the terminal refuses to establish a connection with the AP; In an example, the AP is determined to be a rogue AP, that is, the terminal refuses to establish a connection with the AP.
  • Step 308 The terminal records the legality information and the identification information of the AP to the first database and updates the first database.
  • the number of AP information stored in the first database may be set, for example, 1000 pieces of AP information may be stored, and the first database may be updated when the first database is included.
  • the latest information of the AP and the legality information of the AP are used to replace the related information of the AP with the earliest recording time, or the newly recorded identification information of the AP.
  • the legality information of the AP replaces information about the AP that has not been used for the longest time.
  • FIG. 4 is a schematic flowchart of a method for identifying the legitimacy of an AP according to Embodiment 4 of the present invention. and the method for identifying the legitimacy of an AP in the embodiment of the present invention is as follows:
  • Step 401 The terminal searches for and determines an AP to be connected.
  • the terminal searches for and determines that the AP to be connected may be passively connected to the terminal.
  • Step 402 Acquire identification information of the AP to be connected.
  • the identification information of the AP includes: an SSID of the AP, a MAC address of the AP, and an encryption authentication algorithm of the AP.
  • Step 403 Match the identification information with the identification information stored in the first database to perform identification information.
  • the method further includes:
  • the server obtains and records the legality information and the identification information of the AP to the second database, and includes: the server obtains the identification information of the AP by registering the legal AP or the illegal AP by the AP operating enterprise, organization, or individual, and then The registration information of the AP is confirmed by the correctness. When the legality of the AP is confirmed, the legality information and the identification information of the AP are recorded to the second database. When the server cannot determine the legality of the AP, the Record of AP related information;
  • the correctness of the registration information of the AP is confirmed, and the correctness of the registration information of the AP may be confirmed by using technical means and/or a trust mechanism;
  • the confirmation of the correctness of the registration information of the AP by using technical means includes: performing a verification test on the AP, such as whether there is a conflict with a known legal AP; or performing network operation by connecting the AP and monitoring whether the generation occurs. Risk; or through analysis and judgment of relevant information submitted by users;
  • the confirmation of the correctness of the registration information of the AP by the trust mechanism includes: analyzing the user information of the registered AP, for example, if the user is a trusted operator, the information provided by the user is considered to be legal and trusted. .
  • the step includes: the terminal matches the SSID of the AP with the SSID stored in the first database, and if the SSID fails to match, it determines that the identification information fails to match; when the SSID matches successfully, The MAC address of the AP is matched with the MAC address corresponding to the matched SSID. If the MAC address fails to match, the identification information fails to be matched. When the MAC address is successfully matched, the AP's encryption authentication algorithm and the matched MAC address are obtained. Corresponding encryption authentication algorithm performs matching. When the encryption authentication algorithm fails to match, it is determined that the identification information fails to be matched; when the encryption authentication algorithm matches successfully, it is determined that the identification information is successfully matched;
  • the identification information of the AP stored in the first database is classified into two types: the identification information of the legal AP and the identification information of the illegal AP.
  • matching the identification information with the identification information stored in the first database for identifying information comprises:
  • the identification information is first matched with the identification information of the legal AP stored in the first database, and the identification information of the illegal AP is matched to the identification information. When the identification information of the legal AP is successfully matched, the identification information is not performed. Matching of illegal AP identification information.
  • the terminal matches the MAC address of the AP with the MAC address stored in the first database, the MAC address matching fails.
  • Step 404 Determine that the identification information fails to match, and send a legality query request of the AP to the server.
  • the legality query request of the AP includes the identification information of the AP.
  • Step 405 The server matches the identification information with the identification information stored in the second database.
  • the step of the step of: the server matches the SSID of the AP with the SSID stored in the second database. If the SSID fails to match, it determines that the identification information fails to match; when the SSID matches successfully, the MAC address of the AP is matched with the obtained SSID. Corresponding MAC addresses are matched. When the MAC address matching fails, the identification information fails to be matched. When the MAC address is successfully matched, the encryption authentication algorithm of the AP is matched with the encrypted authentication algorithm corresponding to the matched MAC address. The encryption authentication algorithm is used. When the matching fails, it is determined that the identification information fails to be matched; the encryption authentication is calculated. When the method is successfully matched, it is determined that the identification information is successfully matched;
  • the server is a cloud server;
  • the second database stores two types of identification information of a legal AP and identification information of an illegal AP;
  • matching the identification information with the identification information stored in the second database comprises: matching the identification information with the identification information of the legal AP stored in the second database, and then performing the illegal The identification information of the AP is matched by the identification information.
  • the identification information of the legal AP is successfully matched, the matching of the illegal AP identification information is no longer performed; thus, the recognition speed of the legality of the AP can be improved.
  • the server when the server performs matching between the SSID of the AP and the SSID stored in the second database, it is determined that the matching fails, that is, the AP is determined to be an unknown AP.
  • Step 406 The identification information fails to be matched.
  • the server determines that the AP is an unknown AP, and returns a query result that includes the information that the AP is an unknown AP to the terminal.
  • the information that the AP is an unknown AP includes: the AP is an unknown AP and the AP identification information is matched, such as: SSID matching failure/MAC address matching failure/encryption authentication algorithm matching failure;
  • the query result includes: the AP is an unknown AP, and the MAC address matching of the AP fails.
  • Step 407 The terminal generates and displays a secondary warning that the AP is an unknown AP according to the query result returned by the server.
  • the terminal may generate and display a first-level or second-level warning that the AP is an unknown AP according to the query result returned by the server; the first-level warning and the second-level warning may respectively correspond to different degrees of risk of the AP; For example, when the AP's encryption authentication algorithm fails to match, the AP is considered to be in great risk, and the terminal displays and generates a first-level warning that the AP is an unknown AP; when the AP's SSID matches the failure/MAC address When the match fails, the secondary alarm of the AP being an unknown AP is generated and displayed to prompt the user that the AP has a certain risk.
  • Step 408 The terminal establishes a connection with the AP.
  • the operation of establishing a connection between the terminal and the AP is triggered by the user according to the secondary warning displayed by the terminal.
  • Step 409 The terminal performs credibility scoring on the AP, and reports the scoring result to the server for storage.
  • the second database further stores identification information of the unknown AP and a corresponding credibility score
  • the scoring result is used as reference information in the returned query result when the server receives the legality query request of the AP again;
  • the result of the scoring is used as reference information in the returned query result when the server receives the legality query request of the AP again, that is, when the other terminal sends the legality query request of the AP to the server, the server returns the terminal to the terminal.
  • the query result includes the rating information of the AP, so as to serve as a reference for whether the user connects to the AP.
  • FIG. 5 is a schematic structural diagram of a terminal according to an embodiment of the present invention. As shown in FIG. 5, the component structure of the terminal in the embodiment of the present invention includes: an obtaining module 51 and a matching module 52;
  • the obtaining module 51 is configured to acquire identification information of the AP to be connected;
  • the matching module 52 is configured to match the identification information with the identification information stored in the first database, and determine the legitimacy of the AP when the matching is successful.
  • the terminal further includes: a searching module 53, configured to search for and determine the AP to be connected.
  • the identification information includes: an SSID of the AP, a MAC address of the AP, and an encryption authentication algorithm of the AP;
  • the matching module 52 is configured to calculate the SSID, the MAC address, and the encryption authentication algorithm of the AP respectively, the SSID, the MAC address, and the encryption authentication stored in the first database.
  • the method performs matching, and when the SSID, the MAC address, and the encryption authentication algorithm are all matched successfully, determining that the identification information of the AP matches the identification information stored in the first database successfully; otherwise, determining the identification information of the AP and the first The identification information stored in the database fails to match;
  • the matching module 52 is configured to match the SSID of the AP with the SSID stored in the first database.
  • the SSID fails to match, it is determined that the identification information fails to be matched; when the SSID is successfully matched, the matching is performed.
  • the MAC address of the AP matches the MAC address of the AP corresponding to the matched SSID. If the MAC address fails to match, the identification information fails to be matched.
  • the AP's encryption authentication algorithm and the matched MAC address are obtained. Corresponding encryption authentication algorithms are matched. When the encryption authentication algorithm fails to match, it is determined that the identification information fails to match; when the encryption authentication algorithm matches successfully, it is determined that the identification information is successfully matched.
  • the identification information of the AP stored in the first database is at least classified into two types: the identification information of the legal AP and the identification information of the illegal AP.
  • the matching module 52 matches the identification information with the identification information stored in the first database, including:
  • the matching module 52 matches the identification information with the identification information of the legal AP stored in the first database, and then performs the matching of the identification information of the unauthorized AP.
  • the matching module 52 is no longer illegal.
  • the AP identifies the matching of the information; thus, the recognition speed of the legitimacy of the AP can be improved.
  • the matching module 52 is further configured to: when determining that the identification information fails to match, send the legality query request of the AP to the server; so that the server stores the identification information with the second database. The identification information is matched and the identification information is matched. When the identification information is successfully matched, the legality of the AP is determined; when the identification information fails to match, the AP is determined to be an unknown AP;
  • the legality query request of the AP includes the identification information of the AP;
