WO2017129089A1 - 无线网络连接方法、装置及存储介质 - Google Patents

无线网络连接方法、装置及存储介质 Download PDF

Info

Publication number
WO2017129089A1
WO2017129089A1 PCT/CN2017/072186 CN2017072186W WO2017129089A1 WO 2017129089 A1 WO2017129089 A1 WO 2017129089A1 CN 2017072186 W CN2017072186 W CN 2017072186W WO 2017129089 A1 WO2017129089 A1 WO 2017129089A1
Authority
WO
WIPO (PCT)
Prior art keywords
access point
wireless access
information
authentication
authentication server
Prior art date
Application number
PCT/CN2017/072186
Other languages
English (en)
French (fr)
Inventor
朱戈
唐文宁
杨志伟
付火平
陈水明
徐森圣
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN201610067779.8A external-priority patent/CN105554760B/zh
Priority claimed from CN201610067787.2A external-priority patent/CN105554747B/zh
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Priority to KR1020187020181A priority Critical patent/KR102134302B1/ko
Priority to EP17743704.3A priority patent/EP3410758B1/en
Publication of WO2017129089A1 publication Critical patent/WO2017129089A1/zh
Priority to US15/913,644 priority patent/US10638321B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/033—Protecting confidentiality, e.g. by encryption of the user plane, e.g. user's traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/80—Wireless
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the embodiments of the present application relate to the field of network security, and in particular, to a wireless network connection method, apparatus, and storage medium.
  • Wi-Fi Wireless-Fidelity
  • the manner in which the user terminal accesses the public Wi-Fi mainly includes: no password access, verification code access, and single password access.
  • the password-free access method means that the user terminal sends an access request to the wireless access point after obtaining the SSID (Service Set Identifier) of the public Wi-Fi, and the wireless access point does not need to be authenticated, and directly allows the user terminal. Access to the public Wi-Fi.
  • SSID Service Set Identifier
  • the authentication code access mode means that the user terminal needs to obtain the SSID and the verification code of the public Wi-Fi when accessing the public Wi-Fi, and sends an access request to the wireless access point by using the verification code and the SSID, and the wireless access point pair
  • the verification code and the SSID are verified; after the verification is successful, the user terminal is allowed to access the public Wi-Fi.
  • the verification code usually has a validity period, such as 60s.
  • the single password access mode means that when the user terminal accesses the public Wi-Fi, the SSID and the connection password of the public Wi-Fi are obtained in advance, and the access request is sent to the wireless access point by using the SSID and the connection password.
  • the wireless access point authenticates the SSID and the connection password; after the wireless access point is successfully authenticated, the user terminal is allowed to access the public Wi-Fi.
  • the connection password is usually valid for a long time.
  • the embodiment of the present application provides a wireless network connection method, device, and system.
  • the technical solution is as follows:
  • a master key corresponding to the user information where the master key is that the authentication server verifies that the wireless access point belongs to a trusted wireless connection after receiving the second access request When entering the point, the key generated by the user terminal after the first identity authentication succeeds;
  • a request receiving module configured to receive an access request sent by a wireless access point, where the access request carries user information of a user terminal that attempts to access the wireless access point;
  • a trust verification module configured to verify, after receiving the access request, whether the wireless access point is a trusted wireless access point
  • a user authentication module configured to perform first identity authentication with the user terminal when determining that the wireless access point is a trusted wireless access point
  • a key generation module configured to generate a master key for the user terminal when the first identity authentication succeeds, and send the master key to the user terminal;
  • a key sending module configured to send the master key corresponding to the user information to the wireless access point, so that the wireless access point and the user terminal according to the master key and the user The terminal negotiates to establish an encrypted wireless network connection.
  • a first receiving module configured to receive a first access request sent by the user terminal, where the first access request carries user information of the user terminal;
  • a second receiving module configured to send a second access request to the authentication server, where the second access request carries the user information
  • a key receiving module configured to receive a master key corresponding to the user information sent by the authentication server, where the master key is that the authentication server verifies the wireless connection after receiving the second access request When the in-point belongs to the trusted wireless access point, the key generated for the user terminal after the first identity authentication is successfully performed by the user terminal;
  • a network connection module configured to establish an encrypted wireless network connection with the user terminal according to the master key held by the user terminal.
  • a storage medium of an embodiment of the present application stores a series of machine executable instructions, wherein the instructions can cause at least one processor to perform the following operations:
  • the master key is generated in agreement with the user terminal, and the master key is sent to the user terminal;
  • a storage medium of an embodiment of the present application stores a series of machine executable instructions, wherein the instructions can cause at least one processor to perform the following operations:
  • the authentication server authenticates the wireless access point, and only the trusted wireless access point can obtain the master key corresponding to the user information, thereby establishing an encrypted wireless network connection with the user terminal according to the master key, thereby improving the transmission of the user terminal.
  • FIG. 1A is a schematic structural diagram of a wireless network connection system according to an embodiment of the present application.
  • 1B is a schematic diagram of an authentication server provided by an embodiment of the present application.
  • 1C is a schematic diagram of a wireless access point provided by an embodiment of the present application.
  • FIG. 2 is a flowchart of a method for connecting a wireless network according to an embodiment of the present application
  • FIG. 3 is a flowchart of a method for connecting a wireless network according to an embodiment of the present application
  • FIG. 4 is a flowchart of a method for connecting a wireless network according to an embodiment of the present application
  • FIG. 5A is a flowchart of a method for accessing a wireless network according to an embodiment of the present application
  • FIG. 5B is a schematic diagram of an identity authentication process of an authentication server to a wireless access point according to an embodiment of the present application.
  • 5C is a schematic diagram of a process for a user terminal to register a username and key information with an authentication server according to an embodiment of the present application
  • 5D is a schematic diagram of a process for a user terminal to access a wireless access point according to an embodiment of the present application
  • FIG. 6 is a structural block diagram of a wireless network connection apparatus according to an embodiment of the present application.
  • FIG. 7 is a structural block diagram of a wireless network connection apparatus according to an embodiment of the present application.
  • FIG. 8 is a structural block diagram of a wireless network connection apparatus according to an embodiment of the present application.
  • FIG. 9 is a structural block diagram of a wireless network connection apparatus according to an embodiment of the present application.
  • FIG. 10 is a structural block diagram of a wireless network connection system according to an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram of a wireless access point authentication system according to an embodiment of the present application.
  • FIG. 12 is a flowchart of a method for authenticating a wireless access point according to an embodiment of the present application.
  • FIG. 13 is a flowchart of a method for authenticating a wireless access point according to an embodiment of the present application
  • FIG. 14 is a flowchart of a method for authenticating a wireless access point according to an embodiment of the present application.
  • 15A is a flowchart of a method for authenticating a wireless access point according to an embodiment of the present application.
  • 15B is a flowchart of a method for authenticating a wireless access point according to an embodiment of the present application.
  • 15C is a flowchart of a method for authenticating a wireless access point according to an embodiment of the present application.
  • 16 is a structural block diagram of a wireless access point authentication apparatus according to an embodiment of the present application.
  • FIG. 17 is a structural block diagram of a wireless access point authentication apparatus according to an embodiment of the present application.
  • FIG. 18 is a structural block diagram of a wireless access point authentication system according to an embodiment of the present application.
  • the public key refers to the public key, which does not need to be kept secret.
  • the decryption party can obtain it through various channels.
  • the private key refers to the key held only by the encryption party itself and needs to be kept secret.
  • a public key corresponds to a private key; the public key and the private key together form an asymmetric encryption method.
  • Asymmetric encryption means Public key encrypted information can only be decrypted with the corresponding private key. Information encrypted with the private key can only be decrypted with the corresponding public key. That is, the keys used for encryption and decryption are different.
  • a wants to send encrypted information to B A first needs to obtain the public key corresponding to B, and then encrypts the information to be sent using the public key corresponding to B, and then sends the encrypted information to B, B. After receiving the encrypted information sent by A, the private key corresponding to B must be used to decrypt the encrypted information and obtain the content in the encrypted information. Since the private key corresponding to B is owned by B itself, the encrypted information sent by A is secure.
  • Encryption means that the sender encrypts the transmitted data by using the public key corresponding to the receiver. After receiving the encrypted data, the receiver can only use the private key corresponding to the receiver to decrypt, and can only obtain and send after decryption. The data sent by the sender; or, the sender encrypts the transmitted data using the private key corresponding to the sender, and after receiving the encrypted data, the receiver can only use the public key corresponding to the sender to decrypt, after decryption The data sent by the sender can be obtained. Encryption is used to prevent data leakage. Only the private key corresponding to the public key can decrypt the content of the data.
  • the signature means that the sender signs the transmitted data by using the private key corresponding to the sender.
  • the signature means that the sender calculates the information digest by using the hash function on the transmitted data, and the sender uses the private key pair corresponding to the sender to calculate.
  • the obtained message digest is encrypted, and the sender sends the encrypted message digest as the data signature and data to the receiver; after receiving the data and the signature, the receiver first receives the same hash function as the sender.
  • the data summary is calculated in the data, and the encrypted information digest is decrypted using the public key corresponding to the sender; when the two information digests are the same, the receiver can confirm that the received data and signature are sent by the sender. .
  • the signature is used to prevent the data from being tampered with, and the public key corresponding to the private key can verify whether the data is the data sent by the sender who owns the private key.
  • FIG. 1A is a schematic structural diagram of a wireless network connection system provided by an exemplary embodiment of the present application.
  • the wireless network connection system includes a wireless access point 120, a user terminal 140, and an authentication server 160.
  • the wireless access point 120 may be a general term for devices that provide wireless network access services, such as routers, Wi-Fi hotspots, and wireless gateways.
  • the wireless access point 120 is a router.
  • the wireless access point 120 needs to authenticate the identity of the wireless access point 120 through the authentication server 160 before establishing a wireless network connection with the user terminal 140.
  • the wireless access point 120 establishes a connection with the authentication server 160 via a wireless network or a wired network.
  • the communication mode between the wireless access point 120 and the authentication server 160 is not limited in the embodiment of the present application.
  • the user terminal 140 can be a mobile phone, a tablet computer, an e-book reader, an MP3 (Moving Picture Experts Group Audio Layer III) player, and an MP4 (Moving Picture Experts Group Audio Layer IV). Compress standard audio layers 4) players, laptops and desktop computers, and more.
  • the application terminal 140 has an application with a scan code function, such as Tencent QQ, WeChat, QQ browser, wireless Internet program, etc.
  • the user terminal 140 establishes a connection with the authentication server 160 via a wireless network or a wired network.
  • user terminal 140 registers user information and key information with authentication server 160 over a separate channel.
  • the user information refers to information used to identify the user, for example, a user name, a user ID, a user's device identifier (such as an international mobile device identity code IMEI, a unique device identifier UDID, a MAC address), and a user's IP address.
  • An independent channel refers to a communication channel that does not pass through a wireless access point, such as a 2G network or a 3G network.
  • the communication manner between the user terminal 140 and the authentication server 160 is not limited in the embodiment of the present application.
  • the authentication server 160 stores a set of trusted public keys, user information corresponding to each user terminal 140, and key information.
  • the authentication server 160 can be a server cluster or a server cluster composed of multiple servers.
  • FIG. 1B is a schematic diagram of an authentication server provided by an embodiment of the present application.
  • the authentication server can include a processor 161, a communication interface 164, a storage device 166, and an interconnection mechanism 169.
  • the storage device 166 includes an operating system 167, a communication module 168, a database 162, and a security authentication module 163.
  • the processor 161 may have one or more, may be in the same physical device, or be distributed among multiple physical devices.
  • the authentication server can communicate with the user terminal and the wireless access point device or the like over a certain network using the communication interface 164.
  • a user database 1621 and an access point database 1622 are stored in the database 162.
  • User information and key information corresponding to each user terminal 140 are stored in the user database 1621.
  • the access point database 1622 stores a set of trusted public keys, ie, a set of public keys corresponding to the authenticated wireless access points.
  • the security authentication module 163 includes a user authentication module 1631, an access point authentication module 1632, and an access control module 1633.
  • the user authentication module 1631 may receive a registration request sent by the user terminal, generate user information and key information for the user terminal, and provide the generated user information and key information to the user terminal and save the data in the user database 1621.
  • the access point authentication module 1632 can receive the identity authentication request sent by the wireless access point, and add the public key corresponding to the wireless access point that is authenticated by the identity to the trusted public key set in the access point database 1622. In some examples, when the access point authentication module 1632 authenticates the wireless access point, the access point may also be authenticated according to the authentication information of the service provider received from another device.
  • the other device refers to other devices used by a party (such as a merchant) that provides the public wireless network access service using the wireless access point, hereinafter also referred to as a merchant terminal.
  • the authentication information provided by the merchant terminal refers to information related to the identity and qualification of the owner of the wireless access point, and may include, for example, owner information, administrator information, qualification certificate of the merchant, business license information, and the like.
  • the access control module 1633 may use the trusted public key set in the access point database 1622 to verify whether the wireless access point is a trusted wireless access point after receiving the access request of the wireless access point; when the wireless access When the point is a trusted wireless access point, according to the user information and the number of users in the access request A communication key is generated for the user terminal based on the user data in the library 1621, and the communication key is separately transmitted to the user terminal and the wireless access point.
  • the communication key is a key dedicated to the encrypted communication between the user terminal and the wireless access point, which is also referred to as a master key hereinafter.
  • the master key used for the encrypted communication between the user terminal and the wireless access point and the key used by the authentication server for the user terminal authentication ie, the user information corresponding to the user information of the user terminal in the user database 1621
  • the key information is different, and is also different from the key used by the wireless access point to communicate with the authentication server (ie, the public key and the private key corresponding to the wireless access point).
  • each of the foregoing modules may be located in different physical devices, and the functions of the same module may also be implemented by multiple physical devices.
  • the modules in the security authentication module 163 are only used for the convenience of the description. In other embodiments, the functions of the security authentication module 163 can be implemented by a set of modules obtained according to multiple division methods.
  • FIG. 1C is a schematic diagram of a wireless access point provided by an embodiment of the present application.
  • the wireless access point can include a processor 121, a communication interface 124, a storage device 126, and an interconnection mechanism 129.
  • the storage device 126 includes an operating system 127, a communication module 128, and an access management module 123.
  • the processor 121 may have one or more, and may include a multi-core processor.
  • Storage device 126 may include one or more of ROM, FLASH, NVRAM, RAM, and the like.
  • the wireless access point can communicate with the user terminal and the authentication server using the communication interface 124.
  • the access management module 123 includes a registration module 1231 and a user access module 1232.
  • the registration module 1231 can obtain the public key and the private key corresponding to the wireless access point according to a preset mechanism, obtain information of the preset authentication server (for example, an address, a public key corresponding to the authentication server, and the like), and send the identity to the authentication server. Authentication request.
  • the user access module 1232 may send a second access request including the user terminal information to the authentication server, receive the master key sent by the authentication server, and use the master key with The user terminal establishes an encrypted wireless network connection.
  • the access management module 123 can be stored as firmware in ROM, or FLASH, or NVRAM.
