WO2017031674A1 - 一种安全认证方法、配置方法以及相关设备 - Google Patents

一种安全认证方法、配置方法以及相关设备 Download PDF

Info

Publication number
WO2017031674A1
WO2017031674A1 PCT/CN2015/087967 CN2015087967W WO2017031674A1 WO 2017031674 A1 WO2017031674 A1 WO 2017031674A1 CN 2015087967 W CN2015087967 W CN 2015087967W WO 2017031674 A1 WO2017031674 A1 WO 2017031674A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
type information
information
signature
configuration device
Prior art date
Application number
PCT/CN2015/087967
Other languages
English (en)
French (fr)
Inventor
庞高昆
方平
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21185469.0A priority Critical patent/EP3982590B1/en
Priority to CN201580030204.2A priority patent/CN106464690B/zh
Priority to US15/751,864 priority patent/US11343104B2/en
Priority to KR1020187004702A priority patent/KR102062162B1/ko
Priority to CN202010206792.3A priority patent/CN111465014B/zh
Priority to JP2018510429A priority patent/JP6727292B2/ja
Priority to EP20151329.8A priority patent/EP3700124B1/en
Priority to EP15901945.4A priority patent/EP3334084B1/en
Priority to PCT/CN2015/087967 priority patent/WO2017031674A1/zh
Priority to ES15901945T priority patent/ES2835873T3/es
Priority to KR1020197038514A priority patent/KR102210897B1/ko
Publication of WO2017031674A1 publication Critical patent/WO2017031674A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup

Definitions

  • the present invention relates to the field of network communications, and in particular, to a security authentication method, a configuration method, and related devices.
  • the configuration device can configure the first terminal to be configured, so that the first terminal to be configured can receive the encrypted configuration information sent by the configuration device, and the first terminal that receives the configuration information wishes to Establishing a secure connection with the second terminal, the first terminal forwarding the configuration information to the second terminal, where the second terminal is capable of verifying the configuration information, and if the verification is passed, the first
  • the terminal and the second terminal are capable of establishing a secure connection.
  • the first terminal may be an access point (AP)
  • the second terminal may be a station (Station, referred to as STA).
  • the AP can send the configuration information sent by the configuration device to the STA, and the STA verifies the configuration information.
  • the STA can access the AP, and, for example, in the peer-to-peer network P2P network.
  • the first terminal may be a group owner referred to as a GO device
  • a GO device may be a central node of a P2P network
  • a second terminal may be a P2P device, where the GO device can send configuration information sent by the configuration device to a P2P device, P2P
  • the device verifies the configuration information, if the verification is passed, the P2P device can access the GO device;
  • the deficiencies in the prior art are that, in the case of a wireless local area network, if the attack terminal receives the configuration information sent by the configuration device, the attack terminal can change its role, thereby enabling the attack terminal to spoof the AP device.
  • the attack terminal sets its own information to the service set identifier (SSID) of the AP.
  • SSID service set identifier
  • the attack terminal will send configuration information received from the configuration device to the STA, and the STA according to the configuration information.
  • the STA cannot identify that the attacking terminal is a fake AP.
  • the attacking terminal After the attacking terminal establishes a connection with the STA, the attacking terminal can eavesdrop on the STA information. It can be seen that the connection between the terminals in the prior art is secure. Hidden dangers.
  • the invention provides a security authentication method, a configuration method and related devices.
  • a first aspect of the embodiments of the present invention provides a security authentication method, including:
  • the first terminal receives the second signature information and the second type information, where the second signature information is signature information sent by the configuration device to the second terminal, where the second signature information is configured by the configuration device according to at least the The second type information is generated by the signature private key of the configuration device, the second type information is the role type information of the second terminal, and/or the role type information that the second terminal can connect to, the configuration
  • the signature public key of the device corresponds to the signature private key of the configuration device;
  • the method further includes:
  • the first signature information that is sent by the configuration device, where the first signature information is generated by the configuration device according to at least the first type information and a signature private key, where the first type information is The role type information of the first terminal, and/or the role type information that the first terminal can connect to.
  • the role type information of the first terminal, and/or the role type information that the first terminal can connect to include:
  • Site access point, peer-to-peer group device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, peripheral device, source device, target device, configurator, interface Incoming device, supported capabilities, supported services, service set ID or media access control address.
  • the role type information of the second terminal, and/or the role type information that the second terminal can connect to include:
  • Site access point, peer-to-peer group device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, peripheral device, source device, target device, configurator, interface Incoming device, supported capabilities, supported services, service set ID or media access control address.
  • Determining, by the first terminal, the key information generated by the first terminal according to the second type information and the second signature information includes:
  • a terminal determines to generate generated key information.
  • the first terminal After the first terminal determines that the first terminal generates the key information, according to the second type information and the second signature information, the first terminal includes:
  • the first terminal generates the key information.
  • a second aspect of the embodiments of the present invention provides a configuration method, including:
  • the configuration device obtains the type information of the terminal, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the configuration device generates signature information according to at least the type information and a signature private key of the configuration device;
  • the configuration device sends the signature information and the signature public key of the configuration device to the terminal, and the signature public key of the configuration device corresponds to the signature private key of the configuration device.
  • the obtaining, by the configuration device, the type information of the terminal includes:
  • the configuration device receives an indication message sent by the terminal, where the indication message includes the type information.
  • the obtaining, by the configuration device, the type information of the terminal includes:
  • the configuration device receives a discovery message sent by the terminal
  • the configuration device determines the type information according to the discovery message, and the discovery message corresponds to the type information.
  • the obtaining, by the configuration device, the type information of the terminal includes:
  • the configuration device receives an operation instruction input by a user, and the operation instruction is used to indicate the type information.
  • the obtaining, by the configuration device, the type information of the terminal includes:
  • the configuration device scans a two-dimensional code of the type information included in the terminal
  • the configuration device establishes a NFC connection with the short-range wireless communication technology of the terminal to acquire the type information.
  • the role type information of the terminal, and/or the role type information that the terminal can connect to include:
  • Site access point, point-to-point group leader device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, original device, external device, target device, service set identifier, Media access control address, or access device.
  • the signature information further includes a first hash value, and the first hash value is a hash value generated by the configuration device at least hashing the type information.
  • a third aspect of the embodiments of the present invention provides a configuration method, including:
  • the terminal transmits the type information of the terminal to the configuration device, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the terminal Receiving, by the terminal, signature information sent by the configuration device and a signature public key of the configuration device, where the signature information is generated by the configuration device according to at least the type information and a signature private key of the configuration device,
  • the signature public key of the configuration device corresponds to the signature private key of the configuration device.
  • the terminal transmitting the type information to the configuration device includes:
  • the terminal generates an indication message, where the indication message includes the type information
  • the terminal sends the indication message to the configuration device.
  • the terminal transmitting the type information to the configuration device includes:
  • the terminal generates a discovery message
  • the terminal sends the discovery message to the configuration device, and the discovery message corresponds to the type information.
  • the terminal transmitting the type information to the configuration device includes:
  • the terminal generates a two-dimensional code, and the two-dimensional code includes the type information
  • the terminal establishes a NFC connection with a short-range wireless communication technology of the configuration device
  • the terminal sends the type information to the configuration device by using the NFC.
  • the role type information of the terminal, and/or the role type information that the terminal can connect to include:
  • Site access point, peer-to-peer group device, peer-to-peer client device, anchor master device, non-anchor host Standby, repeater, code center device, non-code center device, original device, external device, target device, service set identifier, media access control address, or access device.
  • a fourth aspect of the embodiment of the present invention provides a first terminal, including:
  • a first receiving unit configured to receive a signature public key of the configuration device that is sent by the configuration device
  • a second receiving unit configured to receive the second signature information and the second type information, where the second signature information is signature information sent by the configuration device to the second terminal, where the second signature information is configured by the configuration device according to at least The second type information and the signature private key of the configuration device are generated, the second type information is role type information of the second terminal, and/or role type information that the second terminal can connect to,
  • the signature public key of the configuration device corresponds to the signature private key of the configuration device;
  • the first determining unit is configured to determine, according to the second type information and the second signature information, the generated key information, where the key information is used by the first terminal to establish a secure connection with the second terminal.
  • the first terminal further includes:
  • a third receiving unit configured to receive first signature information that is sent by the configuration device, where the first signature information is generated by the configuration device according to at least the first type information and a signature private key, where the first type information is The role type information of the first terminal, and/or the role type information that the first terminal can connect to.
  • the role type information of the first terminal, and/or the role type information that the first terminal can connect to include:
  • Site access point, peer-to-peer group device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, peripheral device, source device, target device, configurator, interface Incoming device, supported capabilities, supported services, service set ID or media access control address.
  • the role type information of the second terminal, and/or the role type information that the second terminal can connect to include:
  • Site access point, peer-to-peer group device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, peripheral device, source device, target device, configurator, interface Incoming device, supported capabilities, supported services, service set ID or media access control address.
  • the first determining unit is further configured to: after determining that the first type information and the second type information match, and the first terminal confirms that the second signature information matches the second type information, The first terminal determines to generate generated key information.
  • the first terminal further includes:
  • the first generating unit is configured to generate the key information.
  • the first terminal further includes:
  • a first sending unit configured to send the first signature information to the second terminal.
  • a fifth aspect of the embodiments of the present invention provides a configuration device, including:
  • a fourth receiving unit configured to obtain type information of the terminal, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • a second generating unit configured to generate signature information according to at least the type information and a signature private key of the configuration device
  • a second sending unit configured to send the signature information and a signature public key of the configuration device to the terminal, where a signature public key of the configuration device corresponds to a signature private key of the configuration device.
  • the fourth receiving unit is further configured to receive an indication message sent by the terminal, where the indication message includes the type information.
  • the fourth receiving unit includes:
  • a receiving module configured to receive a discovery message sent by the terminal
  • a determining module configured to determine the type information according to the discovery message, and the discovery message corresponds to the type information.
  • the fourth receiving unit is further configured to receive an operation instruction input by the user, where the operation instruction is used to indicate the type information.
  • the fourth receiving unit is further configured to scan a two-dimensional code of the type information included in the terminal;
  • the fourth receiving unit is further configured to establish a NFC connection with the short-range wireless communication technology of the terminal to obtain the type information.
  • the role type information of the terminal, and/or the role type information that the terminal can connect to include:
  • Site access point, point-to-point group leader device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, original device, external device, target device, service set identifier, Media access control address, or access device.
  • the signature information further includes a first hash value, and the first hash value is a hash value generated by the configuration device at least hashing the type information.
  • a sixth aspect of the embodiments of the present invention provides a terminal, including:
  • a third sending unit configured to: pass the type information of the terminal to the configuration device, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • a fifth receiving unit configured to receive signature information sent by the configuration device and a signature public key of the configuration device, where the signature information is that the configuration device is based at least on the type information and a signature private key of the configuration device
  • the signature public key of the configuration device corresponds to the signature private key of the configuration device.
  • the third sending unit includes:
  • a first generating module configured to generate an indication message, where the indication message includes the type information
  • a second sending module configured to send the indication message to the configuration device.
  • the third sending unit includes:
  • a second generating module configured to generate a discovery message
  • a third sending module configured to send the discovery message to the configuration device, where the discovery message corresponds to the type information.
  • the third sending unit includes:
  • a third generation module configured to generate a two-dimensional code, where the two-dimensional code includes the type information
  • the third sending unit includes:
  • a fourth sending module configured to send the type information to the configuration device by using the NFC.
  • the role type information of the terminal, and/or the role type information that the terminal can connect to include:
  • Site access point, point-to-point group leader device, peer-to-peer client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, original device, external device, target device, service A service identifier, a media access control address, or an access device.
  • a first terminal is provided.
  • a receiver a transmitter, and a processor
  • the processor is coupled to the receiver and the transmitter, respectively;
  • the receiver is configured to receive a signature public key of the configuration device that is sent by the configuration device;
  • the receiver is configured to receive the second signature information and the second type information, where the second signature information is signature information that is sent by the configuration device to the second terminal, where the second signature information is configured by the configuration device according to at least The second type information and the signature private key of the configuration device are generated, the second type information is role type information of the second terminal, and/or role type information that the second terminal can connect to,
  • the signature public key of the configuration device corresponds to the signature private key of the configuration device;
  • the processor is configured to determine, according to the second type information and the second signature information, that the first terminal generates key information, where the key information is used by the first terminal to establish a secure connection with the second terminal. .
  • the receiver is configured to receive first signature information that is sent by the configuration device, where the first signature information is generated by the configuration device according to at least the first type information and a signature private key, where the first type information is The role type information of the first terminal, and/or the role type information that the first terminal can connect to.
  • the role type information of the first terminal, and/or the role type information that the first terminal can connect to include:
  • Site access point, peer-to-peer group device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, peripheral device, source device, target device, configurator, interface Incoming device, supported capabilities, supported services, service set ID or media access control address.
  • the role type information of the second terminal, and/or the role class that the second terminal can connect to Type information includes:
  • Site access point, peer-to-peer group device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, peripheral device, source device, target device, configurator, interface Incoming device, supported capabilities, supported services, service set ID or media access control address.
  • the processor configured to determine that the first type information and the second type information match, and the first terminal confirms that the second signature information matches the second type information, determining to generate and generate Key information.
  • the processor is configured to generate the key information.
  • the transmitter is configured to send the first signature information to the second terminal.
  • An eighth aspect of the present invention provides a configuration device
  • a transmitter, a receiver, and a processor are included, and the processor is respectively connected to the transmitter and the receiver;
  • the receiver is configured to obtain type information of the terminal, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the processor is configured to generate signature information according to at least the type information and a signature private key of the configuration device;
  • the transmitter is configured to send the signature information and a signature public key of the configuration device to the terminal, where a signature public key of the configuration device corresponds to a signature private key of the configuration device.
  • the receiver is configured to receive an indication message sent by the terminal, where the indication message includes the type information.
  • the receiver is configured to receive a discovery message sent by the terminal
  • the processor is configured to determine the type information according to the discovery message, and the discovery message corresponds to the type information.
  • the receiver is configured to receive an operation instruction input by a user, where the operation instruction is used to indicate the type information.
  • the receiver is configured to scan a two-dimensional code of the type information included in the terminal;
  • the receiver is configured to establish a NFC connection with a short-range wireless communication technology of the terminal to obtain the type information.
  • the role type information of the terminal, and/or the role type information that the terminal can connect to include:
  • Site access point, point-to-point group leader device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, original device, external device, target device, service set identifier, Media access control address, or access device.
  • the signature information further includes a first hash value, and the first hash value is a hash value generated by the configuration device at least hashing the type information.
  • a terminal is provided,
  • the transmitter includes: a transmitter, a receiver, and a processor, wherein the processor is respectively connected to the transmitter and the receiver;
  • a transmitter configured to: pass the type information of the terminal to the configuration device, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • a receiver configured to receive signature information sent by the configuration device and a signature public key of the configuration device, where the signature information is that the configuration device is configured according to at least the type information and the configuration device The private key is generated, and the signature public key of the configuration device corresponds to the signature private key of the configuration device.
  • the processor is configured to generate an indication message, where the indication message includes the type information
  • the transmitter is configured to send the indication message to the configuration device.
  • the sender is configured to send the discovery message to the configuration device, where the discovery message corresponds to the type information.
  • the processor is configured to generate a two-dimensional code, where the two-dimensional code includes the type information
  • the processor is configured to establish a NFC connection with a short-range wireless communication technology of the configuration device
  • the transmitter is configured to send the type information to the configuration device by using the NFC.
  • the role type information of the terminal, and/or the role type information that the terminal can connect to include:
  • Site access point, point-to-point group leader device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, original device, external device, target device, service set identifier, Media access control address, or access device.
  • the first terminal not only needs to be included in the second signature information.
  • the information for establishing the connection is verified, and the first terminal further needs to verify the type information of the second terminal, and the first terminal establishes the first terminal and the
  • the secure connection of the second terminal effectively avoids the tampering of the terminal by the terminal, thereby effectively preventing the terminal from establishing a connection with the attacking terminal that has changed the role, thereby preventing the attacking terminal from acquiring the information of the terminal, thereby effectively securing the terminal.
  • FIG. 1 is a flow chart of steps of a security authentication method according to an embodiment of the present invention.
  • FIG. 2 is a flow chart of another step of a security authentication method according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of a step of a configuration method according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of another step of a configuration method according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a first terminal according to an embodiment of the present disclosure.
  • FIG. 6 is another schematic structural diagram of a first terminal according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a configuration device according to an embodiment of the present disclosure.
  • FIG. 8 is another schematic structural diagram of a configuration device according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of a terminal according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of another terminal according to an embodiment of the present disclosure.
  • FIG. 11 is another schematic structural diagram of a first terminal according to an embodiment of the present disclosure.
  • FIG. 12 is another schematic structural diagram of a configuration device according to an embodiment of the present invention.
  • FIG. 13 is a schematic structural diagram of another terminal according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for a security authentication method according to an embodiment of the present invention.
  • the security authentication method provided by the embodiment of the present invention is specifically described in the following. :
  • the first terminal receives a signature public key of the configuration device that is sent by the configuration device.
  • the configurator is a device configured for the terminal, so that the configured terminal can establish a secure connection with other terminals.
  • the first terminal receives second signature information and second type information.
  • the second type information is role type information of the second terminal, and/or the The role type information that the second terminal can connect to.
  • the second type information may be the role type information of the second terminal, the second type information may also be the role type information of the second terminal, and the role type information that the second terminal can connect, and the second type information may also be the second The role type information that the terminal can connect to.
  • the second type information is sent by the second terminal to the first terminal.
  • the second signature information is signature information sent by the configuration device to the second terminal, and the second signature information is generated by the configuration device according to at least the second type information and the signature private key of the terminal.
  • the configuration device may perform hash operation on the second type information, and encrypt the result of the hash operation by using the signature private key to form the second signature information.
  • the signature public key of the configuration device corresponds to a signature private key of the configuration device.
  • the second terminal information that is encrypted by the signature private key can be decrypted by the first terminal by using the signature public key of the configuration device.
  • the first terminal determines, according to the second type information and the second signature information, that the first terminal generates key information.
  • the key information is used by the first terminal to establish a secure connection with the second terminal.
  • the first terminal specifically determines, according to the second type information and the second signature information, that the key information is not limited, as long as the first terminal can determine the second terminal role.
  • the type information, and/or the role type information that the second terminal can connect to, may establish a secure connection between the first terminal and the second terminal.
  • the first terminal may determine whether the connection between the first terminal and the second terminal can pass the verification according to the preset condition, where the preset condition includes: the second type information and the second signature signature information.
  • the preset condition may further include: information of the configurator, for example, a network ID (network ID), a peer key (peer key), and the like.
  • the first terminal When the first terminal determines that the information sent by the second terminal meets the preset condition, and determines that the connection request of the second terminal passes the authentication, the first terminal generates the key information to indicate that the first terminal can establish a secure connection with the second terminal.
  • the key information used to establish the secure connection between the first terminal and the second terminal is in the prior art, and how the first terminal specifically establishes the first terminal by using the key information.
  • the security connection of the second terminal is also a prior art, and is not specifically described in this embodiment.
  • the first terminal in the process of establishing a secure connection between the first terminal and the second terminal, the first terminal needs to perform verification according to the information used to establish the connection included in the second signature information, and The first terminal also needs to verify the type information of the second terminal, and the first terminal establishes a secure connection with the second terminal only when the verification is passed, thereby effectively avoiding the role of the terminal. Tampering, thereby effectively avoiding the connection between the terminal and the attacking terminal that has changed the role, thereby preventing the attacking terminal from acquiring the information of the terminal, and effectively protecting the security of the terminal.
  • FIG. 2 is a flow chart of another step of the security authentication method according to the embodiment of the present invention, which is used to specifically describe how the first terminal performs security authentication on the second terminal, thereby establishing the first terminal and the second terminal.
  • the terminal is securely connected.
  • the first terminal receives the first signature information sent by the configuration device and the signature public key of the configuration device.
  • the first signature information is generated by the configuration device according to at least the first type information and a signature private key of the configuration device;
  • the first type information is role type information of the first terminal, and/or role type information that the first terminal can connect.
  • the role type information of the first terminal, and/or the role type information that the first terminal can connect to may be any of the following types of information:
  • Site STA access point AP, peer-to-peer group device P2P GO, peer-to-peer client device P2P client, anchor master device master, non-anchor master device non-master, repeater repeater, code center device dock center, non-code center device dockee Peripheral peripheral, source device source, target device sink, service set identifier (SSID, service set identifier), media access control address (MAC, Media Access Control), access device enrollee, etc.
  • SSID service set identifier
  • MAC Media Access Control
  • the role type information of the first terminal and the role type information that the first terminal can connect to are two role type information corresponding to each other, and two terminals corresponding to each other can establish a connection. .
  • the type information of the two roles corresponding to each other may be: the STA corresponding to the AP, the P2P GO corresponding to the P2P client, the master corresponding to the non-master, the STA corresponding to the Repeater, and the AP corresponding to the repeater.
  • the first terminal can be connected.
  • the role type information is the STA
  • the role type information of the first terminal is the STA if the role type information that the first terminal can connect to is the AP;
  • the role type information of the first terminal is a repeater
  • the role type information that the first terminal can connect to may be an STA or an AP.
  • the role type information of the first terminal is the capability supported by the first terminal
  • the role type information that the first terminal can connect to is also the capability supported by the corresponding first terminal.
  • the role type information of the first terminal is a device that the first terminal can support P2P
  • the role type information that the first terminal can connect to is a device that supports the P2P
  • the role type information of the first terminal is that the first terminal can support the device that is adjacent to the sensing network NAN, and the role type information that the first terminal can connect to is the device that supports the proximity sensing network NAN;
  • the role type information of a terminal is a device supporting a base station subsystem BSS, and the role type information that the first terminal can connect to is a device supporting the base station subsystem BSS;
  • the role type information of the first terminal is a certain service information supported by the first terminal
  • the role type information that the first terminal can connect to is also a certain service information supported by the corresponding first terminal.
  • the first terminal receives second signature information and second type information.
  • the second signature information is generated by the configuration device according to the second type information and the signature private key of the configuration device, and is sent by the configuration device to the second terminal, and the signature public key and the location of the configuration device The signature private key of the configuration device corresponds.
  • the first terminal further receives a second terminal to send a public key of the second terminal, to generate key information.
  • the second terminal when the second terminal is to establish a connection with the first terminal, the second terminal sends the second signature information and the second type information to the first terminal.
  • the second type information is role type information of the second terminal, and/or role type information that the second terminal can connect to;
  • the role type information of the second terminal, and/or the role type information that the second terminal can connect to may be any of the following types of information:
  • Site STA access point AP, peer-to-peer group device P2P GO, peer-to-peer client device P2P client, anchor master device master, non-anchor master device non-master, repeater repeater, code center set Dock center, non-code center device dockee, peripheral peripheral, source device source, target device sink, service set identifier (SSID, service set identifier), media access control address (MAC, Media Access Control), access device enrollee, etc. ,
  • step 201 the role type information of the first terminal, and/or the role type information that the second terminal can connect to.
  • step 201 the role type information of the first terminal, and The description of the role type information that the first terminal can connect to is not described here.
  • the first terminal determines that the first type information and the second type information match, and the first terminal confirms that the second signature information matches the second type information, and the first terminal determines Generate key information.
  • the first terminal determines that the second type information is role type information that the second terminal can connect, and the first terminal determines that the first type information is that the first terminal can connect The role type information, if the second terminal is capable of connecting the connectable role type information and the first terminal is capable of determining that the first terminal can be connected with the role type information, the first terminal and the The second terminal is matched;
  • the second terminal can connect the connectable role type information to the STA, and the role type information that the first terminal can connect to is the AP, indicating that the first terminal and the second terminal match.
  • the first terminal determines role type information of the second terminal of the second type information, and the first terminal determines that the first type information is role type information of the first terminal, If the role type information of the second terminal matches the role type information of the first terminal, the first terminal and the second terminal are matched;
  • the first terminal determines that the role type information of the second terminal is an AP, and the first terminal determines that the role type information of the first terminal is an STA, and the first terminal and the second terminal are The terminals match.
  • the first terminal determines that the second type information is the role type information that the second terminal can connect, and the first terminal determines that the first type information is the role of the first terminal.
  • Type information if the second terminal is capable of connecting the connectable role type information to match the role type information of the first terminal, the first terminal and the second terminal are matched;
  • the second terminal can connect the connectable role type information to the AP, and the role type information of the first terminal is the AP, indicating that the first terminal and the second terminal match;
  • the STA corresponding to the AP is used as an example to illustrate how to determine that the first type information and the second type information match, and the device role type correspondence is P2P GO corresponding to the P2P client. If the master corresponds to the non-master, the STA corresponds to the Repeater, and the AP corresponds to the repeater, the process of determining whether the match is the same as the corresponding AP of the STA, and details are not described herein.
  • the first terminal determines that the second type information is role type information of the second terminal, and the role type information of the second terminal is a P2P device, the role that the second terminal can connect to The type information is a P2P device, and the two are the same.
  • the first terminal determines whether the role type information of the first terminal is a P2P device. If the role type information of the first terminal is a P2P device, the description is performed. Matching a terminal with the second terminal;
  • the first terminal determines that the second type information is the second terminal role type information, and the second terminal role type information is a service that the second terminal can support
  • the first The terminal can determine that the role type information of the first terminal is a service that the first terminal can support, if the first terminal determines that the service that the first terminal can support is the same as the service that the second terminal can support.
  • the first terminal and the second terminal are matched.
  • determining that the second signature information matches the second type information includes:
  • the first terminal performs a hash operation on at least the second type information to generate a second hash value.
  • the hash operation is a prior art, and is not described in detail in this embodiment.
  • the first terminal decrypts the second signature information by using the signature public key to obtain a first hash value
  • the first hash value is a hash value generated by the configuration device performing a hash operation on at least the second type information, and the first terminal is capable of using the signature public key pair
  • the second signature information is decrypted to obtain the first hash value.
  • the first terminal determines whether the first hash value is equal to the second hash value, that is, the first terminal confirms whether the second signature information is matched with the second type information.
  • the configuration device generates the first hash value for the first predetermined information, and the first terminal generates a second hash value for the second predetermined information, where the first predetermined information is equal to the second Booking letter
  • the first hash value is equal to the second hash value.
  • the first terminal of the first terminal determines, by step 203, that the first type information and the second type information match.
  • the step of calculating the hash value, and the step of performing the step of matching the first type information with the second type information may be replaced; when the first type information and the second type information are When the first terminal confirms that the second signature information matches the second type information, the first terminal determines that the second terminal passes the authentication, and the first terminal generates the key.
  • the first terminal when the first terminal generates the key information, the first terminal matches at least the first type information and the second type information, and the first hash value is equal to Said second hash value;
  • the first terminal may perform other verification before generating the key information, which is not limited in this embodiment;
  • the first terminal may perform other verification, such as a net ID, a peer key, and the like, before the generation of the key information, which is not limited in this embodiment;
  • the first terminal receives a message that is sent by the second device and carries the foregoing information
  • the message contains the following information:
  • the message may be an action message, modifying a message in an existing 802.11, or a newly defined message.
  • the first terminal After the first terminal receives the second signature information sent by the second terminal, the first terminal verifies whether the net-id is the same as the net-id of the first terminal, and checks whether the peerKey matches the peer's The network key (that is, the network key of the first terminal), or, matches the wildcard.
  • the first terminal when the first terminal matches at least the first type information and the second type information, and the first hash value is equal to the second hash value, the first terminal generates a paired master. Key PMK.
  • the first terminal sends the first signature information to the second terminal.
  • the first terminal may send the first signature message to the second terminal.
  • the first terminal establishes a secure connection between the first terminal and the second terminal according to the key information.
  • the first terminal generates the PMK by using the public key net Key of the second terminal and a private key of the first terminal, so as to establish the first terminal and the first according to the PMK.
  • the secure connection of the two terminals The secure connection of the two terminals.
  • the first terminal In the process of establishing a secure connection between the first terminal and the second terminal, the first terminal needs to establish a connection according to the second signature information included in the second terminal. The information is verified, and the first terminal further needs to verify the second type information, determining that the first type information and the second type information match, and determining that the second signature information is correct.
  • the first terminal establishes a secure connection between the first terminal and the second terminal, which effectively avoids tampering of the role by the terminal, thereby effectively preventing the terminal from establishing a connection with the attack terminal that has changed the role, and further The attack terminal is prevented from acquiring the information of the terminal, which effectively ensures the security of the terminal.
  • the first terminal determines the role type information of the second terminal by using the second type information sent by the second terminal, and/or the role type information that the second terminal can connect to is an example. Not limited;
  • a discovery process is performed between the first terminal and the second terminal, and the first terminal obtains role type information of the second terminal and/or a role that the second terminal can connect through the process.