  • the terminal further includes a first control module 54 configured to establish or refuse to establish a connection with the AP according to the query result returned by the server;
  • the matching of the identification information by the matching module 52 may fail due to the SSID matching failure, that is, the AP to be connected is an unknown AP, or the MAC address matching may fail, or the matching of the encryption authentication algorithm may fail; when the identification information fails to match
  • the reason is that the probability that the AP is a rogue AP is very high when the encryption authentication algorithm fails to match. It is necessary to seek re-matching confirmation of the server, but it may also be because the encryption setting of the AP is modified.
  • the server may be a cloud server;
  • the second database stores at least two types of identification information of a legal AP and identification information of a rogue AP.
  • the query result includes: the AP is information of an unknown AP, and may include: the AP is an unknown AP and the AP identification information is matched, for example, the SSID matching failure/MAC address matching failure/ The encryption authentication algorithm fails to match;
  • the terminal further includes a warning module 55 configured to generate and display a primary or secondary alarm of the AP as an unknown AP;
  • the first-level warning and the second-level warning that the AP is an unknown AP may respectively correspond to different degrees of risk of the AP; for example, when the matching authentication algorithm of the AP fails to match, the AP is considered to be at a high risk.
  • the terminal displays and generates a first-level warning that the AP is an unknown AP; thus, the user can be reminded not to connect easily.
  • the query result includes: the AP is information of an unknown AP;
  • the terminal further includes a scoring module 56, configured to perform credibility scoring for the AP, and report the scoring result to the server; the scoring result is used as a legality query for the server to receive the AP again.
  • the reference information in the returned query result when requested.
  • the query result includes: legality information of the AP;
  • the terminal further includes an update module 57 configured to record the identification information of the AP and the legality information of the AP to the first database and update the first database.
  • the terminal further includes a second control module 58 configured to establish or refuse to establish a connection with the AP according to the determined validity of the AP;
  • the second control module 58 establishes or refuses to establish a connection with the AP according to the determined validity of the AP, including:
  • the second control module 58 determines that the AP is a legal AP, the connection with the AP is established. If the AP is determined to be a rogue AP, the terminal refuses to establish a connection with the AP.
  • the warning module 55 is further configured to generate and display a primary or secondary warning that the AP is an unknown AP when the matching module 52 cannot establish a connection with the server.
  • FIG. 6 is a schematic structural diagram of a system for identifying the legitimacy of an AP according to an embodiment of the present invention. As shown in FIG. 6, the system component for identifying the legitimacy of an AP in the embodiment of the present invention includes: a terminal 61 and a server 62;
  • the terminal 61 is configured to acquire identification information of the AP to be connected, and match the identification information with the identification information stored in the first database, and determine the legitimacy of the AP when the identification information is successfully matched; When the information matching fails, the legality query request of the AP is sent to the server;
  • the server 62 is configured to receive a legality query request of the AP, and return a query result to the terminal.
  • the terminal 61 is further configured to search for and determine the AP to be connected.
  • the identification information includes: an SSID of the AP, a MAC address of the AP, and an encryption authentication algorithm of the AP;
  • the terminal 61 is configured to match the SSID, the MAC address, and the encryption authentication algorithm of the AP with the SSID, the MAC address, and the encryption authentication algorithm stored in the first database, respectively, when the SSID, the MAC address, and the encryption are performed.
  • the authentication algorithm is successfully matched, it is determined that the identification information of the AP is successfully matched with the identification information stored in the first database; otherwise, determining that the identification information of the AP fails to match the identification information stored in the first database;
  • the terminal 61 is configured to set the SSID of the AP with the first database. If the SSID is matched, the matching of the identification information fails. When the matching of the SSID is successful, the MAC address of the AP is matched with the MAC address of the AP corresponding to the matched SSID. When the MAC address fails to match, If the matching of the identification information is successful, the encryption authentication algorithm of the AP is matched with the encryption authentication algorithm of the AP corresponding to the matched MAC address. If the encryption authentication algorithm fails to match, the identification information fails to be matched; When the authentication algorithm is successfully matched, it is determined that the identification information is successfully matched.
  • the identification information of the AP stored in the first database is at least classified into two types: the identification information of the legal AP and the identification information of the illegal AP.
  • the terminal 61 matching the identification information with the identification information stored in the first database includes:
  • the terminal 61 matches the identification information with the identification information of the legal AP stored in the first database, and then performs the identification information of the unauthorized AP to match the identification information.
  • the identification information of the legal AP matches successfully, The matching of the illegal AP identification information is no longer performed; thus, the recognition speed of the legality of the AP can be improved.
  • the legality query request of the AP includes the identification information of the AP
  • the server 62 is further configured to match the identification information with the identification information stored in the second database, and when the identification information is successfully matched, determine the legality of the AP; when the identification information fails to match, It is determined that the AP is an unknown AP.
  • the server 62 matches the identification information with the identification information stored in the second database to include the identification information, including:
  • the server 62 matches the SSID, the MAC address, and the encryption authentication algorithm of the AP with the SSID, the MAC address, and the encryption authentication algorithm stored in the second database, respectively, when the SSID, the MAC address, and the encryption authentication algorithm are matched successfully. Determining that the identification information of the AP is successfully matched with the identification information stored in the second database; otherwise, determining that the identification information of the AP fails to match the identification information stored in the second database;
  • the server 62 matches the SSID of the AP with the SSID stored in the second database.
  • the SSID fails to match, it determines that the identification information fails to match; when the SSID matches successfully, the MAC address of the AP is determined.
  • the second database stores at least two types of identification information of a legal AP and identification information of an illegal AP;
  • the server 62 matches the identification information with the identification information stored in the second database, including:
  • the server 62 matches the identification information with the identification information of the legal AP stored in the second database, and then performs the matching of the identification information of the unauthorized AP.
  • the identification information of the legal AP matches successfully, The matching of the illegal AP identification information is no longer performed; thus, the recognition speed of the legality of the AP can be improved.
  • the query result includes: the AP is information of an unknown AP;
  • the terminal 61 is further configured to generate and display a primary or secondary warning that the AP is an unknown AP.
  • the query result includes: the AP is information of an unknown AP;
  • the terminal 61 is further configured to perform a credibility score for the AP, and report the score result to the server 62;
  • the server 62 stores the identification information and the credibility score of the unknown AP to the second database;
  • the server 62 When the server 62 receives the legality query request of the AP again, the result of the scoring is used as reference information in the returned query result.
  • the query result includes: legality information of the AP;
  • the terminal 61 is further configured to record the identification information of the AP and the legality information of the AP to the first database and update the first database.
  • the terminal 61 is further configured to establish or refuse to establish a connection with the AP according to the determined validity of the AP; or establish or refuse to establish and reject the connection according to the query result returned by the server.
  • the server 62 is further configured to acquire and record the legality information and the identification information of the AP to the second database;
  • the server 62 obtains the legality information and the identification information of the AP, including:
  • the server 62 obtains the identification information of the AP by registering the legal AP or the illegal AP by the AP operating enterprise, the organization, or the individual, and then confirms the correctness of the registration information of the AP, and when the legality of the AP is confirmed. Recording the legality information and the identification information of the AP to the second database; when the server cannot determine the legality of the AP, the recording of the related information of the AP is not performed;
  • the correctness of the registration information of the AP is confirmed, and the correctness of the registration information of the AP may be confirmed by using technical means and/or a trust mechanism;
  • the confirmation of the correctness of the registration information of the AP by using technical means includes: performing a verification test on the AP, such as whether there is a conflict with a known legal AP; or performing network operation by connecting the AP and monitoring whether the generation occurs. Risk; or through analysis and judgment of relevant information submitted by users;
  • the confirmation of the correctness of the registration information of the AP by the trust mechanism includes: analyzing the user information of the registered AP, for example, if the user is a trusted operator, the information provided by the user is considered to be legal and trusted. .
  • the server 62 is further configured to maintain and update information of the AP stored in the second database, such as an update of the AP encryption authentication algorithm. Lost AP letter The update of the information, the update of the information after the unknown AP determines its legitimacy, and the like.
  • the obtaining module, the matching module, the searching module, the first control module, the warning module, the scoring module, the updating module, and the second control module may be implemented by a processor, and may also be implemented by a specific Logic circuit implementation; in practical applications, the processor can be a central processing unit (CPU), a microprocessor (MPU) or a field programmable gate array (FPGA).
  • the processor can be a central processing unit (CPU), a microprocessor (MPU) or a field programmable gate array (FPGA).
  • the method for identifying the legality of the AP is implemented in the form of a software function module and sold or used as a stand-alone product, it may also be stored in a computer readable storage medium.
  • the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product stored in a storage medium, including a plurality of instructions.
  • a computer device (which may be a personal computer, server, or network device, etc.) is caused to perform all or part of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read only memory (ROM), a magnetic disk, or an optical disk.
  • program codes such as a USB flash drive, a mobile hard disk, a read only memory (ROM), a magnetic disk, or an optical disk.
  • the embodiment of the present invention further provides a computer storage medium, where the computer storage medium stores a computer program for performing the foregoing method for identifying the legality of the AP in the embodiment of the present invention.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种识别无线接入点(AP)合法性的方法，所述方法包括：终端获取待连接AP的识别信息；将所述识别信息与第一数据库中存储的识别信息进行匹配；匹配成功时，确定所述AP的合法性。本发明还公开了一种终端、识别AP合法性的系统及存储介质。

