WO2017128546A1

WO2017128546A1 - Method and apparatus for securely accessing wifi network

Info

Publication number: WO2017128546A1
Application number: PCT/CN2016/080837
Authority: WO
Inventors: 张子敬; 路雄博
Original assignee: 宇龙计算机通信科技(深圳)有限公司
Priority date: 2016-01-29
Filing date: 2016-04-29
Publication date: 2017-08-03
Also published as: CN107027121A

Abstract

Disclosed are a method and apparatus for securely accessing a WiFi network. The method comprises: acquiring a trusted wireless access point (AP) list of an extended service set (ESS) network; acquiring information about an AP to be connected; determining whether the AP to be connected is in the trusted AP list; and if so, sending a connection request to the AP to be connected. According to the present invention, by checking whether an AP to be associated with a terminal is a trusted AP in an ESS network, an attack from a WiFi rogue access point can be effectively prevented, thereby improving the security of WiFi network access, and adding to the user experience.

Description

WiFi network security access method and device

This application claims priority to Chinese Patent Application No. 201610066994.6, entitled "A WiFi Network Security Access Method and Apparatus", filed on January 29, 2016, the entire contents of In this application.

Technical field

The present invention relates to the field of network security, and in particular, to a WiFi network security access method and apparatus.

Background technique

In the existing wireless network networking, the WiFi coverage is usually extended by an ESS (Extended Service Set) network. The ESS network works in conjunction with several BSS (Basic Service Sets) to build a network with a larger coverage. In the ESS network, each BSS uses the same SSID (Service Set Identifier), and has a different BSSID (Basic Service Set Identifier). The SSID is displayed on each STA (Station) terminal. In the scan list.

For STA terminals, the entire ESS network is like a BSS. Only one AP (Acess Point) hotspot in the ESS network can be seen in the scan list. This hotspot is generally the hotspot of the current location signal in the ESS network. For example, an ESS network is deployed in a building, and its network name SSID is xinxigang. Since the building area is relatively large, it is difficult for an AP to cover a comprehensive area, so it sets up multiple AP hotspots. The SSIDs of these AP hotspots are all set to xinxigang, but the BSSIDs (usually Mac addresses) of each AP are different, and each AP can also work on different channels. The STA terminal can only see one AP hotspot of xinxigang in its scan list.

However, in the above scenario, the attacker may set a rogue access point AP with an SSID of xinxigang. The STA terminal is tricked into associating the rogue access point AP by increasing the transmit power. The attacker can conduct a man-in-the-middle attack (MITM) on the STA terminal to steal the user's data and pose a threat to the user's personal and property. Therefore, the existence of WiFi rogue access points brings great security risks to WiFi security.

Summary of the invention

The invention provides a WiFi network security access method and device, which is used to solve the problem that the STA terminal is vulnerable to rogue access point attacks when the STA terminal is connected to the WiFi network in the prior art.

In order to achieve the above object, the present invention adopts the following technical solutions:

According to an aspect of the present invention, a WiFi network security access method is provided, including:

Obtaining a list of trusted wireless access point APs of the extended service set ESS network;

Obtain information about the AP to be connected;

Determining whether the AP to be connected is in the list of trusted APs, and if yes, sending a connection request to the AP to be connected.

Further, the manner of obtaining the list of trusted APs includes a data network, an identifiable tag, or manually adding any one or more.

Further, the identifiable tag comprises any one or more of a near field communication NFC tag, a two-dimensional code, and a radio frequency identification (RFID) tag.

Further, obtaining the list of trusted APs by using the data network includes:

Acquiring the current location information, sending the location information to the server managing the ESS network, and receiving the list of trusted APs that the server feeds back according to the location information;

Alternatively, receiving, by the server managing the ESS network, the list of trusted APs pushed by the data network.

Further, the list of trusted APs includes a service set identifier SSID in the ESS network and a unique identifier of the trusted AP.

Further, the unique identification code is a medium access control MAC address or configured by a server that manages the ESS network.

According to another aspect of the present invention, a WiFi network security access device is provided, including:

a first obtaining module, configured to obtain a list of trusted wireless access point APs of the extended service set ESS network;

a second acquiring module, configured to acquire information about an AP to be connected;

a determining module, configured to determine whether the AP to be connected is in the list of trusted APs;

And a sending module, configured to: when determining that the AP to be connected is in the list of trusted APs, send a connection request to the AP to be connected.

