WO2017008556A1

WO2017008556A1 - Authentication method and device for wireless access point and management platform

Info

Publication number: WO2017008556A1
Application number: PCT/CN2016/080767
Authority: WO
Inventors: 王意军
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-07-13
Filing date: 2016-04-29
Publication date: 2017-01-19
Also published as: CN106714156A

Abstract

The present invention relates to the field of wireless networks, and discloses an authentication method and device for a wireless access point and a management platform. The method comprises: generating, by a wireless access point, a first random challenge word; utilizing, by the wireless access point, a key stored by the wireless access point to encrypt an identifier number of the wireless access point and the first random challenge word, so as to obtain first key information; sending, by the wireless access point, to a management platform first authentication information comprising the identifier number of the wireless access point, the first random challenge word and the first key information; utilizing, by the management platform, a key corresponding to the wireless access point to verify the first authentication information, so as to obtain second key information; and if the management platform determines the first key information as corresponding to the second key information, then determining the wireless access point to be legitimate. The present application can ensure the legitimacy of a wireless access point and thus provide a more secure and reliable access for a device in a network.

Description

Method and device for wireless access point and management platform authentication

Technical field

This application relates to, but is not limited to, the field of wireless networks.

Background technique

The scale of wireless networks, the management methods of wireless access points are more and more, especially the evolution of current wireless networks. Many wireless access points access the management platform through the Internet. Based on the security problems of access devices, they have to Consider the authentication management between the wireless access point and the management platform.

In the wireless network management, in order to ensure the security of the device, when registering to the management platform, the wireless access point needs to determine the connection wireless access according to the MAC (Media Access Control) address of the device or the serial number of the device. The legality of the point is generally configured by pre-configuring the MAC address or serial number of the device on the network management platform.

However, in today's security field, rewriting MAC addresses and counterfeiting wireless access points are easy to implement. The identification of MAC addresses and serial numbers alone cannot guarantee the legitimacy of wireless access points. After the access point accesses the network management platform, data will be obtained from the network management platform, which will inevitably threaten the security of user information.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The present invention provides a method and device for authenticating a wireless access point and a management platform, which solves the problem of legality verification of an access point device and a network management platform, and provides a more secure and reliable access for devices in the network.

The embodiment of the invention provides a method for authenticating a wireless access point and a management platform, which is applied to the management platform side, and includes:

Receiving, by the wireless access point, the first authentication information, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information, where the first key information is For the office Obtaining, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a key stored by the wireless access point;

And verifying the first authentication information by using a key corresponding to the wireless access point to obtain second key information;

When it is determined that the first key information corresponds to the second key information, it is determined that the wireless access point is legal.

Optionally, after obtaining the second key information, the method further includes:

When it is determined that the first key information does not correspond to the second key information, it is determined that the wireless access point is illegal.

Optionally, after the determining that the wireless access point is legal, the method further includes:

Generating a second random challenge word;

Encrypting the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point to obtain third key information;

Sending second authentication information to the wireless access point, so that the wireless access point verifies the second authentication information by using a key stored by the wireless access point, the second The right information includes an identification number of the wireless access point, a second random challenge word, and third key information.

Optionally, the identifier of the wireless access point includes one or more of the following:

The media is involved in the control layer MAC address, serial number, unique identifier.

Optionally, verifying the first authentication information by using a key corresponding to the wireless access point includes:

Obtaining, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point by the wireless access point And performing a hash operation on the identifier of the wireless access point and the first random challenge word by using a shared key corresponding to the wireless access point, to obtain second decryption information;

Obtaining, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point by the wireless access point First hash value, and signing the first hash value with a private key stored by the wireless access point And obtaining, by using a public key corresponding to the wireless access point, decrypting the first key information to obtain a first decrypted hash value; and using a shared key corresponding to the wireless access point Hashing the identification number of the wireless access point and the first random challenge word to obtain a second hash value.

Optionally, encrypting the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point includes:

Hashing the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point; or

Hashing the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point to obtain a third hash value and storing the data by using the management platform The private key signs the third hash value.

Optionally, determining that the first key information corresponds to the second key information includes:

When the first key information is the same as the second decryption information, determining that the first key information corresponds to the second key information; or

When the first decrypted hash value is the same as the second hash value, it is determined that the first key information corresponds to the second key information.

The embodiment of the invention further provides a method for authenticating a wireless access point and a management platform, which is applied to a wireless access point side, and includes:

Generating a first random challenge word;

Encrypting the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point to obtain first key information;

Transmitting the first authentication information to the management platform, so that the management platform checks the first authentication information by using a key corresponding to the wireless access point, where the first authentication information includes the The identification number of the wireless access point, the first random challenge word, and the first key information.

Optionally, after the first authentication information is sent to the management platform, the method further includes:

Receiving, by the management platform, second authentication information, where the second authentication information includes an identifier of the wireless access point, a second random challenge word, and third key information, where the third key information is Description The management platform obtains the identifier of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point;

And verifying the second authentication information by using a key stored by the wireless access point to obtain fourth key information;

When it is determined that the third key information corresponds to the fourth key information, it is determined that the management platform is legal.

Optionally, after obtaining the fourth key information, the method further includes:

When it is determined that the third key information does not correspond to the fourth key information, it is determined that the management platform is illegal.

Optionally, encrypting the identifier of the wireless access point and the first random challenge word by using a key stored by the wireless access point includes:

Hashing the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point; or

Hashing the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point to obtain a first hash value, and storing by using the wireless access point The private key signs the first hash value.