Description

识别无线接入点合法性的方法、终端、系统及存储介质 技术领域
本发明涉及移动通信安全技术领域，尤其涉及一种识别无线接入点(AP，Access Point)合法性的方法、终端、系统及存储介质。
背景技术
随着无线通信技术的发展，Wi-Fi正在被大量部署，由于Wi-Fi接入点AP部署的廉价性，使得普通用户可以轻易部署AP，因此，很多不法分子非法部署恶意AP进行违法犯罪活动，非法窃取用户信息，严重威胁用户的信息安全。
现有技术中对非法AP的解决方案主要包括两种：一是对非法AP进行侦测定位，然后取缔或屏蔽所述AP；二是运营商判断运营商用户终端连接的AP的合法性然后通知该用户；然而，对于第一种方案，其直接目的并不是为了保护终端的信息安全而是自身网络安全，且实时性差，特别是对于动态随机部署的非法AP，在这些AP被发现前，终端可能早已被攻击了；对于第二种方案，通用性差，仅能保护某个运营商的用户的信息安全，且重要的是，由于用户终端已经连接上了AP，即便再发现该AP为非法AP，用户信息实际已处于危险中，而且实现成本也较高。
发明内容
有鉴于此，本发明实施例期望提供一种识别AP合法性的方法、终端、系统及存储介质，能够准确的识别非法AP，有效的维护终端的信息安全，增强用户体验感，且通用性强、实时性好、成本低。
为达到上述目的，本发明实施例的技术方案是这样实现的：
本发明实施例提供了一种识别无线接入点AP合法性的方法，所述方法 包括：
终端获取待连接AP的识别信息；
将所述识别信息与第一数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性。
上述方案中，所述识别信息包括：所述AP的服务集标识SSID、所述AP的介质访问控制MAC地址及所述AP的加密认证算法；
相应的，将所述识别信息与第一数据库中存储的识别信息进行匹配，包括：
将所述AP的SSID、MAC地址及加密认证算法分别与第一数据库中存储的SSID、MAC地址及加密认证算法进行匹配，当SSID、MAC地址及加密认证算法均匹配成功时，确定所述AP的识别信息与第一数据库中存储的识别信息匹配成功；否则，确定所述AP的识别信息与第一数据库中存储的识别信息匹配失败。
上述方案中，所述方法还包括：
确定识别信息匹配失败时，发送所述AP的合法性查询请求给服务器，并依据所述服务器返回的查询结果建立或拒绝建立与所述AP之间的连接。
上述方案中，所述查询结果包括：所述AP为未知AP的信息；
相应的，依据所述服务器返回的查询结果建立或拒绝建立与所述AP之间的连接之前，所述方法还包括：
生成并显示所述AP为未知AP的一级或二级警告。
上述方案中，所述查询结果包括：所述AP为未知AP的信息；
相应的，依据所述服务器返回的查询结果建立或拒绝建立与所述AP之间的连接之后，所述方法还包括：
为所述AP进行可信度评分，并将评分结果上报至所述服务器；所述评分结果用作服务器再次接收所述AP的合法性查询请求时，返回的查询结果 中的参考信息。
上述方案中，所述查询结果包括：所述AP的合法性信息；
相应的，所述方法还包括：记录所述AP的识别信息及所述AP的合法性信息至第一数据库并更新所述第一数据库。
上述方案中，所述AP的合法性查询请求中包括所述AP的识别信息；
所述识别信息，用于服务器将所述识别信息与第二数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性；匹配失败时，确定所述AP为未知AP；
相应的，发送所述AP的合法性查询请求给服务器之后，所述方法还包括：
所述服务器将所述识别信息与第二数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性；匹配失败时，确定所述AP为未知AP。
本发明实施例还提供了一种终端，所述终端包括：获取模块及匹配模块；其中，
所述获取模块，配置为获取待连接AP的识别信息；
所述匹配模块，配置为将所述识别信息与第一数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性。
上述方案中，所述识别信息包括：所述AP的SSID、所述AP的MAC地址及所述AP的加密认证算法；
相应的，所述匹配模块，配置为将所述AP的SSID、MAC地址及加密认证算法分别与第一数据库中存储的SSID、MAC地址及加密认证算法分别进行匹配，当SSID、MAC地址及加密认证算法均匹配成功时，确定所述AP的识别信息与第一数据库中存储的识别信息匹配成功；否则，确定所述AP的识别信息与第一数据库中存储的识别信息匹配失败。
上述方案中，所述匹配模块，还配置为确定识别信息匹配失败时，发送所述AP的合法性查询请求给服务器；
相应的，所述终端还包括第一控制模块，配置为依据所述服务器返回的查询结果建立或拒绝建立与所述AP之间的连接。
上述方案中，所述查询结果包括：所述AP为未知AP的信息；
相应的，所述终端还包括警告模块，配置为生成并显示所述AP为未知AP的一级或二级警告。
上述方案中，所述查询结果包括：所述AP为未知AP的信息；
相应的，所述终端还包括评分模块，配置为为所述AP进行可信度评分，并将评分结果上报至所述服务器；所述评分结果用作服务器再次接收所述AP的合法性查询请求时，返回的查询结果中的参考信息。
上述方案中，所述查询结果包括：所述AP的合法性信息；
相应的，所述终端还包括更新模块，配置为记录所述AP的识别信息及所述AP的合法性信息至第一数据库并更新所述第一数据库。
本发明实施例还提供了一种识别AP合法性的系统，所述系统包括：终端及服务器；其中，
所述终端，配置为获取待连接AP的识别信息，将所述识别信息与第一数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性；匹配失败时，发送所述AP的合法性查询请求给服务器；
所述服务器，配置为接收所述AP的合法性查询请求，并返回查询结果给所述终端。
上述方案中，所述识别信息包括：所述AP的SSID、所述AP的MAC地址及所述AP的加密认证算法；
相应的，所述终端，配置为将所述AP的SSID、MAC地址及加密认证算法分别与第一数据库中存储的SSID、MAC地址及加密认证算法分别进 行匹配，当SSID、MAC地址及加密认证算法均匹配成功时，确定所述AP的识别信息与第一数据库中存储的识别信息匹配成功；否则，确定所述AP的识别信息与第一数据库中存储的识别信息匹配失败。
上述方案中，所述AP的合法性查询请求中包括所述AP的识别信息；
相应的，所述服务器，还配置为将所述识别信息与第二数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性；匹配失败时，确定所述AP为未知AP。
上述方案中，所述查询结果包括：所述AP为未知AP的信息；
相应的，所述终端，还配置为生成并显示所述AP为未知AP的一级或二级警告。
上述方案中，所述查询结果包括：所述AP为未知AP的信息；
相应的，所述终端，还配置为为所述AP进行可信度评分，并将评分结果上报至所述服务器；所述评分结果用作服务器再次接收所述AP的合法性查询请求时，返回的查询结果中的参考信息。
上述方案中，所述查询结果包括：所述AP的合法性信息；
相应的，所述终端，还配置为记录所述AP的识别信息及所述AP的合法性信息至第一数据库并更新所述第一数据库。
上述方案中，所述服务器，还配置为获取并记录AP的合法性信息及识别信息至第二数据库。
本发明实施例还提供了一种计算机存储介质，所述计算机存储介质存储有计算机程序，该计算机程序用于执行本发明实施例的上述识别AP合法性的方法。
本发明实施例所提供的识别AP合法性的方法、终端、系统及存储介质，终端获取待连接AP的识别信息；将所述识别信息与第一数据库中存储的识别信息进行匹配；匹配成功时，确定所述AP的合法性。如此，能够准确的 识别非法AP，有效的维护终端的信息安全，增强用户体验，且通用性强、实时性好、成本低。
附图说明
图1为本发明实施例一识别AP合法性的方法流程示意图；
图2为本发明实施例二识别AP合法性的方法流程示意图；
图3为本发明实施例三识别AP合法性的方法流程示意图；
图4为本发明实施例四识别AP合法性的方法流程示意图；
图5为本发明实施例终端的组成结构示意图；
图6为本发明实施例识别AP合法性的系统组成结构示意图。
具体实施方式
现有技术中的非法AP主要存在两种形态：1)、与合法AP具有相同的SSID及密码，使用户无威胁感知的仿冒AP；2)、无密码AP，供免费上网的AP；
第一种仿冒AP的工作模式主要是通过将仿冒AP的信号强度调高，超过合法AP信号强度，则新进入网络的终端设备会自动连接仿冒AP，对于已在正常连接中的终端设备，或者终端自己会自动断开当前连接的AP转而连接仿冒AP；或者攻击者主动攻击破坏该正常连接，使终端设备断开当前连接，转而连接仿冒AP；
第二种AP完全是钓鱼方式，或者说是守株待兔方式，是终端用户自动自愿搜索该仿冒AP并主动连接，该模式对安全意识薄弱的终端用户威胁最大。
在本发明实施例中，终端获取待连接AP的识别信息；将所述识别信息与第一数据库中存储的识别信息进行匹配；匹配成功时，确定所述AP的合法性；如此，能够准确的识别非法AP，有效的维护终端的信息安全。
实施例一
图1所示为本发明实施例一识别AP合法性的方法流程示意图，如图1所示，本发明实施例识别AP合法性的方法包括：
步骤101：终端获取待连接AP的识别信息；
本步骤之前，所述方法还包括：搜索并确定所述待连接AP；
这里，终端执行搜索并确定所述待连接AP的操作可以在终端未建立Wi-Fi连接的情况下自动执行的对AP的搜索及确定，也可以为在用户触发的情况下进行的对AP的搜索及确定，还可以是在终端已建立Wi-Fi连接的情况下被动的被当前连接的AP断开了连接而进行的对AP的搜索及确定，或者是在终端已建立Wi-Fi连接的情况下对更强信号的AP的搜索及确定。
在一实施例中，所述AP的识别信息包括：所述AP的服务集标识(SSID，Service Set Identifier)、所述AP的介质访问控制(MAC，Media Access Control)地址及所述AP的加密认证算法；
所述AP的识别信息还可以包括：所述AP的部署者信息、所述AP的部署位置等信息。
步骤102：将所述识别信息与第一数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性；
这里，当终端进行的识别信息的匹配成功时，则可依据所述第一数据库中存储的所述AP对应的合法性信息确定所述AP的合法性，即确定所述AP是否合法。
将所述识别信息与第一数据库中存储的识别信息进行匹配包括：
终端将所述AP的SSID、MAC地址及加密认证算法分别与第一数据库中存储的SSID、MAC地址及加密认证算法分别进行匹配，当SSID、MAC地址及加密认证算法均匹配成功时，确定所述AP的识别信息与第一数据库中存储的识别信息匹配成功；否则，确定所述AP的识别信息与第一数据库 中存储的识别信息匹配失败；