Further, the manner in which the first obtaining module acquires the list of trusted APs includes a data network Any one or more of a network, an identifiable tag, or a manual addition.

Further, the first obtaining module acquires the list of trusted APs by using the data network, including:

An obtaining unit, configured to acquire current location information;

a sending unit, configured to send, by using the data network, location information acquired by the acquiring unit to a server that manages the ESS network;

a first receiving unit, configured to receive a trusted AP list that is sent by the server according to the location information sent by the sending unit;

Or comprising a second receiving unit, configured to receive, by the server managing the ESS network, the list of trusted APs pushed by the data network.

Further, the trusted AP list obtained by the first obtaining module includes a service set identifier SSID of the ESS network and a unique identifier of the trusted AP.

The beneficial effects of the present invention are as follows:

The WiFi network security access method and device provided by the present invention, the ESS network manager issues the ESS network trusted AP list; when the STA terminal wants to associate with an AP of the ESS network, the AP in the trusted AP list is adopted. Information, check whether the AP to be associated is a trusted AP; when the verification is passed, the association is allowed, otherwise it will not be associated. The invention improves the security of the WiFi network access and increases the user experience by checking whether the AP to be associated with the terminal is a trusted AP in the ESS network, which can effectively prevent the attack of the WiFi rogue access point.

The above description is only an overview of the technical solutions of the present invention, and the above-described and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief description of the drawings used in the embodiments or the prior art description will be briefly described below. The drawings are only some of the embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any inventive labor.

FIG. 1 is a flowchart of a method for securely accessing a WiFi network according to an embodiment of the present invention;

2 is a schematic diagram of a list of trusted APs used in an embodiment of the present invention;

FIG. 3 is a schematic structural diagram of a WiFi network security access device according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

Example 1

An embodiment of the present invention provides a WiFi network security access method, which is applicable to an STA terminal. As shown in FIG. 1 , the method specifically includes:

Step 101: Obtain a list of trusted wireless access point APs of the ESS network.

Step 102: Obtain information about an AP to be connected.

Step 103: Determine whether an AP to be connected is in the list of trusted APs.

Step 104: If yes, send a connection request to the AP to be connected.

The list of trusted APs of the ESS network mentioned in this embodiment and in the following embodiments specifically includes the SSID of the ESS network and the unique identification code of the AP. For the unique identification code, the MAC (Medium/Media Access Control) address of the AP is preferably used in the embodiment of the present invention, as shown in FIG. 2 . Of course, the unique identification code can also be configured by the server managing the ESS network, and each AP is uniquely specified.

In step 101, there are many methods for obtaining an ESS network trusted AP list, which are issued by the ESS network through a trusted path, and the STA terminal obtains through a communication method with a certain security level. Specifically, the method for obtaining the list of trusted APs in the embodiment of the present invention includes: a data network, an identifiable tag, and a manual addition of any one or more. The process of obtaining a list of trusted APs will be described later in conjunction with a specific embodiment. I won’t introduce too much here.

In step 102, for the specific process of obtaining the information of the AP to be connected, the AP may actively send information to the STA terminal, where the information carries information about the AP, such as a MAC address and a letter. The strength of the number, etc.; can also be requested by the STA terminal to the AP. For the specific implementation process, it has been well known to those skilled in the art, and specifically, it is introduced in the IEEE 802.11 protocol cluster of the wireless local area network standard. Repeat them.

In steps 103-104, after the STA terminal acquires the AP information to be connected, it traverses each trusted AP information according to the SSID, and compares the traversed AP information with the AP information to be connected; when the comparison result is consistent When the connection request is sent to the AP, when the comparison result is inconsistent, the AP is not allowed to be associated, and the user is prompted to have a certain risk.

Example 2

This embodiment is based on the embodiment 1, and obtains a list of trusted APs of the ESS network, which is implemented by using a data network, and specifically includes two modes: an active mode and a passive mode.