Optionally, verifying the second authentication information by using a key stored by the wireless access point includes:

And obtaining, by the management platform, a hash operation of the identifier of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point by the management platform. And performing a hash operation on the identifier of the wireless access point and the second random challenge word by using a shared key stored by the wireless access point to obtain fourth decryption information;

When the third key information is used by the management platform to hash the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point, And obtaining the third hash value by using a private key stored by the management platform, and decrypting the third key information by using a public key corresponding to the management platform, Obtaining a second decrypted hash value; and hashing the identification number of the wireless access point and the second random challenge word by using a shared key stored by the wireless access point to obtain a fourth hash value.

Optionally, determining that the third key information corresponds to the fourth key information includes:

When the third key information is the same as the fourth decryption information, determining that the third key information corresponds to the fourth key information; or

When the second decrypted hash value is the same as the fourth hash value, it is determined that the third key information corresponds to the fourth key information.

The embodiment of the invention further provides a method for authenticating a wireless access point and a management platform, including:

The wireless access point generates a first random challenge word;

The wireless access point encrypts the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point to obtain first key information;

The wireless access point sends the first authentication information to the management platform, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information;

The management platform performs verification on the first authentication information by using a key corresponding to the wireless access point to obtain second key information;

When the management platform determines that the first key information corresponds to the second key information, it is determined that the wireless access point is legal.

Optionally, the method further includes:

When the management platform determines that the first key information does not correspond to the second key information, it is determined that the wireless access point is illegal.

The management platform generates a second random challenge word;

The management platform encrypts the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point to obtain third key information;

The management platform sends the second authentication information to the wireless access point; the second authentication information includes an identifier of the wireless access point, a second random challenge word, and third key information;

The wireless access point performs verification on the second authentication information by using a key stored by the wireless access point to obtain fourth key information;

When the wireless access point determines that the third key information corresponds to the fourth key information, it is determined that the management platform is legal.

Optionally, when the wireless access point determines that the third key information does not correspond to the fourth key information, it is determined that the management platform is illegal.

Optionally, the encrypting, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a key stored by the wireless access point, including:

Optionally, the verifying, by the management platform, the first authentication information by using a key corresponding to the wireless access point includes:

And performing a hash operation on the identifier of the wireless access point and the first random challenge word by using a shared key corresponding to the wireless access point to obtain second decryption information; or

Decrypting the first key information by using a public key corresponding to the wireless access point to obtain a first decrypted hash value; and using the shared key corresponding to the wireless access point to connect the wireless connection The identification number of the in point and the first random challenge word are hashed to obtain a second hash value.

Optionally, the managing platform encrypts the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point, including:

Optionally, the verifying, by the wireless access point, the second authentication information by using a key stored by the wireless access point includes:

And hashing the identification number of the wireless access point and the second random challenge word by using a shared key stored by the wireless access point to obtain fourth decryption information; or

Decrypting the third key information by using a public key corresponding to the management platform to obtain a second decrypted hash value; and using the shared key stored by the wireless access point to access the wireless access point The identification number and the second random challenge word are hashed to obtain a fourth hash value.

The embodiment of the invention further provides a wireless access point and a management platform authentication device, which are disposed on the management platform side, and includes:

The first receiving module is configured to: receive first authentication information sent by the wireless access point, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information. The first key information is obtained by the wireless access point encrypting the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point;

The first authentication module is configured to: perform verification on the first authentication information by using a key corresponding to the wireless access point, to obtain second key information;

The first determining module is configured to: when it is determined that the first key information corresponds to the second key information, determine that the wireless access point is legal.

Optionally, the first determining module is further configured to: when it is determined that the first key information does not correspond to the second key information, determine that the wireless access point is illegal.

Optionally, the device further includes:

a first generating module, configured to: generate a second random challenge word;

The first encryption module is configured to: encrypt the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point, to obtain third key information;

The first sending module is configured to: send second authentication information to the wireless access point, so that the wireless access point performs the second authentication information by using a key stored by the wireless access point. Verifying that the second authentication information includes an identification number of the wireless access point, a second random challenge word, and third key information.

Optionally, the first authentication module comprises a first dissolving unit and/or a first decrypting unit, wherein:

The first dissolving unit is configured to: when the first key information is an identifier number of the wireless access point shared by the wireless access point by using the shared key stored by the wireless access point, Obtaining, by using a shared key corresponding to the wireless access point, hashing the identification number of the wireless access point and the first random challenge word, and obtaining the first random challenge word. Second decryption information;

The first decryption unit is configured to: when the first key information is an identifier number of the wireless access point shared by the wireless access point by using the shared key stored by the wireless access point, The first random challenge word is hashed to obtain a first hash value, and the first hash value is obtained by using a private key stored by the wireless access point, and the wireless access point is utilized Decrypting the first key information by the corresponding public key to obtain a first decrypted hash value; and using the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the The first random challenge word performs a hash operation to obtain a second hash value.

Optionally, the first encryption module comprises a first hash unit and/or a first signature unit, wherein:

The first hashing unit is configured to: hash the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point; or

The first signature unit is configured to: perform a hash operation on the identifier of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point to obtain a third hash And signing the third hash value with a value and using a private key stored by the management platform.

Optionally, the first determining module includes a first direct corresponding unit and/or a first indirect corresponding unit, where:

The first direct correspondence unit is configured to: when the first key information and the second decryption information are the same, determine that the first key information corresponds to the second key information; or

The first indirect corresponding unit is configured to: when the first decrypted hash value and the second hash value are the same, determine that the first key information corresponds to the second key information.

The embodiment of the present invention further provides a wireless access point and a management platform authentication device, which are disposed on the wireless access point side, and includes:

a second generation module, configured to: generate a first random challenge word;

The second encryption module is configured to: encrypt the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point, to obtain first key information;

The second sending module is configured to: send the first authentication information to the management platform, so that the management platform performs verification on the first authentication information by using a key corresponding to the wireless access point, where The first authentication information includes an identification number of the wireless access point, a first random challenge word, and first key information.