在一实施例中，终端将所述AP的SSID与第一数据库中存储的SSID进行匹配，SSID匹配失败时，确定识别信息匹配失败；SSID匹配成功时，将所述AP的MAC地址与匹配得到的SSID对应的MAC地址进行匹配，MAC地址匹配失败时，确定识别信息匹配失败；MAC地址匹配成功时，将所述AP的加密认证算法与匹配得到的MAC地址对应的加密认证算法进行匹配，加密认证算法匹配失败时，确定识别信息匹配失败；加密认证算法匹配成功时，确定识别信息匹配成功；
也就是说，终端对所述待连接AP依次进行SSID、MAC地址及加密认证算法的匹配，当SSID、MAC地址及加密认证算法均匹配成功时，才确定识别信息匹配成功，当SSID、MAC地址及加密认证算法任一匹配失败，均认为识别信息匹配失败。
在一实施例中，由于所述AP的识别信息还可包括：所述AP的部署者信息、所述AP的部署位置等可选信息，因此，当AP的识别信息包括所述可选信息时，所述可选信息可作为关键词信息，缩小上述匹配的范围，进而提高对AP的合法性的识别效率及准确率，但由于增加所述可选信息会增加识别成本，因此，所述AP的识别信息是否包括所述可选信息可依据实际需要进行设定。
在一实施例中，所述第一数据库中存储的AP的识别信息至少分为合法AP的识别信息及非法AP的识别信息两类；
相应的，将所述识别信息与第一数据库中存储的识别信息进行匹配包括：
将所述识别信息先与第一数据库中存储的合法AP的识别信息进行识别信息的匹配，再进行非法AP的识别信息进行识别信息的匹配，当合法AP的识别信息匹配成功时，不再进行非法AP识别信息的匹配；如此，可 以提高对AP的合法性的识别速度。
在一实施例中，所述方法还包括：确定识别信息匹配失败时，发送所述AP的合法性查询请求给服务器，并依据所述服务器返回的查询结果建立或拒绝建立与所述AP之间的连接；
这里，终端进行的识别信息匹配失败可能由于SSID匹配失败，即当前待连接的AP为未知AP，也可能由于MAC地址匹配失败，还可能由于加密认证算法匹配失败；当识别信息匹配失败的原因是由于加密认证算法匹配失败时，该AP为非法AP的可能性就非常高，需要寻求服务器的再次匹配确认，但也有可能是因为该AP的加密设置被修改。
所述AP的合法性查询请求中包括所述AP的识别信息；
相应的，发送所述AP的合法性查询请求给服务器之后，所述方法还包括：
所述服务器将所述识别信息与第二数据库中存储的识别信息进行识别信息匹配，识别信息匹配成功时，确定所述AP的合法性；识别信息匹配失败时，确定所述AP为未知AP；
其中，所述将所述识别信息与第二数据库中存储的识别信息进行识别信息匹配包括：
将所述AP的SSID、MAC地址及加密认证算法分别与第二数据库中存储的SSID、MAC地址及加密认证算法分别进行匹配，当SSID、MAC地址及加密认证算法均匹配成功时，确定所述AP的识别信息与第二数据库中存储的识别信息匹配成功；否则，确定所述AP的识别信息与第二数据库中存储的识别信息匹配失败；
在一实施例中，将所述AP的SSID与第二数据库中存储的SSID进行匹配，SSID匹配失败时，确定识别信息匹配失败；SSID匹配成功时，将所述AP的MAC地址与匹配得到的SSID对应的MAC地址进行匹配，MAC 地址匹配失败时，确定识别信息匹配失败；MAC地址匹配成功时，将所述AP的加密认证算法与匹配得到的MAC地址对应的加密认证算法进行匹配，加密认证算法匹配失败时，确定识别信息匹配失败；加密认证算法匹配成功时，确定识别信息匹配成功；
所述服务器可以为云端服务器；所述第二数据库中至少存储有合法AP的识别信息及非法AP的识别信息两类；
相应的，将所述识别信息与第二数据库中存储的识别信息进行匹配包括：将所述识别信息先与第二数据库中存储的合法AP的识别信息进行识别信息的匹配，再进行非法AP的识别信息进行识别信息的匹配，当合法AP的识别信息匹配成功时，不再进行非法AP识别信息的匹配；如此，可以提高对AP的合法性的识别速度。
在一实施例中，当终端进行的对所述AP的识别信息匹配失败，但用户确认该AP为该用户私用AP时，可由用户触发保存所述AP的识别信息及合法性至第一数据库；如此，避免了终端每次连接该AP时进行的识别信息的匹配过程及不必要的风险提醒，增强用户体验感。
在一实施例中，所述将所述识别信息与第二数据库中存储的识别信息进行匹配之前，所述方法还包括：
所述服务器获取并记录AP的合法性信息及识别信息至第二数据库；包括：所述服务器通过AP运营企业、组织或个人进行的对合法AP或非法AP的注册获取AP的识别信息，然后对所述AP的注册信息进行正确性确认，当确认了该AP的合法性时，将该AP的合法性信息及识别信息记录至第二数据库；当服务器不能确定该AP的合法性时，不进行对该AP相关信息的记录；
其中，对所述AP的注册信息进行正确性确认，可以通过技术手段和/或信任机制进行对所述AP的注册信息正确性的确认；
这里，通过技术手段进行对所述AP的注册信息正确性的确认包括：通过对所述AP进行验证测试，如与已知合法AP是否有冲突；或通过连接该AP进行网络操作并监测是否产生风险；或通过对用户提交的相关信息进行的分析判断等；
通过信任机制进行对所述AP的注册信息正确性的确认包括：通过对注册所述AP的用户的分析，如用户为某可信任的运营商，则认为其提供的信息为合法可信的。
在一实施例中，当服务器确定所述AP为未知AP时，所述服务器返回的查询结果中则包括所述AP为未知AP的信息；可以包括：所述AP为未知AP及所述AP识别信息匹配情况，如：SSID匹配失败/MAC地址匹配失败/加密认证算法匹配失败；
相应的，终端依据所述服务器返回的查询结果建立或拒绝建立与所述AP之间的连接之前，所述方法还包括：
生成并显示所述AP为未知AP的一级或二级警告；
这里，所述AP为未知AP的一级警告与二级警告可分别对应所述AP存在风险的不同程度，即所述未知AP为非法AP的可能性大小；如：当所述AP的加密认证算法匹配失败时，则认为该AP存在很大风险，终端则显示并生成所述AP为未知AP的一级警告；如此，可提醒用户勿轻易连接。
在一实施例中，当所述查询结果包括所述AP为未知AP的信息时，依据所述服务器返回的查询结果建立或拒绝建立与所述AP之间的连接之后，所述方法还包括：
终端为所述AP进行可信度评分，并将评分结果上报至所述服务器；
相应的，所述第二数据库还存储有未知AP的识别信息及相应的可信度评分；
这里，所述评分结果用作服务器再次接收所述AP的合法性查询请求 时，返回的查询结果中的参考信息；
所述评分结果用作服务器再次接收所述AP的合法性查询请求时，返回的查询结果中的参考信息，即当其他终端向服务器发送该AP的合法性查询请求时，服务器返给该终端的查询结果中包含对该AP的评分信息，以便作为用户是否连接该AP的参考依据。
在一实施例中，当服务器进行的对所述AP的识别信息匹配成功时，服务器返给所述终端的查询结果中包括所述AP的合法性信息；
相应的，所述方法还包括：记录所述AP的识别信息及所述AP的合法性信息至第一数据库并更新所述第一数据库；以便于终端再次连接所述AP时，自身完成对所述AP合法性的识别，提高了识别速度；
由于所述第一数据库存储空间的限制，可设置所述第一数据库存储的AP信息的数目，如可存储1000条AP信息；相应的，所述更新所述第一数据库包括：当所述第一数据库存储的AP信息条目达到上限时，用最新记录的所述AP的识别信息及所述AP的合法性信息替换记录时间最早的AP的相关信息，或用最新记录的所述AP的识别信息及所述AP的合法性信息替换最久未被使用的AP的相关信息。
在一实施例中，当终端进行的对所述AP的识别信息匹配失败，且无法建立与服务器的连接时，终端生成并显示所述AP为未知AP的一级或二级警告。
在一实施例中，所述确定所述AP的合法性之后，所述方法还包括：
终端依据确定的所述AP合法性建立或拒绝建立与所述AP之间的连接；包括：若确定所述AP为合法AP，则终端建立与所述AP之间的连接，若确定所述AP为非法AP，则终端拒绝建立与所述AP之间的连接。
实施例二
图2为本发明实施例二识别AP合法性的方法流程示意图；应用于终端 未建立Wi-Fi连接的场景下，如图2所示，本发明实施例识别AP合法性的方法包括：
步骤201：终端搜索并确定待连接AP；
这里，终端搜索并确定待连接的AP可以为终端自动执行的对可用AP的搜索及确定，也可以为在用户触发的情况下进行的对可用AP的搜索及确定。
步骤202：获取所述待连接AP的识别信息；
在本实施例中，所述AP的识别信息包括：所述AP的SSID、所述AP的MAC地址及所述AP的加密认证算法。
步骤203：将所述识别信息与第一数据库中存储的识别信息进行识别信息匹配；
本步骤包括：终端将所述AP的SSID与第一数据库中存储的SSID进行匹配，SSID匹配失败时，确定识别信息匹配失败；SSID匹配成功时，将所述AP的MAC地址与匹配得到的SSID对应的MAC地址进行匹配，MAC地址匹配失败时，确定识别信息匹配失败；MAC地址匹配成功时，将所述AP的加密认证算法与匹配得到的MAC地址对应的加密认证算法进行匹配，加密认证算法匹配失败时，确定识别信息匹配失败；加密认证算法匹配成功时，确定识别信息匹配成功；
在本实施例中，所述第一数据库中存储的AP的识别信息分为合法AP的识别信息及非法AP的识别信息两类；
相应的，将所述识别信息与第一数据库中存储的识别信息进行识别信息匹配包括：
将所述识别信息先与第一数据库中存储的合法AP的识别信息进行识别信息的匹配，再进行非法AP的识别信息进行识别信息的匹配，当合法AP的识别信息匹配成功时，不再进行非法AP识别信息的匹配。
在本实施例中，终端进行的识别信息的匹配，确定匹配成功。
步骤204：识别信息匹配成功，确定所述AP的合法性，并依据所所述AP的合法性建立或拒绝建立与所述AP的连接；
这里，当终端进行的识别信息的匹配成功时，则可依据所述第一数据库中存储的所述AP对应的合法性信息确定所述AP的合法性，即确定所述AP是否合法。
终端依据确定的所述AP合法性建立或拒绝建立与所述AP之间的连接；包括：若确定所述AP为合法AP，则终端建立与所述AP之间的连接，若确定所述AP为非法AP，则终端拒绝建立与所述AP之间的连接；在本实施例中，确定所述AP合法，即终端建立与所述AP之间的连接。
实施例三
图3为本发明实施例三识别AP合法性的方法流程示意图；应用于终端已建立Wi-Fi连接的场景下，如图3所示，本发明实施例识别AP合法性的方法包括：
步骤301：终端搜索并确定待连接AP；
这里，终端搜索并确定待连接的AP可以为终端被动的被当前连接的AP断开了连接而进行的对AP的搜索及确定，或者是终端对更强信号的AP的搜索及确定。
步骤302：获取所述待连接AP的识别信息；
在本实施例中，所述AP的识别信息包括：所述AP的SSID、所述AP的MAC地址及所述AP的加密认证算法。
步骤303：将所述识别信息与第一数据库中存储的识别信息进行识别信息匹配；