  • Various pre-set mechanisms and information may be stored in the ROM, or FLASH, or NVRAM as part of the access management module 123, or may be stored in ROM, or FLASH, or NVRAM in the form of separate configuration files.
  • FIG. 2 is a flowchart of a method for wireless network connection provided by an embodiment of the present application. This embodiment is exemplified by the wireless network connection method being applied to the wireless access point 120 shown in FIG. 1A.
  • the method includes:
  • Step 201 Receive a first access request sent by a user terminal, where the first access request carries user information of a user terminal that attempts to access the wireless access point.
  • Step 202 Send a second access request to the authentication server, where the second access request carries user information.
  • Step 203 Receive a master key corresponding to the user information sent by the authentication server.
  • the master key is an authentication server that verifies that the wireless access point belongs to the trusted wireless access point after receiving the second access request, and the user terminal. After the first identity authentication is successful, the generated key is negotiated;
  • Step 204 Establish an encrypted wireless network connection with the user terminal according to the master key held by the user terminal.
  • the wireless network access method receives the first access request sent by the user terminal, sends a second access request to the authentication server, and receives the master key corresponding to the user information sent by the authentication server. Establishing an encrypted wireless network connection by negotiating with the user terminal according to the master key; and solving the problem that when the user accesses the fake public Wi-Fi by using the existing access method, the user terminal transmits to the fake public Wi-Fi.
  • the data and the data inside the user terminal are all subject to security threats; the identity authentication of the wireless access point is achieved through the authentication server, and only the trusted wireless access point can obtain the master key corresponding to the user information, thereby The master key establishes an encrypted wireless network connection with the user terminal, which improves the data transmitted by the user terminal and the data security inside the user terminal.
  • FIG. 3 is a flowchart of a method for wireless network connection provided by an embodiment of the present application. This embodiment is exemplified by the wireless network connection method being applied to the authentication server 160 shown in FIG. 1A.
  • the method includes:
  • Step 301 Receive a second access request sent by the wireless access point, where the second access request carries user information.
  • Step 302 After receiving the second access request, verify whether the wireless access point belongs to a trusted wireless access point.
  • Step 303 Perform first identity authentication with the user terminal when the wireless access point belongs to the trusted wireless access point.
  • Step 304 When the first identity authentication is successful, the master key is generated in agreement with the user terminal, and the master key is sent to the user terminal.
  • Step 305 Send a master key corresponding to the user information to the wireless access point, so that the wireless access point and the user terminal establish an encrypted wireless network connection according to the master key held by the user.
  • the wireless network access method receives the second access request sent by the wireless access point, and after receiving the second access request, verifies whether the wireless access point belongs to the trusted wireless.
  • An access point performing a first identity authentication with the user terminal when the wireless access point belongs to the trusted wireless access point; and generating a master key by negotiating with the user terminal when the first identity authentication is successful, and sending the primary key to the user terminal a key; a master key corresponding to the user information is sent to the wireless access point; and when the user accesses the fake public Wi-Fi by using the existing access method, the user terminal sends the fake Wi-Fi to the public
  • the identity authentication of the wireless access point is achieved through the authentication server, and only the trusted wireless access point can obtain the master key corresponding to the user information.
  • FIG. 4 is a flowchart of a method for wireless network connection provided by an embodiment of the present application. This embodiment is exemplified by the wireless network connection method applied to the wireless network access system shown in FIG. 1A.
  • the method includes:
  • Step 401 The user terminal sends a first access request to the wireless access point, where the first access request carries user information of the user terminal.
  • the user terminal stores user information and key information registered in advance in the authentication server.
  • the wireless access point receives the first access request sent by the user terminal.
  • Step 402 The wireless access point sends a second access request to the authentication server, where the second access request carries user information.
  • the second access request carries a second public key corresponding to the wireless access point.
  • the authentication server receives the second access request sent by the wireless access point.
  • Step 403 After receiving the second access request, the authentication server verifies whether the wireless access point belongs to the trusted wireless access point.
  • Step 404 When the wireless access point belongs to the trusted wireless access point, the authentication server performs the first identity authentication with the user terminal.
  • the authentication server When the wireless access point belongs to the trusted wireless access point, the authentication server performs two-way identity authentication with the user terminal, and the authentication server authenticates the user terminal to authenticate the user terminal.
  • the user terminal also authenticates the authentication server.
  • Step 405 When the first identity authentication is successful, the authentication server negotiates with the user terminal to generate a master key, and sends the master key to the user terminal.
  • the user terminal receives the master key corresponding to the user information sent by the authentication server.
  • Step 406 The authentication server sends a master key corresponding to the user information to the wireless access point.
  • the wireless access point receives the master key corresponding to the user information sent by the authentication server.
  • Step 407 The wireless access point establishes an encrypted wireless network connection with the user terminal according to the master key held by the user.
  • the wireless network access method sends a first access request to the wireless access point by the user terminal; the wireless access point sends a second access request to the authentication server; the authentication server receives the second access request. After the second access request, verifying whether the wireless access point belongs to the trusted wireless access point, and when the wireless access point belongs to the trusted wireless access point, the authentication server performs the first identity authentication with the user terminal; When the authentication succeeds, the authentication server negotiates with the user terminal to generate a master key, and sends a master key to the user terminal; the authentication server sends a master key corresponding to the user information to the wireless access point; the wireless access point and the user terminal according to the respective The held master key negotiates to establish an encrypted wireless network connection; and solves the data transmitted by the user terminal to the fake public Wi-Fi when the user accesses the fake public Wi-Fi by using the existing access method.
  • the data inside the user terminal is subject to security threats; the identity authentication of the wireless access point is achieved through the authentication server, only The trusted wireless access point can obtain the master key corresponding to the user information, thereby establishing an encrypted wireless network connection with the user terminal according to the master key, thereby improving the data transmitted by the user terminal and the data security inside the user terminal.
  • the entire process of the embodiment of the present application includes four phases:
  • the wireless access point completes the identity authentication in the authentication server according to the second public key and the second private key corresponding to the wireless access point, and the second public key corresponding to the wireless access point that the authentication server completes the identity authentication is performed.
  • the user terminal registers the user information and the key information in the authentication server through the independent channel, and the authentication server feeds back the user information and the key information registered by the user terminal to the user terminal.
  • the key information is a password or a certificate.
  • the user terminal sends a first access request to the wireless access point, where the first access request carries user information, the wireless access point sends a second access request to the authentication server, and the second access request carries the user. Information and a second public key corresponding to the wireless access point.
  • the authentication server verifies the wireless access point, and when the wireless access point is a trusted wireless access point, performs first identity authentication with the user terminal; when the first identity authentication is successful, the user terminal and the user terminal respectively Some key information is negotiated to generate a master key, and the master key corresponding to the user information is separately sent to the user terminal and the wireless access point; the wireless access point and the user terminal establish an encryption according to the master key agreement held by the user. Wi-Fi connection.
  • FIG. 5A is a flowchart of a method for accessing a wireless network provided by another embodiment of the present application.
  • This embodiment is exemplified by the wireless network access method applied to the wireless network access system shown in FIG. 1A.
  • the method includes:
  • the first stage includes steps 501 to 506;
  • Step 501 The wireless access point generates a second public key and a second private key corresponding to the wireless access point.
  • the second public key and the second private key corresponding to the wireless access point are first generated.
  • the second private key is saved by the wireless access point itself.
  • Step 502 The wireless access point acquires a first public key corresponding to the authentication server.
  • the wireless access point After generating the second public key and the second private key, the wireless access point acquires the first public key corresponding to the authentication server.
  • the wireless access point first obtains the first public key corresponding to the authentication server, the second public key and the second private key corresponding to the wireless access point are generated.
  • the first public key corresponding to the authentication server is stored in the firmware of the wireless access point, and the wireless access point directly obtains the first public key corresponding to the authentication server from the firmware.
  • the order in which the wireless access point acquires the first public key corresponding to the authentication server and the second public key and the second private key corresponding to the wireless access point are not specifically limited.
  • Step 503 The wireless access point sends an identity authentication request to the authentication server.
  • the identity authentication request carries the authentication information and the second public key corresponding to the wireless access point, and the authentication information and the second public key corresponding to the wireless access point are encrypted by using the first public key corresponding to the authentication server, and the authentication information is used. At least hardware information and/or owner information is included.
  • the authentication information is information that the wireless access point encrypts through a second private key corresponding to the wireless access point.
  • the wireless access point sends hardware information and owner information directly to the authentication server. In other examples, the wireless access point only sends hardware information to the authentication server, and the owner information is indirectly sent to the authentication server by the management terminal.
  • the manner of sending the authentication information to the authentication server is not specifically limited.
  • the wireless access point sends the hardware information and the owner information to the authentication server as an example for illustration.
  • the wireless access point After obtaining the first public key corresponding to the authentication server, the wireless access point establishes an encrypted channel with the authentication server.
  • the wireless access point carries the authentication information and the second public key corresponding to the wireless access point in the identity authentication request to the authentication server through the encrypted channel.
  • the encrypted channel means that the information sent by the wireless access point to the authentication server is encrypted by using the first public key corresponding to the authentication server. After receiving the encrypted information sent by the wireless access point, the authentication server needs to use the authentication server.
  • the first private key is decrypted to obtain the information therein; the information sent by the authentication server to the wireless access point is encrypted by using the second public key corresponding to the wireless access point, and the wireless access point receives the encryption sent by the authentication server. After the information, the second private key corresponding to the wireless access point must be used for decryption to obtain the information therein.
  • the hardware information corresponding to the wireless access point may include: a service set identifier of the wireless access point, a BSSID (Basic Service Set Identifier) of the wireless access point, and a MAC of the wireless access point ( MediaAccess Control, the physical address of the device, the network address of the wireless access point, and the gateway IP (Internet Protocol) of the wireless access point.
  • a service set identifier of the wireless access point a BSSID (Basic Service Set Identifier) of the wireless access point
  • a MAC of the wireless access point MediaAccess Control
  • the physical address of the device the network address of the wireless access point
  • the gateway IP Internet Protocol
  • the manner in which the wireless access point provides the second public key to the authentication server is not specifically limited.
  • the owner information corresponding to the wireless access point may include: an administrator account, a business name, a registered company, a business address, and a merchant phone.
  • the wireless access point may separately send the authentication information and the second public key corresponding to the wireless access point to the authentication server. For example, the wireless access point first encrypts the second public key corresponding to the wireless access point by using the first public key corresponding to the authentication server, and then sends the second public key to the authentication server, and then passes the second public key corresponding to the wireless access point.
  • the authentication information is encrypted and sent to the authentication server.
  • the authentication server first decrypts the second public key corresponding to the wireless access point according to the first private key corresponding to the authentication server, and decrypts the encrypted authentication information by using the second public key corresponding to the wireless access point to obtain the authentication. information.
  • the wireless access point may directly send an identity authentication request to the authentication server, where the identity authentication request carries a second public key, hardware information, and/or owner information corresponding to the wireless access point.
  • the wireless access point encrypts the identity authentication request by using the first public key corresponding to the authentication server, where the identity authentication request carries the second public key, hardware information, and/or owner corresponding to the wireless access point. information;
  • the wireless access point encrypts the identity authentication request using the first public key corresponding to the authentication server, and the identity authentication request includes the authentication information and the second public corresponding to the wireless access point. key.
  • the authentication information is information that the wireless access point encrypts using the second private key corresponding to the wireless access point.
  • the authentication information carries hardware information and/or owner information.
  • the authentication server receives the identity authentication request sent by the wireless access point.
  • the wireless access point encrypts the identity authentication request by using the first public key corresponding to the authentication server, where the identity authentication request includes the authentication information and the second public key corresponding to the wireless access point;
  • the second private key corresponding to the entry point encrypts the authentication information as an example.
  • Step 504 The authentication server decrypts the identity authentication request by using the first private key corresponding to the authentication server, and obtains the authentication information and the second public key corresponding to the wireless access point.
  • the authentication server After receiving the identity authentication request sent by the wireless access point, the authentication server decrypts the identity authentication request by using the first private key corresponding to the authentication server, and obtains the authentication information carried by the identity authentication request and the corresponding information corresponding to the wireless access point. Two public keys.
  • Step 505 The authentication server decrypts the authentication information by using a second public key corresponding to the wireless access point to obtain hardware information and/or owner information.
  • the authentication server After the authentication server decrypts the authentication information and the second public key corresponding to the wireless access point by using the first private key corresponding to the authentication server, the authentication information is decrypted by the second public key corresponding to the wireless access point, and the authentication is obtained.
  • Information includes hardware information and/or owner information.
  • Step 506 The authentication server performs second identity authentication on the hardware information and/or the owner information.
  • the second identity authentication succeeds, the second public key corresponding to the wireless access point is added to the trusted public key set.
  • the authentication server After decrypting the hardware information and/or the owner information carried in the authentication information, the authentication server performs second identity authentication on the hardware information and/or the owner information.
  • the second identity authentication process is a manual review process.
  • the second identity authentication refers to verifying whether the hardware information and/or the owner information carried in the authentication information is correct or complete. After the second identity authentication succeeds, the authentication server adds the second public key corresponding to the wireless access point to the trusted public key set, and saves the second public key corresponding to the wireless access point.
  • the trusted public key set is a list of second public keys corresponding to the wireless access points successfully authenticated by the authentication server and stored by the second authentication. That is, the corresponding wireless access points in the set of trusted public keys are wireless access points that have successfully authenticated by the authentication server.
  • the authentication server adds the correspondence between the second public key corresponding to the wireless access point and the wireless access point to the trusted public key set, and allows the user terminal to query the authentication server.
  • the authentication server allows the wireless access point to query the authentication server for the master key corresponding to the user information of the user terminal.
  • the set of trusted public keys is shown in Table 1 below:
  • the second public key corresponding to the wireless access point A is “public key 1"; the second public key corresponding to the wireless access point B is “public key 2"; the corresponding point of the wireless access point C The second public key is “public key 3"; the second public key corresponding to the wireless access point D is “public key 4".
  • the second identity authentication process of the authentication server to the wireless access point is as shown in FIG. 5B.
  • the wireless access point 120 transmits hardware information to the authentication server 160
  • the merchant terminal 180 registering the wireless access point 120 transmits the owner information and the administrator information to the authentication server 160
  • the authentication server 160 pairs the received hardware.
  • the information, the owner information, and the administrator information are authenticated.
  • the wireless access point 120 is approved to join the trusted wireless access point.
  • the second stage includes step 507;
  • Step 507 The user terminal registers the user information and the key information corresponding to the user information to the authentication server through an independent channel.
  • a standalone channel is a communication channel that does not pass through a wireless access point.
  • the key information includes at least one of a password and a certificate.
  • the authentication server When generating the user information and the key information corresponding to the user terminal, the authentication server stores the correspondence between the user terminal and the user information and the key information in the authentication server, and transmits the user information and the key information to the user terminal. .
  • the authentication server stores the user information and key information registered by the user terminal in the form of a user information-password pair, or the authentication server registers the user information and key information registered by the user terminal in the form of a user information-certificate pair. Store.