Optionally, the device further includes:

The second receiving module is configured to: receive second authentication information sent by the management platform, where the second authentication information includes an identifier number, a second random challenge word, and a third key information of the wireless access point, where The third key information is obtained by the management platform encrypting the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point;

The second authentication module is configured to: perform verification on the second authentication information by using a key stored by the wireless access point, to obtain fourth key information;

The second determining module is configured to: when it is determined that the third key information corresponds to the fourth key information, determine that the management platform is legal.

Optionally, the second determining module is further configured to:

Optionally, the second encryption module comprises a second hash unit and/or a second signature unit, wherein:

The second hashing unit is configured to: hash the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point; or

The second signature unit is configured to perform a hash operation on the identifier of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point to obtain a first hash value. And signing the first hash value with a private key stored by the wireless access point.

Optionally, the second authentication module comprises a second dissolving unit and/or a second decrypting unit, wherein:

The second dissolving unit is configured to: when the third key information is the management platform, use the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the Obtaining, by using the shared key stored by the wireless access point, hashing the identification number of the wireless access point and the second random challenge word to obtain a fourth Decrypt information;

The second decryption unit is configured to: when the third key information is the management platform, use the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the The second random challenge word is hashed to obtain a third hash value, and the third hash value is obtained by using the private key stored by the management platform, and the public key pair corresponding to the management platform is utilized. Decrypting the third key information to obtain a second decrypted hash value; and performing, by using a shared key stored by the wireless access point, the identification number of the wireless access point and the second random challenge word The hash operation obtains a fourth hash value.

Optionally, the second determining module includes a second direct corresponding unit and/or a second indirect corresponding unit, where:

The second direct correspondence unit is configured to: when the third key information is the same as the fourth decryption information, determine that the third key information corresponds to the fourth key information; or

The second indirect corresponding unit is configured to: when the second decrypted hash value is the same as the fourth hash value, determine that the third key information corresponds to the fourth key information.

The authentication method and device provided by the embodiments of the present invention can verify the mutuality of the legality of the access point device and the network management platform, ensure the legality of the wireless access point, and provide more secure and reliable access for the devices in the network. .

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

1 is a flowchart of a method for authenticating a wireless access point and a management platform applied to a management platform side according to an embodiment of the present invention;

2 is a flowchart of a method for authenticating a wireless access point and a management platform applied to a wireless access point side according to an embodiment of the present invention;

3 is a flowchart of a method for authenticating a wireless access point and a management platform according to an embodiment of the present invention;

4 is a schematic structural diagram of a wireless access point and a management platform authentication device disposed on a management platform side according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a wireless access point and a management platform device disposed on a wireless access point side according to an embodiment of the present invention; FIG.

6 is a schematic diagram 1 of wireless access point encryption according to an embodiment of the present invention;

7 is a schematic diagram 2 of wireless access point encryption according to an embodiment of the present invention;

8 is a schematic diagram 1 of a management platform authentication according to an embodiment of the present invention;

9 is a schematic diagram 2 of a management platform authentication according to an embodiment of the present invention;

Figure 10 is a schematic diagram 1 of a management platform encryption according to an embodiment of the present invention;

11 is a schematic diagram 2 of a management platform encryption according to an embodiment of the present invention;

Figure 12 is a schematic diagram 1 of wireless access point authentication according to an embodiment of the present invention;

FIG. 13 is a schematic diagram 2 of wireless access point authentication according to an embodiment of the present invention; FIG.

14 is a flowchart of authentication of a wireless access point and a management platform according to Embodiment 1 of the present invention;

15 is a flowchart of authentication of a wireless access point and a management platform according to Embodiment 2 of the present invention.

Preferred embodiment of the invention

Embodiments of the present invention will be described below with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the various manners in the embodiments may be combined with each other without conflict.

As shown in FIG. 1 , an embodiment of the present invention provides a method for authenticating a wireless access point and a management platform, which is applied to a management platform side. When the management platform authenticates a wireless access point, the method includes:

S101. Receive first authentication information that is sent by the wireless access point, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information, where the first secret is The key information is obtained by the wireless access point encrypting the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point;

S102: Perform verification on the first authentication information by using a key corresponding to the wireless access point, to obtain second key information.

S103. When it is determined that the first key information corresponds to the second key information, determine that the wireless access point is legal.

S104. When it is determined that the first key information does not correspond to the second key information, determine that the wireless access point is illegal.

Preferably, when requesting the wireless access point to authenticate the management platform, the method includes:

S105. Generate a second random challenge word.

S106. Encrypt the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point to obtain third key information.

S107. Send second authentication information to the wireless access point, so that the wireless access point performs verification on the second authentication information by using a key stored by the wireless access point. The second authentication information includes an identification number of the wireless access point, a second random challenge word, and third key information.

The identifier of the wireless access point includes one or more of the following:

Step S102 includes:

Obtaining, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point by the wireless access point (As shown in FIG. 6), hashing the identification number of the wireless access point and the first random challenge word by using a shared key corresponding to the wireless access point (as shown in FIG. 8 Show) obtaining the second decrypted information;

Obtaining, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point by the wireless access point And obtaining, by using a private key stored by the wireless access point, the first hash value by using a private key stored by the wireless access point (as shown in FIG. 7 ), using a public corresponding to the wireless access point Decrypting the first key information to obtain a first decrypted hash value; and using an shared key corresponding to the wireless access point to identify an identifier of the wireless access point and the first random number The challenge word performs a hash operation to obtain a second hash value (as shown in Figure 9).

In the foregoing step S102, the management platform may determine, according to the protocol agreement, that the wireless access point obtains the encryption method of the first key information, and does not necessarily have to pass the judgment.