本步骤包括：终端将所述AP的SSID与第一数据库中存储的SSID进行匹配，SSID匹配失败时，确定识别信息匹配失败；SSID匹配成功时，将 所述AP的MAC地址与匹配得到的SSID对应的MAC地址进行匹配，MAC地址匹配失败时，确定识别信息匹配失败；MAC地址匹配成功时，将所述AP的加密认证算法与匹配得到的MAC地址对应的加密认证算法进行匹配，加密认证算法匹配失败时，确定识别信息匹配失败；加密认证算法匹配成功时，确定识别信息匹配成功；
在本实施例中，所述第一数据库中存储的AP的识别信息分为合法AP的识别信息及非法AP的识别信息两类；
相应的，将所述识别信息与第一数据库中存储的识别信息进行识别信息匹配包括：
将所述识别信息先与第一数据库中存储的合法AP的识别信息进行识别信息的匹配，再进行非法AP的识别信息进行识别信息的匹配，当合法AP的识别信息匹配成功时，不再进行非法AP识别信息的匹配。
在本实施例中，终端将所述AP的SSID与第一数据库中存储的SSID进行匹配，SSID匹配失败，即所述AP为未知AP。
步骤304：确定识别信息匹配失败，发送所述AP的合法性查询请求给服务器；
这里，所述AP的合法性查询请求中包括所述AP的识别信息。
步骤305：服务器将所述识别信息与第二数据库中存储的识别信息进行识别信息匹配；
本步骤之前，所述方法还包括：
所述服务器获取并记录AP的合法性信息及识别信息至第二数据库；包括：所述服务器通过AP运营企业、组织或个人进行的对合法AP或非法AP的注册获取AP的识别信息，然后对所述AP的注册信息进行正确性确认，当确认了该AP的合法性时，将该AP的合法性信息及识别信息记录至第二数据库；当服务器不能确定该AP的合法性时，不进行对该AP相关信 息的记录；
其中，对所述AP的注册信息进行正确性确认，可以通过技术手段和/或信任机制进行对所述AP的注册信息正确性的确认；
这里，通过技术手段进行对所述AP的注册信息正确性的确认包括：通过对所述AP进行验证测试，如与已知合法AP是否有冲突；或通过连接该AP进行网络操作并监测是否产生风险；或通过对用户提交的相关信息进行的分析判断等；
通过信任机制进行对所述AP的注册信息正确性的确认包括：通过对注册所述AP的用户的分析，如用户为某可信任的运营商，则认为其提供的信息为合法可信的。
在一实施例中，本步骤包括：服务器将所述AP的SSID与第二数据库中存储的SSID进行匹配，SSID匹配失败时，确定识别信息匹配失败；SSID匹配成功时，将所述AP的MAC地址与匹配得到的SSID对应的MAC地址进行匹配，MAC地址匹配失败时，确定识别信息匹配失败；MAC地址匹配成功时，将所述AP的加密认证算法与匹配得到的MAC地址对应的加密认证算法进行匹配，加密认证算法匹配失败时，确定识别信息匹配失败；加密认证算法匹配成功时，确定识别信息匹配成功；
在本实施例中，所述服务器为云端服务器；所述第二数据库中存储有合法AP的识别信息及非法AP的识别信息两类；
相应的，将所述识别信息与第二数据库中存储的识别信息进行识别信息匹配包括：将所述识别信息先与第二数据库中存储的合法AP的识别信息进行识别信息的匹配，再进行非法AP的识别信息进行识别信息的匹配，当合法AP的识别信息匹配成功时，不再进行非法AP识别信息的匹配；如此，可以提高对AP的合法性的识别速度。
在本发明实施例中，进行的识别信息的匹配，确定匹配成功。
步骤306：识别信息匹配成功，服务器确定所述AP的合法性，并返回包含所述AP合法性信息的查询结果给终端；
这里，当服务器进行的对所述AP的识别信息的匹配成功时，可依据第二数据库中存储的对应所述AP的识别信息的合法性信息确定所述AP是否合法。
步骤307：终端依据服务器返回的查询结果建立或拒绝建立与所述AP之间的连接；
本步骤包括：若确定所述AP为合法AP，则终端建立与所述AP之间的连接，若确定所述AP为非法AP，则终端拒绝建立与所述AP之间的连接；在本实施例中，确定所述AP为非法AP，即终端拒绝建立与所述AP之间的连接。
步骤308：终端记录所述AP的合法性信息及识别信息至第一数据库并更新所述第一数据库；
由于所述第一数据库存储空间的限制，可设置所述第一数据库存储的AP信息的数目，如可存储1000条AP信息；相应的，所述更新所述第一数据库包括：当所述第一数据库存储的AP信息条目达到上限时，用最新记录的所述AP的识别信息及所述AP的合法性信息替换记录时间最早的AP的相关信息，或用最新记录的所述AP的识别信息及所述AP的合法性信息替换最久未被使用的AP的相关信息。
实施例四
图4为本发明实施例四识别AP合法性的方法流程示意图；应用于终端已建立Wi-Fi连接的场景下，如图4所示，本发明实施例识别AP合法性的方法包括：
步骤401：终端搜索并确定待连接AP；
这里，终端搜索并确定待连接的AP可以为终端被动的被当前连接的 AP断开了连接而进行的对AP的搜索及确定，或者是终端对更强信号的AP的搜索及确定。
步骤402：获取所述待连接AP的识别信息；
在本实施例中，所述AP的识别信息包括：所述AP的SSID、所述AP的MAC地址及所述AP的加密认证算法。
步骤403：将所述识别信息与第一数据库中存储的识别信息进行识别信息匹配；
本步骤之前，所述方法还包括：
服务器获取并记录AP的合法性信息及识别信息至第二数据库；包括：所述服务器通过AP运营企业、组织或个人进行的对合法AP或非法AP的注册获取AP的识别信息，然后对所述AP的注册信息进行正确性确认，当确认了该AP的合法性时，将该AP的合法性信息及识别信息记录至第二数据库；当服务器不能确定该AP的合法性时，不进行对该AP相关信息的记录；
其中，对所述AP的注册信息进行正确性确认，可以通过技术手段和/或信任机制进行对所述AP的注册信息正确性的确认；
这里，通过技术手段进行对所述AP的注册信息正确性的确认包括：通过对所述AP进行验证测试，如与已知合法AP是否有冲突；或通过连接该AP进行网络操作并监测是否产生风险；或通过对用户提交的相关信息进行的分析判断等；
通过信任机制进行对所述AP的注册信息正确性的确认包括：通过对注册所述AP的用户信息的分析，如用户为某可信任的运营商，则认为其提供的信息为合法可信的。
本步骤包括：终端将所述AP的SSID与第一数据库中存储的SSID进行匹配，SSID匹配失败时，确定识别信息匹配失败；SSID匹配成功时，将 所述AP的MAC地址与匹配得到的SSID对应的MAC地址进行匹配，MAC地址匹配失败时，确定识别信息匹配失败；MAC地址匹配成功时，将所述AP的加密认证算法与匹配得到的MAC地址对应的加密认证算法进行匹配，加密认证算法匹配失败时，确定识别信息匹配失败；加密认证算法匹配成功时，确定识别信息匹配成功；
在本实施例中，所述第一数据库中存储的AP的识别信息分为合法AP的识别信息及非法AP的识别信息两类；
相应的，将所述识别信息与第一数据库中存储的识别信息进行识别信息匹配包括：
将所述识别信息先与第一数据库中存储的合法AP的识别信息进行识别信息的匹配，再进行非法AP的识别信息进行识别信息的匹配，当合法AP的识别信息匹配成功时，不再进行非法AP识别信息的匹配。
在本实施例中，终端将所述AP的MAC地址与第一数据库中存储的MAC地址进行匹配时，MAC地址匹配失败。
步骤404：确定识别信息匹配失败，发送所述AP的合法性查询请求给服务器；
这里，所述AP的合法性查询请求中包括所述AP的识别信息。
步骤405：服务器将所述识别信息与第二数据库中存储的识别信息进行识别信息匹配；
本步骤包括：服务器将所述AP的SSID与第二数据库中存储的SSID进行匹配，SSID匹配失败时，确定识别信息匹配失败；SSID匹配成功时，将所述AP的MAC地址与匹配得到的SSID对应的MAC地址进行匹配，MAC地址匹配失败时，确定识别信息匹配失败；MAC地址匹配成功时，将所述AP的加密认证算法与匹配得到的MAC地址对应的加密认证算法进行匹配，加密认证算法匹配失败时，确定识别信息匹配失败；加密认证算 法匹配成功时，确定识别信息匹配成功；
在本实施例中，所述服务器为云端服务器；所述第二数据库中存储有合法AP的识别信息及非法AP的识别信息两类；
相应的，将所述识别信息与第二数据库中存储的识别信息进行识别信息匹配包括：将所述识别信息先与第二数据库中存储的合法AP的识别信息进行识别信息的匹配，再进行非法AP的识别信息进行识别信息的匹配，当合法AP的识别信息匹配成功时，不再进行非法AP识别信息的匹配；如此，可以提高对AP的合法性的识别速度。
在本发明实施例中，服务器进行对所述AP的SSID与第二数据库中存储的SSID的匹配时，确定匹配失败，即确定所述AP为未知AP。
步骤406：识别信息匹配失败，服务器确定所述AP为未知AP，并返回包含所述AP为未知AP的信息的查询结果给终端；
这里，所述AP为未知AP的信息包括：所述AP为未知AP及所述AP识别信息匹配情况，如：SSID匹配失败/MAC地址匹配失败/加密认证算法匹配失败；
在本实施例中，所述查询结果中包括：所述AP为未知AP，对所述AP进行的MAC地址匹配失败。
步骤407：终端依据服务器返回的查询结果生成并显示所述AP为未知AP的二级警告；
这里，所述终端可依据服务器返回的查询结果生成并显示所述AP为未知AP的一级或二级警告；所述一级警告与二级警告可分别对应所述AP存在风险的不同程度；如：当所述AP的加密认证算法匹配失败时，则认为该AP存在很大风险，终端则显示并生成所述AP为未知AP的一级警告；当所述AP的SSID匹配失败/MAC地址匹配失败时，则生成并显示所述AP为未知AP的二级警告，以提示用户该AP存在一定风险。
步骤408：终端建立与所述AP之间的连接；
这里，终端建立与所述AP之间连接的操作由用户依据终端显示的二级警告触发。
步骤409：终端对所述AP进行可信度评分，并将评分结果上报至所述服务器存储；
在本发明实施例中，所述第二数据库还存储有未知AP的识别信息及相应的可信度评分；
所述评分结果用作服务器再次接收所述AP的合法性查询请求时，返回的查询结果中的参考信息；
所述评分结果用作服务器再次接收所述AP的合法性查询请求时，返回的查询结果中的参考信息，即当其他终端向服务器发送该AP的合法性查询请求时，服务器返给该终端的查询结果中包含对该AP的评分信息，以便作为用户是否连接该AP的参考依据。
实施例五
图5为本发明实施例终端的组成结构示意图；如图5所示，本发明实施例终端的组成结构包括：获取模块51及匹配模块52；其中，
所述获取模块51，配置为获取待连接AP的识别信息；
所述匹配模块52，配置为将所述识别信息与第一数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性。
在一实施例中，所述终端还包括：搜索模块53，配置为搜索并确定所述待连接AP。
在一实施例中，所述识别信息包括：所述AP的SSID、所述AP的MAC地址及所述AP的加密认证算法；
相应的，所述匹配模块52，配置为将所述AP的SSID、MAC地址及加密认证算法分别与第一数据库中存储的SSID、MAC地址及加密认证算 法分别进行匹配，当SSID、MAC地址及加密认证算法均匹配成功时，确定所述AP的识别信息与第一数据库中存储的识别信息匹配成功；否则，确定所述AP的识别信息与第一数据库中存储的识别信息匹配失败；