  • the correspondence between the authentication server and the user information-password pair is as shown in Table 2 below:
  • the user information and key information registered by the user terminal to the authentication server are unique. That is, each user terminal corresponds to a unique user information and key information, and the user terminal and the user information have a one-to-one correspondence.
  • the process of registering the user information and the key information with the authentication server by the user terminal is as shown in FIG. 5C , and the user terminal registers the user information and the password with the authentication server as an example for illustration.
  • the user terminal 140 and the authentication server 160 complete the registration of the user information and the password through an independent channel, that is, the registration process of the user information and the password is completed in the communication channel without passing through the wireless access point.
  • the user information and the key information may be registered with the authentication server through a communication client or a browser client in the user terminal.
  • the third stage includes steps 508 and 509;
  • Step 508 The user terminal sends a first access request to the wireless access point.
  • the first access request carries user information of the user terminal.
  • the user terminal stores user information and key information registered in advance in the authentication server.
  • the user terminal When there is a wireless access point to be accessed, the user terminal sends a first access request to the wireless access point, where the first access request carries user information corresponding to the user terminal.
  • the manner in which the user terminal sends the first access request to the wireless access point includes:
  • the user terminal scans the two-dimensional code of the hardware information carrying the wireless access point provided by the merchant through the scan code function in the application, and the user terminal sends the first access to the wireless access point by scanning the two-dimensional code. request.
  • the user terminal sends a first access request to the wireless access point based on the public number provided by the merchant carrying the hardware information of the wireless access point.
  • the user terminal sends a first access request to the wireless access point based on a separate wireless network client provided by the merchant that carries the hardware information of the wireless access point.
  • the user terminal uses the scan function in the WeChat to scan the QR code of the hardware information provided by the merchant and carries the wireless access point, and sends the first access request to the wireless access point through the WeChat.
  • the user terminal directly scans the two-dimensional code of the hardware information of the wireless access point provided by the merchant by using the sweep function in the browser, and directly sends the first access request to the wireless access point through the browser.
  • the user terminal utilizes the attention function in the WeChat to pay attention to the public number provided by the merchant, and sends the first access request to the wireless access point through the public number.
  • the user terminal installs a separate wireless network client that carries the hardware information of the wireless access point provided by the merchant, and sends a first access request to the wireless access point through a separate wireless network client.
  • the wireless access point receives the first access request sent by the user terminal.
  • Step 509 The wireless access point sends a second access request to the authentication server, where the second access request carries user information.
  • the wireless access point After receiving the first access request sent by the user terminal, the wireless access point sends a second access request to the authentication server, where the second access request carries the user information.
  • the second access request further carries a second public key corresponding to the wireless access point.
  • the wireless access point After receiving the first access request sent by the user terminal, the wireless access point sends the second public key corresponding to the wireless access point and the user information carried in the first access request to the authentication server.
  • the wireless access point sends a second access request to the authentication server, where the second access request carries user information and a second public key corresponding to the wireless access point.
  • the wireless access point sends a second access request to the authentication server, the second access request carrying user information and a second public key corresponding to the wireless access point.
  • the second access request is a wireless connection
  • the entry point uses a first public key corresponding to the authentication server for encryption.
  • the wireless access point sends a second access request to the authentication server, where the second access request carries the first ciphertext and the second public key corresponding to the wireless access point.
  • the second access request is a request for the wireless access point to encrypt using the first public key corresponding to the authentication server.
  • the first ciphertext is a ciphertext in which the wireless access point encrypts the user information by using a second private key corresponding to the wireless access point.
  • This embodiment is exemplified by a third possible implementation manner.
  • the authentication server receives the second access request sent by the wireless access point.
  • the fourth stage includes steps 510 to 519;
  • Step 510 The authentication server obtains the first ciphertext carried in the query key request and the second public key corresponding to the wireless access point.
  • the authentication server After receiving the second access request sent by the wireless access point, the authentication server acquires the first ciphertext carried in the second access request and the second public key corresponding to the wireless access point.
  • the authentication server may directly obtain the user information carried in the second access request and the second public key corresponding to the wireless access point.
  • the authentication server may decrypt the second access request by using the first private key corresponding to the authentication server, and obtain user information and wireless access carried by the second access request.
  • the second access request is a request for the wireless access point to encrypt the first ciphertext and the second public key corresponding to the wireless access point by using the first public key corresponding to the authentication server.
  • Step 511 The authentication server verifies whether the second public key corresponding to the wireless access point exists in the trusted public key set; if the second public key corresponding to the wireless access point exists in the trusted public key set, The wireless access point is authenticated as a trusted wireless access point.
  • the trusted public key set stores a second public key corresponding to the wireless access point that successfully authenticates the identity of the authentication server, where the first ciphertext includes user information.
  • the authentication server After obtaining the second public key corresponding to the wireless access point, the authentication server verifies whether the second public key corresponding to the wireless access point exists in the trusted public key set, and if it exists in the trusted public key set, The authentication server then determines that the wireless access point is a trusted wireless access point.
  • the authentication server will obtain the obtained public key 2 and The second public key in the trusted public key set shown in Table 1 is matched, and it is found that the public key 2 belongs to the trusted public key set, and the authentication server determines that the wireless access point is a trusted wireless access point. .
  • the authentication server verifies that the wireless access point does not belong to a trusted wireless access point, the subsequent steps are not performed.
  • Step 512 The authentication server decrypts the first ciphertext carried in the second access request by using the second public key corresponding to the wireless access point, and obtains the user information, when the wireless access point belongs to the trusted wireless access point. .
  • the acquired server uses the obtained The second public key corresponding to the wireless access point decrypts the obtained first ciphertext, and decrypts the user information carried in the first ciphertext.
  • the first ciphertext is a ciphertext in which the wireless access point encrypts the user information by using a second private key corresponding to the wireless access point.
  • Step 513 The authentication server queries the key information corresponding to the user information according to the user information.
  • the authentication server After decrypting the first ciphertext to obtain the user information carried in the first ciphertext, the authentication server queries the key information corresponding to the user information.
  • the correspondence between the exemplary user information and the password in Table 2 is taken as an example. If the user information carried in the second access request obtained by the authentication server is “User B”, the authentication server to the user information and The password corresponding to User B is queried in the correspondence between passwords. As shown in Table 2, the password that is queried is Password 2.
  • Step 514 The authentication server performs the first identity authentication with the user terminal by using the key information.
  • the authentication information is used to perform the first identity authentication with the user terminal.
  • the first identity authentication refers to mutual authentication between the authentication server and the user terminal. That is, the authentication server needs to perform identity authentication on the user terminal according to the key information; the user terminal also needs to perform identity authentication on the authentication server according to the key information.
  • the first identity authentication is one-way authentication. That is, the authentication server authenticates the user terminal according to the key information; or the user terminal needs to perform identity authentication on the authentication server according to the key information.
  • the process of the first identity authentication and negotiation by the authentication server and the user terminal to generate the master key is to establish a TLS (Transport Layer Security) channel, and perform the first identity authentication and negotiation through the forwarding of the wireless access point. Key.
  • TLS Transport Layer Security
  • the process of the first identity authentication performed by the authentication server and the user terminal conforms to the protocol of the user access by the PEAP (Protected Extensible Authentication Protocol).
  • Step 515 When the first identity authentication is successful, the authentication server negotiates with the user terminal to generate a master key, and sends the master key to the user terminal.
  • the authentication server and the user terminal negotiate to generate a master key according to the key information.
  • the master key generated by the authentication server and the user terminal is a PMK (Pairwise Master Key).
  • the authentication server After the authentication server and the user terminal negotiate to generate the master key, the authentication server sends the master key generated by the negotiation to the user terminal through the TLS channel.
  • Step 516 The authentication server performs first encryption on the master key generated by the negotiation by using the second public key corresponding to the wireless access point.
  • the authentication server can send the master key to the wireless access point directly through the encrypted channel
  • the authentication server may encrypt the master key by using the first private key corresponding to the authentication server, and send the encrypted master key to the wireless access point;
  • the authentication server may first perform the first encryption on the master key using the second public key corresponding to the wireless access point; and then perform the first encrypted master key on the first private key corresponding to the authentication server. Second encryption; sending the second encrypted master key to the wireless access point.
  • the method is taken as an example for description.
  • the second public key corresponding to the wireless access point is saved when the authentication server successfully authenticates the wireless access point.
  • the authentication server After the authentication server negotiates with the user terminal to generate the master key, the first key is encrypted by using the second public key corresponding to the wireless access point.
  • Step 517 The authentication server performs second encryption on the first encrypted master key by using the first private key corresponding to the authentication server, and sends the second encrypted master key to the wireless access point.
  • the authentication server After the first encryption of the master key by using the second public key corresponding to the wireless access point, the authentication server performs second encryption on the first encrypted master key by using the first private key corresponding to the authentication server. Send the two encrypted master keys to the wireless access point.
  • the first key is first encrypted by using the second public key corresponding to the wireless access point, and then the first encrypted key corresponding to the first private key corresponding to the authentication server is used.
  • the master key performs the second encryption for illustration.
  • the encryption order of the master key is not specifically limited, and the first key may be first encrypted by using the first private key corresponding to the authentication server, and then the second public key corresponding to the wireless access point may be used. Performing a second encryption on the first encrypted master key.
  • the encryption mode of the master key is not specifically limited by the authentication server.
  • the wireless access point receives the encrypted master key sent by the authentication server.
  • the wireless access point receives the first encrypted master key sent by the authentication service, and the first encrypted master key is used by the authentication server when the wireless access point belongs to the trusted wireless access point.
  • the master key after encrypting the master key by the second public key corresponding to the access point.
  • the wireless access point receives the second encrypted master key sent by the authentication server, and the second encrypted master key is used by the authentication server when the wireless access point belongs to the trusted wireless access point.
  • the second public key corresponding to the access point performs the first encryption on the master key, and then performs the second encrypted master key on the first encrypted master key by using the first private key corresponding to the authentication server.
  • Step 518 The wireless access point decrypts the second encrypted master key by using the first public key corresponding to the authentication server to obtain a second ciphertext.
  • the wireless access point After receiving the encrypted master key sent by the authentication server, the wireless access point decrypts the second encrypted master key by using the first public key corresponding to the authentication server to obtain a second ciphertext.
  • the second ciphertext is a ciphertext that the authentication server encrypts the master key by using the second public key corresponding to the wireless access point.
  • Step 519 The wireless access point decrypts the second ciphertext by using a second private key corresponding to the wireless access point to obtain a master key.
  • the wireless access point After the wireless access point decrypts the second ciphertext by using the first public key corresponding to the authentication server, The second ciphertext is decrypted by using a second private key corresponding to the wireless access point to obtain a master key.
  • the authentication server encrypts only the master key corresponding to the user information by using the second public key corresponding to the wireless access point
  • the wireless access point only needs to use the second private corresponding to the wireless access point.
  • the key decrypts the encrypted master key to obtain the master key.
  • Step 520 The wireless access point and the user terminal negotiate to generate a temporary key used in the current connection according to the master key held by each, and establish a secure wireless network connection by using the temporary key.
  • the wireless access point and the user terminal use the PMK negotiation to generate a PTK (Pairwise Temporary Key) used by the current connection, and the wireless access point and the user terminal establish an encrypted wireless network connection by using the PTK.
  • PTK Packetwise Temporary Key
  • the wireless access point and the user terminal use the acquired master key as the PMK to complete WPA2 (Wi-Fi Protected Access II, launched by the Wi-Fi Alliance).
  • WPA2 Wi-Fi Protected Access II, launched by the Wi-Fi Alliance.
  • Wireless Network Security Authentication Protocol Encryption Protocol.
  • the PTK used for the current connection is negotiated, and the user terminal establishes an encrypted wireless network connection with the wireless access point using the negotiated PTK.
  • the wireless access point generates a random number A, and the wireless access point sends a message M1 to the user terminal, and the message M1 carries the random number A;
  • the user terminal generates a random number B, and the user terminal calculates the PTK used in the current connection according to the master key, the random number A, and the random number B; the user terminal sends a message M2 to the wireless access point, and the message M2 carries There is a random number B; and the MIC (Message Integrity Code) authentication is performed on the message M2 using the acknowledgment key part in the calculated PTK;
  • the MIC Message Integrity Code
  • the wireless access point obtains the random number B, and calculates the PTK used in the current connection according to the master key, the random number A, and the random number B, and uses the calculated confirmation key part in the PTK to the message M2. Perform MIC check. If the verification fails, the message M2 is discarded. If the verification is correct, the message M3 is sent to the user terminal, and the message M3 includes a MIC check, so that the user terminal verifies that the wireless access point has the master key.
  • the user terminal After receiving the message M3, the user terminal performs MIC check on the message M3. After the verification succeeds, the PTK is loaded, and the message M4 is sent to the wireless access point, and the message M4 is used to indicate that the user terminal has loaded the PTK. After receiving the message M4, the wireless access point also loads the PTK to complete the process of establishing an encrypted wireless network connection.
  • the core encryption algorithm for completing the WPA2 encryption protocol between the wireless access point and the user terminal is illustrated by WPE2-PEAP (WPE2-PEAP, based on the protection channel authentication protocol), but the core encryption algorithm of the WPA2 encryption protocol is completed.
  • EAP-TLS Extensible Authentication Protocol-Transport Layer Security
  • EAP-TTLS/MSCHAPv2 PEAPv0/EAP-MSCHAPv2
  • PEAPv1/EAP-GTC PEAP -TLS
  • EAP-SIM EPA-Subscriber Identity Module
  • EAP-AKA EAP-Authentication and Key Agreement
  • EAP- FAST EAP-Flexible Authentication via Secure Tunneling
  • the process of a user terminal accessing a wireless access point is illustrated in Figure 5D.
  • the user terminal 140 transmits the user information to the wireless access point 120, and the wireless access point 120 forwards the user information to the authentication server 160.
  • the authentication server 160 performs the first with the user terminal 140 after confirming that the wireless access point belongs to the trusted wireless access point.
  • An identity authentication when the first identity authentication succeeds, respectively sending a master key corresponding to the user information to the user terminal 140 and the wireless access point 120, and the user terminal 140 and the wireless access point 120 obtain the master key as PMK, negotiate to establish an encrypted wireless network connection.
  • the wireless network access method sends a first access request to the wireless access point by the user terminal; the wireless access point sends a second access request to the authentication server; the authentication server receives the second access request. After the second access request, verifying whether the wireless access point belongs to the trusted wireless access point, and performing the first identity authentication with the user terminal when the wireless access point belongs to the trusted wireless access point, when the first identity authentication is successful Negotiating with the user terminal to generate a master key; the authentication server sends a master key corresponding to the user information to the wireless access point; and the wireless access point and the user terminal negotiate to establish an encrypted wireless network connection according to the master key held by each;
  • the user accesses the fake public Wi-Fi by using the existing access method the data transmitted by the user terminal to the fake public Wi-Fi and the data inside the user terminal are subject to security threats;
  • the identity of the wireless access point is authenticated by the authentication server, and only the trusted wireless access point can obtain the master key corresponding to the user information. Therefore, the user terminal establishes an
  • the authentication server and the wireless access point transmit data through the encrypted channel, which improves the security of the data during the transmission process.