Step S106 includes:

Hashing the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point (as shown in FIG. 10); or

Hashing the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point to obtain a third hash value and storing the data by using the management platform The private key signs the third hash value (as shown in Figure 11).

Step S103 includes:

As shown in FIG. 2, an embodiment of the present invention provides a method for authenticating a wireless access point and a management platform, which is applied to a wireless access point side, and when the request management platform authenticates the wireless access point, the method includes:

S201. Generate a first random challenge word.

S202. Encrypt the identifier of the wireless access point and the first random challenge word by using a key stored by the wireless access point to obtain first key information.

S203. The first authentication information is sent to the management platform, so that the management platform checks the first authentication information by using a key corresponding to the wireless access point, where the first authentication information includes The identification number of the wireless access point, the first random challenge word, and the first key information.

Preferably, when the wireless access point authenticates the management platform, the method further includes:

S204: Receive second authentication information that is sent by the management platform, where the second authentication information includes an identifier of the wireless access point, a second random challenge word, and third key information, where the third key information is Obtaining, by the management platform, the identifier of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point;

S205. Verify the second authentication information by using a key stored by the wireless access point to obtain fourth key information.

S206. When it is determined that the third key information corresponds to the fourth key information, determine that the management platform is legal.

S207. When it is determined that the third key information does not correspond to the fourth key information, determine that the management platform is illegal.

Step S202 includes:

Omitting the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point (as shown in FIG. 6); or

Hashing the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point to obtain a first hash value, and storing by using the wireless access point The private key signs the first hash value (as shown in Figure 7).

Step S205 includes:

And obtaining, by the management platform, a hash operation of the identifier of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point by the management platform. (As shown in FIG. 10), the identification number of the wireless access point and the second random challenge word are hashed by using the shared key stored by the wireless access point (as shown in FIG. 12). Obtaining fourth decryption information;

When the third key information is used by the management platform to hash the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point, And obtaining the third hash value by using a private key stored by the management platform, as shown in FIG. 11 , by using a public key corresponding to the management platform Decrypting the third key information to obtain a second decrypted hash value; and hashing the identification number of the wireless access point and the second random challenge word by using a shared key stored by the wireless access point A fourth hash value is obtained (as shown in Figure 13).

Step S206 includes:

As shown in FIG. 3, an embodiment of the present invention provides a wireless access point and a management platform authentication method, where a wireless access point performs encryption by using a stored key, and requests the management platform to authenticate the wireless access point, including:

S301. The wireless access point generates a first random challenge word.

S302. The wireless access point encrypts the identifier of the wireless access point and the first random challenge word by using a key stored by the wireless access point to obtain first key information.

S303. The wireless access point sends the first authentication information to the management platform, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information.

S304. The management platform uses the key corresponding to the wireless access point to perform the first authentication. The information is verified to obtain the second key information;

S305. When the management platform determines that the first key information corresponds to the second key information, determine that the wireless access point is legal.

S306. When the management platform determines that the first key information does not correspond to the second key information, determine that the wireless access point is illegal.

If the wireless access point is legal, the key stored by the wireless access point is the same as or corresponds to the key corresponding to the wireless access point stored by the management platform, and the authentication may pass if the wireless access point It is illegal. For example, if the wireless access point is masquerading, the key stored by the wireless access point is different from or different from the key corresponding to the wireless access point stored by the management platform. At this time, the authentication cannot pass.

The management platform encrypts by using the key corresponding to the wireless access point, and requests the wireless access point to authenticate the management platform (if the authentication is not required, the following steps are not required), including:

S307. The management platform generates a second random challenge word.

S308. The management platform encrypts the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point to obtain third key information.

S309. The management platform sends second authentication information to the wireless access point. The second authentication information includes an identifier of the wireless access point, a second random challenge word, and third key information.

S310. The wireless access point performs verification on the second authentication information by using a key stored by the wireless access point to obtain fourth key information.

S311. When the wireless access point determines that the third key information corresponds to the fourth key information, determine that the management platform is legal.

S312. When the wireless access point determines that the third key information does not correspond to the fourth key information, determine that the management platform is illegal.

Similarly, if the management platform is legal, the key stored by the wireless access point is the same as or corresponds to the key corresponding to the wireless access point stored by the management platform, and the authentication may be passed if the management platform is If the authentication platform is spoofed, the key stored by the wireless access point is different from or different from the key corresponding to the wireless access point stored by the management platform. In this case, the authentication cannot pass.

Step S302 includes:

Step S304 includes:

And hashing the identification number of the wireless access point and the first random challenge word by using a shared key corresponding to the wireless access point (as shown in FIG. 8), to obtain second decryption information; or ,

Decrypting the first key information by using a public key corresponding to the wireless access point to obtain a first decrypted hash value; and using the shared key corresponding to the wireless access point to connect the wireless connection The identification number of the in point and the first random challenge word are hashed to obtain a second hash value (as shown in FIG. 9).

Step S305 includes:

Step S308 includes:

Step S310 includes:

Identifying the identification number and location of the wireless access point by using a shared key stored by the wireless access point The second random challenge word is hashed (as shown in FIG. 12) to obtain the fourth decrypted information; or,

Decrypting the third key information by using a public key corresponding to the management platform to obtain a second decrypted hash value; and using the shared key stored by the wireless access point to access the wireless access point The identification number and the second random challenge word are hashed to obtain a fourth hash value (as shown in FIG. 13).

Step S311 includes:

The shared key of each wireless access point is different from that of other wireless access points. The shared wireless access point and the legitimate management platform both store the shared key, and both parties use the shared key to authenticate the key information.

To prevent shared key compromise, you can further do cryptographic signatures (such as the RSA algorithm).