在一实施例中，所述匹配模块52，配置为将所述AP的SSID与第一数据库中存储的SSID进行匹配，SSID匹配失败时，确定识别信息匹配失败；SSID匹配成功时，将所述AP的MAC地址与匹配得到的SSID对应的AP的MAC地址进行匹配，MAC地址匹配失败时，确定识别信息匹配失败；MAC地址匹配成功时，将所述AP的加密认证算法与匹配得到的MAC地址对应的加密认证算法进行匹配，加密认证算法匹配失败时，确定识别信息匹配失败；加密认证算法匹配成功时，确定识别信息匹配成功。
在一实施例中，所述第一数据库中存储的AP的识别信息至少分为合法AP的识别信息及非法AP的识别信息两类；
相应的，所述匹配模块52将所述识别信息与第一数据库中存储的识别信息进行匹配包括：
所述匹配模块52将所述识别信息先与第一数据库中存储的合法AP的识别信息进行匹配，再进行非法AP的识别信息进行匹配，当合法AP的识别信息匹配成功时，不再进行非法AP识别信息的匹配；如此，可以提高对AP的合法性的识别速度。
在一实施例中，所述匹配模块52，还配置为确定识别信息匹配失败时，发送所述AP的合法性查询请求给服务器；以便所述服务器将所述识别信息与第二数据库中存储的识别信息进行识别信息匹配，识别信息匹配成功时，确定所述AP的合法性；识别信息匹配失败时，确定所述AP为未知AP；
所述AP的合法性查询请求中包括所述AP的识别信息；
相应的，所述终端还包括第一控制模块54，配置为依据所述服务器返回的查询结果建立或拒绝建立与所述AP之间的连接；
所述匹配模块52进行的识别信息匹配失败可能由于SSID匹配失败，即当前待连接的AP为未知AP，也可能由于MAC地址匹配失败，还可能由于加密认证算法匹配失败；当识别信息匹配失败的原因是由于加密认证算法匹配失败时，该AP为非法AP的可能性就非常高，需要寻求服务器的再次匹配确认，但也有可能是因为该AP的加密设置被修改；
这里，所述服务器可以为云端服务器；所述第二数据库中至少存储有合法AP的识别信息及非法AP的识别信息两类。
在一实施例中，所述查询结果包括：所述AP为未知AP的信息；可以包括：所述AP为未知AP及所述AP识别信息匹配情况，如：SSID匹配失败/MAC地址匹配失败/加密认证算法匹配失败；
相应的，所述终端还包括警告模块55，配置为生成并显示所述AP为未知AP的一级或二级警告；
这里，所述AP为未知AP的一级警告与二级警告可分别对应所述AP存在风险的不同程度；如：当所述AP的加密认证算法匹配失败时，则认为该AP存在很大风险，终端则显示并生成所述AP为未知AP的一级警告；如此，可提醒用户勿轻易连接。
在一实施例中，所述查询结果包括：所述AP为未知AP的信息；
相应的，所述终端还包括评分模块56，配置为为所述AP进行可信度评分，并将评分结果上报至所述服务器；所述评分结果用作服务器再次接收所述AP的合法性查询请求时，返回的查询结果中的参考信息。
在一实施例中，所述查询结果包括：所述AP的合法性信息；
相应的，所述终端还包括更新模块57，配置为记录所述AP的识别信息及所述AP的合法性信息至第一数据库并更新所述第一数据库。
在一实施例中，所述终端还包括第二控制模块58，配置为依据确定的所述AP合法性建立或拒绝建立与所述AP之间的连接；
第二控制模块58依据确定的所述AP合法性建立或拒绝建立与所述AP之间的连接包括：
第二控制模块58若确定所述AP为合法AP，则建立与所述AP之间的连接，若确定所述AP为非法AP，则终端拒绝建立与所述AP之间的连接。
在一实施例中，所述警告模块55，还配置为匹配模块52无法建立与服务器的连接时，生成并显示所述AP为未知AP的一级或二级警告。
实施例六
图6为本发明实施例识别AP合法性的系统组成结构示意图；如图6所示，本发明实施例识别AP合法性的系统组成包括：终端61及服务器62；其中，
所述终端61，配置为获取待连接AP的识别信息，将所述识别信息与第一数据库中存储的识别信息进行识别信息匹配，识别信息匹配成功时，确定所述AP的合法性；确定识别信息匹配失败时，发送所述AP的合法性查询请求给服务器；
所述服务器62，配置为接收所述AP的合法性查询请求，并返回查询结果给所述终端。
在一实施例中，所述终端61，还配置为搜索并确定所述待连接AP。
在一实施例中，所述识别信息包括：所述AP的SSID、所述AP的MAC地址及所述AP的加密认证算法；
相应的，所述终端61，配置为将所述AP的SSID、MAC地址及加密认证算法分别与第一数据库中存储的SSID、MAC地址及加密认证算法分别进行匹配，当SSID、MAC地址及加密认证算法均匹配成功时，确定所述AP的识别信息与第一数据库中存储的识别信息匹配成功；否则，确定所述AP的识别信息与第一数据库中存储的识别信息匹配失败；
在一实施例中，所述终端61，配置为将所述AP的SSID与第一数据库 中存储的SSID进行匹配，SSID匹配失败时，确定识别信息匹配失败；SSID匹配成功时，将所述AP的MAC地址与匹配得到的SSID对应的AP的MAC地址进行匹配，MAC地址匹配失败时，确定识别信息匹配失败；MAC地址匹配成功时，将所述AP的加密认证算法与匹配得到的MAC地址对应的AP的加密认证算法进行匹配，加密认证算法匹配失败时，确定识别信息匹配失败；加密认证算法匹配成功时，确定识别信息匹配成功。
在一实施例中，所述第一数据库中存储的AP的识别信息至少分为合法AP的识别信息及非法AP的识别信息两类；
相应的，所述终端61将所述识别信息与第一数据库中存储的识别信息进行识别信息匹配包括：
所述终端61将所述识别信息先与第一数据库中存储的合法AP的识别信息进行识别信息的匹配，再进行非法AP的识别信息进行识别信息的匹配，当合法AP的识别信息匹配成功时，不再进行非法AP识别信息的匹配；如此，可以提高对AP的合法性的识别速度。
在一实施例中，所述AP的合法性查询请求中包括所述AP的识别信息；
相应的，所述服务器62，还配置为将所述识别信息与第二数据库中存储的识别信息进行识别信息匹配，识别信息匹配成功时，确定所述AP的合法性；识别信息匹配失败时，确定所述AP为未知AP。
在一实施例中，所述服务器62将所述识别信息与第二数据库中存储的识别信息进行识别信息匹配包括：
所述服务器62将所述AP的SSID、MAC地址及加密认证算法分别与第二数据库中存储的SSID、MAC地址及加密认证算法分别进行匹配，当SSID、MAC地址及加密认证算法均匹配成功时，确定所述AP的识别信息与第二数据库中存储的识别信息匹配成功；否则，确定所述AP的识别信息与第二数据库中存储的识别信息匹配失败；
在一实施例中，所述服务器62将所述AP的SSID与第二数据库中存储的SSID进行匹配，SSID匹配失败时，确定识别信息匹配失败；SSID匹配成功时，将所述AP的MAC地址与匹配得到的SSID对应的MAC地址进行匹配，MAC地址匹配失败时，确定识别信息匹配失败；MAC地址匹配成功时，将所述AP的加密认证算法与匹配得到的MAC地址对应的加密认证算法进行匹配，加密认证算法匹配失败时，确定识别信息匹配失败；加密认证算法匹配成功时，确定识别信息匹配成功；
所述第二数据库中至少存储有合法AP的识别信息及非法AP的识别信息两类；
相应的，所述服务器62将所述识别信息与第二数据库中存储的识别信息进行匹配包括：
所述服务器62将所述识别信息先与第二数据库中存储的合法AP的识别信息进行识别信息的匹配，再进行非法AP的识别信息进行识别信息的匹配，当合法AP的识别信息匹配成功时，不再进行非法AP识别信息的匹配；如此，可以提高对AP的合法性的识别速度。
在一实施例中，所述查询结果包括：所述AP为未知AP的信息；
相应的，所述终端61，还配置为生成并显示所述AP为未知AP的一级或二级警告。
在一实施例中，所述查询结果包括：所述AP为未知AP的信息；
相应的，所述终端61，还配置为为所述AP进行可信度评分，并将评分结果上报至所述服务器62；
相应的，所述服务器62将所述未知AP的识别信息及可信度评分存储至第二数据库；
所述服务器62再次接收所述AP的合法性查询请求时，将所述评分结果作为返回的查询结果中的参考信息。
在一实施例中，所述查询结果包括：所述AP的合法性信息；
相应的，所述终端61，还配置为记录所述AP的识别信息及所述AP的合法性信息至第一数据库并更新所述第一数据库。
在一实施例中，所述终端61，还配置为依据确定的所述AP合法性建立或拒绝建立与所述AP之间的连接；或者，依据服务器返回的查询结果建立或拒绝建立与所述AP之间的连接。
在一实施例中，所述服务器62，还配置为获取并记录AP的合法性信息及识别信息至第二数据库；
这里，所述服务器62获取AP的合法性信息及识别信息包括：
所述服务器62通过AP运营企业、组织或个人进行的对合法AP或非法AP的注册获取AP的识别信息，然后对所述AP的注册信息进行正确性确认，当确认了该AP的合法性时，将该AP的合法性信息及识别信息记录至第二数据库；当服务器不能确定该AP的合法性时，不进行对该AP相关信息的记录；
其中，对所述AP的注册信息进行正确性确认，可以通过技术手段和/或信任机制进行对所述AP的注册信息正确性的确认；
这里，通过技术手段进行对所述AP的注册信息正确性的确认包括：通过对所述AP进行验证测试，如与已知合法AP是否有冲突；或通过连接该AP进行网络操作并监测是否产生风险；或通过对用户提交的相关信息进行的分析判断等；
通过信任机制进行对所述AP的注册信息正确性的确认包括：通过对注册所述AP的用户信息的分析，如用户为某可信任的运营商，则认为其提供的信息为合法可信的。
在一实施例中，所述服务器62，还配置为对第二数据库中存储的AP的信息进行维护和更新，如对AP加密认证算法的更新。对被停用的AP信 息的更新、对未知AP确定其合法性后的信息的更新等。
本发明实施例中提出的所述获取模块、匹配模块、搜索模块、第一控制模块、警告模块、评分模块、更新模块及第二控制模块均可以通过处理器来实现，当然也可通过具体的逻辑电路实现；在实际应用中，处理器可以为中央处理器(CPU)、微处理器(MPU)或现场可编程门阵列(FPGA)等。
本发明实施例中，如果以软件功能模块的形式实现上述识别AP合法性的方法，并作为独立的产品销售或使用时，也可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明实施例的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机、服务器、或者网络设备等)执行本发明各个实施例所述方法的全部或部分。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read Only Memory，ROM)、磁碟或者光盘等各种可以存储程序代码的介质。这样，本发明实施例不限制于任何特定的硬件和软件结合。
相应地，本发明实施例还提供一种计算机存储介质，该计算机存储介质中存储有计算机程序，该计算机程序用于执行本发明实施例的上述识别AP合法性的方法。
以上所述仅为本发明的较佳实施例而已，并非用于限定本发明的保护范围。