  • steps 501 to 506 and step 507 in this embodiment is not specifically limited. That is, there is no inevitable sequence between the authentication process of the wireless access point in the authentication server and the process of the user terminal registering the user information and the key information with the authentication server; but the wireless access of the encrypted wireless network connection is established with the user terminal.
  • the point must be a trusted wireless access point stored on the authentication server.
  • the information that can be carried in the transmitted data has a random number generated by each time and a time for sending the data. Poke and so on.
  • the data when the wireless access point sends data to the authentication server, the data also carries information such as a random number generated by the wireless access point and a timestamp for transmitting the data.
  • the information that can be carried in the data is not specifically limited except for the information carried in the data in the foregoing embodiment.
  • the information that can be carried in the transmitted data has a random number generated by the user and a timestamp of the data to be sent, and details are not described herein.
  • the modified embodiment of the information that can be carried by the data is an equivalent replacement of the embodiment of the present application.
  • the examples are included in the scope of protection of the present application.
  • the fake wireless access point has exactly the same hardware information as the real wireless access point.
  • the user terminal when the user terminal obtains the fake wireless access point, the user terminal sends a first access request to the fake wireless access point, where the access request carries the user information corresponding to the user terminal.
  • the fake wireless access point sends a second access request to the authentication server, where the second access request carries the user information.
  • the fake wireless access point acquires the first public key corresponding to the authentication server, encrypts the second access request by using the first public key corresponding to the authentication server, and sends the encrypted second access request to the authentication. server.
  • the authentication server decrypts the second access request by using the first private key corresponding to the authentication server, and obtains a second public key and user information corresponding to the fake wireless access point.
  • the authentication server verifies whether the second public key corresponding to the fake wireless access point exists in the trusted public key set.
  • the authentication server determines that the fake wireless access point is an untrusted wireless access point when verifying whether the second public key corresponding to the fake wireless access point exists in the trusted public key set. . After determining that the wireless access point is a fake wireless access point, the authentication server does not send the master key corresponding to the user information to the fake wireless access point.
  • the wireless network provided in the embodiment shown in FIG. 5A In the entry method, the fake wireless access point cannot establish an encrypted wireless network connection with the user terminal.
  • the second public key corresponding to the fake wireless access point does not exist in the trusted public key set stored by the authentication server, and thus is determined by the authentication server as an untrusted wireless access point. Therefore, the wireless network access method provided by the embodiment of FIG. 5A improves the security of the data transmitted by the user terminal and the internal data of the user terminal.
  • FIG. 6 is a structural block diagram of a wireless network connection apparatus according to an embodiment of the present application.
  • the wireless network connection device can be implemented as all or part of the wireless access point in FIG. 1A by software, hardware or a combination of both.
  • the wireless network connection device includes:
  • the first receiving module 610 is configured to receive a first access request sent by the user terminal, where the first access request carries user information of the user terminal;
  • the second receiving module 620 is configured to send a second access request to the authentication server, where the second access request carries user information.
  • the key receiving module 630 is configured to receive a master key corresponding to the user information sent by the authentication server, where the master key is that the authentication server determines that the wireless access point belongs to the trusted wireless access point after receiving the second access request. And the key generated by the user terminal after the first identity authentication succeeds;
  • the network connection module 640 is configured to establish an encrypted wireless network connection with the user terminal according to the master key held by the user terminal.
  • the wireless network access device receives the first access request sent by the user terminal, sends a second access request to the authentication server, and receives the primary key corresponding to the user information sent by the authentication server.
  • Key establishes an encrypted wireless network connection with the user terminal according to the master key held by the user terminal; and solves the problem that the user uses the existing access method to make the user terminal access the fake public Wi-Fi, causing the user terminal to the fake public
  • the data transmitted by Wi-Fi and the data inside the user terminal are subject to security threats; the identity authentication of the wireless access point is achieved through the authentication server, and only the trusted wireless access point can obtain the master corresponding to the user information.
  • the key thereby establishing an encrypted wireless network connection with the user terminal according to the master key held by the user terminal, improves the data transmitted by the user terminal and the data security inside the user terminal.
  • FIG. 7 is a structural block diagram of a wireless network connection apparatus according to another embodiment of the present application.
  • the wireless network connection device can be implemented as all or part of the wireless access point in FIG. 1A by software, hardware or a combination of both.
  • the wireless network connection device includes:
  • the key generation module 710 is configured to generate a second public key and a second private key corresponding to the wireless access point;
  • the public key obtaining module 720 is configured to acquire a first public key corresponding to the authentication server.
  • the information sending module 730 is configured to send an identity authentication request to the authentication server, where the identity authentication request carries the authentication information and the second public key corresponding to the wireless access point, and the authentication information and the second public key corresponding to the wireless access point are both
  • the encryption is performed using the first public key corresponding to the authentication server, and the authentication information includes at least hardware information and/or owner information.
  • the authentication information is information encrypted by a second private key corresponding to the wireless access point.
  • the first receiving module 740 is configured to receive a first access request sent by the user terminal, where the first access request carries user information of the user terminal.
  • the second receiving module 750 is configured to send a second access request to the authentication server, where the second access request carries the user information.
  • the key receiving module 760 is configured to receive a master key corresponding to the user information sent by the authentication server, where the master key is that the authentication server determines that the wireless access point belongs to the trusted wireless access point after receiving the second access request.
  • the generated key is negotiated with the user terminal after the first identity authentication succeeds.
  • the key receiving module 760 is further configured to receive a first encrypted master key sent by the authentication server, where the first encrypted master key is an authentication server that belongs to the wireless access point.
  • the master key is encrypted using the second public key corresponding to the wireless access point.
  • the key receiving module 760 is further configured to receive a second encrypted master key sent by the authentication server, where the second encrypted master key is an authentication server that belongs to the wireless access point.
  • the first key is first encrypted by using the second public key corresponding to the wireless access point, and the first encrypted primary key is performed by using the first private key corresponding to the authentication server.
  • the second encrypted master key is further configured to receive a second encrypted master key sent by the authentication server, where the second encrypted master key is an authentication server that belongs to the wireless access point.
  • the first key is first encrypted by using the second public key corresponding to the wireless access point, and the first encrypted primary key is performed by using the first private key corresponding to the authentication server.
  • the second encrypted master key is further configured to receive a second encrypted master key sent by the authentication server, where the second encrypted master key is an authentication server that belongs to the wireless access point.
  • the network connection module 770 is configured to establish an encrypted wireless network connection with the user terminal according to the master key.
  • the network connection module 770 may include: a first decryption unit 771 and a first connection unit 772;
  • the first decryption unit 771 is configured to decrypt the first encrypted master key by using a second private key corresponding to the wireless access point to obtain a master key.
  • the first connection unit 772 is configured to establish an encrypted wireless network connection with the user terminal according to the master key held by the user terminal.
  • the network connection module 770 may include: a second decryption unit 773, a third decryption unit 774, and a second connection unit 775.
  • the second decryption unit 773 is configured to decrypt the second encrypted master key by using the first public key corresponding to the authentication server to obtain a second ciphertext.
  • the third decryption unit 774 is configured to decrypt the second ciphertext by using the second private key corresponding to the wireless access point to obtain a master key.
  • the second connection unit 775 is configured to establish an encrypted wireless network connection with the user terminal according to the master key held by the user terminal.
  • the second ciphertext is a ciphertext that the authentication server encrypts the master key by using the second public key corresponding to the wireless access point.
  • the network connection module 770 is further configured to negotiate with the user terminal to use the master key held by the user terminal to generate a temporary key used in the current connection, and establish a temporary key with the user terminal. Encrypt wireless network connection.
  • the wireless network access device receives the first access request sent by the user terminal, sends a second access request to the authentication server, and receives the primary key corresponding to the user information sent by the authentication server.
  • Key establishes an encrypted wireless network connection with the user terminal according to the master key held by the user terminal; and solves the problem that the user uses the existing access method to make the user terminal access the fake public Wi-Fi, causing the user terminal to the fake public
  • the data transmitted by Wi-Fi and the data inside the user terminal are subject to security threats; the identity authentication of the wireless access point is achieved through the authentication server, and only the trusted wireless access point can obtain the master corresponding to the user information.
  • the key thereby establishing an encrypted wireless network connection with the user terminal according to the master key held by the user terminal, improves the data transmitted by the user terminal and the data security inside the user terminal.
  • FIG. 8 is a structural block diagram of a wireless network connection apparatus according to an embodiment of the present application.
  • the wireless network connection device can be implemented as all or part of the authentication server in FIG. 1A by software, hardware or a combination of both.
  • the wireless network connection device includes:
  • the request receiving module 810 is configured to receive a second access request sent by the wireless access point, where the second access request carries user information;
  • the trust verification module 820 is configured to verify, after receiving the second access request, whether the wireless access point belongs to the trusted wireless access point;
  • the user authentication module 830 is configured to: when the wireless access point belongs to the trusted wireless access point, The terminal performs the first identity authentication;
  • the key generation module 840 is configured to: when the first identity authentication succeeds, negotiate with the user terminal to generate a master key, and send the master key to the user terminal.
  • the key sending module 850 is configured to send key information corresponding to the user information to the wireless access point when the wireless access point belongs to the trusted wireless access point, so that the wireless access point and the user terminal are according to the respective masters Key negotiation establishes an encrypted wireless network connection.
  • the wireless network access device receives the second access request sent by the wireless access point, and after receiving the second access request, verifies whether the wireless access point belongs to the trusted wireless.
  • An access point performing a first identity authentication with the user terminal when the wireless access point belongs to the trusted wireless access point, and generating a master key by negotiating with the user terminal when the first identity authentication succeeds, and sending the master key to the user terminal Sending a master key corresponding to the user information to the wireless access point; resolving that when the user accesses the fake public Wi-Fi by using the existing access method, the user terminal is caused by the fake public Wi-Fi
  • the identity authentication of the wireless access point is achieved through the authentication server, and only the trusted wireless access point can obtain the master key corresponding to the user information, thereby Establishing an encrypted wireless network connection with the user terminal according to the master key held by the user terminal, improving data transmitted by the user terminal and data security inside the user terminal Sexual effect.
  • FIG. 9 is a structural block diagram of a wireless network connection apparatus according to another embodiment of the present application.
  • the wireless network connection device can be implemented as all or part of the authentication server in FIG. 1A by software, hardware or a combination of both.
  • the wireless network connection device includes:
  • the authentication receiving module 910 is configured to receive an identity authentication request sent by the wireless access point, where the identity authentication request carries the authentication information and a second public key corresponding to the wireless access point, the authentication information, and the second corresponding to the wireless access point.
  • the public key is encrypted by using the first public key corresponding to the authentication server, and the authentication information includes at least hardware information and/or owner information.
  • the information decryption module 920 is configured to decrypt the identity authentication request by using the first private key corresponding to the authentication server to obtain the authentication information and the second public key corresponding to the wireless access point.
  • the information authentication module 930 is configured to perform second identity authentication on the authentication information, and add the second public key corresponding to the wireless access point to the trusted public key set when the second identity authentication succeeds.
  • the authentication information is information that the wireless access point encrypts through a second private key corresponding to the wireless access point.
  • the information authentication module 930 may include: a first decryption unit 931 and a first authentication unit 932.
  • the first decrypting unit 931 is configured to decrypt the authentication information by using a second public key corresponding to the wireless access point to obtain hardware information and/or owner information.
  • the first authentication unit 932 is configured to perform second identity authentication on the hardware information and/or the owner information, and add the second public key corresponding to the wireless access point to the trusted public key set when the second identity authentication succeeds in.
  • the request receiving module 940 is configured to receive a second access request sent by the wireless access point, where the second access The incoming request carries user information.
  • the trust verification module 950 is configured to verify, after receiving the second access request, whether the wireless access point belongs to a trusted wireless access point.
  • the trust verification module 950 may include: a public key obtaining unit 951 and a first verification unit 952.
  • the public key obtaining unit 951 is configured to obtain a first ciphertext carried in the second access request and a second public key corresponding to the wireless access point.
  • the public key obtaining unit 951 is further configured to: decrypt the second access request by using the first private key corresponding to the authentication server, to obtain a first ciphertext and a second public key corresponding to the wireless access point;
  • the second access request is a request for the wireless access point to encrypt the first ciphertext and the second public key corresponding to the wireless access point by using the first public key corresponding to the authentication server.
  • the first verification unit 952 is configured to verify whether the second public key corresponding to the wireless access point exists in the trusted public key set; if the second public key corresponding to the wireless access point exists in the trusted public key set , the wireless access point is verified as a trusted wireless access point;
  • the trusted public key set stores a second public key corresponding to the wireless access point that successfully passes the second identity authentication.
  • the user authentication module 960 is configured to perform first identity authentication with the user terminal when the wireless access point belongs to the trusted wireless access point.
  • the user authentication module 960 may include: a ciphertext decryption unit 961, a key query unit 962, and a key authentication unit 963.
  • the ciphertext decryption unit 961 is configured to: when the wireless access point belongs to the trusted wireless access point, decrypt the first ciphertext carried in the second access request by using the second public key corresponding to the wireless access point, Get user information.
  • the key querying unit 962 is configured to query key information corresponding to the user information.
  • the key authentication unit 963 is configured to perform first identity authentication with the user terminal according to the key information.
  • the first ciphertext is a ciphertext that the wireless access point encrypts the user information by using a second private key corresponding to the wireless access point.
  • the key generation module 970 is configured to: when the first identity authentication succeeds, negotiate with the user terminal to generate a master key, and send the master key to the user terminal.
  • the key sending module 980 is configured to send a master key corresponding to the user information to the wireless access point, so that the wireless access point and the user terminal establish an encrypted wireless network connection according to the master key held by the user.
  • the key sending module 980 is further configured to perform first encryption on the master key generated by the negotiation using the second public key corresponding to the wireless access point, and send the first encrypted primary key to the wireless access point. key.
  • the key sending module 980 is further configured to perform second encryption on the first encrypted master key by using a first private key corresponding to the authentication server, and send the second encrypted to the wireless access point. Master key.
  • the wireless network access device receives the second access request sent by the wireless access point, and after receiving the second access request, verifies whether the wireless access point belongs to the trusted wireless.
  • An access point performing a first identity authentication with the user terminal when the wireless access point belongs to the trusted wireless access point, and generating a master key by negotiating with the user terminal when the first identity authentication succeeds, and sending the master key to the user terminal Sending a master key corresponding to the user information to the wireless access point; resolving that when the user accesses the fake public Wi-Fi by using the existing access method, the user terminal is caused by the fake public Wi-Fi
  • the identity authentication of the wireless access point is achieved through the authentication server, and only the trusted wireless access point can obtain the master key corresponding to the user information, thereby Establishing an encrypted wireless network connection with the user terminal according to the master key held by the user terminal, improving data transmitted by the user terminal and data security inside the user terminal Sexual effect.