The wireless access point stores the signed private key and the public key corresponding to the management platform. The management platform stores the private key of the platform and the public key corresponding to the wireless access point, and the two parties use the corresponding public key or private key to perform key information. Authentication.

As shown in FIG. 4, the present invention further provides a wireless access point and management platform authentication device, which is disposed on the management platform side, and includes:

The first receiving module 401 is configured to: receive first authentication information sent by the wireless access point, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and a first key Information, the first key information is obtained by the wireless access point encrypting the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point;

The first authentication module 402 is configured to: perform verification on the first authentication information by using a key corresponding to the wireless access point, to obtain second key information;

The first determining module 403 is configured to: when determining the first key information and the second key When the information corresponds, it is determined that the wireless access point is legal.

The first determining module 403 is further configured to: when it is determined that the first key information does not correspond to the second key information, determine that the wireless access point is illegal.

The above device also includes:

The first generating module 404 is configured to: generate a second random challenge word;

The first encryption module 405 is configured to: encrypt the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point, to obtain third key information;

The first sending module 406 is configured to: send second authentication information to the wireless access point, so that the wireless access point uses the key stored by the wireless access point to the second authentication information. Performing verification, the second authentication information includes an identification number of the wireless access point, a second random challenge word, and third key information.

The first authentication module 402 includes a first dissolving unit 4021 and/or a first decrypting unit 4022:

The first dissolving unit 4021 is configured to: when the first key information is an identifier number of the wireless access point and the number of the wireless access point using a shared key stored by the wireless access point Obtaining a random challenge word by performing a hash operation, and hashing the identification number of the wireless access point and the first random challenge word by using a shared key corresponding to the wireless access point to obtain a first Second decryption information;

The first decrypting unit 4022 is configured to: when the first key information is an identifier number of the wireless access point and the number of the wireless access point using a shared key stored by the wireless access point And a random challenge word is obtained by performing a hash operation to obtain a first hash value, and signing the first hash value by using a private key stored by the wireless access point, and using the wireless access point The public key decrypts the first key information to obtain a first decrypted hash value; and uses the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the A random challenge word performs a hash operation to obtain a second hash value.

The first encryption module 405 includes a first hash unit 4051 and/or a first signature unit 4052, where:

The first hash unit 4051 is configured to: utilize a shared key corresponding to the wireless access point Hashing the identification number of the wireless access point and the second random challenge word; or

The first signature unit 4052 is configured to: hash the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point to obtain a third hash value. And signing the third hash value with a private key stored by the management platform.

The first determining module 403 includes a first direct corresponding unit 4031 and/or a first indirect corresponding unit 4032, where:

The first direct correspondence unit 4031 is configured to: when the first key information is the same as the second decryption information, determine that the first key information corresponds to the second key information; or

The first indirect corresponding unit 4032 is configured to: when the first decrypted hash value is the same as the second hash value, determine that the first key information corresponds to the second key information.

As shown in FIG. 5, an embodiment of the present invention further provides a wireless access point and a management platform authentication device, which are disposed on a wireless access point side, and includes:

The second generating module 501 is configured to: generate a first random challenge word;

The second encryption module 502 is configured to: encrypt the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point, to obtain first key information;

The second sending module 503 is configured to: send the first authentication information to the management platform, so that the management platform performs verification on the first authentication information by using a key corresponding to the wireless access point, where The first authentication information includes an identification number of the wireless access point, a first random challenge word, and first key information.

The above device also includes:

The second receiving module 504 is configured to: receive second authentication information sent by the management platform, where the second authentication information includes an identifier of the wireless access point, a second random challenge word, and third key information, where The third key information is obtained by the management platform encrypting the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point;

The second authentication module 505 is configured to: perform verification on the second authentication information by using a key stored by the wireless access point, to obtain fourth key information;

The second determining module 506 is configured to: when it is determined that the third key information corresponds to the fourth key information, determine that the management platform is legal.

The second determining module 506 is further configured to:

The second encryption module 502 includes a second hash unit 5021 and/or a second signature unit 5022:

The second hashing unit 5021 is configured to: hash the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point; or

The second signature unit 5022 is configured to: hash the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point to obtain a first hash value, And signing the first hash value with a private key stored by the wireless access point.

The second authentication module 505 includes a second dissolving unit 5051 and/or a second decrypting unit 5052, wherein:

The second dissolving unit 5051 is configured to: when the third key information is the management platform, use the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the second Obtaining, by using a shared key stored by the wireless access point, hashing the identification number of the wireless access point and the second random challenge word to obtain a fourth decryption. information;

The second decryption unit 5052 is configured to: when the third key information is the management platform, use the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the second The random challenge word is hashed to obtain a third hash value, and the third hash value is obtained by using the private key stored by the management platform, and the public key pair corresponding to the management platform is utilized. Deciphering the third key information to obtain a second decrypted hash value; and dispersing the identification number of the wireless access point and the second random challenge word by using a shared key stored by the wireless access point The column operation obtains a fourth hash value.

The second determining module 506 includes a second direct corresponding unit 5061 and/or a second indirect corresponding unit 5062, wherein:

The second direct correspondence unit 5061 is configured to: when the third key information is the same as the fourth decryption information, determine that the third key information corresponds to the fourth key information; or

The second indirect correspondence unit 5062 is configured to: when the second decrypted hash value is the same as the fourth hash value, determine that the third key information corresponds to the fourth key information.

Example 1

The shared key in the embodiment of the present invention refers to a shared key used for performing hash operations on a certain hash algorithm (such as SHA-256). As shown in Figure 14, the steps are as follows:

11. The wireless access point uses its own NodeID (the NodeID can be the MAC address, serial number, or other unique identifier of the wireless access point), and a randomly generated challenge word X, which is stored using the shared key. Hash operation, get the hash value A (see Figure 6);

12. When the wireless access point requests to connect to the management platform, the packet carries the NodeID, the challenge word, and the hash value A;

After receiving the connection request of the wireless access point, the management platform uses the shared key of the wireless access point to perform a hash algorithm on the received NodeID and the challenge word X to obtain a hash value AA (see FIG. 8). .