Claims (21)

  1. 一种识别无线接入点AP合法性的方法，所述方法包括：
    终端获取待连接AP的识别信息；
    将所述识别信息与第一数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性。
  2. 根据权利要求1所述方法，其中，所述识别信息包括：所述AP的服务集标识SSID、所述AP的介质访问控制MAC地址及所述AP的加密认证算法；
    相应的，将所述识别信息与第一数据库中存储的识别信息进行匹配，包括：
    将所述AP的SSID、MAC地址及加密认证算法分别与第一数据库中存储的SSID、MAC地址及加密认证算法进行匹配，当SSID、MAC地址及加密认证算法均匹配成功时，确定所述AP的识别信息与第一数据库中存储的识别信息匹配成功；否则，确定所述AP的识别信息与第一数据库中存储的识别信息匹配失败。
  3. 根据权利要求1或2所述方法，其中，所述方法还包括：
    确定识别信息匹配失败时，发送所述AP的合法性查询请求，并依据返回的查询结果建立或拒绝建立与所述AP之间的连接。
  4. 根据权利要求3所述方法，其中，所述查询结果包括：所述AP为未知AP的信息；
    相应的，依据返回的查询结果建立或拒绝建立与所述AP之间的连接之前，所述方法还包括：
    生成并显示所述AP为未知AP的一级或二级警告。
  5. 根据权利要求3所述方法，其中，所述查询结果包括：所述AP为未知AP的信息；
    相应的，依据返回的查询结果建立或拒绝建立与所述AP之间的连接之后，所述方法还包括：
    为所述AP进行可信度评分，并上报评分结果；所述评分结果用作再次发送所述AP的合法性查询请求时，返回的查询结果中的参考信息。
  6. 根据权利要求3所述方法，其中，所述查询结果包括：所述AP的合法性信息；
    相应的，所述方法还包括：记录所述AP的识别信息及所述AP的合法性信息至第一数据库并更新所述第一数据库。
  7. 根据权利要求4-6任一项所述方法，其中，所述AP的合法性查询请求中包括所述AP的识别信息；
    所述识别信息，用于服务器将所述识别信息与第二数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性；匹配失败时，确定所述AP为未知AP。
  8. 一种终端，所述终端包括：获取模块及匹配模块；其中，
    所述获取模块，配置为获取待连接AP的识别信息；
    所述匹配模块，配置为将所述识别信息与第一数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性。
  9. 根据权利要求8所述终端，其中，所述识别信息包括：所述AP的SSID、所述AP的MAC地址及所述AP的加密认证算法；
    相应的，所述匹配模块，配置为将所述AP的SSID、MAC地址及加密认证算法分别与第一数据库中存储的SSID、MAC地址及加密认证算法分别进行匹配，当SSID、MAC地址及加密认证算法均匹配成功时，确定所述AP的识别信息与第一数据库中存储的识别信息匹配成功；否则，确定所述AP的识别信息与第一数据库中存储的识别信息匹配失败。
  10. 根据权利要求8或9所述终端，其中，所述匹配模块，还配置为 确定识别信息匹配失败时，发送所述AP的合法性查询请求；
    相应的，所述终端还包括第一控制模块，配置为依据返回的查询结果建立或拒绝建立与所述AP之间的连接。
  11. 根据权利要求10所述终端，其中，所述查询结果包括：所述AP为未知AP的信息；
    相应的，所述终端还包括警告模块，配置为生成并显示所述AP为未知AP的一级或二级警告。
  12. 根据权利要求10所述终端，其中，所述查询结果包括：所述AP为未知AP的信息；
    相应的，所述终端还包括评分模块，配置为为所述AP进行可信度评分，并上报评分结果；所述评分结果用作再次发送所述AP的合法性查询请求时，返回的查询结果中的参考信息。
  13. 根据权利要求10所述终端，其中，所述查询结果包括：所述AP的合法性信息；
    相应的，所述终端还包括更新模块，配置为记录所述AP的识别信息及所述AP的合法性信息至第一数据库并更新所述第一数据库。
  14. 一种识别AP合法性的系统，所述系统包括：终端及服务器；其中，
    所述终端，配置为获取待连接AP的识别信息，将所述识别信息与第一数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性；匹配失败时，发送所述AP的合法性查询请求给服务器；
    所述服务器，配置为接收所述AP的合法性查询请求，并返回查询结果给所述终端。
  15. 根据权利要求14所述系统，其中，所述识别信息包括：所述AP的SSID、所述AP的MAC地址及所述AP的加密认证算法；
    相应的，所述终端，配置为将所述AP的SSID、MAC地址及加密认证 算法分别与第一数据库中存储的SSID、MAC地址及加密认证算法分别进行匹配，当SSID、MAC地址及加密认证算法均匹配成功时，确定所述AP的识别信息与第一数据库中存储的识别信息匹配成功；否则，确定所述AP的识别信息与第一数据库中存储的识别信息匹配失败。
  16. 根据权利要求14或15所述系统，其中，所述AP的合法性查询请求中包括所述AP的识别信息；
    相应的，所述服务器，还配置为将所述识别信息与第二数据库中存储的识别信息进行匹配，匹配成功时，确定所述AP的合法性；匹配失败时，确定所述AP为未知AP。
  17. 根据权利要求14或15所述系统，其中，所述查询结果包括：所述AP为未知AP的信息；
    相应的，所述终端，还配置为生成并显示所述AP为未知AP的一级或二级警告。
  18. 根据权利要求14或15所述系统，其中，所述查询结果包括：所述AP为未知AP的信息；
    相应的，所述终端，还配置为为所述AP进行可信度评分，并将评分结果上报至所述服务器；所述评分结果用作服务器再次接收所述AP的合法性查询请求时，返回的查询结果中的参考信息。
  19. 根据权利要求14或15所述系统，其中，所述查询结果包括：所述AP的合法性信息；
    相应的，所述终端，还配置为记录所述AP的识别信息及所述AP的合法性信息至第一数据库并更新所述第一数据库。
  20. 根据权利要求14或15所述系统，其中，所述服务器，还配置为获取并记录AP的合法性信息及识别信息至第二数据库。
  21. 一种计算机存储介质，所述计算机存储介质中存储有计算机可执 行指令，该计算机可执行指令用于执行权利要求1至7任一项所述的识别AP合法性的方法。
PCT/CN2015/084485 2015-04-20 2015-07-20 识别无线接入点合法性的方法、终端、系统及存储介质 WO2016169142A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510188697.4A CN106162649A (zh) 2015-04-20 2015-04-20 一种识别无线接入点合法性的方法、终端及系统
CN201510188697.4 2015-04-20