  • Type information For example, a discovery process is performed between the first terminal and the second terminal, and the first terminal obtains role type information of the second terminal and/or a role that the second terminal can connect through the process.
  • the second terminal may also obtain role type information of the first terminal and/or role type information that the first terminal can connect to;
  • the 802.11 process is performed, and the second terminal sends a probe request to the first terminal as the STA, and the first terminal responds to the AP as a response.
  • the first terminal may obtain the role type information of the second terminal, and/or the role type information that the second terminal can connect, and the second terminal may also obtain the role type information of the first terminal. And/or role type information that the first terminal can connect to;
  • the sent message is different, and the role type information of the terminal and/or the role type information that can be connected can be determined by the message sent by the terminal.
  • FIG. 1 to FIG. 2 illustrates how the first terminal and the second terminal perform security authentication for secure connection.
  • the following describes how the configuration device configures the terminal according to FIG. 3 . So that the configured terminal can establish a secure connection relationship with other terminals;
  • FIG. 3 is a flowchart of a step of a configuration method according to an embodiment of the present invention.
  • the terminal transmits the type information of the terminal to the configuration device.
  • the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the terminal device specifically transmits the role type information of the terminal, and/or the role type information that the terminal can connect to the configuration device, as long as the configuration device can obtain the configuration device.
  • the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the configuration device specifically obtains the role type information of the terminal, and/or the role type information that the terminal can connect to;
  • the configuration device may obtain only the role type information of the terminal, and may obtain the role type information of the terminal and the role type information that the terminal can connect to, or obtain only the role type information that the terminal can connect.
  • the role type information of the terminal that is obtained by the configuration device, and/or the role type information that the terminal can connect to is not limited;
  • the role type information of the terminal may be any of the following types of information, and it is clear that the following role type information of the terminal is only An exemplary description is not limited;
  • Site STA access point AP, peer-to-peer group device P2P GO, peer-to-peer client device P2P client, anchor master device master, non-anchor master device non-master, repeater repeater, code center device dock center, non-code center device dockee Peripheral peripheral, source device source, target device sink, SSID service set identifier, MAC media access control address, access device enrollee;
  • the role type information of the terminal and the role type information that the terminal can be connected are two role type information corresponding to each other, and two terminals corresponding to each other can establish a connection;
  • the role type information of the terminal is an AP
  • the role type information that the terminal can connect to is the STA
  • the role type information that the terminal can connect to is the AP
  • the role type information of the terminal is STA
  • the two role type information corresponding to each other may be: the STA corresponding to the AP, the P2P GO corresponding to the P2P client, the master corresponding to the non-master, the STA corresponding to the Repeater, and the AP corresponding to the repeater;
  • the role type information of the terminal is a repeater
  • the role type information that the terminal can connect to may be an STA or an AP
  • the role type information of the terminal is the capability supported by the terminal
  • the role type information that the terminal can connect to is also the capability supported by the corresponding terminal
  • the role type information of the terminal is a device that the terminal can support P2P
  • the role type information that the terminal can connect to is a device that supports the P2P
  • the role type information of the terminal is that the terminal can support the device that is adjacent to the sensing network NAN, and the role type information that the terminal can connect to is the device that supports the proximity sensing network NAN;
  • the role type information of the terminal is a device supporting a base station subsystem BSS
  • the role type information that the terminal can connect to is a device supporting the base station subsystem BSS
  • the role type information of the terminal is a certain service information supported by the terminal
  • the role type information that the terminal can connect to is also a certain service information supported by the corresponding terminal.
  • the configuration device generates signature information according to at least the type information and a signature private key of the configuration device.
  • the configuration device performs at least hashing the type information to generate a hash value, and encrypts the generated hash value by using a signature private key to generate the signature information;
  • the signature information is generated according to the signature private key, which is not described in detail in this embodiment.
  • the configuration device sends the signature information and a signature public key of the configuration device to the terminal.
  • the configuration device specifically sends the signature information and the signature public key without limitation
  • the configuration device may send the signature information and the signature public key as two independent messages or one message to the terminal simultaneously, and send the same message to the terminal, and may also or the signature information and the The signature public key is sent to the terminal separately, which is not limited.
  • the terminal receives signature information sent by the configuration device and a signature public key of the configuration device.
  • the signature information is generated by the configuration device according to at least the type information and a signature private key of the configuration device;
  • the signature public key of the configuration device corresponds to the signature private key of the configuration device, so that the terminal that receives the signature public key can decrypt the signature information encrypted by the signature private key. .
  • the terminal After the terminal receives the signature information sent by the configuration device and the signature public key of the configuration device, completing configuration of the terminal by the configuration device, so that the terminal can perform mapping based on the configuration of the configuration device. 1 to the process of security certification shown in Figure 2.
  • the configuration device sends the signature information and the signature public key of the configuration device to the terminal, so that when the terminal needs to access other terminals, the terminal can send the The signature information and the own type information are sent to other terminals, so that other terminals not only need to verify whether the signature information is correct, but also need to verify whether the terminals match, and only the type information of the two terminals match each other and the signature information
  • the secure connection relationship between the two terminals is established, which effectively avoids the tampering of the terminal by the terminal, thereby effectively preventing the terminal from establishing a connection with the attacking terminal that has changed the role, thereby preventing the attacking terminal from acquiring the terminal information. , effectively protect the security of the terminal.
  • FIG. 4 is a flowchart of another step of the configuration method provided by the embodiment of the present invention.
  • the configuration device acquires a first DH public key of the terminal.
  • the terminal has a first DH public key and a first DH private key for performing key exchange
  • the configuration device has a second DH public key and a second DH private key for performing key exchange
  • the manner in which the configuration device acquires the first DH public key may be: the configuration device scans the The terminal includes the two-dimensional code of the first DH public key, or the terminal sends the first DH public key that the terminal has to the configuration device, which is not limited;
  • the configuration device sends the second DH public key to the terminal.
  • the configuration device calculates a second interaction key by using a key exchange algorithm according to the first DH public key and the second DH private key;
  • the key interaction algorithm may be a DH algorithm or an ECDH algorithm.
  • a DH algorithm or an ECDH algorithm.
  • the terminal generates a first interaction key.
  • the terminal calculates the first interaction key by using the key exchange according to the second DH public key and the first DH private key;
  • the configuration device establishes a secure connection with the terminal.
  • the configuration device can The terminal establishes a secure connection.
  • the type information of the terminal is not limited when the configuration device is specifically obtained;
  • the configuration device acquires role type information of the terminal in the process of establishing a secure connection between the configuration device and the terminal, and/or role type information that the terminal can connect to;
  • the configuration device After the configuration device successfully establishes a secure connection with the terminal, the configuration device acquires role type information of the terminal, and/or role type information that the terminal can connect to;
  • the following is a description of how the configuration device acquires the type information in the process of establishing a secure connection between the configuration device and the terminal:
  • the configuration device acquires an identity public key of the terminal
  • the configuration device acquires an identity public key in the terminal QR-code
  • the specific manner in which the configuration device obtains the identity public key of the terminal is not limited.
  • the terminal may send the message to the configuration device by using a message including the identity public key, or Configuring the device to scan, the terminal includes a two-dimensional code of the identity public key, and the like;
  • the configuration device sends a first target hash value corresponding to the identity public key to the terminal;
  • the configuration device performs a hash operation on the identity public key to generate the first target.
  • Hash value
  • the configuration device is sent to the terminal by using a message DPP Authentication Request including the first target hash value;
  • the DPP Authentication Request may be: H(EI), H(CI), CE, ⁇ C-nonce ⁇ K1 ⁇
  • the H (EI) generates the first target hash value by using the identity public key of the terminal, and the H (CI) generates a hash value for the identity key of the configuration device;
  • the terminal determines that the first target hash value meets a preset requirement, the terminal generates a response message
  • the terminal After the terminal receives the DPP Authentication Request, the terminal performs a hash operation on the identity public key of the terminal to generate a second target hash value.
  • the preset requirement is that the first target hash value is equal to the second target hash value
  • the response message DPP Authentication Response may be: DPP Authentication Response: ⁇ H(EI), [H(CI),] ⁇ E-nonce
  • the response message shown in this embodiment further carries role type information of the terminal, and/or role type information that the terminal can connect to;
  • the configuration device may determine role type information of the terminal according to the response message, and/or role type information that the terminal can connect to;
  • the configuration device After the configuration device determines the role type information of the terminal, and/or the role type information that the terminal can connect to, the configuration device sends an acknowledgement message to the terminal;
  • the confirmation message is DPP Authentication Confirm: H(EI), [H(CI),] ⁇ C-auth ⁇ Ke ⁇
  • the configuration device After the configuration device succeeds in establishing a secure connection with the terminal, the configuration device obtains the role type information of the terminal, and/or the role type information that the terminal can connect to as an example:
  • step 406 is performed;
  • the configuration device obtains type information of the terminal.
  • the type information of the terminal is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the configuration device obtains the role type information of the terminal, and/or the manner in which the terminal can connect the role type information in the following manners, and it is clear that the following configuration device obtains the terminal.
  • the role type information, and/or the manner in which the terminal can connect to the role type information is an exemplary description, which is not limited:
  • the configuration device receives an indication message sent by the terminal
  • the terminal can indicate role type information of the terminal in the indication message, and/or role type information that the terminal can connect.
  • Another configuration device receives the discovery message sent by the terminal
  • the configuration device determines the type information according to the discovery message
  • the discovery message corresponds to the type information.
  • the configuration device performs a discovery process with the terminal, and the configuration device obtains the role type information of the terminal through the process, and/or the role type information that the terminal can connect to;
  • the configuration device may determine that the role type information of the terminal is STA, and/or the configuration device can determine the location.
  • the role type information that the terminal can connect to is an AP;
  • the configuration device may determine that the role type information of the terminal is an AP, and/or the configuration device can determine the role type that the terminal can connect to.
  • the information is STA;
  • the reason why the configuration device adopts the determination mode is that, because the roles of the terminals are different in the discovery process, the sent discovery messages are different, so that the configuration device can determine the role of the terminal through different discovery messages sent by the terminal.
  • the configuration device is provided with an operation interface, and the user can input an operation instruction through the operation interface, so that the user directly indicates the type information through the operation instruction.
  • the configurator obtains the role type of the terminal device as STA, and the device type that can be connected is AP. For example, the user selects the input configuration network, and the configurator obtains The role type of the terminal device is AP, and the device type that can be connected is STA.
  • the configuration device may scan the two-dimensional code of the terminal, and the type code of the terminal includes the type information, so that the configuration device can directly acquire the terminal by scanning the two-dimensional code.
  • the configuration device establishes a NFC connection with the short-range wireless communication technology of the terminal, so that the configuration device can obtain the type information through the NFC connection.
  • the terminal device passes the public key net Key to the configuration device.
  • the configuration device generates a configuration message.
  • the configuration message includes at least a public key net Key, a signature public key of the configuration device, and the type information of the terminal;
  • the configuration message DPP Configuration Response may be: ⁇ net-id, cruft, C-name, C-sign-key, connector, [connector...][,configurators][,introducers] ⁇ Ke ⁇
  • the role type information that the terminal can connect to is the role type information that the terminal can connect to
  • the role type information of the terminal is the role type information of the terminal.
  • the configuration device performs a hash operation on the configuration information.
  • the configuration device determines signature information.
  • the signature information is formed by performing the hashing of the configuration information by using a signature private key of the configuration device.
  • the hash hash operation is a hash algorithm, and the hash algorithm can input some numbers through the hash operation to generate other numbers, and has unidirectionality.
  • the signature information includes a first hash value
  • the first hash value is The configuration device performs a hash value generated by hashing the role type information of the terminal and/or the role type information that the terminal can connect.
  • the configuration device sends the signature information and the signature public key of the configuration device to the terminal, so that when the terminal needs to access other terminals, the terminal can send the The signature information and the own type information are sent to other terminals, so that other terminals not only need to verify whether the signature information is correct, but also need to verify whether the terminals match, and only the type information of the two terminals match each other and the signature information
  • the secure connection relationship between the two terminals is established, which effectively avoids the tampering of the terminal by the terminal, thereby effectively preventing the terminal from establishing a connection with the attacking terminal that has changed the role, thereby preventing the attacking terminal from acquiring the terminal information. , effectively protect the security of the terminal.
  • FIG. 5 is a schematic structural diagram of the first terminal according to the embodiment of the present invention.
  • the first terminal includes:
  • the first receiving unit 501 is configured to receive a signature public key of the configuration device that is sent by the configuration device;
  • the second receiving unit 502 is configured to receive the second signature information and the second type information, where the second signature information is signature information that is sent by the configuration device to the second terminal, where the second signature information is configured by the configuration device according to at least Generating the second type information and the signature private key of the configuration device, the second type information is role type information of the second terminal, and/or role type information that the second terminal can connect to,
  • the signature public key of the configuration device corresponds to a signature private key of the configuration device;
  • the first determining unit 503 is configured to determine, according to the second type information and the second signature information, the generated key information, where the key information is used by the first terminal to establish a secure connection with the second terminal.
  • the first terminal in the process of establishing the secure connection between the first terminal and the second terminal, the first terminal needs to perform verification according to the information used to establish the connection included in the second signature information, and The first terminal further needs to verify the type information of the second terminal, and the first terminal establishes a secure connection between the first terminal and the second terminal only when the verification is passed, and the effective The terminal tampering with the role is avoided, thereby effectively preventing the terminal from establishing a connection with the attacking terminal that has changed the role, thereby preventing the attacking terminal from acquiring the information of the terminal, and effectively protecting the security of the terminal.
  • FIG. 6 is another schematic structural diagram of the first terminal according to the embodiment of the present invention.
  • the third receiving unit 601 is configured to receive first signature information that is sent by the configuration device, where the first signature information is generated by the configuration device according to at least the first type information and a signature private key, where the first type
  • the information is role type information of the first terminal, and/or role type information that the first terminal can connect to;
  • the role type information of the first terminal, and/or the role type information that the first terminal can connect to include:
  • Site access point, peer-to-peer group device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, peripheral device, source device, target device, configurator, interface Incoming device, supported capabilities, supported services, service set ID or media access control address.
  • the first receiving unit 602 is configured to receive a signature public key of the configuration device that is sent by the configuration device.
  • the second receiving unit 603 is configured to receive the second signature information and the second type information, where the second signature information is signature information that is sent by the configuration device to the second terminal, where the second signature information is configured by the configuration device according to at least Generating the second type information and the signature private key of the configuration device, the second type information is role type information of the second terminal, and/or role type information that the second terminal can connect to,
  • the signature public key of the configuration device corresponds to a signature private key of the configuration device;
  • the role type information of the second terminal, and/or the role type information that the second terminal can connect to include:
  • Site access point, peer-to-peer group device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, peripheral device, source device, target device, configurator, interface Incoming device, supported capabilities, supported services, service set ID or media access control address.
  • the first determining unit 604 is configured to determine, according to the second type information and the second signature information, the generated key information, where the key information is used by the first terminal to establish a secure connection with the second terminal.
  • the first determining unit 604 is further configured to: determine that the first type information and the second type information match, and the first terminal confirms that the second signature information matches the second Type information, the first terminal determines to generate generated key information;
  • the first generating unit 605 is configured to generate the key information.
  • the first sending unit 606 is configured to send the first signature information to the second terminal.
  • the first terminal In the process of establishing a secure connection between the first terminal and the second terminal, the first terminal needs to establish a connection according to the second signature information included in the second terminal. The information is verified, and the first terminal further needs to verify the second type information, determining that the first type information and the second type information match, and determining that the second signature information is correct.
  • the first terminal establishes a secure connection between the first terminal and the second terminal, which effectively avoids tampering of the role by the terminal, thereby effectively preventing the terminal from establishing a connection with the attack terminal that has changed the role, and further The attack terminal is prevented from acquiring the information of the terminal, which effectively ensures the security of the terminal.
  • FIG. 7 is a schematic structural diagram of the configuration device according to the embodiment of the present invention. schematic diagram;
  • the configuration device includes:
  • the fourth receiving unit 701 is configured to obtain type information of the terminal, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the second generating unit 702 is configured to generate signature information according to at least the type information and the signature private key of the configuration device;
  • the second sending unit 703 is configured to send the signature information and a signature public key of the configuration device to the terminal, where a signature public key of the configuration device corresponds to a signature private key of the configuration device.
  • the configuration device sends the signature information and the signature public key of the configuration device to the terminal, so that the terminal can send the configured device when the terminal needs to access other terminals.
  • the signature information and the own type information are sent to other terminals, so that other terminals not only need to verify whether the signature information is correct, but also need to verify whether the terminals match, and only the type information of the two terminals match each other and the signature information
  • the secure connection relationship between the two terminals is established, which effectively avoids the tampering of the terminal by the terminal, thereby effectively preventing the terminal from establishing a connection with the attacking terminal that has changed the role, thereby preventing the attacking terminal from acquiring the terminal information. , effectively protect the security of the terminal.
  • FIG. 8 is another schematic structural diagram of a configuration device according to an embodiment of the present invention.
  • the fourth receiving unit 801 is configured to obtain type information of the terminal, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the role type information of the terminal, and/or the role type information that the terminal can connect to include:
  • Site access point, point-to-point group leader device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, original device, external device, target device, service set identifier, Media access control address, or access device.
  • the fourth receiving unit 801 is further configured to receive an indication message sent by the terminal, where the indication message includes the type information.
  • the fourth receiving unit 801 is further configured to receive an operation instruction input by a user, where the operation instruction is used to indicate the type information.
  • the fourth receiving unit 801 is further configured to scan a two-dimensional code of the type information included in the terminal;
  • the fourth receiving unit 801 is further configured to establish a NFC connection with a short-range wireless communication technology of the terminal to obtain the type information.
  • the fourth receiving unit 801 includes:
  • the receiving module 8011 is configured to receive a discovery message sent by the terminal.
  • the determining module 8012 is configured to determine the type information according to the discovery message, and the discovery message corresponds to the type information.
  • a second generating unit 802 configured to generate signature information according to at least the type information and a signature private key of the configuration device
  • the signature information further includes a first hash value, and the first hash value is a hash value generated by the configuration device at least hashing the type information.
  • the second sending unit 803 is configured to send the signature information and a signature public key of the configuration device to the terminal, where a signature public key of the configuration device corresponds to a signature private key of the configuration device.
  • the configuration device sends the signature information and the signature public key of the configuration device to the terminal, so that the terminal can send the configured device when the terminal needs to access other terminals.
  • the signature information and the own type information are sent to other terminals, so that other terminals not only need to verify whether the signature information is correct, but also need to verify whether the terminals match, and only the type information of the two terminals match each other and the signature information
  • the secure connection relationship between the two terminals will be established, which effectively avoids the tampering of the terminal by the terminal, thereby effectively avoiding the terminal.
  • a connection is established with the attack terminal that has changed the role, thereby preventing the attack terminal from acquiring the information of the terminal, thereby effectively securing the terminal.
  • FIG. 7 to FIG. 8 illustrate a specific structure of the configuration device when the configuration device configures the terminal device from the perspective of the configuration device, and the configuration device is described below with reference to FIG. 9 .
  • FIG. 9 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • the terminal includes:
  • the third sending unit 901 is configured to: pass the type information of the terminal to the configuration device, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the fifth receiving unit 902 is configured to receive the signature information sent by the configuration device and the signature public key of the configuration device, where the signature information is that the configuration device is at least according to the type information and the signature of the configuration device. Key generation, the signature public key of the configuration device and the signature private key of the configuration device.
  • the configuration device sends the signature information and the signature public key of the configuration device to the terminal, so that the terminal can send the signature sent by the configuration device when the terminal needs to access other terminals.
  • the information and its own type information are sent to other terminals, so that other terminals not only need to verify whether the signature information is correct, but also need to verify whether the terminals match, only the type information of the two terminals matches each other and the signature information is correct.
  • the security connection between the two terminals is established, which effectively avoids the tampering of the terminal by the terminal, thereby effectively preventing the terminal from establishing a connection with the attacking terminal that has changed the role, thereby preventing the attacking terminal from acquiring the terminal information. Effectively protect the security of the terminal.
  • FIG. 10 is another schematic structural diagram of a terminal according to an embodiment of the present invention.
  • the terminal includes:
  • the third sending unit 1001 is configured to: pass the type information of the terminal to the configuration device, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the third sending unit 1001 includes:
  • a first generating module 10011 configured to generate an indication message, where the indication message includes the type information
  • the second sending module 10012 is configured to send the indication message to the configuration device.
  • the third sending unit 1001 includes:
  • the second generating module 10013 is configured to generate a discovery message.
  • the third sending module 10014 is configured to send the discovery message to the configuration device, where the discovery message corresponds to the type information.
  • the third sending unit 1001 includes:
  • a third generation module 10015 configured to generate a two-dimensional code, where the two-dimensional code includes the type information
  • the third sending unit 1001 includes:
  • the establishing module 10016 is configured to establish a NFC connection with the short-range wireless communication technology of the configuration device;
  • the fourth sending module 10017 is configured to send the type information to the configuration device by using the NFC.
  • the fifth receiving unit 1002 is configured to receive the signature information sent by the configuration device and the signature public key of the configuration device, where the signature information is that the configuration device is at least according to the type information and the signature of the configuration device. a key generation, where the signature public key of the configuration device corresponds to a signature private key of the configuration device;
  • the role type information of the terminal, and/or the role type information that the terminal can connect to include:
  • Site access point, point-to-point group leader device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, original device, external device, target device, service set identifier, Media access control address, or access device.
  • the configuration device sends the signature information and the signature public key of the configuration device to the terminal, so that the terminal can send the signature sent by the configuration device when the terminal needs to access other terminals.
  • Information and its own type information are sent to other terminals, thereby making other terminals It is not only necessary to verify whether the signature information is correct, but also to verify whether the terminals match, and only when the type information of the two terminals matches each other and the signature information is correct, the secure connection relationship between the two terminals is established.
  • the tampering of the terminal is effectively avoided, thereby effectively preventing the terminal from establishing a connection with the attacking terminal that has changed the role, thereby preventing the attacking terminal from acquiring the information of the terminal, and effectively protecting the security of the terminal.
  • FIG. 5 to FIG. 6 illustrates the specific structure of the first terminal from the perspective of the function module.
  • the specific structure of the first terminal is described from the hardware point of view below with reference to the embodiment shown in FIG.
  • the first terminal includes: a transmitter 1101, a receiver 1102, and a processor 1103.
  • the processor 1103 can be one or more.
  • the transmitter 1101, the receiver 1102, and the processor 1103 are connected through a bus.
  • other connection manners may be used.
  • the specific connection manner is not limited in this embodiment.
  • the first terminal according to the embodiment of the present invention may have more or less components than those shown in FIG. 11, may combine two or more components, or may have different component configurations or settings, and each component may be Hardware, software, or a combination of hardware and software, including one or more signal processing and/or application specific integrated circuits.
  • the receiver 1102 is configured to receive a signature public key of the configuration device that is sent by the configuration device.
  • the receiver 1102 is configured to receive second signature information and second type information, where the second signature information is signature information that is sent by the configuration device to the second terminal, where the second signature information is configured by the configuration device according to at least Generating the second type information and the signature private key of the configuration device, the second type information is role type information of the second terminal, and/or role type information that the second terminal can connect to,
  • the signature public key of the configuration device corresponds to a signature private key of the configuration device;
  • the processor 1103 is configured to determine, according to the second type information and the second signature information, that the first terminal generates key information, where the key information is used to establish security between the first terminal and the second terminal. connection.
  • the receiver 1102 is configured to receive first signature information that is sent by the configuration device, where the first signature information is generated by the configuration device according to at least the first type information and a signature private key.
  • the first type information is role type information of the first terminal, and/or role type information that the first terminal can connect.
  • the role type information of the first terminal, and/or the first terminal is connectable
  • the role type information includes:
  • Site access point, peer-to-peer group device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, peripheral device, source device, target device, configurator, interface Incoming device, supported capabilities, supported services, service set ID or media access control address.
  • the role type information of the second terminal, and/or the role type information that the second terminal can connect to include:
  • Site access point, peer-to-peer group device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, peripheral device, source device, target device, configurator, interface Incoming device, supported capabilities, supported services, service set ID or media access control address.
  • the processor 1103 is configured to determine that the first type information and the second type information match, and the first terminal confirms that the second signature information matches the second type information , then determine to generate the generated key information.
  • the processor 1103 is configured to generate the key information.
  • the transmitter 1101 is configured to send the first signature information to the second terminal.
  • FIG. 7 to FIG. 8 illustrates the specific structure of the configuration device from the perspective of the function module.
  • the specific structure of the configuration device is described from the hardware point of view below with reference to the embodiment shown in FIG. 12:
  • the configuration device includes: a transmitter 1201, a receiver 1202, and a processor 1203.
  • the processor 1203 may be one or more.
  • the transmitter 1201, the receiver 1202, and the processor 1203 are connected through a bus.
  • other connection manners may be used.
  • the specific connection manner is not limited in this embodiment.
  • the configuration device may have more or less components than those shown in FIG. 12, may combine two or more components, or may have different component configurations or settings, and each component may include Hardware, software, or a combination of hardware and software implementations of one or more signal processing and/or application specific integrated circuits.
  • the receiver 1202 is configured to obtain type information of the terminal, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the processor 1203 is configured to generate signature information according to at least the type information and a signature private key of the configuration device;
  • the transmitter 1201 is configured to send the signature information and a signature public key of the configuration device to the terminal, where a signature public key of the configuration device corresponds to a signature private key of the configuration device.
  • the receiver 1202 is configured to receive an indication message sent by the terminal, where the indication message includes the type information.
  • the receiver 1202 is configured to receive a discovery message sent by the terminal.
  • the processor 1203 is configured to determine the type information according to the discovery message, and the discovery message corresponds to the type information.
  • the receiver 1202 is configured to receive an operation instruction input by a user, where the operation instruction is used to indicate the type information.
  • the receiver 1202 is configured to scan a two-dimensional code of the type information included in the terminal;
  • the receiver 1202 is configured to establish a NFC connection with a short-range wireless communication technology of the terminal to obtain the type information.
  • the role type information of the terminal, and/or the role type information that the terminal can connect to include:
  • Site access point, point-to-point group leader device, point-to-point client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, original device, external device, target device, service set identifier, Media access control address, or access device.
  • the signature information further includes a first hash value, where the first hash value is a hash value generated by the configuration device performing a hash operation on the type information.
  • FIG. 9 to FIG. 10 illustrates the specific structure of the terminal from the perspective of the functional module.
  • the specific structure of the terminal is described from the hardware point of view below with reference to the embodiment shown in FIG. 13:
  • the terminal includes: a transmitter 1301, a receiver 1302, and a processor 13031303.
  • the processor 13031303 may be one or more.
  • the transmitter 1301, the receiver 1302, and the processor 13031303 are connected through a bus.
  • other connection manners may be used.
  • the specific connection manner is not limited in this embodiment.
  • a terminal according to an embodiment of the present invention may have more or fewer components than those shown in FIG. Two or more components may be combined, or may have different component configurations or arrangements, each component being implemented in hardware, software, or a combination of hardware and software including one or more signal processing and/or application specific integrated circuits. .
  • the terminal includes:
  • the sender 1301 is configured to: pass the type information of the terminal to the configuration device, where the type information is role type information of the terminal, and/or role type information that the terminal can connect to;
  • the receiver 1302 is configured to receive signature information sent by the configuration device and a signature public key of the configuration device, where the signature information is generated by the configuration device according to at least the type information and a signature private key of the configuration device.
  • the signature public key of the configuration device corresponds to a signature private key of the configuration device.
  • the processor 1303 is configured to generate an indication message, where the indication message includes the type information
  • the transmitter 1301 is configured to send the indication message to the configuration device.
  • the processor 1303 is configured to generate a discovery message.
  • the sender 1301 is configured to send the discovery message to the configuration device, where the discovery message corresponds to the type information.
  • the processor 1303 is configured to generate a two-dimensional code, where the two-dimensional code includes the type information;
  • the processor 1303 is configured to establish a NFC connection with a short-range wireless communication technology of the configuration device
  • the transmitter 1301 is configured to send the type information to the configuration device by using the NFC.
  • the role type information of the terminal, and/or the role type information that the terminal can connect to include:
  • Site access point, point-to-point group leader device, peer-to-peer client device, anchor master device, non-anchor master device, repeater, code center device, non-code center device, original device, external device, target device, service A service identifier, a media access control address, or an access device.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Power Engineering (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明提供了一种安全认证方法、配置方法以及相关设备，第一终端接收配置设备发送的配置设备的签名公钥,所述第一终端接收第二签名信息和第二类型信息,所述第一终端至少根据所述第二类型信息和所述第二签名信息确定所述第一终端生成密钥信息,以使所述第一终端才会建立所述第一终端与所述第二终端的安全连接，有效的避免了终端对角色的篡改，从而有效的避免了终端与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。