  • FIG. 10 is a structural block diagram of a wireless network connection system according to an embodiment of the present application.
  • the system includes: a user terminal 1020, a wireless access point 1040, and an authentication server 1060.
  • the user terminal 1020 is configured to send a first access request to the wireless access point, and perform first identity authentication with the authentication server.
  • the wireless access point 1040 includes a wireless network connection device as described in any of the embodiments shown in FIG. 6 or the embodiment shown in FIG. 7;
  • the authentication server 1060 includes the wireless network connection device as described in any of the embodiments shown in FIG. 8 or the embodiment shown in FIG.
  • the embodiment of the present application further provides a wireless access point authentication method.
  • FIG. 11 is a schematic structural diagram of a wireless access point system according to an exemplary embodiment of the present application.
  • the wireless access point system includes a wireless access point 1120, a management terminal 1140, and an authentication server 1160.
  • the wireless access point 1120 may be a general term for devices that provide wireless network access services, such as routers, Wi-Fi hotspots, and wireless gateways.
  • the wireless access point 1120 is a router.
  • the wireless access point 1120 and the management terminal 1140 are connected by a wireless network. Before the wireless access point 1120 establishes a wireless network connection with the user terminal (not shown), the wireless access point 1120 needs to be authenticated by the authentication server 1160. Authentication.
  • the wireless access point 1120 and the authentication server 1160 establish a connection through a wireless network or a wired network.
  • the communication mode between the wireless access point 1120 and the authentication server 1160 is not limited in this embodiment of the present application.
  • the management terminal 1140 is the merchant terminal 180 in the above.
  • the management terminal 1140 may be a mobile phone, a tablet, an e-book reader, a laptop portable computer, a desktop computer, or the like.
  • the management terminal 1140 is installed with an application specifically for managing public Wi-Fi, such as Tencent QQ, WeChat, Weibo, and the like.
  • the management terminal 1140 and the authentication server 1160 establish a connection through a wireless network or a wired network.
  • the management terminal 1140 transmits information to the authentication server 1160 through the encrypted channel.
  • the encrypted channel refers to an independent channel between the management terminal 1140 and the authentication server 1160, for example, sending information by using the https channel.
  • the communication mode between the management terminal 1140 and the authentication server 1160 is not limited in the embodiment of the present application.
  • the authentication server 1160 stores a list of trusted wireless access points, a second public key corresponding to the authentication server 1160, and a second private key. In some examples, there is more than one second public key corresponding to the authentication server 1160, and different second public keys are used for signatures, sessions, and the like, respectively.
  • the authentication server 1160 can be a server cluster or a server cluster composed of multiple servers.
  • FIG. 12 is a flowchart of a method for authenticating a wireless access point according to an embodiment of the present application.
  • This embodiment is exemplified by the wireless access point authentication method applied to the authentication server 1160 shown in FIG.
  • the method includes:
  • Step 1201 Receive first information sent by a wireless access point, where the first information includes: hardware information of the wireless access point and a first public key corresponding to the wireless access point.
  • the hardware information includes: the SSID (Service Set Identifier) of the wireless access point, the BSSID (Basic Service Set Identifier) of the wireless access point, and the MAC (Media Access Control, device) of the wireless access point. Physical address).
  • SSID Service Set Identifier
  • BSSID Basic Service Set Identifier
  • MAC Media Access Control, device
  • Step 1202 Receive second information sent by the management terminal, where the second information includes: hardware information of the wireless access point and owner information of the wireless access point.
  • the owner information includes, but is not limited to, at least one of latitude and longitude coordinates, owner name, and owner address.
  • Step 1203 After receiving the second information, perform identity authentication on the hardware information and the owner information, add the wireless access point to the trusted wireless access point list, and store the wireless access point when the identity authentication is passed. Corresponding first public key.
  • the wireless access point authentication method receives the first information sent by the wireless access point, receives the second information sent by the management terminal, and after receiving the second information, the hardware information and The owner information is used for identity authentication, and when the identity authentication is passed, the wireless access point is added to the list of trusted wireless access points, and the first public key corresponding to the wireless access point is stored; and the existing authentication method is solved.
  • the authentication server defaults the fake public Wi-Fi to a trusted public Wi-Fi, and the data transmitted by the user terminal to the fake public Wi-Fi and the data inside the user terminal are subject to security threats;
  • the authentication of the wireless access point is performed by the authentication server, so that only the real wireless access point can pass the identity authentication of the authentication server, thereby improving the data transmitted by the user terminal and the data security inside the user terminal.
  • FIG. 13 is a flowchart of a method for authenticating a wireless access point according to another embodiment of the present application.
  • This embodiment is exemplified by the wireless access point authentication method applied to the wireless access point authentication system shown in FIG.
  • the method includes:
  • Step 1301 The wireless access point sends the first information to the authentication server, where the first information includes: hardware information of the wireless access point and a first public key corresponding to the wireless access point.
  • Hardware information includes: SSID of the wireless access point, BSSID of the wireless access point, and wireless access The MAC of the point.
  • Step 1302 The management terminal sends the second information to the authentication server, where the second information includes: hardware information of the wireless access point and owner information of the wireless access point.
  • the owner information includes, but is not limited to, at least one of latitude and longitude coordinates, owner name, and owner address.
  • Step 1303 After receiving the second information, the authentication server performs identity authentication on the hardware information and the owner information, and when the identity authentication passes, adds the wireless access point to the list of trusted wireless access points, and stores and connects to the wireless device.
  • the wireless access point authentication method sends the first information to the authentication server through the wireless access point; the management terminal sends the second information to the authentication server; after receiving the second information, the authentication server Authenticating the hardware information and the owner information, adding the wireless access point to the list of trusted wireless access points and storing the first public key corresponding to the wireless access point when the identity authentication is passed; Authentication method, the authentication server will default the fake public Wi-Fi to the trusted public Wi-Fi, and the data transmitted by the user terminal to the fake public Wi-Fi and the data inside the user terminal will be threatened by security.
  • the problem is that the wireless access point is authenticated by the authentication server, so that only the real wireless access point can pass the authentication of the authentication server, thereby improving the data transmitted by the user terminal and the data security inside the user terminal. .
  • FIG. 14 is a flowchart of a method for authenticating a wireless access point according to still another embodiment of the present application.
  • This embodiment is exemplified by the wireless access point authentication method applied to the wireless network access system shown in FIG.
  • the method includes:
  • Step 1401 The wireless access point sends the first information to the authentication server, where the first information includes: hardware information of the wireless access point and a first public key corresponding to the wireless access point.
  • the wireless access point first sends the first information to the authentication server, where the first information includes hardware information of the wireless access point and a first public key corresponding to the wireless access point.
  • the hardware information of the wireless access point includes: the SSID of the wireless access point, the BSSID of the wireless access point, and the MAC of the wireless access point.
  • one wireless access point includes at least one SSID and one BSSID; if one wireless access point includes multiple SSIDs and multiple BSSIDs, the wireless access point carries multiple SSIDs and multiple BSSIDs simultaneously
  • the hardware information is sent to the authentication server.
  • the wireless access point Before the wireless access point sends the first information to the authentication server, the wireless access point generates a first public key and a first private key corresponding to the wireless access point, and sends the first public key corresponding to the wireless access point to the authentication. server.
  • the first information sent by the wireless access point to the authentication server also carries the first random number.
  • the wireless access point randomly generates a random number of 12 bytes, and the wireless access point encodes the generated 12-byte random number to obtain a first random number of 16 bytes.
  • the first information sent by the wireless access point to the authentication server is also carried with the wireless The firmware/plugin version number corresponding to the access point.
  • the wireless access point first signs the first information using the first private key corresponding to the wireless access point, and sends the first information and the first signature to the authentication server.
  • the wireless access point carries hardware information, a first public key corresponding to the wireless access point, a first random number, and a firmware/plug-in version number in the first information, the wireless access point The first information is signed using the first private key corresponding to the wireless access point, and the wireless access point simultaneously transmits the first information and the first signature to the authentication server.
  • the wireless access point sends the first information and the first signature to the authentication server by using a URL (Uniform Resource Locator): "http://[domain name]/router/inform”.
  • URL Uniform Resource Locator
  • the first information that the wireless access point sends to the authentication server includes the content as shown in Table 3:
  • the wireless access point shown in Table 3 includes 2 ssids.
  • the field represents the identifier of different information, such as: ver represents the current firmware/plug-in version number of the wireless access point; mac represents the MAC address of the wireless access point; ssid represents the SSID of the wireless access point; bssid represents the wireless access point BSSID; ssid2 represents the second SSID of the wireless access point; bssid2 represents the second BSSID of the wireless access point; pbk represents the second public key corresponding to the wireless access point, and the second public key is the wireless access point According to the Curve25519 algorithm, it is calculated by using base64 encoding; x represents the first random number generated by the wireless access point, and the first random number is obtained by using base64 encoding for the 12-byte random number randomly generated by the wireless access point. a random number of bytes; sig represents a first signature obtained by signing the above data using a second private key corresponding to the wireless
  • the authentication server receives the first information sent by the wireless access point.
  • Step 1402 The authentication server sends the feedback information and the second signature to the wireless access point.
  • the second signature is a signature of the authentication server by using the second private key corresponding to the authentication server, and the feedback information includes the first corresponding to the authentication server. Two public keys and a second random number.
  • the authentication server After receiving the first information sent by the wireless access point, the authentication server verifies whether the first information is tampered with by the first public key corresponding to the wireless access point, and when the first information is not falsified, to the wireless access point.
  • the feedback information includes a second public key and a second random number corresponding to the authentication server.
  • the authentication server performs a second signature on the feedback information using a second private key corresponding to the authentication server; the authentication server sends the feedback information together with the second signature to the wireless access point.
  • the feedback information may also include the latest version number of the firmware/plug-in corresponding to the wireless access point.
  • the latest version number of the firmware/plug-in corresponding to the wireless access point is used to detect if the firmware/plug-in in the wireless access point needs to be updated.
  • the feedback information and the second signature sent by the authentication server to the wireless access point are as shown in Table 4:
  • the field represents the identifier of different information, such as: ret represents the return code; msg represents the return code text information; ver represents the latest version number of the firmware/plug-in of the wireless access point; pbk represents the first corresponding to the authentication server Public key; y represents the second random number generated by the authentication server, the second random number is used to calculate the encryption key; sig represents the use of the first private key corresponding to the authentication server to sign the above data, and the wireless access point uses and authenticates The first public key corresponding to the server verifies the signature.
  • the type refers to the type of each information in the second information, including integers and strings.
  • the wireless access point receives the feedback information and the second signature sent by the authentication server.
  • Step 1403 The management terminal sends an acquisition request to the wireless access point, where the acquisition request is used to acquire hardware information of the wireless access point.
  • the wireless access point provides a default wireless network that does not require authentication, and the management terminal accesses the default wireless network. Then, the management terminal sends an acquisition request to the wireless access point through the default wireless network, where the acquisition request is used to acquire hardware information corresponding to the wireless access point.
  • the management terminal sends an acquisition request to the wireless access point through the channel with the URL: "http://[domain name]/admin/getrouterinfo".
  • the management terminal uses the instant messaging program "WeChat" to the wireless access point.
  • Sending the acquisition request, the obtaining request carries the openid identity identifier after the WeChat login, and the openid identity identifier is the identifier of the management terminal.
  • the acquisition request carries the identity of the management terminal.
  • the management terminal establishes a connection with the wireless access point through the default wireless network of the wireless access point, and the management terminal sends an acquisition request to the wireless access point through the wireless network.
  • the acquisition request sent by the management terminal to the wireless access point is as shown in Table 5:
  • the field openid represents the identifier of the management terminal, and the type is string.
  • the wireless access point receives the acquisition request sent by the management terminal.
  • Step 1404 The wireless access point sends hardware information to the management terminal.
  • the wireless access point After receiving the acquisition request sent by the management terminal, the wireless access point sends hardware information to the management terminal according to the acquisition request.
  • the hardware information sent by the wireless access point to the management terminal includes, but is not limited to, at least one of a MAC address of the wireless access point, an SSID of the wireless access point, and a BSSID of the wireless access point.
  • the wireless access point after receiving the acquisition request sent by the management terminal, the wireless access point verifies the identifier of the management terminal carried in the acquisition request, and sends the hardware information to the management terminal when verifying that the identifier has the management authority.
  • the management terminal stores in advance a first public key corresponding to the wireless access point.
  • the wireless access point performs a third signature on all or part of the hardware information and the identity of the management terminal using the first private key corresponding to the wireless access point.
  • the wireless access point performs a third signature on the MAC address of the wireless access point and the identifier of the management terminal by using the first private key corresponding to the wireless access point.
  • the wireless access point sends the hardware information and the third signature to the management terminal.
  • the hardware information sent by the wireless access point to the management terminal is as shown in Table 6:
  • the field represents the identifier of different information, such as: ret represents the return code; msg represents the return code text information; mac represents the MAC address of the wireless access point; ssid represents the SSID of the wireless access point; bssid represents the wireless connection
  • the BSSID of the ingress if the wireless access point supports multiple ssid and bssid, it is defined as an array ssidlist, showing multiple ssid and bssid; sig represents using the second private key corresponding to the wireless access point to openid and MAC address signature.
  • the type refers to the type of each information in the second information, including integers and strings.
  • the management terminal receives the hardware information and the third signature sent by the wireless access point, and verifies the third signature.
  • Step 1405 The management terminal sends the second information to the authentication server, where the second information includes: hardware information of the wireless access point and owner information of the wireless access point.
  • the management terminal After receiving the hardware information sent by the wireless access point, the management terminal sends the second information to the authentication server, where the second information includes hardware information of the wireless access point and owner information of the wireless access point.
  • the management terminal sends the second information to the authentication server through the encrypted connection
  • the encrypted connection is: a connection using https technology.
  • the management terminal sends the second information to the authentication server through the "https://[domain name]/admin/bind" channel.
  • the owner information of the wireless access point includes, but is not limited to, at least one of latitude and longitude coordinates, owner name, and owner address.
  • the owner's latitude and longitude coordinates are automatically acquired by the management terminal through positioning.
  • the information included in the owner information of the wireless access point is not specifically limited.
  • the second information further includes: an identifier of the management terminal and an access token of the management terminal.
  • the access token of the management terminal is used to indicate that the management terminal has the right to request the authentication server to authenticate the wireless access point.
  • the second information further includes a third signature.
  • the third signature refers to the signature of the wireless access point on all or part of the hardware information and the identity of the management terminal by using the first private key corresponding to the wireless access point.
  • the second information sent by the management terminal to the authentication server is as shown in Table 7:
  • the field represents the identifier of different information, such as: openid represents the identity of the management terminal; token represents the access token of the management terminal; mac represents the MAC address of the wireless access point; ssid represents the SSID of the wireless access point; Bssid represents the BSSID of the wireless access point; mark represents the SSID of the wireless access point; ssid2 represents the second SSID of the wireless access point; bssid2 represents the second BSSID of the wireless access point; mark2 represents the wireless access point
  • the type refers to the string type of each information in the second information.