For actively obtaining a list of trusted APs through the data network, the following steps are included:

Get current location information;

Sending location information to the server managing the ESS network through the data network;

After receiving the list of trusted APs that the server feeds back according to the location information, the list of trusted APs is configured locally.

When the list of trusted APs is obtained in this embodiment, it is implemented based on the location of the user. Specifically, the STA terminal user needs to first pay attention to the administrator information (such as the public account of WeChat, etc.) that deploys the ESS network. The information exchange with the server side of the management ESS network is realized by the administrator of the ESS network. The location area of the ESS network is pre-stored in the ESS web server. The server of the ESS network can obtain a list of trusted APs of the ESS network according to the location of the STA terminal.

Take McDonald's as an example for explanation. The STA terminal user just enters a local McDonald's, the STA terminal obtains the current location information through a GPS (Global Positioning System), and sends the location information to the McDonald's public account; the McDonald's public account determines whether the location is based on the location information. In the pre-set location area; when it is determined that the location is in the corresponding deployment area, the trusted AP list corresponding to the ESS network of the area is sent to the STA terminal through the data network.

Of course, the STA terminal can automatically detect and connect to a trusted AP. Specifically, the STA terminal automatically detects whether the ESS network exists in the current environment; when present, acquires current location information, and sends the location information to the administrators of all ESS networks concerned; all servers of the ESS network determine according to the location information. Whether to obtain a list of trusted APs when determining to be within the deployment area within the deployment area to which it belongs. If there are multiple available ESS networks in the current area, the user can select them at their own discretion. The network can also automatically select the network according to the ESS network trust ranking preset by the user. There may be multiple selection procedures for a plurality of available ESS networks, and the present invention is not specifically limited.

For passively obtaining a list of trusted APs through the data network, it is only necessary to receive a list of trusted APs pushed by the ESS network.

Specifically, the STA terminal information entering the coverage area is detected by the ESS network; after detecting that the STA terminal enters the ESS network, the list of trusted APs is pushed to the STA terminal through the data network.

Specifically, the time for the ESS network to push the list of trusted APs needs to be allowed by the user of the STA terminal to allow the push. For example, when the user opens the WIFI and needs to access the ESS network, the ESS network starts to push to the STA terminal; or, when the WIFI is in the open state, when the ESS network detects that the STA terminal performs the area covered by the network, it queries the STA terminal. Whether a connection is required, and a list of trusted APs is pushed to the STA terminal when needed. The STA terminal receives the list of trusted APs pushed by the ESS network, and configures the list of trusted APs locally.

Example 3

The embodiment is based on the first embodiment. When the list of trusted APs of the ESS network is obtained, the identifiable tags are actively acquired by the terminal. The identifiable tags include NFC (Near Field Communication) tags, two-dimensional codes, and RFID (Radio Frequency Identification) tags, which can be used to identify and carry information.

Specifically, in this embodiment, the trusted AP list of the ESS network may be configured into an NFC tag/two-dimensional code, or a link of the trusted AP list information that can be obtained to the ESS network may be written to the NFC tag. In the QR code, the STA terminal has only the read permission. When the STA terminal user enters the area, the NFC tag/QR code can be directly obtained through the NFC function of the STA terminal to obtain the above information and configured into the STA terminal. For reading the RFID tag, the STA terminal can read the information of the RFID tag through the RFID reader. The RFID reader can be integrated into the STA terminal or provided by the ESS network side.

It should be noted that the specific manner for the STA terminal to obtain the list of trusted APs is not limited to the foregoing embodiment, and the user also adds the trusted APs advertised by the ESS network by manual operations. Therefore, the method for the STA terminal to obtain the list of trusted APs by other means is within the protection scope of the present invention.

Example 4

The embodiment of the present invention further provides a WiFi network security access device, which is used to implement Embodiments 1 to 3. The method provided by any of the embodiments. Referring to FIG. 3, the WiFi network security access device includes:

The first obtaining module 201 is configured to obtain a list of trusted wireless access points AP of the extended service set ESS network;

The second obtaining module 202 is configured to obtain information about the AP to be connected;

The determining module 203 is configured to determine whether the AP to be connected is in the list of trusted APs;

The sending module 204 is configured to: when determining that the AP to be connected is in the list of trusted APs, send a connection request to the AP to be connected.