Description

一种安全认证方法、配置方法以及相关设备 技术领域
本发明涉及网络通信领域,尤其涉及的是一种安全认证方法、配置方法以及相关设备。
背景技术
现有技术中，配置设备能够对待配置的第一终端进行配置，以使待配置的第一终端能够接收到配置设备发送的经过加密的配置信息，接收到所述配置信息的第一终端若希望和第二终端建立安全连接，则所述第一终端将所述配置信息转发给所述第二终端，所述第二终端能够对所述配置信息进行验证，若验证通过，则所述第一终端和所述第二终端能够建立安全连接。例如，在无线局域网(Wireless Local Area Network，简称WLAN)中，所述第一终端可为接入点(Access Point，简称AP)，所述第二终端可为站点(Station，简称STA)，其中，AP能够将所述配置设备发送的配置信息发送给STA，STA对所述配置信息进行验证，若验证通过，则STA能够接入所述AP，还例如，在对等网络P2P network中，所述第一终端可为group owner简称GO设备，GO设备可作为P2P network的中心节点，第二终端可为P2P设备，其中，GO设备能够将所述配置设备发送的配置信息发送给P2P设备，P2P设备对所述配置信息进行验证若验证通过，则P2P设备能够接入所述GO设备；
但是，现有技术中的缺陷在于，以无线局域网为例，若攻击终端接收到所述配置设备发送的所述配置信息，所述攻击终端能够改变自己的角色，进而使得攻击终端能够假冒AP设备，攻击终端将自己的信息设置为AP的服务集标识(SSID，Service Set Identifier)，当有STA来连接AP时，攻击终端将从所述配置设备接收到的配置信息给STA，STA根据配置信息进行验证，且能够验证成功，STA无法识别攻击终端是假冒的AP，当攻击终端与STA建立连接后，攻击终端即可窃听STA的信息，可见，现有技术中的终端之间建立连接存在安全隐患。
发明内容
本发明提供了一种安全认证方法、配置方法以及相关设备。
本发明实施例第一方面提供了一种安全认证方法，包括：
第一终端接收配置设备发送的所述配置设备的签名公钥；
所述第一终端接收第二签名信息和第二类型信息，所述第二签名信息为所述配置设备发送给第二终端的签名信息，所述第二签名信息由配置设备至少根据所述第二类型信息和所述配置设备的签名私钥生成，所述第二类型信息为所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息，所述配置设备的签名公钥和所述配置设备的签名私钥对应；
所述第一终端至少根据所述第二类型信息和所述第二签名信息确定所述第一终端生成密钥信息，所述密钥信息用于第一终端与第二终端建立安全连接。
结合本发明实施例第一方面，本发明实施例第一方面的第一种实现方式中，
所述方法还包括：
所述第一终端接收所述配置设备发送的第一签名信息，所述第一签名信息由所述配置设备至少根据所述第一类型信息和签名私钥生成，所述第一类型信息为所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息。
结合本发明实施例第一方面的第一种实现方式，本发明实施例第一方面的第二种实现方式中，
所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
结合本发明实施例第一方面的第二种实现方式，本发明实施例第一方面的第三种实现方式中，
所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
结合本发明实施例第一方面的第三种实现方式，本发明实施例第一方面的第四种实现方式中，
结合本发明实施例第一方面至本发明实施例第一方面的第三种实现方式的任意一种方式,本发明实施例第一方面的第四种实现方式中，
所述第一终端至少根据所述第二类型信息和第二签名信息确定所述第一终端生成密钥信息包括：
所述第一终端确定所述第一类型信息和所述第二类型信息相匹配，且，所述第一终端确认所述第二签名信息与所述第二类型信息相匹配，则所述第一终端确定生成生成密钥信息。
结合本发明实施例第一方面的第四种实现方式,本发明实施例第一方面的第五种实现方式中，
所述第一终端至少根据所述第二类型信息和第二签名信息确定所述第一终端生成密钥信息之后包括：
所述第一终端生成所述密钥信息。
本发明实施例第二方面提供了一种配置方法，包括：
配置设备获得所述终端的类型信息，所述类型信息为终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成签名信息；
所述配置设备将所述签名信息和所述配置设备的签名公钥发送给所述终端，所述配置设备的签名公钥与所述配置设备的签名私钥相对应。
结合本发明实施例第二方面,本发明实施例第二方面的第一种实现方式中,
所述配置设备获得所述终端的类型信息包括：
所述配置设备接收所述终端发送的指示消息，所述指示消息包含所述类型信息。
结合本发明实施例第二方面,本发明实施例第二方面的第二种实现方式中,
所述配置设备获得所述终端的类型信息包括：
所述配置设备接收所述终端发送的发现消息；
所述配置设备根据所述发现消息确定所述类型信息，且所述发现消息与所述类型信息对应。
结合本发明实施例第二方面,本发明实施例第二方面的第三种实现方式中,
所述配置设备获得所述终端的类型信息包括：
所述配置设备接收用户输入的操作指令，所述操作指令用于指示所述类型信息。
结合本发明实施例第二方面,本发明实施例第二方面的第四种实现方式中,
所述配置设备获得所述终端的类型信息包括：
所述配置设备扫描所述终端中包含的所述类型信息的二维码；
或，
所述配置设备建立与所述终端的近距离无线通讯技术NFC连接以获取所述类型信息。
结合本发明实施例第二方面至本发明实施例第二方面的第四种实现方式任一项所示,本发明实施例第二方面的第五种实现方式中，
所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
结合本发明实施例第二方面至本发明实施例第二方面的第五种实现方式任一项所示,本发明实施例第二方面的第六种实现方式中,
所述签名信息还包括第一哈希值，所述第一哈希值为所述配置设备至少对所述类型信息进行哈希运算所生成的哈希值。
本发明实施例第三方面提供了一种配置方法，包括：
终端将所述终端的类型信息传递给配置设备，所述类型信息为所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
所述终端接收所述配置设备发送的签名信息和所述配置设备的签名公钥，所述签名信息为所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成，所述配置设备的签名公钥和所述配置设备的签名私钥对应。
结合本发明实施例第三方面,本发明实施例第三方面的第一种实现方式中，
所述终端将类型信息传递给配置设备包括：
所述终端生成指示消息，所述指示消息包含有所述类型信息；
所述终端将所述指示消息发送给所述配置设备。
结合本发明实施例第三方面,本发明实施例第三方面的第二种实现方式中,
所述终端将类型信息传递给配置设备包括：
所述终端生成发现消息；
所述终端将所述发现消息发送给所述配置设备，所述发现消息与所述类型信息对应。
结合本发明实施例第三方面,本发明实施例第三方面的第三种实现方式中，
所述终端将类型信息传递给配置设备包括：
所述终端生成二维码，所述二维码包含有所述类型信息；
或，
所述终端建立与所述配置设备的近距离无线通讯技术NFC连接；
所述终端通过所述NFC将所述类型信息发送给所述配置设备。
结合本发明实施例第三方面至本发明实施例第三方面的第三种实现方式任一项所述的方法,本发明实施例第三方面的第四种实现方式中，
所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设 备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
本发明实施例第四方面提供了一种第一终端，包括：
第一接收单元，用于接收配置设备发送的所述配置设备的签名公钥；
第二接收单元，用于接收第二签名信息和第二类型信息，所述第二签名信息为所述配置设备发送给第二终端的签名信息，所述第二签名信息由配置设备至少根据所述第二类型信息和所述配置设备的签名私钥生成，所述第二类型信息为所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息，所述配置设备的签名公钥和所述配置设备的签名私钥对应；
第一确定单元，用于至少根据所述第二类型信息和所述第二签名信息确定生成密钥信息，所述密钥信息用于第一终端与第二终端建立安全连接。
结合本发明实施例第四方面,本发明实施例第四方面的第一种实现方式中，
所述第一终端还包括：
第三接收单元，用于接收所述配置设备发送的第一签名信息，所述第一签名信息由所述配置设备至少根据所述第一类型信息和签名私钥生成，所述第一类型信息为所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息。
结合本发明实施例第四方面的第一种实现方式,本发明实施例第四方面的第二种实现方式中,
所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
结合本发明实施例第四方面的第二种实现方式,本发明实施例第四方面的第三种实现方式中，
所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
结合本发明实施例第四方面的第三种实现方式,本发明实施例第四方面的第四种实现方式中,
所述第一确定单元还用于，在确定所述第一类型信息和所述第二类型信息相匹配，并且所述第一终端确认所述第二签名信息匹配所述第二类型信息，则所述第一终端确定生成生成密钥信息。
结合本发明实施例第四方面的第四种实现方式,本发明实施例第四方面的第五种实现方式中,
所述第一终端还包括：
第一生成单元，用于生成所述密钥信息。
结合本发明实施例第四方面的第五种实现方式,本发明实施例第四方面的第六种实现方式中,
所述第一终端还包括：
第一发送单元，用于将所述第一签名信息发送给所述第二终端。
本发明实施例第五方面提供了一种配置设备，包括：
第四接收单元，用于获得所述终端的类型信息，所述类型信息为终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
第二生成单元，用于至少根据所述类型信息和所述配置设备的签名私钥生成签名信息；
第二发送单元，用于将所述签名信息和所述配置设备的签名公钥发送给所述终端，所述配置设备的签名公钥与所述配置设备的签名私钥相对应。
结合本发明实施例第五方面,本发明实施例第五方面的第一种实现方式中,
所述第四接收单元还用于，接收所述终端发送的指示消息，所述指示消息包含所述类型信息。
结合本发明实施例第五方面,本发明实施例第五方面的第二种实现方式中,
所述第四接收单元包括：
接收模块，用于接收所述终端发送的发现消息；
确定模块，用于根据所述发现消息确定所述类型信息，且所述发现消息与所述类型信息对应。
结合本发明实施例第五方面,本发明实施例第五方面的第三种实现方式中,
所述第四接收单元还用于，接收用户输入的操作指令，所述操作指令用于指示所述类型信息。
结合本发明实施例第五方面,本发明实施例第五方面的第四种实现方式中,
所述第四接收单元还用于，扫描所述终端中包含的所述类型信息的二维码；
或，
所述第四接收单元还用于，建立与所述终端的近距离无线通讯技术NFC连接以获取所述类型信息。
结合本发明实施例第五方面至本发明实施例第五方面的第四种实现方式的任意一种方式，本发明实施例第五方面的第五种实现方式中,
所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
结合本发明实施例第五方面至本发明实施例第五方面的第五种实现方式的任意一种方式,本发明实施例第五方面的第六种实现方式中,
所述签名信息还包括第一哈希值，所述第一哈希值为所述配置设备至少对所述类型信息进行哈希运算所生成的哈希值。
本发明实施例第六方面提供一种终端，包括：
第三发送单元，用于将所述终端的类型信息传递给配置设备，所述类型信息为所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
第五接收单元，用于接收所述配置设备发送的签名信息和所述配置设备的签名公钥，所述签名信息为所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成，所述配置设备的签名公钥和所述配置设备的签名私钥对应。
结合本发明实施例第六方面,本发明实施例第六方面的第一种实现方式中,
所述第三发送单元包括：
第一生成模块，用于生成指示消息，所述指示消息包含有所述类型信息；
第二发送模块，用于将所述指示消息发送给所述配置设备。
结合本发明实施例第六方面,本发明实施例第六方面的第二种实现方式中,
所述第三发送单元包括：
第二生成模块，用于生成发现消息；
第三发送模块，用于将所述发现消息发送给所述配置设备，所述发现消息与所述类型信息对应。
结合本发明实施例第六方面,本发明实施例第六方面的第三种实现方式中,
所述第三发送单元包括：
第三生成模块，用于生成二维码，所述二维码包含有所述类型信息；
或，
所述第三发送单元包括：
建立模块，用于建立与所述配置设备的近距离无线通讯技术NFC连接；
第四发送模块，用于通过所述NFC将所述类型信息发送给所述配置设备。
结合结合本发明实施例第六方面至发明实施例第六方面的第三种实现方式任一项所述的终端，本发明实施例第六方面的第四种实现方式中,
所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服 务集标识、媒体访问控制地址、或接入设备。
本发明实施例第七方面,提供了一种第一终端，
包括接收器、发送器和处理器，且所述处理器分别和所述接收器和所述发送器连接；
所述接收器，用于接收配置设备发送的所述配置设备的签名公钥；
所述接收器，用于接收第二签名信息和第二类型信息，所述第二签名信息为所述配置设备发送给第二终端的签名信息，所述第二签名信息由配置设备至少根据所述第二类型信息和所述配置设备的签名私钥生成，所述第二类型信息为所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息，所述配置设备的签名公钥和所述配置设备的签名私钥对应；
所述处理器，用于至少根据所述第二类型信息和所述第二签名信息确定所述第一终端生成密钥信息，所述密钥信息用于第一终端与第二终端建立安全连接。
结合本发明实施例第七方面,本发明实施例第七方面的第一种实现方式中,
所述接收器，用于接收所述配置设备发送的第一签名信息，所述第一签名信息由所述配置设备至少根据所述第一类型信息和签名私钥生成，所述第一类型信息为所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息。
结合结合本发明实施例第七方面,本发明实施例第七方面的第二种实现方式中,
所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
结合本发明实施例第七方面的第二种实现方式,本发明实施例第七方面的第三种实现方式中,
所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类 型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
结合本发明实施例第七方面的第三种实现方式,本发明实施例第七方面的第四种实现方式中,
所述处理器，用于在确定所述第一类型信息和所述第二类型信息相匹配，并且所述第一终端确认所述第二签名信息匹配所述第二类型信息，则确定生成生成密钥信息。
结合本发明实施例第七方面的第四种实现方式,本发明实施例第七方面的第五种实现方式中,
所述处理器，用于生成所述密钥信息。
结合本发明实施例第七方面的第五种实现方式,本发明实施例第七方面的第六种实现方式中,
所述发送器，用于将所述第一签名信息发送给所述第二终端。
本发明第八方面提供了一种配置设备，
包括发送器、接收器和处理器，且所述处理器分别和所述发送器和所述接收器连接；
所述接收器，用于获得所述终端的类型信息，所述类型信息为终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
所述处理器，用于至少根据所述类型信息和所述配置设备的签名私钥生成签名信息；
所述发送器，用于将所述签名信息和所述配置设备的签名公钥发送给所述终端，所述配置设备的签名公钥与所述配置设备的签名私钥相对应。
结合本发明八方面,本发明八方面的第一种实现方式中,
所述接收器，用于接收所述终端发送的指示消息，所述指示消息包含所述类型信息。
结合本发明八方面的第一种实现方式,本发明八方面的第二种实现方式中,
所述接收器，用于接收所述终端发送的发现消息；
所述处理器，用于根据所述发现消息确定所述类型信息，且所述发现消息与所述类型信息对应。
结合本发明第八方面,本发明八方面的第三种实现方式中,
所述接收器，用于接收用户输入的操作指令，所述操作指令用于指示所述类型信息。
结合本发明第八方面,本发明八方面的第四种实现方式中,
所述接收器，用于扫描所述终端中包含的所述类型信息的二维码；
或，
所述接收器，用于建立与所述终端的近距离无线通讯技术NFC连接以获取所述类型信息。
结合结合本发明第八方面至本发明八方面的第四种实现方式中任一项所述的配置设备，本发明八方面的第五种实现方式中,
所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
结合结合本发明第八方面至本发明八方面的第五种实现方式中任一项所述的配置设备，本发明八方面的第六种实现方式中,
所述签名信息还包括第一哈希值，所述第一哈希值为所述配置设备至少对所述类型信息进行哈希运算所生成的哈希值。
结合本发明第九方面提供了一种终端，
包括：发送器、接收器和处理器，其中，所述处理器分别和所述发送器和所述接收器连接；
发送器，用于将所述终端的类型信息传递给配置设备，所述类型信息为所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
接收器，用于接收所述配置设备发送的签名信息和所述配置设备的签名公钥，所述签名信息为所述配置设备至少根据所述类型信息和所述配置设备的签 名私钥生成，所述配置设备的签名公钥和所述配置设备的签名私钥对应。
结合本发明第九方面,本发明第九方面的第一种实现方式中,
所述处理器，用于生成指示消息，所述指示消息包含有所述类型信息；
所述发送器，用于将所述指示消息发送给所述配置设备。
结合本发明第九方面,本发明第九方面的第二种实现方式中,
所处理器，用于生成发现消息；
所述发送器，用于将所述发现消息发送给所述配置设备，所述发现消息与所述类型信息对应。
结合本发明第九方面,本发明第九方面的第三种实现方式中,
所述处理器，用于生成二维码，所述二维码包含有所述类型信息；
或，
所述处理器，用于建立与所述配置设备的近距离无线通讯技术NFC连接；
所述发送器，用于通过所述NFC将所述类型信息发送给所述配置设备。
结合本发明第九方面至本发明第九方面的第三种实现方式任一项所述的终端,本发明第九方面的第四种实现方式中,
所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
通过本实施例所提供的一种安全认证方法、配置方法以及相关设备，在建立第一终端与第二终端安全连接的过程中，所述第一终端不仅需要根据第二签名信息中所包含的用于建立连接的信息进行验证，且所述第一终端还需验证所述第二终端的类型信息，只有在验证通过的情况下，所述第一终端才会建立所述第一终端与所述第二终端的安全连接，有效的避免了终端对角色的篡改，从而有效的避免了终端与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。
附图说明
图1为本发明实施例所提供的安全认证方法的一种步骤流程图；
图2为本发明实施例所提供的安全认证方法的另一种步骤流程图；
图3为本发明实施例所提供的配置方法的一种步骤流程图；
图4为本发明实施例所提供的配置方法的另一种步骤流程图；
图5为本发明实施例所提供的第一终端的一种结构示意图；
图6为本发明实施例所提供的第一终端的另一种结构示意图；
图7为本发明实施例所提供的配置设备的一种结构示意图；
图8为本发明实施例所提供的配置设备的另一种结构示意图；
图9为本发明实施例所提供的终端的一种结构示意图；
图10为本发明实施例所提供的终端的另一种结构示意图；
图11为本发明实施例所提供的第一终端的另一种结构示意图；
图12为本发明实施例所提供的配置设备的另一种结构示意图；
图13为本发明实施例所提供的终端的另一种结构示意图。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
当本发明实施例提及“第一”、“第二”等序数词时，除非根据上下文其确实表达顺序之意，应当理解为仅仅起区分的作用。
图1为本发明实施例所提供的一种安全认证方法的步骤流程图，下面按照图1所示对本发明实施例所提供的安全认证方法进行详细说明，本发明实施例提供的安全认证方法包括：
101、第一终端接收配置设备发送的所述配置设备的签名公钥。
其中，配置器是对终端进行配置的设备，以使得配置后的终端可以和其他终端建立安全连接。
102、所述第一终端接收第二签名信息和第二类型信息；
其中，所述第二类型信息为所述第二终端的角色类型信息，和/或，所述 第二终端能够连接的角色类型信息。
即：第二类型信息可为第二终端的角色类型信息、第二类型信息还可为第二终端的角色类型信息和第二终端能够连接的角色类型信息、第二类型信息还可为第二终端能够连接的角色类型信息。
所述第二类型信息由所述第二终端发送给所述第一终端。
所述第二签名信息为所述配置设备发送给第二终端的签名信息，所述第二签名信息由配置设备至少根据所述第二类型信息和所述终端的签名私钥生成。
具体的，配置设备可以对所述第二类型信息进行哈希运算，并利用所述签名私钥对哈希运算的结果进行加密从而形成所述第二签名信息。
所述配置设备的签名公钥和所述配置设备的签名私钥对应。
用于第一终端能够利用配置设备的签名公钥对经过所述签名私钥加密的所述第二签名信息进行解密。
103、所述第一终端至少根据所述第二类型信息和所述第二签名信息确定所述第一终端生成密钥信息；
所述密钥信息用于第一终端与第二终端建立安全连接。
本实施例对所述第一终端具体如何根据所述第二类型信息和所述第二签名信息确定所述密钥信息的不做限定，只要所述第一终端能够确定所述第二终端角色类型信息，和/或，所述第二终端能够连接的角色类型信息的情况下，建立所述第一终端与所述第二终端的安全连接即可。