Publications (1)

Publication Number Publication Date
WO2016169142A1 true WO2016169142A1 (zh) 2016-10-27

Family

ID=57144385

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/084485 WO2016169142A1 (zh) 2015-04-20 2015-07-20 识别无线接入点合法性的方法、终端、系统及存储介质

Country Status (2)

Country Link
CN (1) CN106162649A (zh)
WO (1) WO2016169142A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109982413A (zh) * 2019-02-19 2019-07-05 北京三快在线科技有限公司 移动热点的识别方法、装置、电子设备和存储介质
CN111542083A (zh) * 2020-03-24 2020-08-14 浙江中烟工业有限责任公司 一种通过工业无线网空口采集和分析的方法
CN112512050A (zh) * 2020-11-06 2021-03-16 北京小米移动软件有限公司 终端防止攻击方法、装置及存储介质
CN113572773A (zh) * 2021-07-27 2021-10-29 迈普通信技术股份有限公司 一种接入设备及终端接入控制方法

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106572464B (zh) * 2016-11-16 2020-10-30 上海斐讯数据通信技术有限公司 无线局域网中非法ap监测方法及其抑制方法、监测ap
CN106878989B (zh) * 2016-12-23 2020-08-04 新华三技术有限公司 一种接入控制方法及装置
CN106714175B (zh) * 2016-12-30 2020-12-04 哈尔滨安天科技集团股份有限公司 一种防伪造wifi接入点的验证方法及系统
JP2019115021A (ja) * 2017-12-26 2019-07-11 トヨタ自動車株式会社 通信装置、通信装置の制御方法及びプログラム
WO2019228257A1 (zh) * 2018-06-01 2019-12-05 上海连尚网络科技有限公司 一种用于识别无线热点的类型的方法及其网络设备
CN110557800B (zh) * 2018-06-01 2020-09-01 上海连尚网络科技有限公司 一种用于识别无线热点的类型的方法及其网络设备
CN110881186B (zh) * 2019-11-22 2023-03-14 北京天融信网络安全技术有限公司 非法设备识别方法、装置、电子设备及可读存储介质
US11877154B2 (en) 2020-03-05 2024-01-16 Cisco Technology, Inc. Identifying trusted service set identifiers for wireless networks

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101442402A (zh) * 2007-11-20 2009-05-27 华为技术有限公司 认证接入点设备的方法、系统和装置
CN102075934A (zh) * 2009-11-19 2011-05-25 中国移动通信集团江苏有限公司 接入点监控器、监控非法接入点的方法及系统
CN102843682A (zh) * 2012-08-20 2012-12-26 中国联合网络通信集团有限公司 接入点认证方法、装置及系统
CN104113842A (zh) * 2014-07-31 2014-10-22 北京金山安全软件有限公司 识别伪无线网络接入点的方法、装置、服务器及移动终端

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101442402A (zh) * 2007-11-20 2009-05-27 华为技术有限公司 认证接入点设备的方法、系统和装置
CN102075934A (zh) * 2009-11-19 2011-05-25 中国移动通信集团江苏有限公司 接入点监控器、监控非法接入点的方法及系统
CN102843682A (zh) * 2012-08-20 2012-12-26 中国联合网络通信集团有限公司 接入点认证方法、装置及系统
CN104113842A (zh) * 2014-07-31 2014-10-22 北京金山安全软件有限公司 识别伪无线网络接入点的方法、装置、服务器及移动终端

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109982413A (zh) * 2019-02-19 2019-07-05 北京三快在线科技有限公司 移动热点的识别方法、装置、电子设备和存储介质
CN111542083A (zh) * 2020-03-24 2020-08-14 浙江中烟工业有限责任公司 一种通过工业无线网空口采集和分析的方法
CN111542083B (zh) * 2020-03-24 2023-10-20 浙江中烟工业有限责任公司 一种通过工业无线网空口采集和分析的方法
CN112512050A (zh) * 2020-11-06 2021-03-16 北京小米移动软件有限公司 终端防止攻击方法、装置及存储介质
CN113572773A (zh) * 2021-07-27 2021-10-29 迈普通信技术股份有限公司 一种接入设备及终端接入控制方法

Also Published As

Publication number Publication date
CN106162649A (zh) 2016-11-23

Similar Documents

Publication Publication Date Title
WO2016169142A1 (zh) 识别无线接入点合法性的方法、终端、系统及存储介质
US10135818B2 (en) User biological feature authentication method and system
US9912695B1 (en) Techniques for using a honeypot to protect a server
US10097546B2 (en) Authentication of a user device using traffic flow information
ES2804771T3 (es) Método y sistema para facilitar identificadores de terminal
US9961077B2 (en) System and method for biometric authentication with device attestation
CN107800678B (zh) 检测终端异常注册的方法及装置
US20190036951A1 (en) System and method for detecting rogue access point and user device and computer program for the same
US20180307832A1 (en) Information processing device, information processing method, and computer readable medium
TWI633775B (zh) 終端識別方法、機器識別碼註冊方法及相應系統、設備
US11316681B2 (en) User identity authentication method and device, readable storage medium and computer equipment
WO2019095856A1 (zh) 一种网络身份认证方法、系统及其使用的用户代理设备
US9571485B2 (en) Spatial and temporal verification of users and/or user devices
JP2013545411A (ja) ワイヤレス通信装置のフィンガープリントのための方法および装置
TW201405354A (zh) 識別用戶風險的方法和裝置
CN106792704B (zh) 一种检测钓鱼接入点的方法及装置
US11533614B1 (en) Systems and methods of multi-factor authentication utilizing a vehicle
JP2015225500A (ja) 認証用情報の窃取検知方法、認証用情報の窃取検知装置、及びプログラム
CN108306739B (zh) 一种用于检测用户身份信息的方法、服务器、计算机可读存储介质及计算机设备
CN105959294B (zh) 一种恶意域名鉴别方法及装置
CN110943840B (zh) 一种签名验证方法
CN113342892A (zh) 基于区块链节点集群的云安全数据处理方法及区块链系统
US10542434B2 (en) Evaluating as to whether or not a wireless terminal is authorized
CN111405548B (zh) 一种钓鱼wifi的检测方法及装置
CN107948140B (zh) 便携式设备的校验方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15889631

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15889631

Country of ref document: EP

Kind code of ref document: A1