Further, the manner in which the first obtaining module 201 obtains the list of trusted APs includes any one or more of a data network, an identifiable tag, or a manual addition.

Further, the first obtaining module 201 obtains the list of trusted APs through the data network, including:

An obtaining unit, configured to acquire current location information;

a sending unit, configured to send, by using a data network, location information acquired by the acquiring unit to a server that manages the ESS network;

a first receiving unit, configured to receive, by the server, a list of trusted APs that are fed back according to the location information sent by the sending unit;

Or including a second receiving unit, configured to receive a list of trusted APs that the server managing the ESS network pushes through the data network.

Further, the list of trusted APs acquired by the first obtaining module 201 includes a service set identifier SSID of the ESS network and a unique identifier of the trusted AP.

In summary, the WiFi network security access method and device provided by the embodiment of the present invention, the ESS network manager issues the list of trusted APs of the ESS network; when the STA terminal wants to associate with an AP of the ESS network, The AP information in the AP list can be trusted to check whether the AP to be associated is a trusted AP. When the verification is passed, the association is allowed, otherwise the association is not performed. By checking whether the AP to be associated with the terminal is a trusted AP in the ESS network, the invention can effectively prevent the attack of the WiFi rogue access point, improve the security of the WiFi network access, and increase the user experience.

One of ordinary skill in the art can understand all or part of the process in implementing the above embodiments. The program can be implemented by a computer program to instruct the associated hardware, and the program can be stored in a computer readable storage medium, which, when executed, can include the flow of an embodiment of the methods described above.

While the present invention has been described by the embodiments of the invention, it will be understood that Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims

A WiFi network security access method, comprising:

Obtaining a list of trusted wireless access point APs of the extended service set ESS network;

Obtain information about the AP to be connected;

Determining whether the AP to be connected is in the list of trusted APs;

If yes, a connection request is sent to the AP to be connected.
The method of claim 1, wherein the manner of obtaining the list of trusted APs comprises any one or more of a data network, an identifiable tag, or a manual addition.
The method of claim 2 wherein the identifiable tag comprises any one or more of a near field communication NFC tag, a two dimensional code, and a radio frequency identification (RFID) tag.
The method of claim 2, wherein obtaining the list of trusted APs by using the data network comprises:

Acquiring the current location information, sending the location information to the server managing the ESS network, and receiving the list of trusted APs that the server feeds back according to the location information;

Alternatively, receiving, by the server managing the ESS network, the list of trusted APs pushed by the data network.
The method according to any one of claims 1 to 4, wherein the list of trusted APs comprises a service set identifier SSID in the ESS network and a unique identification code of the trusted AP.
The method of claim 5 wherein the unique identification code is a medium access control MAC address or is configured by a server that manages the ESS network.
A WiFi network security access device, comprising:

a first obtaining module, configured to obtain a list of trusted wireless access point APs of the extended service set ESS network;

a second acquiring module, configured to acquire information about an AP to be connected;

a determining module, configured to determine whether the AP to be connected is in the list of trusted APs;

And a sending module, configured to: when determining that the AP to be connected is in the list of trusted APs, send a connection request to the AP to be connected.
The device according to claim 7, wherein the manner in which the first obtaining module acquires the list of trusted APs comprises any one of a data network, an identifiable tag, or a manual addition. A variety.
The device of claim 8 wherein the identifiable tag comprises any one or more of a near field communication NFC tag, a two dimensional code, and a radio frequency identification (RFID) tag.
The device according to claim 7, wherein the first obtaining module acquires the list of trusted APs by using the data network, including:

An obtaining unit, configured to acquire current location information;

a sending unit, configured to send, by using the data network, location information acquired by the acquiring unit to a server that manages the ESS network;

a first receiving unit, configured to receive a trusted AP list that is sent by the server according to the location information sent by the sending unit;

Or comprising a second receiving unit, configured to receive, by the server managing the ESS network, the list of trusted APs pushed by the data network.
The device according to any one of claims 7 to 10, wherein the list of trusted APs acquired by the first obtaining module includes a service set identifier SSID of the ESS network and a unique identifier of the trusted AP. .
The apparatus of claim 11 wherein said unique identification code is a medium access control MAC address or is configured by a server managing said ESS network.