第一终端可以根据预设条件判断第一终端与第二终端的连接是否能够通过验证，其中，预设条件包括：第二类型信息和第二签名签名信息。预设条件还可以包括：配置器的信息，例如：网络标识(network ID)、对端密钥(peer key)等。
当第一终端判断第二终端发送的信息符合预设条件时，确定第二终端的连接请求通过认证，则第一终端生成密钥信息，以指示第一终端可以与第二终端建立安全连接。
具体的，用于建立所述第一终端与所述第二终端安全连接的所述密钥信息为现有技术，所述第一终端具体如何通过所述密钥信息建立所述第一终端与所述第二终端的安全连接亦为现有技术，具体在本实施例中不做赘述。
本实施例中，在所述第一终端与所述第二终端建立安全连接的过程中，所述第一终端不仅需要根据第二签名信息中所包含的用于建立连接的信息进行验证，且所述第一终端还需验证所述第二终端的类型信息，只有在验证通过的情况下，所述第一终端才会与所述第二终端建立安全连接，有效的避免了终端对角色的篡改，从而有效的避免了终端与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。
图2为本发明实施例安全认证方法的另一种步骤流程图，用于具体说明所述第一终端具体是如何对第二终端进行安全认证，从而建立所述第一终端与所述第二终端的安全连接的。
201、所述第一终端接收所述配置设备发送的第一签名信息和所述配置设备的签名公钥；
所述第一签名信息由所述配置设备至少根据所述第一类型信息和所述配置设备的签名私钥生成；
所述第一类型信息为所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息。
具体的，所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息可为以下类型信息的任一项：
站点STA，接入点AP，点对点组长设备P2P GO，点对点客户设备P2P client，锚主设备master，非锚主设备non-master，中继器repeater，码中心设备dock center，非码中心设备dockee，外设peripheral，源设备source，目标设备sink，服务集标识(SSID，service set identifier)，媒体访问控制地址(MAC，Media Access Control)，接入设备enrollee等。
需明确的是，以上仅为对所述第一终端的角色类型信息的示例性说明。
具体的，本实施例中，所述第一终端的角色类型信息和所述第一终端能够连接的角色类型信息为相互对应的两个角色类型信息，且相互对应角色的两个终端能够建立连接。
需要说明的是，相互对应的两个角色的类型信息可为：STA对应AP、P2P GO对应P2P client、master对应non-master、STA对应Repeater、AP对应repeater。
例如，若所述第一终端的角色类型信息为AP，则所述第一终端能够连接 的角色类型信息为STA，反之，若所述第一终端能够连接的角色类型信息为AP，则所述第一终端的角色类型信息为STA；
若第一终端的角色类型信息为repeater，则该第一终端能够连接的角色类型信息可为STA，也可为AP。
进一步的，若所述第一终端的角色类型信息为所述第一终端支持的能力，则所述第一终端能够连接的角色类型信息也为对应的第一终端支持的能力。
例如，所述第一终端的角色类型信息为所述第一终端能够支持P2P的设备，那么所述第一终端能够连接的角色类型信息为支持所述P2P的设备；
所述第一终端的角色类型信息为所述第一终端能够支持临近感知网络NAN的设备，那么所述第一终端能够连接的角色类型信息为支持所述临近感知网络NAN的设备；所述第一终端的角色类型信息为支持某基站子系统BSS的设备，那么所述第一终端能够连接的角色类型信息为支持所述基站子系统BSS的设备；
更具体的，若所述第一终端的角色类型信息为所述第一终端支持的某服务信息，则所述第一终端能够连接的角色类型信息也为对应的第一终端支持的某服务信息。
202、所述第一终端接收第二签名信息和第二类型信息；
所述第二签名信息由配置设备至少根据所述第二类型信息和所述配置设备的签名私钥生成，并由配置设备发送给第二终端，且，所述配置设备的签名公钥和所述配置设备的签名私钥对应。
所述第一终端还接收第二终端发送第二终端的公钥，用以生成密钥信息。
具体的，当所述第二终端要建立与所述第一终端的连接时，所述第二终端将第二签名信息和第二类型信息发送给所述第一终端。
其中，所述第二类型信息为所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息；
具体的，所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息可为以下类型信息的任一项：
站点STA，接入点AP，点对点组长设备P2P GO，点对点客户设备P2P client，锚主设备master，非锚主设备non-master，中继器repeater，码中心设 备dock center，非码中心设备dockee，外设peripheral，源设备source，目标设备sink，服务集标识(SSID，service set identifier)，媒体访问控制地址(MAC，Media Access Control)，接入设备enrollee等，
需明确的是，以上仅为对所述第二终端的角色类型信息的示例性说明。
此处对所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息的具体说明请详见步骤201中，对所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息的说明，此处不再赘述。
203、所述第一终端确定所述第一类型信息和所述第二类型信息相匹配，且第一终端确认所述第二签名信息与所述第二类型信息相匹配，则第一终端确定生成密钥信息。
具体的，若所述第一终端确定所述第二类型信息为所述第二终端能够连接的角色类型信息，且所述第一终端确定所述第一类型信息为所述第一终端能够连接的角色类型信息，若所述第二终端能够连接能够连接的角色类型信息与所述第一终端能够确定所述第一终端能够连接的角色类型信息相匹配，则说明所述第一终端和所述第二终端相匹配；
例如，所述第二终端能够连接能够连接的角色类型信息为STA，而所述第一终端能够连接的角色类型信息为AP，则说明所述第一终端和所述第二终端相匹配。
具体的，若所述第一终端确定所述第二类型信息所述第二终端的角色类型信息，且所述第一终端确定所述第一类型信息为所述第一终端的角色类型信息，若所述第二终端的角色类型信息与所述第一终端的角色类型信息相匹配，则说明所述第一终端和所述第二终端相匹配；
例如，所述第一终端确定所述第二终端的角色类型信息为AP，所述第一终端确定所述第一终端的角色类型信息为STA，则说明所述第一终端和所述第二终端相匹配。
具体的，若所述第一终端确定所述第二类型信息为所述第二终端能够连接的角色类型信息，且所述第一终端确定所述第一类型信息为所述第一终端的角色类型信息，若所述第二终端能够连接能够连接的角色类型信息与所述第一终端的角色类型信息相匹配，则说明所述第一终端和所述第二终端相匹配；
例如，所述第二终端能够连接能够连接的角色类型信息为AP，所述第一终端的角色类型信息为AP，则说明所述第一终端和所述第二终端相匹配；
上述示例以设备角色类型对应关系为：STA对应AP为示例以说明如何确定所述第一类型信息和所述第二类型信息相匹配进行示例说明，设备角色类型对应关系为P2P GO对应P2P client、master对应non-master、STA对应Repeater、AP对应repeater时，确定是否匹配的过程与STA对应AP相同，具体不再赘述。
还例如，若所述第一终端确定所述第二类型信息为所述第二终端的角色类型信息，且所述第二终端的角色类型信息为P2P设备，所述第二终端能够连接的角色类型信息是P2P设备，两者是相同的，则第一终端确定所述第一终端的角色类型信息是否是P2P设备即可，若第一终端的角色类型信息是P2P设备，则说明所述第一终端和所述第二终端相匹配；
还例如，若所述第一终端确定所述第二类型信息为所述第二终端角色类型信息，且所述第二终端角色类型信息为所述第二终端能够支持的服务，所述第一终端能够确定所述第一终端的角色类型信息为所述第一终端能够支持的服务，若所述第一终端确定所述第一终端能够支持的服务与所述第二终端能够支持的服务相同，则说明所述第一终端和所述第二终端相匹配。
具体的，判断第二签名信息与第二类型信息相匹配，包括：
所述第一终端至少对所述第二类型信息进行哈希运算以生成第二哈希值。
其中，哈希运算为现有技术，具体在本实施例中不做赘述。
所述第一终端通过所述签名公钥对所述第二签名信息进行解密以获取第一哈希值；
具体的，所述第一哈希值为所述配置设备至少对所述第二类型信息进行哈希运算所生成的哈希值；所述第一终端能够通过所述签名公钥对所述第二签名信息进行解密以获取到的第一哈希值。
所述第一终端确定第一哈希值是否等于所述第二哈希值，即第一终端确认第二签名信息是否与第二类型信息相匹。
具体的，所述配置设备对第一预定信息生成所述第一哈希值，所述第一终端对第二预定信息生成第二哈希值，当所述第一预定信息等于所述第二预定信 息时，所述第一哈希值等于第二哈希值。
需明确的是，上述执行过程中，所述第一终端所述第一终端通过步骤203确定所述第一类型信息和所述第二类型信息相匹配。
本发明实施例中，对于计算哈希值的步骤，以及第一类型信息与第二类型信息是否匹配的步骤的执行步骤可以更换；当在所述第一类型信息和所述第二类型信息相匹配，且第一终端确认第二签名信息与第二类型信息相匹配时，第一终端确定第二终端通过认证，第一终端生成密钥。
本实施例中，所述第一终端生成所述密钥信息时，所述第一终端至少基于所述第一类型信息和所述第二类型信息相匹配以及所述第一哈希值等于所述第二哈希值；
即在具体应用过程中，所述第一终端在生成所述密钥信息前，还可进行其他验证，具体在本实施例中不做限定；
即在具体应用过程中，所述第一终端在生成所述密钥信息前，还可进行其他验证，比如net ID，peer key等信息，具体在本实施例中不做限定；
例如所述第一终端接收第二设备发送的携带有上述信息的消息；
消息包含如下信息：
netID，peerKey，所述第二终端能够连接的角色类型信息；
netKey，所述第二终端的角色类型信息。
所述消息可以是action消息，修改现有802.11中的消息，或，新定义的消息。
所述第一终端接收到所述第二终端发送的所述第二签名信息后，所述第一终端验证net-id是否与所述第一终端的net-id相同，并检查peerKey是否匹配peer’s network key(即，所述第一终端的network key)，或，匹配wildcard。
其中，对公钥peer Key进行验证的具体过程请详见现有技术所示，另外验证这些信息的签名信息具体过程请详见现有技术所示，具体不再赘述。
即所述第一终端至少基于所述第一类型信息和所述第二类型信息相匹配以及所述第一哈希值等于所述第二哈希值时，所述第一终端生成成对主密钥PMK。
208、所述第一终端将所述第一签名信息发送给所述第二终端。
本实施例中，，所述第一终端可将所述第一签名消息发送给所述第二终端。
209、所述第一终端根据所述密钥信息建立所述第一终端与所述第二终端的安全连接；
具体的，所述第一终端利用所述第二终端的所述公钥net Key和所述第一终端的私钥生成所述PMK，从而根据所述PMK建立所述第一终端与所述第二终端的安全连接。
采用本实施例所示的安全认证方法，在建立所述第一终端与所述第二终端安全连接的过程中，所述第一终端不仅需要根据第二签名信息中所包含的用于建立连接的信息进行验证，且所述第一终端还需验证所述第二类型信息，在确定所述第一类型信息和所述第二类型信息匹配，且在确定所述第二签名信息正确的情况下，所述第一终端建立所述第一终端与所述第二终端的安全连接，有效的避免了终端对角色的篡改，从而有效的避免了终端与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。
上述过程中，所述第一终端通过第二终端发送的第二类型信息确定所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息为一种示例，不做限定；
例如，所述第一终端与所述第二终端之间执行发现过程，所述第一终端通过此过程获得所述第二终端的角色类型信息和/或，所述第二终端能够连接的角色类型信息；
而在此过程中，所述第二终端亦可获得所述第一终端的角色类型信息和/或，所述第一终端能够连接的角色类型信息；
比如执行802.11过程，所述第二终端作为STA发送probe request给所述第一终端，所述第一终端作为AP响应response。
所述第一终端可以获得所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息，同样第二终端亦可获得所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息；
因为这些发现过程中，终端的角色类型信息不同，则发送的消息也不同，可以通过终端发送的消息判断出终端的角色类型信息，和/或，能够连接的角色类型信息。
图1至图2所示的实施例说明了如何建立所述第一终端与所述第二终端如何进行安全认证以进行安全连接的，以下结合图3所示说明配置设备是如何对终端进行配置，以使配置后的终端能够建立与其他终端的安全连接关系的；
其中，图3为本发明实施例所提供的配置方法的一种步骤流程图；
301、终端将所述终端的类型信息传递给配置设备；
所述类型信息为所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
本实施例中，对所述终端具体如何将所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息传递给配置设备的不做限定，只要所述配置设备能够获取到所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息即可。
302、配置设备获得所述终端的类型信息；
所述类型信息为终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
本实施例对所述配置设备具体如何获得终端的角色类型信息，和/或，所述终端能够连接的角色类型信息的不做限定；
本实施例中，配置设备可以仅获取终端的角色类型信息，还可以获取终端的角色类型信息和终端能够连接的角色类型信息，也可以仅获取终端能够连接的角色类型信息。
本实施例中，对所述配置设备所获取到的所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息不做限定；
具体的，所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息可为以下类型信息的任一项，需明确的是，以下对所述终端的角色类型信息仅仅为示例性的说明，不做限定；
站点STA，接入点AP，点对点组长设备P2P GO，点对点客户设备P2P client，锚主设备master，非锚主设备non-master，中继器repeater，码中心设备dock center，非码中心设备dockee，外设peripheral，源设备source，目标设备sink，SSID服务集标识(service set identifier)，MAC媒体访问控制地址，接入设备enrollee；
具体的，本实施例中，所述终端的角色类型信息和所述终端能够连接的角色类型信息为相互对应的两个角色类型信息，且相互对应的两个终端能够建立连接；
例如，若所述终端的角色类型信息为AP，则所述终端能够连接的角色类型信息为STA，反之，若所述终端能够连接的角色类型信息为AP，则所述终端的角色类型信息为STA；
还例如，相互对应的两个角色类型信息可为：STA对应AP、P2P GO对应P2P client、master对应non-master、STA对应Repeater、AP对应repeater；
具体的，若终端的角色类型信息为repeater，则该终端能够连接的角色类型信息可为STA，也可为AP；
更具体的，若所述终端的角色类型信息为所述终端支持的能力，则所述终端能够连接的角色类型信息也为对应的终端支持的能力；
例如，所述终端的角色类型信息为所述终端能够支持P2P的设备，那么所述终端能够连接的角色类型信息为支持所述P2P的设备；
还例如，所述终端的角色类型信息为所述终端能够支持临近感知网络NAN的设备，那么所述终端能够连接的角色类型信息为支持所述临近感知网络NAN的设备；
还例如，所述终端的角色类型信息为支持某基站子系统BSS的设备，那么所述终端能够连接的角色类型信息为支持所述基站子系统BSS的设备；
更具体的，若所述终端的角色类型信息为所述终端支持的某服务信息，则所述终端能够连接的角色类型信息也为对应的终端支持的某服务信息。
303、所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成签名信息；
具体的，所述配置设备至少将所述类型信息进行哈希运算以生成哈希值，并将已生成的哈希值通过签名私钥进行加密以生成所述签名信息；
需明确的是，具体如何根据签名私钥生成所述签名信息为现有技术，具体在本实施例中不做赘述。
304、所述配置设备将所述签名信息和所述配置设备的签名公钥发送给所述终端；
本实施例中，对所述配置设备具体如何发送所述签名信息和所述签名公钥的不做限定；
例如，所述配置设备可将所述签名信息和所述签名公钥作为独立的两个消息或一个消息同时发送给终端，通过同一消息发送给终端，还可以或将所述签名信息和所述签名公钥先后分别发送至所述终端，具体不做限定；
305、所述终端接收所述配置设备发送的签名信息和所述配置设备的签名公钥；
所述签名信息为所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成；
其中，所述配置设备的签名公钥与所述配置设备的签名私钥相对应，以使接收到所述签名公钥的终端能够对经过所述签名私钥加密的所述签名信息进行解密处理。
当所述终端接收到所述配置设备发送的签名信息和所述配置设备的签名公钥则完成所述配置设备对所述终端的配置，从而使得终端能够基于所述配置设备的配置以进行图1至图2所示的安全认证的过程。
采用本实施例所示的配置方法，所述配置设备向终端发送签名信息和所述配置设备的签名公钥，从而使得终端在需要接入到其他终端时，终端能够将配置设备发送的所述签名信息和自己的类型信息发送给其他终端，进而使得其他终端不仅仅要验证所述签名信息是否正确，还需要验证终端之间是否匹配，只有两个终端的类型信息相互匹配且所述签名信息正确时，才会建立两个终端之间的安全连接关系，有效的避免了终端对角色的篡改，从而有效的避免了终端与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。
以下结合图4所示对配置设备具体如何对终端进行配置的进行详细说明，其中，图4为本发明实施例所提供的配置方法的另一种步骤流程图；
401、所述配置设备获取所述终端的第一DH公钥；
具体的，所述终端拥有用于进行密钥交换的第一DH公钥和第一DH私钥，配置设备拥有用于进行密钥交换的第二DH公钥和第二DH私钥；
所述配置设备获取所述第一DH公钥的方式可为：所述配置设备扫描所述 终端包含有所述第一DH公钥的二维码，或者，所述终端将其拥有的第一DH公钥发送给所述配置设备，具体不做限定；
402、配置设备将第二DH公钥发送给终端；
403、配置设备生成第二交互密钥；
具体的，所述配置设备根据所述第一DH公钥和所述第二DH私钥通过密钥交换算法计算第二交互密钥；
所述密钥交互算法可为DH算法或ECDH算法，具体请详见现有技术所示，具体不再赘述；
404、所述终端生成第一交互密钥；
具体的，所述终端根据所述第二DH公钥和所述第一DH私钥通过所述密钥交换计算所述第一交互密钥；
405、所述配置设备和所述终端建立安全连接；
具体的，因所述第一交互密钥和所述第二交互密钥为对等的，基于这个对等密钥，或，对等密钥的衍生密钥，所述配置设备即可与所述终端建立安全连接。
本实施例中，对所述配置设备具体何时获得终端的类型信息的不做限定；
例如，所述配置设备在可所述配置设备与所述终端建立安全连接的过程中获取终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
还例如，所述配置设备在可所述配置设备与所述终端建立安全连接成功后，获取终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
以下首先说明所述配置设备如何在所述配置设备与所述终端建立安全连接的过程中获取所述类型信息的进行说明：
所述配置设备获取所述终端的身份公钥；
具体的，所述配置设备获取所述终端QR-code中的身份公钥identity key；
更具体的，所述配置设备获取所述终端的身份公钥的具体方式不做限定，例如，所述终端可通过包含有所述身份公钥的消息发送给所述配置设备，或者，所述配置设备扫描所述终端包含有所述身份公钥的二维码等方式；
所述配置设备将与所述身份公钥对应的第一目标哈希值发送给所述终端；
具体的，所述配置设备对所述身份公钥进行哈希运算以生成所述第一目标 哈希值；
更具体的，所述配置设备和通过包含有所述第一目标哈希值的消息DPP Authentication Request发送给所述终端；
其中，所述DPP Authentication Request可为：H(EI),H(CI),CE,{C-nonce}K1→
其中，H(EI)为利用所述终端的身份公钥identity key生成所述第一目标哈希值，H(CI)为所述配置设备的身份公钥identity key生成哈希值；
若所述终端确定所述第一目标哈希值满足预设要求，则所述终端生成响应消息；
具体的，所述终端接收到所述消息DPP Authentication Request后，所述终端对所述终端的身份公钥进行哈希运算以生成第二目标哈希值；
所述预设要求为所述第一目标哈希值等于所述第二目标哈希值；
所述响应消息DPP Authentication Response可为：DPP Authentication Response：←H(EI),[H(CI),]{E-nonce|C-nonce|EN}K1,{E-auth}Ke；
且本实施例所示的响应消息还携带有所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
所述终端将所述响应消息发送给所述配置设备；