  • the authentication server receives the second information sent by the management terminal.
  • Step 1406 After receiving the second information, the authentication server performs identity authentication on the hardware information and the owner information.
  • the identity authentication is passed, the wireless access point is added to the trusted wireless access point list, and is stored and connected to the wireless device.
  • the authentication server After receiving the second information sent by the management terminal, the authentication server acquires the hardware information and the owner information in the second information, and performs identity authentication on the acquired hardware information and the owner information.
  • the authentication server's authentication of hardware information and owner information includes:
  • the authentication server adds the wireless access point to the list of trusted wireless access points while storing the first public key corresponding to the wireless access point.
  • Adding a wireless access point to the list of trusted wireless access points by the authentication server means that the authentication server adds the SSID provided by the wireless access point through which the authentication is authenticated to the list of trusted wireless access points.
  • the authentication server stores the first public key corresponding to the wireless access point, so that the authentication server authenticates whether the first public key provided by the wireless access point belongs to the trusted wireless access point when performing identity authentication on the wireless access point. The corresponding public key in the list.
  • the first public key corresponding to the wireless access point stored by the authentication server is used to be used in the subsequent process.
  • the authentication process of the authentication server to the wireless access point includes: the authentication server receives the first public key provided by the wireless access point, and the authentication server verifies whether the first public key corresponding to the wireless access point belongs to the trusted wireless access point
  • the public key list corresponding to the list refers to a list of public keys corresponding to the trusted wireless access point.
  • the authentication server determines that the wireless access point is a trusted wireless access point; when the wireless access point provides When the first public key does not exist in the public key list corresponding to the trusted wireless access point list, the authentication server determines that the wireless access point is not a trusted wireless access point.
  • the wireless access point authentication method sends the first information to the authentication server through the wireless access point; the management terminal sends the second information to the authentication server; after receiving the second information, the authentication server Authenticating the hardware information and the owner information, adding the wireless access point to the list of trusted wireless access points and storing the first public key corresponding to the wireless access point when the identity authentication is passed; Authentication method, the authentication server will default the fake public Wi-Fi to the trusted public Wi-Fi, and the data transmitted by the user terminal to the fake public Wi-Fi and the data inside the user terminal will be threatened by security.
  • the problem is that the wireless access point is authenticated by the authentication server, so that only the real wireless access point can pass the authentication of the authentication server, thereby improving the data transmitted by the user terminal and the data security inside the user terminal. .
  • the wireless access point performs the first signature on the first information by using the first private key corresponding to the wireless access point, and sends the first information and the first signature to the authentication server, so that the first information is not falsified, and the first The security of a message.
  • the wireless access point performs a third signature on all or part of the hardware information and the identifier of the management terminal by using the first private key corresponding to the wireless access point, thereby ensuring that the hardware information of the wireless access point received by the management terminal is not Tampering has improved the security of the data.
  • step of the authentication server side in this embodiment can be separately implemented as the wireless access point authentication method on the authentication server side.
  • the information transmission between the authentication server and the wireless access point may be transmitted in an encrypted manner, that is, after step 1402, the following steps may also be included, as shown in FIG. 15A. Shown as follows:
  • Step 1402a The authentication server calculates a first key according to the first random number, the second random number, and the first public key corresponding to the wireless access point, and uses the first key to perform information sent to the wireless access point. encryption.
  • the authentication server After transmitting the feedback information and the second signature to the wireless access point, the authentication server calculates the first key according to the first random number, the second random number, and the first public key corresponding to the wireless access point. The authentication server encrypts the information sent to the wireless access point using the first key.
  • the information required by the authentication server to calculate the first key further includes the sequence number of the data packet.
  • the sequence number of the data packet refers to the sequence number corresponding to the information sent by the authentication server to the wireless access point.
  • the authentication server sends information to the wireless access point for the first time. At this time, the serial number of the data packet is 1. The authentication server sends information to the wireless access point for the second time. At this time, the serial number of the data packet is 2, and so on.
  • the process by which the authentication server calculates the first key is as follows:
  • the authentication server calculates the session key by using the first random number and the second random number; the authentication server calculates the shared key by using the first public key corresponding to the wireless access point; The server calculates the first key according to the session key and the shared key;
  • the authentication server calculates the first key based on the previous session key and the shared key.
  • the first key is used to encrypt the information sent to the wireless access point.
  • Step 1402b The wireless access point calculates a second key according to the first random number, the second random number, and the second public key corresponding to the authentication server, and encrypts the information sent to the authentication server by using the second key.
  • the wireless access point After receiving the feedback information and the second signature sent by the authentication server, the wireless access point verifies whether the feedback information is tampered according to the second public key corresponding to the authentication server, and when the feedback information is not falsified, according to the first random number, The second random number and the second public key corresponding to the authentication server are calculated to obtain a second key. The wireless access point encrypts the information sent to the authentication server using the second key.
  • the information required by the wireless access point to calculate the second key further includes the sequence number of the data packet.
  • the sequence number of the data packet refers to the sequence number corresponding to the information sent by the wireless access point to the authentication server.
  • the wireless access point sends information to the authentication server for the first time. At this time, the serial number of the data packet is 1. The wireless access point sends information to the authentication server for the second time. At this time, the serial number of the data packet is 2, and so on.
  • the process by which the wireless access point calculates the second key is as follows:
  • the wireless access point calculates the session key by using the first random number and the second random number; the wireless access point calculates the shared key by using the second public key corresponding to the authentication server. The wireless access point calculates the second key according to the session key and the shared key;
  • the wireless access point calculates the second key according to the previous session key and the shared key.
  • the second key is used to encrypt the information sent to the authentication server.
  • the authentication server encrypts the information sent to the wireless access point by using the first key
  • the wireless access point encrypts the information sent to the authentication server by using the second key to ensure wireless access. The security of information transfer between the point and the authentication server.
  • the management terminal can obtain the authentication network list in the authentication server through the authentication server. And delete the hardware information in the authentication network list. That is, after step 1406, the following steps may also be included, as shown in FIG. 15B:
  • Step 1407 The management terminal sends a list acquisition request to the authentication server.
  • the list obtaining request is used to obtain a list of authentication networks in the authentication server, and the authentication network list is a list of each trusted SSID provided by the trusted wireless access point.
  • the management terminal When the management terminal needs to view or delete the authentication network corresponding to the wireless access point, the management terminal sends a list acquisition request to the authentication server.
  • the list acquisition request is used to obtain a list of individual trusted SSIDs provided by trusted wireless access points in the authentication server.
  • the list acquisition request carries the identity of the management terminal.
  • the access request carries the openid and access token after the WeChat login.
  • the management terminal sends a list acquisition request to the authentication server through "http://[domain name]/admin/getrouterlist”.
  • the list obtaining request sent by the management terminal to the authentication server is as shown in Table 8:
  • the list obtaining request carries the identifier of the management terminal.
  • the field openid represents the identifier of the management terminal, and the token represents the access token of the management terminal, and both types are string type.
  • the authentication server receives the list acquisition request sent by the management terminal.
  • Step 1408 The authentication server sends a list of authentication networks to the management terminal.
  • the authentication After receiving the list acquisition request, the authentication sends a list of authentication networks to the management terminal.
  • the authentication network list is a list of each trusted SSID provided by the trusted wireless access point.
  • the field represents the identifier of different information, such as: ret represents the return code; msg represents the return code text information; mac represents the MAC address of the wireless access point; ssid represents the SSID of the wireless access point; bssid represents the wireless connection Inbound BSSID, if the wireless access point supports multiple ssid and bssid, the array ssidlist and routerlist are created, showing multiple ssid and bssid; mark represents the SSID of the wireless access point.
  • Type refers to the type of information in the authentication network list, including integers and strings.
  • the management terminal receives the authentication network list sent by the authentication server.
  • Step 1409 The management terminal sends an unbinding request to the authentication server, where the unbinding request includes a trusted SSID provided by the wireless access point.
  • the management terminal After receiving the authentication network list, the management terminal sends an unbinding request to the authentication server, where the unbinding request includes the trusted SSID provided by the wireless access point.
  • the unbind request is used to cancel the trusted SSID provided by the corresponding wireless access point in the authentication network list in the authentication server. For example, the management terminal sends an unbinding request to the authentication server through "http://[domain name]/admin/unbind".
  • the unbind request also includes the identity of the management terminal.
  • the unbinding request may cancel all SSIDs in the wireless access point, and may also cancel part of the SSID in the wireless access point.
  • the trusted SSID provided by the wireless access point included in the unbind request refers to the SSID to be cancelled in the wireless access point.
  • the unbind request sent by the management terminal to the authentication server is as shown in Table 10:
  • the wireless access point shown in Table 10 includes 2 ssids.
  • the field represents the identifier of different information, for example, the field openid represents the identifier of the management terminal, the token represents the access token of the management terminal, mac represents the MAC address of the wireless access point, ssid represents the SSID of the wireless access point, and bssid represents the wireless The BSSID of the access point; ssid2 represents the second SSID of the wireless access point; bssid2 represents the second BSSID of the wireless access point.
  • the type of all information in the unbind request is the type of the string.
  • the authentication server receives the unbinding request sent by the management terminal.
  • Step 1410 The authentication server deletes the trusted SSID provided by the wireless access point in the authentication network list according to the unbinding request.
  • the authentication server After receiving the unbinding request, the authentication server obtains the trusted SSID provided by the wireless access point carried in the unbinding request, and deletes the trusted SSID provided by the wireless access point in the authentication network list according to the hardware information.
  • the management terminal determines that the SSID of the wireless access point is the authentication network
  • the SSID of the determined wireless access point is sent to the authentication server. That is, after step 1406, the following steps may also be included, as shown in FIG. 15C:
  • Step 1411 The management terminal sends a network confirmation request to the authentication server, where the network confirmation request carries the SSID of the wireless access point.
  • the SSID of the wireless access point is designated as the SSID of the authentication network; and the SSID of the specified wireless access point is carried in the network confirmation request and sent to the authentication server.
  • the management terminal sends a network confirmation request to the authentication server via "http://[domain name]/admin/setwifi”.
  • the authentication server receives the network confirmation request sent by the management terminal.
  • step 1412 the authentication server adds the specified SSID to the authentication network list according to the network confirmation request.
  • the authentication server After receiving the network confirmation request sent by the management terminal, the authentication server acquires the SSID of the wireless access point specified in the network confirmation request; the authentication server adds the specified SSID to the authentication network list.
  • the list of authentication networks refers to a list of trusted SSIDs provided by trusted wireless access points.
  • FIG. 16 is a structural block diagram of a wireless access point authentication apparatus according to an embodiment of the present application.
  • the wireless access point authentication device can be implemented as all or part of the authentication server in FIG. 11 by software, hardware, or a combination of both.
  • the wireless access point authentication device includes:
  • the first receiving module 1620 is configured to receive first information sent by the wireless access point, where the first information includes: hardware information of the wireless access point and a first public key corresponding to the wireless access point.
  • the second receiving module 1640 is configured to receive second information sent by the management terminal, where the second information includes: hardware information of the wireless access point and owner information of the wireless access point.
  • the identity authentication module 1660 is configured to perform identity authentication on the hardware information and the owner information after receiving the second information, and add the wireless access point to the trusted wireless access point list when the identity authentication is passed, and store and The first public key corresponding to the wireless access point.
  • the wireless access point authentication apparatus receives the first information sent by the wireless access point, receives the second information sent by the management terminal, and after receiving the second information, the hardware information and The owner information is used for identity authentication, and when the identity authentication is passed, the wireless access point is added to the list of trusted wireless access points, and the first public key corresponding to the wireless access point is stored; and the existing authentication method is solved.
  • the authentication server defaults the fake public Wi-Fi to a trusted public Wi-Fi, and the data transmitted by the user terminal to the fake public Wi-Fi and the data inside the user terminal are subject to security threats;
  • the authentication of the wireless access point is performed by the authentication server, so that only the real wireless access point can pass the identity authentication of the authentication server, thereby improving the data transmitted by the user terminal and the data security inside the user terminal.
  • FIG. 17 is a structural block diagram of a wireless access point authentication apparatus according to another embodiment of the present application.
  • the wireless access point authentication device can be implemented as all or part of the authentication server in FIG. 11 by software, hardware, or a combination of both.
  • the wireless access point authentication device includes:
  • the first receiving module 1710 is configured to receive first information sent by the wireless access point, where the first information packet is sent The hardware information of the wireless access point and the first public key corresponding to the wireless access point.
  • the first receiving module 1710 is further configured to receive the first information and the first signature sent by the wireless access point, where the first signature is that the wireless access point uses the first corresponding to the wireless access point.
  • the signature of the first information by a private key.
  • the first information also carries a first random number.
  • the wireless access point authentication apparatus may further include: a feedback sending module 1720 and a key calculating module 1730.
  • the feedback sending module 1720 is configured to send the feedback information and the second signature to the wireless access point, where the second signature is a signature of the feedback information by the authentication server using the second private key corresponding to the authentication server, where the feedback information includes the corresponding to the authentication server.
  • the second public key and the second random number are configured to send the feedback information and the second signature to the wireless access point, where the second signature is a signature of the feedback information by the authentication server using the second private key corresponding to the authentication server, where the feedback information includes the corresponding to the authentication server.
  • the second public key and the second random number is configured to send the feedback information and the second signature to the wireless access point, where the second signature is a signature of the feedback information by the authentication server using the second private key corresponding to the authentication server, where the feedback information includes the corresponding to the authentication server.
  • the second public key and the second random number are configured to send the feedback information and the second signature to the wireless access point, where the second signature is a signature of the feedback information by the authentication server using the second private key corresponding to
  • the key calculation module 1730 is configured to calculate, according to the first random number, the second random number, and the first public key corresponding to the wireless access point, the first key, and send the first key pair to the wireless access point.
  • the information is encrypted.
  • the second receiving module 1740 is configured to receive second information sent by the management terminal, where the second information includes: hardware information of the wireless access point and owner information of the wireless access point.
  • the identity authentication module 1750 is configured to perform identity authentication on the hardware information and the owner information after receiving the second information, and add the wireless access point to the trusted wireless access point list when the identity authentication is passed, and store and The first public key corresponding to the wireless access point.
  • the wireless access point authentication apparatus may further include: a request receiving module 1760 and a list sending module 1770.
  • the request receiving module 1760 is configured to receive a list obtaining request sent by the management terminal, where the list obtaining request is used to obtain an authentication network list in the authentication server, where the authentication network list is a trusted service set identifier SSID provided by the trusted wireless access point. List.
  • the list sending module 1770 is configured to send the authentication network list to the management terminal.
  • the wireless access point authentication apparatus may further include: a cancel receiving module 1780 and an information deleting module 1790.
  • the cancel receiving module 1780 is configured to receive an unbinding request sent by the management terminal, where the unbinding request includes a trusted SSID provided by the wireless access point.
  • the information deleting module 1790 is configured to delete the trusted SSID provided by the wireless access point in the authentication network list according to the unbinding request.