14. If A=AA, the management platform determines that the wireless access point is legal, otherwise it is illegal.

The following four steps are the authentication of the management platform by the wireless access point, which is a further function of the embodiment of the present invention. If you do not need this authentication, you do not need these four steps:

15. If it is determined that the wireless access point is legal, the management platform randomly generates a challenge word Y, and for receiving the NodeID, hashing is performed by using the shared key corresponding to the wireless access point to obtain a hash value B (see FIG. 10);

The management platform carries the NodeID, the challenge word, and the encrypted hash value B of the wireless access point in the response message sent to the wireless access point (see FIG. 10);

After receiving the response message, the wireless access point performs a hash operation on the received NodeID and the challenge word Y using the stored shared key to obtain a hash value BB;

18. If B=BB, the management platform is legal, otherwise it is illegal (see Figure 3).

Example 2

To prevent the shared key from being compromised, the hash value can be further cryptographically signed (such as the RSA algorithm). As shown in Figure 15, the steps are as follows:

21, the wireless access point with its own NodeID (NodeID can be the wireless access point's MAC address, serial number, or other unique identifier), and a randomly generated challenge word X, use the storage shared key to spread them Column operation, get the hash value A, use RSA signature of the private key stored by the wireless access point to obtain the RSA signature ciphertext AAA (see Figure 7);

22. When the wireless access point requests to connect to the management platform, the packet carries the NodeID, the challenge string, and the RSA signature ciphertext AAA;

After receiving the connection request of the wireless access point, the management platform uses the public key corresponding to the wireless access point to perform RSA decryption on the signature result AAA, obtains the original text of the RSA signature, and obtains the decrypted hash value AAAA, and then uses The wireless access point performs a hash operation on the NodeID and the challenge word X corresponding to the shared key to obtain a hash result AA (see FIG. 9);

24. The management platform compares the RSA signature decryption hash value AAAA with the calculated hash value AA result. If the agreement is consistent, the wireless access point is legal, otherwise it is illegal.

25. If it is determined that the wireless access point is legal, the management platform randomly generates a challenge word Y, and receives the NodeID, and uses the shared key corresponding to the wireless access point to perform a hash operation to obtain a hash value B;

26, using the private key stored by the management platform to perform RSA signature on the hash value B, and obtain the RSA signature ciphertext BBB (see FIG. 11), and carry the NodeID, challenge word and RSA signature of the wireless access point in the response message. Ciphertext BBB.

27. After receiving the response message, the wireless access point uses the public key corresponding to the pre-stored management platform to perform RSA decryption on the received signature result BBB, and obtains the original text of the RSA signature, and obtains the decrypted hash value BBBB. Hashing the BB with the NodeID and the challenge word using the shared key stored by the wireless access point (see Figure 13);

28. The wireless access point compares the RSA signature decryption hash value BBBB with the calculated hash value BB. If the two results are consistent, the management platform is legal, otherwise illegal.

One of ordinary skill in the art will appreciate that all or a portion of the steps of the above-described embodiments can be implemented using a computer program flow, which can be stored in a computer readable storage medium, such as on a corresponding hardware platform (eg, The system, device, device, device, etc. are executed, and when executed, include one or a combination of the steps of the method embodiments.

Alternatively, all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.

The devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.

When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium. The above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Industrial applicability

The authentication method and device provided by the embodiments of the present invention can verify the mutual legality of the access point device and the network management platform, ensure the legality of the wireless access point, and provide a more secure and reliable connection for the devices in the network. In.

Claims

A wireless access point and management platform authentication method is applied to the management platform side, wherein:

Receiving, by the wireless access point, the first authentication information, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information, where the first key information is Obtaining, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a key stored by the wireless access point;

And verifying the first authentication information by using a key corresponding to the wireless access point to obtain second key information;

When it is determined that the first key information corresponds to the second key information, it is determined that the wireless access point is legal.
The method of claim 1 wherein after obtaining the second key information further comprises:

When it is determined that the first key information does not correspond to the second key information, it is determined that the wireless access point is illegal.
The method of claim 1, wherein: after the determining that the wireless access point is legal, the method further comprises:

Generating a second random challenge word;

Encrypting the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point to obtain third key information;

Sending second authentication information to the wireless access point, so that the wireless access point verifies the second authentication information by using a key stored by the wireless access point, the second The right information includes an identification number of the wireless access point, a second random challenge word, and third key information.
The method of claim 1 wherein the identification number of the wireless access point comprises one or more of the following:

The media is involved in the control layer MAC address, serial number, unique identifier.
The method of any of claims 1-4, wherein: utilizing the wireless access point The verifying the first authentication information by the corresponding key includes:

Obtaining, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point by the wireless access point And performing a hash operation on the identifier of the wireless access point and the first random challenge word by using a shared key corresponding to the wireless access point, to obtain second decryption information;

Obtaining, by the wireless access point, the identifier of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point by the wireless access point And obtaining, by the first hash value, the first hash value by using a private key stored by the wireless access point, using the public key corresponding to the wireless access point to the first secret Decrypting the key information to obtain a first decrypted hash value; and hashing the identification number of the wireless access point and the first random challenge word by using a shared key corresponding to the wireless access point The second hash value.
The method of claim 3, wherein encrypting the identification number of the wireless access point and the second random challenge word with a key corresponding to the wireless access point comprises:

Hashing the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point; or

Hashing the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point to obtain a third hash value and storing the data by using the management platform The private key signs the third hash value.
The method of claim 5, wherein determining that the first key information corresponds to the second key information comprises:

When the first key information is the same as the second decryption information, determining that the first key information corresponds to the second key information; or

When the first decrypted hash value is the same as the second hash value, it is determined that the first key information corresponds to the second key information.
A wireless access point and management platform authentication method is applied to a wireless access point side, wherein:

Generating a first random challenge word;

Identifying an identification number of the wireless access point and the number by using a key stored by the wireless access point Encrypting a random challenge word to obtain the first key information;

Transmitting the first authentication information to the management platform, so that the management platform checks the first authentication information by using a key corresponding to the wireless access point, where the first authentication information includes the The identification number of the wireless access point, the first random challenge word, and the first key information.
The method of claim 8, wherein after the sending the first authentication information to the management platform, the method further comprises:

Receiving, by the management platform, second authentication information, where the second authentication information includes an identifier of the wireless access point, a second random challenge word, and third key information, where the third key information is The management platform obtains the identifier of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point;

And verifying the second authentication information by using a key stored by the wireless access point to obtain fourth key information;

When it is determined that the third key information corresponds to the fourth key information, it is determined that the management platform is legal.
The method of claim 9, wherein after obtaining the fourth key information, the method further comprises:

When it is determined that the third key information does not correspond to the fourth key information, it is determined that the management platform is illegal.
The method of claim 8 wherein: the identification number of the wireless access point comprises one or more of the following:

The media is involved in the control layer MAC address, serial number, unique identifier.
The method of claim 8 wherein: encrypting the identification number of the wireless access point and the first random challenge word using a key stored by the wireless access point comprises:

Hashing the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point; or

Hashing the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point to obtain a first hash value, and storing by using the wireless access point The private key signs the first hash value.
The method of claim 9 wherein: verifying said second authentication information using a key stored by said wireless access point comprises:

And obtaining, by the management platform, a hash operation of the identifier of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point by the management platform. And performing a hash operation on the identifier of the wireless access point and the second random challenge word by using a shared key stored by the wireless access point to obtain fourth decryption information;

When the third key information is used by the management platform to hash the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point, And obtaining the third hash value by using a private key stored by the management platform, and decrypting the third key information by using a public key corresponding to the management platform, Obtaining a second decrypted hash value; and hashing the identification number of the wireless access point and the second random challenge word by using a shared key stored by the wireless access point to obtain a fourth hash value.
The method of claim 13, wherein: determining that the third key information corresponds to the fourth key information comprises:

When the third key information is the same as the fourth decryption information, determining that the third key information corresponds to the fourth key information; or

When the second decrypted hash value is the same as the fourth hash value, it is determined that the third key information corresponds to the fourth key information.
A wireless access point and management platform authentication method, including:

The wireless access point generates a first random challenge word;

The wireless access point encrypts the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point to obtain first key information;

The wireless access point sends the first authentication information to the management platform, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information;

The management platform performs verification on the first authentication information by using a key corresponding to the wireless access point to obtain second key information;

When the management platform determines that the first key information corresponds to the second key information, it is determined that the wireless access point is legal.
The method of claim 15 further comprising:

When the management platform determines that the first key information does not correspond to the second key information, it is determined that the wireless access point is illegal.
The method of claim 15, wherein: after the determining that the wireless access point is legal, the method further comprises:

The management platform generates a second random challenge word;

The management platform encrypts the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point to obtain third key information;

The management platform sends the second authentication information to the wireless access point; the second authentication information includes an identifier of the wireless access point, a second random challenge word, and third key information;

The wireless access point performs verification on the second authentication information by using a key stored by the wireless access point to obtain fourth key information;

When the wireless access point determines that the third key information corresponds to the fourth key information, it is determined that the management platform is legal.
The method of claim 17, wherein: when the wireless access point determines that the third key information does not correspond to the fourth key information, it is determined that the management platform is illegal.
The method of claim 15, wherein: the wireless access point encrypting the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point comprises:

Hashing the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point; or

Hashing the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point to obtain a first hash value, and storing by using the wireless access point The private key signs the first hash value.
The method of claim 19, wherein the verifying, by the management platform, the first authentication information by using a key corresponding to the wireless access point comprises:

Identifying an identification number of the wireless access point with a shared key corresponding to the wireless access point Performing a hash operation on the first random challenge word to obtain second decryption information; or

Decrypting the first key information by using a public key corresponding to the wireless access point to obtain a first decrypted hash value; and using the shared key corresponding to the wireless access point to connect the wireless connection The identification number of the in point and the first random challenge word are hashed to obtain a second hash value.
The method of claim 20, wherein: determining that the first key information corresponds to the second key information comprises:

When the first key information is the same as the second decryption information, determining that the first key information corresponds to the second key information; or

When the first decrypted hash value is the same as the second hash value, it is determined that the first key information corresponds to the second key information.
The method of claim 17, wherein: the managing platform encrypting the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point comprises:

Hashing the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point; or

Hashing the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point to obtain a third hash value and storing the data by using the management platform The private key signs the third hash value.
The method of claim 22, wherein the verifying, by the wireless access point, the second authentication information by using a key stored by the wireless access point comprises:

And hashing the identification number of the wireless access point and the second random challenge word by using a shared key stored by the wireless access point to obtain fourth decryption information; or

Decrypting the third key information by using a public key corresponding to the management platform to obtain a second decrypted hash value; and using the shared key stored by the wireless access point to access the wireless access point The identification number and the second random challenge word are hashed to obtain a fourth hash value.
The method of claim 23, wherein: determining that the third key information corresponds to the fourth key information comprises:

Determining the third key letter when the third key information is the same as the fourth decryption information Corresponding to the fourth key information; or