所述配置设备根据所述响应消息即可确定所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
所述配置设备在确定了所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息后，则向所述终端发送确认消息；
所述确认消息为DPP Authentication Confirm：H(EI),[H(CI),]{C-auth}Ke→
本实施例以配置设备在可所述配置设备与所述终端建立安全连接成功后，获取终端的角色类型信息，和/或，所述终端能够连接的角色类型信息为例进行说明：
即在执行了步骤401至步骤405以使所述配置设备和终端建立了安全连接后，则执行步骤406；
406、所述配置设备获得所述终端的类型信息；
所述终端的类型信息为所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
本实施例中，所述配置设备获得终端的角色类型信息，和/或，所述终端能够连接的角色类型信息的方式有以下几种情况，需明确的是，以下对所述配置设备获得终端的角色类型信息，和/或，所述终端能够连接的角色类型信息的方式为示例性的说明，不做限定：
一种、所述配置设备接收所述终端发送的指示消息；
其中，所述终端能够在所述指示消息里指示所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息。
另一种、所述配置设备接收所述终端发送的发现消息；
所述配置设备根据所述发现消息确定所述类型信息；
其中，所述发现消息与所述类型信息对应；
例如，所述配置设备与终端之间执行发现过程，配置设备通过此过程获得终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
比如执行802.11过程，若所述配置设备确定所接收到的发现消息为probe request，则所述配置设备即可确定所述终端的角色类型信息为STA，和/或，所述配置设备能够确定所述终端能够连接的角色类型信息为AP；
若所述配置设备所接收到的发现消息为response，则所述配置设备即可确定所述终端的角色类型信息为AP，和/或，所述配置设备能够确定所述终端能够连接的角色类型信息为STA；
所述配置设备采用本种确定方式的原因在于，因为这些发现过程中，终端的角色不同，发送的发现消息也会不同，从而使得配置设备可以通过终端发送的发现消息的不同判断出终端的角色类型信息，和/或，所述终端能够连接的角色类型信息。
另一种、所述配置设备设置有操作界面，用户可通过所述操作界面输入操作指令，以使用户通过所述操作指令直接指示所述类型信息。
比如：用户选择输入配置设备到网络中，配置器获得终端设备的角色类型为STA，能连接的设备类型为AP，比如用户选择输入配置网络，配置器获得 终端设备的角色类型为AP，能连接的设备类型为STA。
另一种，所述配置设备可扫描所述终端的二维码，所述终端的二维码里包含有所述类型信息，以使配置设备通过扫描所述二维码能够直接获取所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息。
另一种，所述配置设备建立与所述终端的近距离无线通讯技术NFC连接，从而使得所述配置设备能够通过所述NFC连接以获取所述类型信息。
407、所述终端设备将公钥net Key传递给配置设备；
408、所述配置设备生成配置消息；
本实施例中，所述配置消息至少包括公钥net Key、所述配置设备的签名公钥和所述终端的所述类型信息；
当然，所述配置消息里还可包括其他内容，具体在本实施例中不做限定；
具体的，所述配置消息DPP Configuration Response可为：{net-id,cruft,C-name,C-sign-key,connector,[connector…][,configurators][,introducers]}Ke→
其中，字段Connector::＝
SEQUENCE{
netID INTEGER,
peerKey SubjectPublicKeyInfo，
所述终端能够连接的角色类型信息，
netKey SubjectPublicKeyInfo,
所述终端的角色类型信息，
introducer DirectoryString}
409、所述配置设备对所述配置信息进行哈希运算；
410、所述配置设备确定签名信息。
其中，所述签名信息为经过哈希运算后的所述配置信息通过所述配置设备的签名私钥进行加密所形成的。
其中，哈希hash运算为一种散列算法，Hash算法可以将输入一些数经过hash运算后生成另外一些数，并且具有单向性。
具体的，本实施例中，所述签名信息包括第一哈希值，所述第一哈希值为 所述配置设备对所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息进行哈希运算所生成的哈希值。
采用本实施例所示的配置方法，所述配置设备向终端发送签名信息和所述配置设备的签名公钥，从而使得终端在需要接入到其他终端时，终端能够将配置设备发送的所述签名信息和自己的类型信息发送给其他终端，进而使得其他终端不仅仅要验证所述签名信息是否正确，还需要验证终端之间是否匹配，只有两个终端的类型信息相互匹配且所述签名信息正确时，才会建立两个终端之间的安全连接关系，有效的避免了终端对角色的篡改，从而有效的避免了终端与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。
以下结合图5所示对能够实现图1所示的安全认证方法的第一终端的具体结构进行详细说明，其中，图5为本发明实施例所提供的第一终端的一种结构示意图；
所述第一终端包括：
第一接收单元501，用于接收配置设备发送的所述配置设备的签名公钥；
第二接收单元502，用于接收第二签名信息和第二类型信息，所述第二签名信息为所述配置设备发送给第二终端的签名信息，所述第二签名信息由配置设备至少根据所述第二类型信息和所述配置设备的签名私钥生成，所述第二类型信息为所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息，所述配置设备的签名公钥和所述配置设备的签名私钥对应；
第一确定单元503，用于至少根据所述第二类型信息和所述第二签名信息确定生成密钥信息，所述密钥信息用于第一终端与第二终端建立安全连接。
本实施例中，在建立所述第一终端与所述第二终端安全连接的过程中，所述第一终端不仅需要根据第二签名信息中所包含的用于建立连接的信息进行验证，且所述第一终端还需验证所述第二终端的类型信息，只有在验证通过的情况下，所述第一终端才会建立所述第一终端与所述第二终端的安全连接，有效的避免了终端对角色的篡改，从而有效的避免了终端与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。
以下结合图6所示对能够实现图2所示的安全认证方法的第一终端的具体 结构进行详细说明，其中，图6为本发明实施例所提供的第一终端的另一种结构示意图；
第三接收单元601，用于接收所述配置设备发送的第一签名信息，所述第一签名信息由所述配置设备至少根据所述第一类型信息和签名私钥生成，所述第一类型信息为所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息；
其中，所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
第一接收单元602，用于接收配置设备发送的所述配置设备的签名公钥；
第二接收单元603，用于接收第二签名信息和第二类型信息，所述第二签名信息为所述配置设备发送给第二终端的签名信息，所述第二签名信息由配置设备至少根据所述第二类型信息和所述配置设备的签名私钥生成，所述第二类型信息为所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息，所述配置设备的签名公钥和所述配置设备的签名私钥对应；
所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
第一确定单元604，用于至少根据所述第二类型信息和所述第二签名信息确定生成密钥信息，所述密钥信息用于第一终端与第二终端建立安全连接。
具体的，所述第一确定单元604还用于，在确定所述第一类型信息和所述第二类型信息相匹配，并且所述第一终端确认所述第二签名信息匹配所述第二类型信息，则所述第一终端确定生成生成密钥信息；
第一生成单元605，用于生成所述密钥信息。
第一发送单元606，用于将所述第一签名信息发送给所述第二终端。
采用本实施例所示的第一终端，在建立所述第一终端与所述第二终端安全连接的过程中，所述第一终端不仅需要根据第二签名信息中所包含的用于建立连接的信息进行验证，且所述第一终端还需验证所述第二类型信息，在确定所述第一类型信息和所述第二类型信息匹配，且在确定所述第二签名信息正确的情况下，所述第一终端建立所述第一终端与所述第二终端的安全连接，有效的避免了终端对角色的篡改，从而有效的避免了终端与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。
以下结合图7所示对能够实现对终端进行配置，以使终端之间能够建立安全连接的配置设备的具体结构进行说明，其中，图7为本发明实施例所提供的配置设备的一种结构示意图；
所述配置设备包括：
第四接收单元701，用于获得所述终端的类型信息，所述类型信息为终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
第二生成单元702，用于至少根据所述类型信息和所述配置设备的签名私钥生成签名信息；
第二发送单元703，用于将所述签名信息和所述配置设备的签名公钥发送给所述终端，所述配置设备的签名公钥与所述配置设备的签名私钥相对应。
采用本实施例所示的配置设备，所述配置设备向终端发送签名信息和所述配置设备的签名公钥，从而使得终端在需要接入到其他终端时，终端能够将配置设备发送的所述签名信息和自己的类型信息发送给其他终端，进而使得其他终端不仅仅要验证所述签名信息是否正确，还需要验证终端之间是否匹配，只有两个终端的类型信息相互匹配且所述签名信息正确时，才会建立两个终端之间的安全连接关系，有效的避免了终端对角色的篡改，从而有效的避免了终端与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。
以下结合图8所示对所述配置设备的具体结构进行进一步的详细说明，其中，图8为本发明实施例所提供的配置设备的另一种结构示意图；
第四接收单元801，用于获得所述终端的类型信息，所述类型信息为终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
所述第四接收单元801还用于，接收所述终端发送的指示消息，所述指示消息包含所述类型信息。
所述第四接收单元801还用于，接收用户输入的操作指令，所述操作指令用于指示所述类型信息。
所述第四接收单元801还用于，扫描所述终端中包含的所述类型信息的二维码；
所述第四接收单元801还用于，建立与所述终端的近距离无线通讯技术NFC连接以获取所述类型信息。
可选的，所述第四接收单元801包括：
接收模块8011，用于接收所述终端发送的发现消息；
确定模块8012，用于根据所述发现消息确定所述类型信息，且所述发现消息与所述类型信息对应。
第二生成单元802，用于至少根据所述类型信息和所述配置设备的签名私钥生成签名信息；
所述签名信息还包括第一哈希值，所述第一哈希值为所述配置设备至少对所述类型信息进行哈希运算所生成的哈希值。
第二发送单元803，用于将所述签名信息和所述配置设备的签名公钥发送给所述终端，所述配置设备的签名公钥与所述配置设备的签名私钥相对应。
采用本实施例所示的配置设备，所述配置设备向终端发送签名信息和所述配置设备的签名公钥，从而使得终端在需要接入到其他终端时，终端能够将配置设备发送的所述签名信息和自己的类型信息发送给其他终端，进而使得其他终端不仅仅要验证所述签名信息是否正确，还需要验证终端之间是否匹配，只有两个终端的类型信息相互匹配且所述签名信息正确时，才会建立两个终端之间的安全连接关系，有效的避免了终端对角色的篡改，从而有效的避免了终端 与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。
图7至图8所示从配置设备的角度说明了当所述配置设备对所述终端设备进行配置时，所述配置设备的具体结构，以下结合图9所示说明所述配置设备对所述终端设备进行配置时，所述终端的具体结构；
其中，图9为本发明实施例所提供的终端的一种结构示意图；
所述终端包括：
第三发送单元901，用于将所述终端的类型信息传递给配置设备，所述类型信息为所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
第五接收单元902，用于接收所述配置设备发送的签名信息和所述配置设备的签名公钥，所述签名信息为所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成，所述配置设备的签名公钥和所述配置设备的签名私钥对应。
采用本实施例所示的终端，所述配置设备向终端发送签名信息和所述配置设备的签名公钥，从而使得终端在需要接入到其他终端时，终端能够将配置设备发送的所述签名信息和自己的类型信息发送给其他终端，进而使得其他终端不仅仅要验证所述签名信息是否正确，还需要验证终端之间是否匹配，只有两个终端的类型信息相互匹配且所述签名信息正确时，才会建立两个终端之间的安全连接关系，有效的避免了终端对角色的篡改，从而有效的避免了终端与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。
以下结合图10所示对所述终端的具体结构进行进一步的详细说明：
其中，图10为本发明实施例所提供的终端的另一种结构示意图；
所述终端包括：
第三发送单元1001，用于将所述终端的类型信息传递给配置设备，所述类型信息为所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
具体的，所述第三发送单元1001包括：
第一生成模块10011，用于生成指示消息，所述指示消息包含有所述类型信息；
第二发送模块10012，用于将所述指示消息发送给所述配置设备；
或者，
所述第三发送单元1001包括：
第二生成模块10013，用于生成发现消息；
第三发送模块10014，用于将所述发现消息发送给所述配置设备，所述发现消息与所述类型信息对应。
或者，
所述第三发送单元1001包括：
第三生成模块10015，用于生成二维码，所述二维码包含有所述类型信息；
或者，
所述第三发送单元1001包括：
建立模块10016，用于建立与所述配置设备的近距离无线通讯技术NFC连接；
第四发送模块10017，用于通过所述NFC将所述类型信息发送给所述配置设备。
第五接收单元1002，用于接收所述配置设备发送的签名信息和所述配置设备的签名公钥，所述签名信息为所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成，所述配置设备的签名公钥和所述配置设备的签名私钥对应；
其中，所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
采用本实施例所示的终端，所述配置设备向终端发送签名信息和所述配置设备的签名公钥，从而使得终端在需要接入到其他终端时，终端能够将配置设备发送的所述签名信息和自己的类型信息发送给其他终端，进而使得其他终端 不仅仅要验证所述签名信息是否正确，还需要验证终端之间是否匹配，只有两个终端的类型信息相互匹配且所述签名信息正确时，才会建立两个终端之间的安全连接关系，有效的避免了终端对角色的篡改，从而有效的避免了终端与更改了角色的攻击终端建立连接，进而避免攻击终端获取终端的信息，有效的保障了终端的安全。
图5至图6所示的实施例从功能模块的角度对第一终端的具体结构进行说明，以下结合图11所示的实施例从硬件角度对第一终端的具体结构进行说明：
如图11所示，该第一终端包括：发送器1101、接收器1102和处理器1103；其中，处理器1103可为一个或多个，在本实施例中以一个为例进行说明：
且本实施例中发送器1101、接收器1102和处理器1103之间通过总线进行连接，当然也可采用其他的连接方式，具体连接方式在本实施例中不作限定。
本发明实施例涉及的第一终端可以具有比图11所示出的更多或更少的部件，可以组合两个或更多个部件，或者可以具有不同的部件配置或设置，各个部件可以在包括一个或多个信号处理和/或专用集成电路在内的硬件、软件或硬件和软件的组合实现。
所述接收器1102，用于接收配置设备发送的所述配置设备的签名公钥；
所述接收器1102，用于接收第二签名信息和第二类型信息，所述第二签名信息为所述配置设备发送给第二终端的签名信息，所述第二签名信息由配置设备至少根据所述第二类型信息和所述配置设备的签名私钥生成，所述第二类型信息为所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息，所述配置设备的签名公钥和所述配置设备的签名私钥对应；
所述处理器1103，用于至少根据所述第二类型信息和所述第二签名信息确定所述第一终端生成密钥信息，所述密钥信息用于第一终端与第二终端建立安全连接。
可选的，所述接收器1102，用于接收所述配置设备发送的第一签名信息，所述第一签名信息由所述配置设备至少根据所述第一类型信息和签名私钥生成，所述第一类型信息为所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息。
可选的，所述第一终端的角色类型信息，和/或，所述第一终端能够连接 的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
可选的，所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
可选的，所述处理器1103，用于在确定所述第一类型信息和所述第二类型信息相匹配，并且所述第一终端确认所述第二签名信息匹配所述第二类型信息，则确定生成生成密钥信息。
可选的，所述处理器1103，用于生成所述密钥信息。
可选的，所述发送器1101，用于将所述第一签名信息发送给所述第二终端。
图7至图8所示的实施例从功能模块的角度对配置设备的具体结构进行说明，以下结合图12所示的实施例从硬件角度对配置设备的具体结构进行说明：
如图12所示，该配置设备包括：发送器1201、接收器1202和处理器1203；其中，处理器1203可为一个或多个，在本实施例中以一个为例进行说明：
且本实施例中发送器1201、接收器1202和处理器1203之间通过总线进行连接，当然也可采用其他的连接方式，具体连接方式在本实施例中不作限定。
本发明实施例涉及的配置设备可以具有比图12所示出的更多或更少的部件，可以组合两个或更多个部件，或者可以具有不同的部件配置或设置，各个部件可以在包括一个或多个信号处理和/或专用集成电路在内的硬件、软件或硬件和软件的组合实现。
所述接收器1202，用于获得所述终端的类型信息，所述类型信息为终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
所述处理器1203，用于至少根据所述类型信息和所述配置设备的签名私钥生成签名信息；
所述发送器1201，用于将所述签名信息和所述配置设备的签名公钥发送给所述终端，所述配置设备的签名公钥与所述配置设备的签名私钥相对应。
可选的，所述接收器1202，用于接收所述终端发送的指示消息，所述指示消息包含所述类型信息。
可选的，所述接收器1202，用于接收所述终端发送的发现消息；
所述处理器1203，用于根据所述发现消息确定所述类型信息，且所述发现消息与所述类型信息对应。
可选的，所述接收器1202，用于接收用户输入的操作指令，所述操作指令用于指示所述类型信息。
可选的，所述接收器1202，用于扫描所述终端中包含的所述类型信息的二维码；
或，
所述接收器1202，用于建立与所述终端的近距离无线通讯技术NFC连接以获取所述类型信息。
可选的，所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
可选的，所述签名信息还包括第一哈希值，所述第一哈希值为所述配置设备至少对所述类型信息进行哈希运算所生成的哈希值。
图9至图10所示的实施例从功能模块的角度对终端的具体结构进行说明，以下结合图13所示的实施例从硬件角度对终端的具体结构进行说明：
如图13所示，该终端包括：发送器1301、接收器1302和处理器13031303；其中，处理器13031303可为一个或多个，在本实施例中以一个为例进行说明：
且本实施例中发送器1301、接收器1302和处理器13031303之间通过总线进行连接，当然也可采用其他的连接方式，具体连接方式在本实施例中不作限定。
本发明实施例涉及的终端可以具有比图13所示出的更多或更少的部件， 可以组合两个或更多个部件，或者可以具有不同的部件配置或设置，各个部件可以在包括一个或多个信号处理和/或专用集成电路在内的硬件、软件或硬件和软件的组合实现。
所述终端包括：
发送器1301，用于将所述终端的类型信息传递给配置设备，所述类型信息为所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
接收器1302，用于接收所述配置设备发送的签名信息和所述配置设备的签名公钥，所述签名信息为所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成，所述配置设备的签名公钥和所述配置设备的签名私钥对应。
可选的，
所述处理器1303，用于生成指示消息，所述指示消息包含有所述类型信息；
所述发送器1301，用于将所述指示消息发送给所述配置设备。
可选的，
所处理器1303，用于生成发现消息；
所述发送器1301，用于将所述发现消息发送给所述配置设备，所述发现消息与所述类型信息对应。
可选的，所述处理器1303，用于生成二维码，所述二维码包含有所述类型信息；
或，
所述处理器1303，用于建立与所述配置设备的近距离无线通讯技术NFC连接；
所述发送器1301，用于通过所述NFC将所述类型信息发送给所述配置设备。
可选的，所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服 务集标识、媒体访问控制地址、或接入设备。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (56)