  • the wireless access point authentication apparatus sends the first information to the authentication server through the wireless access point; the management terminal sends the second information to the authentication server; after receiving the second information, the authentication server Authenticating the hardware information and the owner information, adding the wireless access point to the list of trusted wireless access points and storing the first public key corresponding to the wireless access point when the identity authentication is passed; Authentication method, the authentication server will default the fake public Wi-Fi to the trusted public Wi-Fi, and the data transmitted by the user terminal to the fake public Wi-Fi and the data inside the user terminal will be threatened by security.
  • the problem is that the wireless access point is authenticated by the authentication server, so that only the real wireless access point can pass the authentication service.
  • the identity authentication of the server improves the data transmitted by the user terminal and the data security inside the user terminal.
  • the wireless access point performs the first signature on the first information by using the first private key corresponding to the wireless access point, and sends the first information and the first signature to the authentication server, so that the first information is not falsified, and the first The security of a message.
  • the wireless access point performs a third signature on all or part of the hardware information and the identifier of the management terminal by using the first private key corresponding to the wireless access point, thereby ensuring that the hardware information of the wireless access point received by the management terminal is not Tampering has improved the security of the data.
  • FIG. 18 is a structural block diagram of a wireless access point authentication system provided by an embodiment of the present application, where the system includes: a management terminal 1820, a wireless access point 1840, and an authentication server 1860;
  • the management terminal 1820 is configured to send second information to the authentication server.
  • a wireless access point 1840 configured to send first information to an authentication server
  • the authentication server 1860 includes the wireless access point authentication device as described in any of the embodiments shown in FIG. 16 or the embodiment shown in FIG.
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例公开了一种无线网络连接方法、装置及系统，属于网络安全领域。本申请通过向无线接入点发送第一接入请求；向认证服务器发送第二接入请求；验证无线接入点是否属于可信任无线接入点，属于可信任无线接入点时与用户终端进行第一身份认证，与用户终端协商生成主密钥；向无线接入点发送与用户信息对应的主密钥；根据主密钥与用户终端协商建立加密无线网络连接；解决了用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了只有可信任无线接入点能获取与用户信息对应的主密钥，从而与用户终端根据各自持有的主密钥协商建立加密无线网络连接，提高了用户终端传输的数据以及用户终端内部数据安全性的效果。

Description

无线网络连接方法、装置及存储介质 技术领域
本申请实施例涉及网络安全领域，特别涉及一种无线网络连接方法、装置及存储介质。
背景
随着用户终端的广泛使用，无线网络成为用户终端接入互联网的一种重要形式。常见的无线网络是Wi-Fi(Wireless-Fidelity，无线保真)网络。目前的大部分商业场所均提供有公众Wi-Fi，供用户免费使用。
现有技术中，用户终端接入公众Wi-Fi的方式主要包括：无密码接入、验证码接入和单一密码接入三种方式。无密码接入方式是指用户终端在获取到公众Wi-Fi的SSID(Service Set Identifier，服务集标识)后，向无线接入点发送接入请求，无线接入点无需验证，直接允许用户终端接入该公众Wi-Fi。验证码接入方式是指用户终端在接入公众Wi-Fi时需要获取公众Wi-Fi的SSID和验证码，通过将验证码和SSID向无线接入点发送接入请求，无线接入点对验证码和SSID进行验证；在验证成功后，允许用户终端接入该公众Wi-Fi。验证码通常具有有效期，比如60s。单一密码接入方式是指用户终端在接入公众Wi-Fi时，预先获取该公众Wi-Fi的SSID和连接密码，通过将该SSID和连接密码向无线接入点发送接入请求。无线接入点对SSID和连接密码进行验证；在无线接入点验证成功后，允许用户终端接入该公众Wi-Fi。连接密码通常是长期有效的。
内容
为了解决用户使用现有的接入方法使得用户终端接入假冒的公众Wi-Fi后，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题，本申请实施例提供了一种无线网络连接方法、装置及系统。所述技术方案如下：
本申请实施例的一种无线网络连接方法包括：
接收无线接入点发送的接入请求，所述接入请求携带有试图接入所述无线接入点的用户终端的用户信息；
在接收到所述接入请求后，验证所述无线接入点是否为可信任无线接入点；
确定所述无线接入点为可信任无线接入点时，与所述用户终端进行第一身份认证；
在所述第一身份认证成功时，为所述用户终端生成主密钥，并向所述用户终端发送所述主密钥；
向所述无线接入点发送与所述用户信息对应的所述主密钥，以便所述无线接入点与所述用户终端根据各自持有的所述主密钥建立加密无线网络连接。
本申请实施例的一种无线网络连接方法包括：
接收用户终端发送的第一接入请求，所述第一接入请求携带有所述用户终端的用户信息；
向所述认证服务器发送第二接入请求，所述第二接入请求携带有所述用户信息；
接收所述认证服务器发送的与所述用户信息对应的主密钥，所述主密钥是所述认证服务器在接收到所述第二接入请求后，验证无线接入点属于可信任无线接入点时，与用户终端进行第一身份认证成功后协商生成的密钥；
与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接。
本申请实施例的一种无线网络连接装置包括：
请求接收模块，用于接收无线接入点发送的接入请求，所述接入请求携带有试图接入所述无线接入点的用户终端的用户信息；
信任验证模块，用于在接收到所述接入请求后，验证所述无线接入点是否为可信任无线接入点；
用户认证模块，用于在确定所述无线接入点为可信任无线接入点时，与所述用户终端进行第一身份认证；
密钥生成模块，用于在所述第一身份认证成功时，为所述用户终端生成主密钥，并向所述用户终端发送所述主密钥；
密钥发送模块，用于向所述无线接入点发送与所述用户信息对应的所述主密钥，以便所述无线接入点与用户终端根据各自持有的所述主密钥与用户终端协商建立加密无线网络连接。
本申请实施例的一种无线网络连接装置包括：
第一接收模块，用于接收用户终端发送的第一接入请求，所述第一接入请求携带有所述用户终端的用户信息；
第二接收模块，用于向所述认证服务器发送第二接入请求，所述第二接入请求携带有所述用户信息；
密钥接收模块，用于接收所述认证服务器发送的与所述用户信息对应的主密钥，所述主密钥是所述认证服务器在接收到所述第二接入请求后，验证无线接入点属于可信任无线接入点时，与用户终端进行第一身份认证成功后为所述用户终端生成的密钥；
网络连接模块，用于与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接。
本申请实施例的一种存储介质存储有一系列机器可执行指令，其特征在于，所述指令可以使至少一个处理器执行以下操作：
接收无线接入点发送的第二接入请求，所述第二接入请求携带有所述用户信息；
在接收到所述第二接入请求后，验证所述无线接入点是否属于可信任无线接入点；
在所述无线接入点属于所述可信任无线接入点时与用户终端进行第一身份认证；
在所述第一身份认证成功时，与所述用户终端协商生成主密钥，并向所述用户终端发送所述主密钥；
向所述无线接入点发送与所述用户信息对应的所述主密钥，以便所述无线接入点与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接。
本申请实施例的一种存储介质存储有一系列机器可执行指令，其特征在于，所述指令可以使至少一个处理器执行以下操作：
接收用户终端发送的第一接入请求，所述第一接入请求携带有所述用户终端的用户信息；
向认证服务器发送第二接入请求，所述第二接入请求携带有所述用户信息；
接收所述认证服务器发送的与所述用户信息对应的主密钥，所述主密钥是所述认证服务器在接收到所述第二接入请求后，验证发送所述第二接入请求的无线接入点为可信任无线接入点时，与用户终端进行第一身份认证成功后为所述用户终端生成的密钥；
与所述用户终端根据各自持有的所述主密钥进行加密通信。
通过认证服务器对无线接入点进行身份认证，只有可信任无线接入点才能获取与用户信息对应的主密钥，从而根据主密钥与用户终端建立加密无线网络连接，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
附图简要说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1A是本申请实施例提供的无线网络连接系统的结构示意图；
图1B是本申请实施例提供的认证服务器的示意图；
图1C是本申请实施例提供的无线接入点的示意图；
图2是本申请实施例提供的无线网络连接方法的流程图；
图3是本申请实施例提供的无线网络连接方法的流程图；
图4是本申请实施例提供的无线网络连接方法的流程图；
图5A是本申请实施例提供的无线网络接入方法的流程图；
图5B是本申请实施例提供的认证服务器对无线接入点的身份认证过程的示意图；
图5C是本申请实施例提供的用户终端向认证服务器注册用户名和密钥信息过程的示意图；
图5D是本申请实施例提供的用户终端接入无线接入点过程的示意图；
图6是本申请实施例提供的无线网络连接装置的结构方框图；
图7是本申请实施例提供的无线网络连接装置的结构方框图；
图8是本申请实施例提供的无线网络连接装置的结构方框图；
图9是本申请实施例提供的无线网络连接装置的结构方框图；
图10是本申请实施例提供的一种无线网络连接系统的结构方框图；
图11是本申请实施例提供的无线接入点认证系统的结构示意图；
图12是本申请实施例提供的无线接入点认证方法的流程图；
图13是本申请实施例提供的无线接入点认证方法的流程图；
图14是本申请实施例提供的无线接入点认证方法的流程图；
图15A是本申请实施例提供的无线接入点认证方法的流程图；
图15B是本申请实施例提供的无线接入点认证方法的流程图；
图15C是本申请实施例提供的无线接入点认证方法的流程图；
图16是本申请实施例提供的无线接入点认证装置的结构方框图；
图17是本申请实施例提供的无线接入点认证装置的结构方框图；
图18本申请实施例提供的一种无线接入点认证系统的结构方框图。
实施本申请的方式
为了描述上的简洁和直观，下文通过描述若干代表性的实施例来对本申请的方案进行阐述。但本文并未示出所有实施方式。实施例中大量的细节仅用于帮助理解本申请的方案，本申请的技术方案实现时可以不局限于这些细节。为了避免不必要地模糊了本申请的方案，一些实施方式没有进行细致地描述，而是仅给出了框架。下文中，“包括”是指“包括但不限于”，“根据......”是指“至少根据......，但不限于仅根据......”。说明书和权利要求书中的“包括”是指某种程度上至少包括，应当解释为除了包括之后提到的特征外，其它特征也可以存在。
为了便于理解，首先介绍一些本申请实施例所涉及的技术概念。
公钥和私钥
公钥是指公开的密钥，不需要进行保密，解密方可以通过各种渠道获取；而私钥是指仅由加密方自身持有的密钥，需要进行保密。一个公钥对应一个私钥；公钥和私钥共同组成了一种不对称加密方式。不对称加密方式是指用 公钥加密的信息只能用对应的私钥进行解密，使用私钥加密的信息也只能用对应的公钥进行解密。也即，加密和解密使用的密钥是不相同的。
比如：假定A要向B发送加密信息，则A首先要获取与B对应的公钥，然后使用与B对应的公钥对需要发送的信息进行加密后，将加密后的信息发送给B，B在接收到A发送的加密的信息后，必须使用与B对应的私钥才可以对加密的信息进行解密，获取加密的信息中的内容。由于与B对应的私钥只有B自己拥有，因此A发送的加密的信息是安全的。
加密和签名
加密是指发送者使用与接收者对应的公钥对发送的数据进行加密，接收者在接收到加密的数据后只能使用与接收者对应的私钥进行解密，在解密后才可以获取到发送者发送的数据；或者，发送者使用与发送者对应的私钥对发送的数据进行加密，接收者在接收到加密的数据后，只能使用与发送者对应的公钥进行解密，在解密后才可获取到发送者发送的数据。加密用于防止数据泄露，只有拥有与公钥对应的私钥才可以解密得到数据的内容。
签名是指发送者使用与发送者对应的私钥对发送的数据进行签名，签名是指发送者对发送的数据运用哈希函数计算得到信息摘要，发送者使用与发送者对应的私钥对计算得到的信息摘要进行加密，发送者将加密后的信息摘要作为数据的签名和数据一起发送给接收者；接收者在接收到数据和签名后，首先使用与发送者一样的哈希函数从接收到的数据中计算得出信息摘要，再使用与发送者对应的公钥对加密后的信息摘要进行解密；当两个信息摘要相同时，接收者可以确认接收到的数据和签名是发送者发送的。签名用于防止数据被篡改，拥有与私钥对应的公钥可以验证数据是否是拥有私钥的发送者发送的数据。
请参考图1A，其示出了本申请一个示例性实施例提供的无线网络连接系统的结构示意图。该无线网络连接系统包括：无线接入点120、用户终端140和认证服务器160。
无线接入点120可以是路由器、Wi-Fi热点和无线网关等提供无线网络接入服务的设备的统称。本申请实施例中，以无线接入点120是路由器来举例说明。无线接入点120在与用户终端140建立无线网络连接之前，需要通过认证服务器160对该无线接入点120的身份认证。无线接入点120与认证服务器160之间通过无线网络或有线网络建立连接。本申请实施例对无线接入点120和认证服务器160之间的通信方式不做限定。