When the second decrypted hash value is the same as the fourth hash value, it is determined that the third key information corresponds to the fourth key information.
A wireless access point and management platform authentication device is disposed on the management platform side, and includes:

The first receiving module is configured to: receive first authentication information sent by the wireless access point, where the first authentication information includes an identifier of the wireless access point, a first random challenge word, and first key information. The first key information is obtained by the wireless access point encrypting the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point;

The first authentication module is configured to: perform verification on the first authentication information by using a key corresponding to the wireless access point, to obtain second key information;

The first determining module is configured to: when it is determined that the first key information corresponds to the second key information, determine that the wireless access point is legal.
The device of claim 25, wherein: the first determining module is further configured to: when determining that the first key information does not correspond to the second key information, determine the wireless access point illegal.
The apparatus of claim 25, further comprising:

a first generating module, configured to: generate a second random challenge word;

The first encryption module is configured to: encrypt the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point, to obtain third key information;

The first sending module is configured to: send second authentication information to the wireless access point, so that the wireless access point performs the second authentication information by using a key stored by the wireless access point. Verifying that the second authentication information includes an identification number of the wireless access point, a second random challenge word, and third key information.
The apparatus of claim 25 wherein: said first authentication module comprises a first dissolving unit and/or a first decrypting unit, wherein:

The first dissolving unit is configured to: when the first key information is an identifier number of the wireless access point shared by the wireless access point by using the shared key stored by the wireless access point, the first If the random challenge word is obtained by performing a hash operation, the identifier of the wireless access point and the first random challenge word are hashed by using a shared key corresponding to the wireless access point to obtain a second Decrypt information;

The first decryption unit is configured to: when the first key information is an identifier number of the wireless access point shared by the wireless access point by using the shared key stored by the wireless access point, The first random challenge word is hashed to obtain a first hash value, and the first hash value is obtained by using a private key stored by the wireless access point, and the wireless access point is utilized Decrypting the first key information by the corresponding public key to obtain a first decrypted hash value; and using the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the The first random challenge word performs a hash operation to obtain a second hash value.
The apparatus of claim 27, wherein the first encryption module comprises a first hash unit and/or a first signature unit, wherein:

The first hashing unit is configured to: hash the identification number of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point; or

The first signature unit is configured to: perform a hash operation on the identifier of the wireless access point and the second random challenge word by using a shared key corresponding to the wireless access point to obtain a third hash And signing the third hash value with a value and using a private key stored by the management platform.
The apparatus of claim 29, wherein the first determining module comprises a first direct corresponding unit and/or a first indirect corresponding unit, wherein:

The first direct correspondence unit is configured to: when the first key information and the second decryption information are the same, determine that the first key information corresponds to the second key information; or

The first indirect corresponding unit is configured to: when the first decrypted hash value and the second hash value are the same, determine that the first key information corresponds to the second key information.
A wireless access point and management platform authentication device is disposed on the wireless access point side, and includes:

a second generation module, configured to: generate a first random challenge word;

The second encryption module is configured to: encrypt the identification number of the wireless access point and the first random challenge word by using a key stored by the wireless access point, to obtain first key information;

The second sending module is configured to: send the first authentication information to the management platform, so that the management platform performs verification on the first authentication information by using a key corresponding to the wireless access point, where The first authentication information includes an identification number of the wireless access point, a first random challenge word, and first key information.
The apparatus of claim 31, further comprising:

The second receiving module is configured to: receive second authentication information sent by the management platform, where the second authentication information includes an identifier number, a second random challenge word, and a third key information of the wireless access point, where The third key information is obtained by the management platform encrypting the identification number of the wireless access point and the second random challenge word by using a key corresponding to the wireless access point;

The second authentication module is configured to: perform verification on the second authentication information by using a key stored by the wireless access point, to obtain fourth key information;

The second determining module is configured to: when it is determined that the third key information corresponds to the fourth key information, determine that the management platform is legal.
The apparatus of claim 32, wherein the second determining module is further configured to:

When it is determined that the third key information does not correspond to the fourth key information, it is determined that the management platform is illegal.
The apparatus of claim 31 wherein: said second encryption module comprises a second hash unit and/or a second signature unit, wherein:

The second hashing unit is configured to: hash the identification number of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point; or

The second signature unit is configured to perform a hash operation on the identifier of the wireless access point and the first random challenge word by using a shared key stored by the wireless access point to obtain a first hash value. And signing the first hash value with a private key stored by the wireless access point.
The apparatus of claim 32 wherein: said second authentication module comprises a second dissolving unit and/or a second decrypting unit, wherein:

The second dissolving unit is configured to: when the third key information is the management platform, use the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the If the two random challenge words are obtained by a hash operation, the shared key pair stored by the wireless access point is utilized. The identification number of the wireless access point and the second random challenge word are hashed to obtain fourth decryption information;

The second decryption unit is configured to: when the third key information is the management platform, use the shared key corresponding to the wireless access point to identify the identification number of the wireless access point and the The second random challenge word is hashed to obtain a third hash value, and the third hash value is obtained by using the private key stored by the management platform, and the public key pair corresponding to the management platform is utilized. Decrypting the third key information to obtain a second decrypted hash value; and performing, by using a shared key stored by the wireless access point, the identification number of the wireless access point and the second random challenge word The hash operation obtains a fourth hash value.
The apparatus of claim 35, wherein: said second determining module comprises a second direct corresponding unit and/or a second indirect corresponding unit, wherein:

The second direct correspondence unit is configured to: when the third key information is the same as the fourth decryption information, determine that the third key information corresponds to the fourth key information; or

The second indirect corresponding unit is configured to: when the second decrypted hash value is the same as the fourth hash value, determine that the third key information corresponds to the fourth key information.