  1. 一种安全认证方法，其特征在于，包括：
    第一终端接收配置设备发送的所述配置设备的签名公钥；
    所述第一终端接收第二签名信息和第二类型信息，所述第二签名信息为所述配置设备发送给第二终端的签名信息，所述第二签名信息由配置设备至少根据所述第二类型信息和所述配置设备的签名私钥生成，所述第二类型信息为所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息，所述配置设备的签名公钥和所述配置设备的签名私钥对应；
    所述第一终端至少根据所述第二类型信息和所述第二签名信息确定所述第一终端生成密钥信息，所述密钥信息用于第一终端与第二终端建立安全连接。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一终端接收所述配置设备发送的第一签名信息，所述第一签名信息由所述配置设备至少根据所述第一类型信息和签名私钥生成，所述第一类型信息为所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息。
  3. 根据权利要求2所述的方法，其特征在于，所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息为：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
  4. 根据权利要求1-3任一项所述的方法，其特征在于，所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息为：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
  5. 根据权利要求1-4任一项所述的方法，其特征在于，所述第一终端至少根据所述第二类型信息和第二签名信息确定所述第一终端生成密钥信息包括：
    所述第一终端确定所述第一类型信息和所述第二类型信息相匹配，且，所述第一终端确认所述第二签名信息与所述第二类型信息相匹配，则所述第一终端确定生成生成密钥信息。
  6. 根据权利要求5所述的方法，其特征在于，所述第一终端至少根据所述第二类型信息和第二签名信息确定所述第一终端生成密钥信息之后，包括：
    所述第一终端生成所述密钥信息。
  7. 一种配置方法，用于配置终端设备，其特征在于，包括：
    配置设备获得所述终端的类型信息，所述类型信息为终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
    所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成签名信息；
    所述配置设备将所述签名信息和所述配置设备的签名公钥发送给所述终端，所述配置设备的签名公钥与所述配置设备的签名私钥相对应。
  8. 根据权利要求7所述的方法，其特征在于，所述配置设备获得所述终端的类型信息包括：
    所述配置设备接收所述终端发送的指示消息，所述指示消息包含所述类型信息。
  9. 根据权利要求7所述的方法，其特征在于，所述配置设备获得所述终端的类型信息包括：
    所述配置设备接收所述终端发送的发现消息；
    所述配置设备根据所述发现消息确定所述类型信息，且所述发现消息与所述类型信息对应。
  10. 根据权利要求7所述的方法，其特征在于，所述配置设备获得所述终端的类型信息包括：
    所述配置设备接收用户输入的操作指令，所述操作指令用于指示所述类型信息。
  11. 根据权利要求7所述的方法，其特征在于，所述配置设备获得所述终端的类型信息包括：
    所述配置设备扫描所述终端中包含的所述类型信息的二维码；
    或，
    所述配置设备建立与所述终端的近距离无线通讯技术NFC连接以获取所述类型信息。
  12. 根据权利要求7至11任一项所述的方法，其特征在于，所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
  13. 根据权利要求7至12任一项所述的方法，其特征在于，所述签名信息还包括第一哈希值，所述第一哈希值为所述配置设备至少对所述类型信息进行哈希运算所生成的哈希值。
  14. 一种配置方法，其特征在于，包括：
    终端将所述终端的类型信息传递给配置设备，所述类型信息为所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
    所述终端接收所述配置设备发送的签名信息和所述配置设备的签名公钥，所述签名信息为所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成，所述配置设备的签名公钥和所述配置设备的签名私钥对应。
  15. 根据权利要求14所述的方法，其特征在于，所述终端将类型信息传递给配置设备包括：
    所述终端生成指示消息，所述指示消息包含有所述类型信息；
    所述终端将所述指示消息发送给所述配置设备。
  16. 根据权利要求14所述的方法，其特征在于，所述终端将类型信息传递给配置设备包括：
    所述终端生成发现消息；
    所述终端将所述发现消息发送给所述配置设备，所述发现消息与所述类型信息对应。
  17. 根据权利要求14所述的方法，其特征在于，所述终端将类型信息传递给配置设备包括：
    所述终端生成二维码，所述二维码包含有所述类型信息；
    或，
    所述终端建立与所述配置设备的近距离无线通讯技术NFC连接；
    所述终端通过所述NFC将所述类型信息发送给所述配置设备。
  18. 根据权利要求14至17任一项所述的方法，其特征在于，所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
  19. 一种第一终端，其特征在于，包括：
    第一接收单元，用于接收配置设备发送的所述配置设备的签名公钥；
    第二接收单元，用于接收第二签名信息和第二类型信息，所述第二签名信息为所述配置设备发送给第二终端的签名信息，所述第二签名信息由配置设备至少根据所述第二类型信息和所述配置设备的签名私钥生成，所述第二类型信息为所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息，所述配置设备的签名公钥和所述配置设备的签名私钥对应；
    第一确定单元，用于至少根据所述第二类型信息和所述第二签名信息确定生成密钥信息，所述密钥信息用于第一终端与第二终端建立安全连接。
  20. 根据权利要求19所述的第一终端，其特征在于，所述第一终端还包括：
    第三接收单元，用于接收所述配置设备发送的第一签名信息，所述第一签名信息由所述配置设备至少根据所述第一类型信息和签名私钥生成，所述第一类型信息为所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息。
  21. 根据权利要求20所述的第一终端，其特征在于，所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息包括：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
  22. 根据权利要求21所述的第一终端，其特征在于，所述第二终端的角 色类型信息，和/或，所述第二终端能够连接的角色类型信息包括：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
  23. 根据权利要求22所述的第一终端，其特征在于，所述第一确定单元还用于，在确定所述第一类型信息和所述第二类型信息相匹配，并且所述第一终端确认所述第二签名信息匹配所述第二类型信息，则所述第一终端确定生成生成密钥信息。
  24. 根据权利要求23所述的第一终端，其特征在于，所述第一终端还包括：
    第一生成单元，用于生成所述密钥信息。
  25. 根据权利要求24所述的第一终端，其特征在于，所述第一终端还包括：
    第一发送单元，用于将所述第一签名信息发送给所述第二终端。
  26. 一种配置设备，其特征在于，包括：
    第四接收单元，用于获得所述终端的类型信息，所述类型信息为终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
    第二生成单元，用于至少根据所述类型信息和所述配置设备的签名私钥生成签名信息；
    第二发送单元，用于将所述签名信息和所述配置设备的签名公钥发送给所述终端，所述配置设备的签名公钥与所述配置设备的签名私钥相对应。
  27. 根据权利要求26所述的配置设备，其特征在于，所述第四接收单元还用于，接收所述终端发送的指示消息，所述指示消息包含所述类型信息。
  28. 根据权利要求26所述的配置设备，其特征在于，所述第四接收单元包括：
    接收模块，用于接收所述终端发送的发现消息；
    确定模块，用于根据所述发现消息确定所述类型信息，且所述发现消息与所述类型信息对应。
  29. 根据权利要求26所述的配置设备，其特征在于，所述第四接收单元 还用于，接收用户输入的操作指令，所述操作指令用于指示所述类型信息。
  30. 根据权利要求26所述的配置设备，其特征在于，所述第四接收单元还用于，扫描所述终端中包含的所述类型信息的二维码；
    或，
    所述第四接收单元还用于，建立与所述终端的近距离无线通讯技术NFC连接以获取所述类型信息。
  31. 根据权利要求26至30任一项所述的配置设备，其特征在于，所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
  32. 根据权利要求26至31任一项所述的配置设备，其特征在于，所述签名信息还包括第一哈希值，所述第一哈希值为所述配置设备至少对所述类型信息进行哈希运算所生成的哈希值。
  33. 一种终端，其特征在于，包括：
    第三发送单元，用于将所述终端的类型信息传递给配置设备，所述类型信息为所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
    第五接收单元，用于接收所述配置设备发送的签名信息和所述配置设备的签名公钥，所述签名信息为所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成，所述配置设备的签名公钥和所述配置设备的签名私钥对应。
  34. 根据权利要求33所述的终端，其特征在于，所述第三发送单元包括：
    第一生成模块，用于生成指示消息，所述指示消息包含有所述类型信息；
    第二发送模块，用于将所述指示消息发送给所述配置设备。
  35. 根据权利要求33所述的终端，其特征在于，所述第三发送单元包括：
    第二生成模块，用于生成发现消息；
    第三发送模块，用于将所述发现消息发送给所述配置设备，所述发现消息与所述类型信息对应。
  36. 根据权利要求33所述的终端，其特征在于，所述第三发送单元包括：
    第三生成模块，用于生成二维码，所述二维码包含有所述类型信息；
    或，
    所述第三发送单元包括：
    建立模块，用于建立与所述配置设备的近距离无线通讯技术NFC连接；
    第四发送模块，用于通过所述NFC将所述类型信息发送给所述配置设备。
  37. 根据权利要求33至36任一项所述的终端，其特征在于，所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
  38. 一种第一终端，其特征在于，包括接收器、发送器和处理器，且所述处理器分别和所述接收器和所述发送器连接；
    所述接收器，用于接收配置设备发送的所述配置设备的签名公钥；
    所述接收器，用于接收第二签名信息和第二类型信息，所述第二签名信息为所述配置设备发送给第二终端的签名信息，所述第二签名信息由配置设备至少根据所述第二类型信息和所述配置设备的签名私钥生成，所述第二类型信息为所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息，所述配置设备的签名公钥和所述配置设备的签名私钥对应；
    所述处理器，用于至少根据所述第二类型信息和所述第二签名信息确定所述第一终端生成密钥信息，所述密钥信息用于第一终端与第二终端建立安全连接。
  39. 根据权利要求38所述的第一终端，其特征在于，
    所述接收器，用于接收所述配置设备发送的第一签名信息，所述第一签名信息由所述配置设备至少根据所述第一类型信息和签名私钥生成，所述第一类型信息为所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息。
  40. 根据权利要求39所述的第一终端，其特征在于，所述第一终端的角色类型信息，和/或，所述第一终端能够连接的角色类型信息包括：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设 备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
  41. 根据权利要求40所述的第一终端，其特征在于，所述第二终端的角色类型信息，和/或，所述第二终端能够连接的角色类型信息包括：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备，非码中心设备，外设，源设备，目标设备，配置器，接入设备，支持的能力，支持的服务，服务集标识或媒体访问控制地址。
  42. 根据权利要求41所述的第一终端，其特征在于，
    所述处理器，用于在确定所述第一类型信息和所述第二类型信息相匹配，并且所述第一终端确认所述第二签名信息匹配所述第二类型信息，则确定生成生成密钥信息。
  43. 根据权利要求42所述的第一终端，其特征在于，
    所述处理器，用于生成所述密钥信息。
  44. 根据权利要求43所述的第一终端，其特征在于，
    所述发送器，用于将所述第一签名信息发送给所述第二终端。
  45. 一种配置设备，其特征在于，包括发送器、接收器和处理器，且所述处理器分别和所述发送器和所述接收器连接；
    所述接收器，用于获得所述终端的类型信息，所述类型信息为终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
    所述处理器，用于至少根据所述类型信息和所述配置设备的签名私钥生成签名信息；
    所述发送器，用于将所述签名信息和所述配置设备的签名公钥发送给所述终端，所述配置设备的签名公钥与所述配置设备的签名私钥相对应。
  46. 根据权利要求45所述的配置设备，其特征在于，
    所述接收器，用于接收所述终端发送的指示消息，所述指示消息包含所述类型信息。
  47. 根据权利要求45所述的配置设备，其特征在于，
    所述接收器，用于接收所述终端发送的发现消息；
    所述处理器，用于根据所述发现消息确定所述类型信息，且所述发现消息 与所述类型信息对应。
  48. 根据权利要求45所述的配置设备，其特征在于，
    所述接收器，用于接收用户输入的操作指令，所述操作指令用于指示所述类型信息。
  49. 根据权利要求45所述的配置设备，其特征在于，
    所述接收器，用于扫描所述终端中包含的所述类型信息的二维码；
    或，
    所述接收器，用于建立与所述终端的近距离无线通讯技术NFC连接以获取所述类型信息。
  50. 根据权利要求45至49任一项所述的配置设备，其特征在于，
    所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
  51. 根据权利要求45至50任一项所述的配置设备，其特征在于，所述签名信息还包括第一哈希值，所述第一哈希值为所述配置设备至少对所述类型信息进行哈希运算所生成的哈希值。
  52. 一种终端，其特征在于，包括：发送器、接收器和处理器，其中，所述处理器分别和所述发送器和所述接收器连接；
    发送器，用于将所述终端的类型信息传递给配置设备，所述类型信息为所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息；
    接收器，用于接收所述配置设备发送的签名信息和所述配置设备的签名公钥，所述签名信息为所述配置设备至少根据所述类型信息和所述配置设备的签名私钥生成，所述配置设备的签名公钥和所述配置设备的签名私钥对应。
  53. 根据权利要求52所述的终端，其特征在于，
    所述处理器，用于生成指示消息，所述指示消息包含有所述类型信息；
    所述发送器，用于将所述指示消息发送给所述配置设备。
  54. 根据权利要求52所述的终端，其特征在于，
    所处理器，用于生成发现消息；
    所述发送器，用于将所述发现消息发送给所述配置设备，所述发现消息与所述类型信息对应。
  55. 根据权利要求52所述的终端，其特征在于，
    所述处理器，用于生成二维码，所述二维码包含有所述类型信息；
    或，
    所述处理器，用于建立与所述配置设备的近距离无线通讯技术NFC连接；
    所述发送器，用于通过所述NFC将所述类型信息发送给所述配置设备。
  56. 根据权利要求52至55任一项所述的终端，其特征在于，所述终端的角色类型信息，和/或，所述终端能够连接的角色类型信息包括：
    站点、接入点、点对点组长设备、点对点客户设备、锚主设备、非锚主设备、中继器、码中心设备、非码中心设备、原设备、外部设备、目标设备、服务集标识、媒体访问控制地址、或接入设备。
PCT/CN2015/087967 2015-08-24 2015-08-24 一种安全认证方法、配置方法以及相关设备 WO2017031674A1 (zh)

Priority Applications (11)

Application Number Priority Date Filing Date Title
EP21185469.0A EP3982590B1 (en) 2015-08-24 2015-08-24 Security authentication method, configuration method, and related device
CN201580030204.2A CN106464690B (zh) 2015-08-24 2015-08-24 一种安全认证方法、配置方法以及相关设备
US15/751,864 US11343104B2 (en) 2015-08-24 2015-08-24 Method for establishing secured connection, and related device
KR1020187004702A KR102062162B1 (ko) 2015-08-24 2015-08-24 보안 인증 방법, 구성 방법 및 관련 기기
CN202010206792.3A CN111465014B (zh) 2015-08-24 2015-08-24 一种安全认证方法、配置方法以及相关设备
JP2018510429A JP6727292B2 (ja) 2015-08-24 2015-08-24 セキュリティ認証方法、構成方法、および関連デバイス
EP20151329.8A EP3700124B1 (en) 2015-08-24 2015-08-24 Security authentication method, configuration method, and related device
EP15901945.4A EP3334084B1 (en) 2015-08-24 2015-08-24 Security authentication method, configuration method and related device
PCT/CN2015/087967 WO2017031674A1 (zh) 2015-08-24 2015-08-24 一种安全认证方法、配置方法以及相关设备
ES15901945T ES2835873T3 (es) 2015-08-24 2015-08-24 Método de autentificación de seguridad, método de configuración y dispositivo relacionado
KR1020197038514A KR102210897B1 (ko) 2015-08-24 2015-08-24 보안 인증 방법, 구성 방법 및 관련 기기

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2015/087967 WO2017031674A1 (zh) 2015-08-24 2015-08-24 一种安全认证方法、配置方法以及相关设备

Publications (1)

Publication Number Publication Date
WO2017031674A1 true WO2017031674A1 (zh) 2017-03-02

Family

ID=58091921

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/087967 WO2017031674A1 (zh) 2015-08-24 2015-08-24 一种安全认证方法、配置方法以及相关设备

Country Status (7)

Country Link
US (1) US11343104B2 (zh)
EP (3) EP3982590B1 (zh)
JP (1) JP6727292B2 (zh)
KR (2) KR102062162B1 (zh)
CN (2) CN111465014B (zh)
ES (1) ES2835873T3 (zh)
WO (1) WO2017031674A1 (zh)

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20170034066A (ko) * 2015-09-18 2017-03-28 삼성전자주식회사 전자기기 및 그 제어방법
JP6746427B2 (ja) * 2016-08-10 2020-08-26 キヤノン株式会社 通信装置、通信方法、及びプログラム
CN106850209A (zh) * 2017-02-28 2017-06-13 苏州福瑞思信息科技有限公司 一种身份认证方法及装置
WO2019006728A1 (zh) * 2017-07-06 2019-01-10 北京小米移动软件有限公司 物联网设备之间建立快速连接的方法、装置及设备
KR102530441B1 (ko) * 2018-01-29 2023-05-09 삼성전자주식회사 전자 장치와 외부 전자 장치 및 이를 포함하는 시스템
US10834170B2 (en) * 2018-03-19 2020-11-10 Citrix Systems, Inc. Cloud authenticated offline file sharing
CN108494777A (zh) * 2018-03-27 2018-09-04 四川斐讯信息技术有限公司 一种基于智能设备的验证码验证方法及系统
JP7262949B2 (ja) 2018-09-11 2023-04-24 キヤノン株式会社 通信装置、通信方法及びプログラム
JP7278087B2 (ja) * 2019-01-31 2023-05-19 キヤノン株式会社 通信装置およびその制御方法、プログラム
CN110234110B (zh) * 2019-06-26 2021-11-02 恒宝股份有限公司 一种移动网络自动切换方法
SE544340C2 (en) * 2019-11-19 2022-04-12 Assa Abloy Ab Secure configuration of a target device performed by a user device
SE545260C2 (en) * 2021-03-01 2023-06-13 Assa Abloy Ab Privacy-enhanced delegation of access right to unlock a physical lock involving a delegator, a delegatee, a derivation scalar and public and secret keys
WO2023091613A1 (en) * 2021-11-17 2023-05-25 X70.Io Ltd. Method for securing security token and smartcard into processing device, and system, terminal and computer-readable medium for the same
CN118355636A (zh) * 2022-10-18 2024-07-16 北京小米移动软件有限公司 一种设备业务角色的验证方法/装置/设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007035655A2 (en) * 2005-09-16 2007-03-29 The Trustees Of Columbia University In The City Of New York Using overlay networks to counter denial-of-service attacks
CN101401387A (zh) * 2006-03-10 2009-04-01 Abb研究有限公司 用于嵌入式设备的访问控制协议
CN101772024A (zh) * 2008-12-29 2010-07-07 中国移动通信集团公司 一种用户身份确定方法及装置和系统
CN102857492A (zh) * 2011-06-27 2013-01-02 通用电气公司 基于位置感知证书的认证的方法和系统
CN104756126A (zh) * 2012-10-29 2015-07-01 三菱电机株式会社 设备管理装置、设备管理系统以及程序

Family Cites Families (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CZ11597A3 (en) * 1994-07-19 1997-09-17 Bankers Trust Co Method of safe use of digital designation in a commercial coding system
US6671805B1 (en) * 1999-06-17 2003-12-30 Ilumin Corporation System and method for document-driven processing of digitally-signed electronic documents
US6789193B1 (en) * 2000-10-27 2004-09-07 Pitney Bowes Inc. Method and system for authenticating a network user
US7246230B2 (en) * 2002-01-29 2007-07-17 Bea Systems, Inc. Single sign-on over the internet using public-key cryptography
US7992194B2 (en) * 2006-03-14 2011-08-02 International Business Machines Corporation Methods and apparatus for identity and role management in communication networks
JP4963425B2 (ja) * 2007-02-23 2012-06-27 日本電信電話株式会社 セッション鍵共有システム、第三者機関装置、要求側装置、および応答側装置
CN101378315B (zh) 2007-08-27 2011-09-14 华为技术有限公司 认证报文的方法、系统、设备和服务器
CN101319582B (zh) * 2008-07-10 2011-06-22 宇龙计算机通信科技(深圳)有限公司 一种安全系统及其开锁方法
JP2011004317A (ja) * 2009-06-22 2011-01-06 Hitachi Ltd 認証システム、記憶媒体、認定装置、および検証装置
US9912654B2 (en) * 2009-11-12 2018-03-06 Microsoft Technology Licensing, Llc IP security certificate exchange based on certificate attributes
CN102215274B (zh) * 2010-04-07 2014-04-30 苹果公司 用于邀请用户到在线会话的设备和方法
CN102065126A (zh) * 2010-11-19 2011-05-18 东莞宇龙通信科技有限公司 用于移动终端的远程登录方法、远程登录系统和移动终端
US8493353B2 (en) * 2011-04-13 2013-07-23 Longsand Limited Methods and systems for generating and joining shared experience
MY172974A (en) * 2012-07-13 2019-12-16 Mimos Berhad A system and method for authentication using non-reusable random generated mobile sms key
CN103702291B (zh) * 2012-09-27 2017-06-09 中兴通讯股份有限公司 一种基于Wi‑Fi建立群组的方法和WiFi直连设备
CN104349319B (zh) 2013-08-01 2018-10-30 华为终端（东莞）有限公司 一种用于配置多设备的方法、设备和系统
CN105684344B (zh) 2013-10-28 2019-06-11 华为终端有限公司 一种密钥配置方法和装置
CN103532975B (zh) 2013-10-28 2016-08-17 国家电网公司 一种可动态平滑扩展的数据采集系统及方法
CA2929173A1 (en) * 2013-10-30 2015-05-07 Huawei Device Co., Ltd. Key configuration method, system, and apparatus
CN103580872B (zh) * 2013-11-11 2016-12-07 北京华大智宝电子系统有限公司 一种用于密钥生成与管理的系统及方法
US20150229475A1 (en) * 2014-02-10 2015-08-13 Qualcomm Incorporated Assisted device provisioning in a network
US9413536B2 (en) * 2014-06-12 2016-08-09 Cisco Technology, Inc. Remote secure device management in smart grid ami networks
CN104539701B (zh) 2014-12-29 2018-04-27 飞天诚信科技股份有限公司 一种在线激活移动终端令牌的设备和系统的工作方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007035655A2 (en) * 2005-09-16 2007-03-29 The Trustees Of Columbia University In The City Of New York Using overlay networks to counter denial-of-service attacks
CN101401387A (zh) * 2006-03-10 2009-04-01 Abb研究有限公司 用于嵌入式设备的访问控制协议
CN101772024A (zh) * 2008-12-29 2010-07-07 中国移动通信集团公司 一种用户身份确定方法及装置和系统
CN102857492A (zh) * 2011-06-27 2013-01-02 通用电气公司 基于位置感知证书的认证的方法和系统
CN104756126A (zh) * 2012-10-29 2015-07-01 三菱电机株式会社 设备管理装置、设备管理系统以及程序

Also Published As

Publication number Publication date
CN111465014A (zh) 2020-07-28
EP3334084A4 (en) 2018-07-25
US20180241570A1 (en) 2018-08-23
EP3982590A1 (en) 2022-04-13
EP3700124A1 (en) 2020-08-26
CN111465014B (zh) 2021-12-28
JP2018525939A (ja) 2018-09-06
KR20180030192A (ko) 2018-03-21
JP6727292B2 (ja) 2020-07-22
CN106464690A (zh) 2017-02-22
EP3700124B1 (en) 2021-10-06
ES2835873T3 (es) 2021-06-23
EP3334084A1 (en) 2018-06-13
US11343104B2 (en) 2022-05-24
KR102210897B1 (ko) 2021-02-01
EP3334084B1 (en) 2020-10-07
KR102062162B1 (ko) 2020-01-03
KR20200000502A (ko) 2020-01-02
CN106464690B (zh) 2020-04-10
EP3982590B1 (en) 2023-06-07

Similar Documents

Publication Publication Date Title
WO2017031674A1 (zh) 一种安全认证方法、配置方法以及相关设备
US10218501B2 (en) Method, device, and system for establishing secure connection
US20180167389A1 (en) Dynamically generated ssid
CN113099443B (zh) 设备认证方法、装置、设备和系统
US10305684B2 (en) Secure connection method for network device, related apparatus, and system
US7734280B2 (en) Method and apparatus for authentication of mobile devices
EP3065334A1 (en) Key configuration method, system and apparatus
CN107567017B (zh) 无线连接系统、装置及方法
US20090019539A1 (en) Method and system for wireless communications characterized by ieee 802.11w and related protocols
KR20160058491A (ko) 사용자 기기의 식별자에 기반하여 서비스를 제공하는 방법 및 장치
WO2014127751A1 (zh) 无线终端配置方法及装置和无线终端
EP4044553A1 (en) Method and device to provide a security level for communication
WO2014161277A1 (zh) 便携式wlan热点的连接方法及系统
WO2016184351A1 (zh) 无线网络的ip地址分配方法和系统
WO2016112860A1 (zh) 无线设备的通讯方法、无线设备和服务器
CN115516892A (zh) 在重新配置期间安全地改变密码强度
JP2017135599A (ja) 無線基地局装置、無線通信システム、及び、無線基地局装置の制御方法
CN106664559B (zh) 无线通信网络中设备配置的方法、装置及系统
US20240039732A1 (en) Signature graph method for enabling human authentication of high-entropy data
CN116017506A (zh) 网络接入方法、装置和通信设备
WO2006080079A1 (ja) 無線ネットワークシステムおよびそのユーザ認証方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15901945

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15751864

Country of ref document: US

ENP Entry into the national phase

Ref document number: 20187004702

Country of ref document: KR

Kind code of ref document: A

ENP Entry into the national phase

Ref document number: 2018510429

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2015901945

Country of ref document: EP