用户终端140可以是手机、平板电脑、电子书阅读器、MP3(Moving Picture Experts Group Audio Layer III，动态影像专家压缩标准音频层面3)播放器、MP4(Moving Picture Experts Group Audio Layer IV，动态影像专家压缩标准音频层面4)播放器、膝上型便携计算机和台式计算机等等。一些例子中，用户终端140中安装有具有扫码功能的应用程序，比如，腾讯QQ、微信、 QQ浏览器、无线上网程序等。
用户终端140与认证服务器160之间通过无线网络或有线网络建立连接。一些例子中，用户终端140通过独立通道向认证服务器160注册用户信息和密钥信息。其中，用户信息是指用于标识用户的信息，例如，用户名、用户ID、用户的设备标识(如国际移动设备身份码IMEI、唯一设备识别符UDID、MAC地址、)、用户的IP地址，等。独立通道是指不经过无线接入点的通信通道，比如：2G网络、3G网络等。本申请实施例对用户终端140和认证服务器160之间的通信方式不做限定。
认证服务器160中存储有可信任公钥集合、每个用户终端140对应的用户信息和密钥信息。认证服务器160可以是一台服务器、多台服务器组成的服务器集群或云计算中心。
图1B是本申请实施例提供的认证服务器的示意图。该认证服务器可以包括处理器161、通信接口164、存储装置166和互联机构169。存储装置166中包括操作系统167、通信模块168、数据库162和安全认证模块163。
处理器161可以有一个或者多个，可以在同一个物理设备中，或者分布在多个物理设备中。
认证服务器可以利用通信接口164通过某种网络与用户终端和无线接入点设备等进行通信。
数据库162中存储有用户数据库1621和接入点数据库1622。用户数据库1621中存储有每个用户终端140对应的用户信息和密钥信息。接入点数据库1622存储有可信任公钥集合，即经过认证的无线接入点对应的公钥的集合。
安全认证模块163包括：用户认证模块1631、接入点认证模块1632和接入控制模块1633。
用户认证模块1631可以接收用户终端发送的注册请求，为用户终端生成用户信息和密钥信息，并将生成的用户信息和密钥信息提供给用户终端并保存在用户数据库1621中。
接入点认证模块1632可以接收无线接入点发送的身份认证请求，将通过身份认证的无线接入点对应的公钥添加至接入点数据库1622中的可信任公钥集合中。一些例子中，接入点认证模块1632对无线接入点进行身份认证时，还可以依据从另一设备接收到的服务提供方的认证信息对该无线接入点进行认证。该另一设备是指使用该无线接入点提供公共无线网络接入服务的一方(如商家)所使用的其它设备，后文也称为商家终端。商家终端提供的认证信息是指与无线接入点的拥有者的身份和资质有关的信息，例如，可以包括拥有者信息、管理员信息、商家的资质证明、经营许可信息，等。
接入控制模块1633可以在接收到无线接入点的接入请求后，利用接入点数据库1622中的可信任公钥集合验证无线接入点是否为可信任无线接入点；当无线接入点为可信任无线接入点时，根据接入请求中的用户信息和用户数 据库1621中的用户数据为用户终端生成通信密钥，并将通信密钥分别发送给该用户终端和该无线接入点。这里，通信密钥是专门用于该用户终端与该无线接入点之间进行加密通信的密钥，后文也称为主密钥。
本申请实施例中，用户终端与无线接入点之间进行加密通信使用的主密钥与认证服务器对用户终端认证所使用的密钥(即用户数据库1621中该用户终端的用户信息对应的密钥信息)不同，也与无线接入点与认证服务器通信时使用的密钥(即无线接入点对应的公钥和私钥)不同。
一些实施例中，认证服务器可以由多台服务器实现时，上述各模块可以分别位于不同的物理设备中，同一模块的功能也可以由多个物理设备实现。安全认证模块163中的各模块仅仅是为了方便描述而采用的模块划分方式，其它实施例中，安全认证模块163的功能可以由按照多种划分方式得到的模块集合分别实现。
图1C是本申请实施例提供的无线接入点的示意图。该无线接入点可以包括处理器121、通信接口124、存储装置126和互联机构129。存储装置126中包括操作系统127、通信模块128和接入管理模块123。
处理器121可以有一个或者多个，可以包括多核处理器。
存储装置126可以包括ROM、FLASH、NVRAM、RAM等中的一个或者多个。
无线接入点可以利用通信接口124与用户终端和认证服务器进行通信。
接入管理模块123包括：注册模块1231和用户接入模块1232。
注册模块1231可以按照预先设置的机制获得该无线接入点对应的公钥和私钥，获取预先设置的认证服务器的信息(例如地址、认证服务器对应的公钥，等)，向认证服务器发送身份认证请求。
用户接入模块1232可以在接收到用户终端发送的第一接入请求后，向认证服务器发送包括用户终端信息的第二接入请求，接收认证服务器发送的主密钥，并利用主密钥与该用户终端建立加密无线网络连接。
一些实施例中，接入管理模块123可以作为固件存储在ROM、或FLASH、或NVRAM中。各种预先设置的机制和信息可以作为接入管理模块123的一部分保存在ROM、或FLASH、或NVRAM中，也可以以独立的配置文件的形式保存在ROM、或FLASH、或NVRAM中。
请参考图2，其示出了本申请一个实施例提供的无线网络连接方法的流程图。本实施例以该无线网络连接方法应用于图1A所示的无线接入点120中来举例说明。该方法包括：
步骤201，接收用户终端发送的第一接入请求，第一接入请求携带有试图接入所述无线接入点的用户终端的用户信息；
步骤202，向认证服务器发送第二接入请求，第二接入请求携带有用户信息；
步骤203，接收认证服务器发送的与用户信息对应的主密钥，主密钥是认证服务器在接收到第二接入请求后，验证无线接入点属于可信任无线接入点时，与用户终端进行第一身份认证成功后协商生成的密钥；
步骤204，与用户终端根据各自持有的主密钥协商建立加密无线网络连接。
综上所述，本实施例提供的无线网络接入方法，接收用户终端发送的第一接入请求；向认证服务器发送第二接入请求；接收认证服务器发送的与用户信息对应的主密钥；根据主密钥与用户终端协商建立加密无线网络连接；解决了用户使用现有的接入方法使得用户终端接入假冒的公众Wi-Fi时，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，只有可信任无线接入点才能获取与用户信息对应的主密钥，从而根据主密钥与用户终端建立加密无线网络连接，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
请参考图3，其示出了本申请一个实施例提供的无线网络连接方法的流程图。本实施例以该无线网络连接方法应用于图1A所示的认证服务器160中来举例说明。该方法包括：
步骤301，接收无线接入点发送的第二接入请求，第二接入请求携带有用户信息。
步骤302，在接收到第二接入请求后，验证无线接入点是否属于可信任无线接入点。
步骤303，在无线接入点属于可信任无线接入点时与用户终端进行第一身份认证。
步骤304，在第一身份认证成功时，与用户终端协商生成主密钥，并向用户终端发送主密钥。
步骤305，向无线接入点发送与用户信息对应的主密钥，以便无线接入点与用户终端根据各自持有的主密钥协商建立加密无线网络连接。
综上所述，本实施例提供的无线网络接入方法，通过接收无线接入点发送的第二接入请求；在接收到第二接入请求后，验证无线接入点是否属于可信任无线接入点；在无线接入点属于可信任无线接入点时与用户终端进行第一身份认证；在第一身份认证成功时，与用户终端协商生成主密钥，并向用户终端发送主密钥；向无线接入点发送与用户信息对应的主密钥；解决了用户使用现有的接入方法使得用户终端接入假冒的公众Wi-Fi时，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，只有可信任无线接入点才能获取与用户信息对应的主密钥，从而根据主密钥与用户终端建立加密无线网络连接，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
请参考图4，其示出了本申请一个实施例提供的无线网络连接方法的流程图。本实施例以该无线网络连接方法应用于图1A所示的无线网络接入系统中来举例说明。该方法包括：
步骤401，用户终端向无线接入点发送第一接入请求，第一接入请求携带有用户终端的用户信息。
用户终端存储有预先在认证服务器中注册的用户信息和密钥信息。
对应地，无线接入点接收用户终端发送的第一接入请求。
步骤402，无线接入点向认证服务器发送第二接入请求，第二接入请求携带有用户信息。
第二接入请求中携带有与无线接入点对应的第二公钥。
对应地，认证服务器接收无线接入点发送的第二接入请求。
步骤403，认证服务器在接收到第二接入请求后，验证无线接入点是否属于可信任无线接入点。
步骤404，在无线接入点属于可信任无线接入点时，认证服务器与用户终端进行第一身份认证。
在无线接入点属于可信任无线接入点时，认证服务器与用户终端进行双向身份认证，认证服务器对用户终端进行身份认证，认证用户终端是否可信；同时用户终端对认证服务器也进行认证。
步骤405，在第一身份认证成功时，认证服务器与用户终端协商生成主密钥，并向用户终端发送主密钥。
对应地，用户终端接收认证服务器发送的与用户信息对应的主密钥。
步骤406，认证服务器向无线接入点发送与用户信息对应的主密钥。
对应地，无线接入点接收认证服务器发送的与用户信息对应的主密钥。
步骤407，无线接入点与用户终端根据各自持有的主密钥协商建立加密无线网络连接。
综上所述，本实施例提供的无线网络接入方法，通过用户终端向无线接入点发送第一接入请求；无线接入点向认证服务器发送第二接入请求；认证服务器在接收到第二接入请求后，验证无线接入点是否属于可信任无线接入点，在无线接入点属于可信任无线接入点时，认证服务器与用户终端进行第一身份认证；在第一身份认证成功时，认证服务器与用户终端协商生成主密钥，并向用户终端发送主密钥；认证服务器向无线接入点发送与用户信息对应的主密钥；无线接入点与用户终端根据各自持有的主密钥协商建立加密无线网络连接；解决了用户使用现有的接入方法使得用户终端接入假冒的公众Wi-Fi时，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，只有可信任无线接入点才能获取与用户信息对应的主密钥，从而根据主密钥与用户终端建立加密无线网络连接，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
在一个具体的例子中，本申请实施例的整个过程包括四个阶段：
第一、无线接入点根据与无线接入点对应的第二公钥和第二私钥，在认证服务器中完成身份认证，认证服务器将完成身份认证的无线接入点对应的第二公钥添加至可信任公钥集合中；
第二、用户终端通过独立通道在认证服务器中注册用户信息和密钥信息，认证服务器将用户终端注册的用户信息和密钥信息反馈给用户终端。一些例子中，密钥信息是密码或者证书。
第三、用户终端向无线接入点发送第一接入请求，第一接入请求中携带有用户信息，无线接入点向认证服务器发送第二接入请求，第二接入请求携带有用户信息和与无线接入点对应的第二公钥。
第四、认证服务器对无线接入点进行验证，在无线接入点是可信任无线接入点时，与用户终端进行第一身份认证；在第一身份认证成功时，与用户终端根据各自持有的密钥信息协商生成主密钥，并将与用户信息对应的主密钥分别发送给用户终端和无线接入点；无线接入点与用户终端根据各自持有的主密钥协商建立加密无线网络连接。
请参考图5A，其示出了本申请另一个实施例提供的无线网络接入方法的流程图。本实施例以该无线网络接入方法应用于图1A所示的无线网络接入系统中来举例说明。该方法包括：
第一阶段，包括步骤501至步骤506；
步骤501，无线接入点生成与无线接入点对应的第二公钥和第二私钥。
无线接入点在使用之前，首先生成与无线接入点对应的第二公钥和第二私钥。第二私钥由无线接入点自身来保存。
步骤502，无线接入点获取与认证服务器对应的第一公钥。
无线接入点在生成第二公钥和第二私钥后，获取认证服务器对应的第一公钥。
一些例子中，无线接入点首先获取认证服务器对应的第一公钥后，再生成与无线接入点对应的第二公钥和第二私钥。
一些例子中，与认证服务器对应的第一公钥存储在无线接入点的固件中，无线接入点直接从固件中获取与认证服务器对应的第一公钥。
本实施例中，对无线接入点获取认证服务器对应的第一公钥和生成与无线接入点对应的第二公钥和第二私钥的先后顺序不作具体限定。
步骤503，无线接入点向认证服务器发送身份认证请求。
身份认证请求携带有认证信息和与无线接入点对应的第二公钥，认证信息和与无线接入点对应的第二公钥均使用与认证服务器对应的第一公钥进行加密，认证信息至少包括硬件信息和/或拥有者信息。
一些例子中，认证信息是无线接入点通过与无线接入点对应的第二私钥进行加密的信息。
一些例子中，无线接入点直接将硬件信息和拥有者信息发送给认证服务器。另一些例子中，无线接入点只将硬件信息发送给认证服务器，拥有者信息由管理终端间接发送给认证服务器。
本实施例中，对向认证服务器发送认证信息的方式不作具体限定。本实施例中以无线接入点向认证服务器发送硬件信息和拥有者信息为例进行举例说明。
无线接入点在获取到认证服务器对应的第一公钥后，与认证服务器建立加密通道。无线接入点通过加密通道将认证信息和与无线接入点对应的第二公钥携带在身份认证请求中发送给认证服务器。
加密通道是指：将无线接入点向认证服务器发送的信息均使用与认证服务器对应的第一公钥进行加密，认证服务器在接收到无线接入点发送的加密信息后，需要使用认证服务器的第一私钥进行解密后获取其中的信息；认证服务器向无线接入点发送的信息均使用与无线接入点对应的第二公钥进行加密，无线接入点在接收到认证服务器发送的加密信息后，必须使用与无线接入点对应的第二私钥进行解密后才能获取其中的信息。
一些例子中，与无线接入点对应的硬件信息可以包括：无线接入点的服务集标识、无线接入点的BSSID(Basic Service Set Identifier，基本服务集标识)、无线接入点的MAC(MediaAccess Control，设备的物理地址)、无线接入点的网络地址和无线接入点的网关IP(Internet Protocol，互联网协议)等。
本实施例中，对无线接入点将第二公钥提供给认证服务器的方式不作具体限定。
与无线接入点对应的拥有者信息可以包括：管理员帐号、商家名称、注册公司、商家地址和商家电话等信息。
一些例子中，无线接入点可以将认证信息和与无线接入点对应的第二公钥分别单独发送给认证服务器。比如：无线接入点先通过与认证服务器对应的第一公钥对与无线接入点对应的第二公钥进行加密后发送给认证服务器，再通过与无线接入点对应的第二公钥对认证信息进行加密后发送给认证服务器。认证服务器首先根据与认证服务器对应的第一私钥解密得到与无线接入点对应的第二公钥；再使用与无线接入点对应的第二公钥对加密后的认证信息进行解密得到认证信息。
一些例子中，无线接入点可以直接将身份认证请求发送给认证服务器，身份认证请求中携带有与无线接入点对应的第二公钥、硬件信息和/或拥有者信息。
一些例子中，无线接入点使用与认证服务器对应的第一公钥对身份认证请求进行加密，身份认证请求中携带有与无线接入点对应的第二公钥、硬件信息和/或拥有者信息；
一些例子中，无线接入点使用与认证服务器对应的第一公钥对身份认证请求进行加密，身份认证请求包括认证信息和与无线接入点对应的第二公 钥。认证信息是无线接入点使用与无线接入点对应的第二私钥进行加密的信息。认证信息携带有硬件信息和/或拥有者信息。
对应地，认证服务器接收无线接入点发送的身份认证请求。
本实施例中以无线接入点使用与认证服务器对应的第一公钥对身份认证请求进行加密，身份认证请求包括认证信息和与无线接入点对应的第二公钥；并使用与无线接入点对应的第二私钥对认证信息进行加密为例进行举例说明。
步骤504，认证服务器通过与认证服务器对应的第一私钥对身份认证请求进行解密，得到认证信息和与无线接入点对应的第二公钥。
认证服务器在接收到无线接入点发送的身份认证请求后，通过与认证服务器对应的第一私钥对身份认证请求进行解密，得到身份认证请求携带的认证信息和与无线接入点对应的第二公钥。
步骤505，认证服务器通过与无线接入点对应的第二公钥对认证信息进行解密，得到硬件信息和/或拥有者信息。
认证服务器通过与认证服务器对应的第一私钥解密得到认证信息和与无线接入点对应的第二公钥后，通过与无线接入点对应的第二公钥对认证信息进行解密，得到认证信息包括的硬件信息和/或拥有者信息。
步骤506，认证服务器对硬件信息和/或拥有者信息进行第二身份认证，在第二身份认证成功时，将与无线接入点对应的第二公钥添加至可信任公钥集合中。
认证服务器在解密得到认证信息中携带的硬件信息和/或拥有者信息后，对硬件信息和/或拥有者信息进行第二身份认证。一些例子中，该第二身份认证过程是人工审核过程。
其中，第二身份认证是指核实认证信息中携带的硬件信息和/或拥有者信息是否正确或完整。在第二身份认证成功后，认证服务器将与无线接入点对应的第二公钥添加至可信任公钥集合中，并保存与无线接入点对应的第二公钥。可信任公钥集合是认证服务器存储的成功通过第二身份认证的无线接入点对应的第二公钥的列表。也即，可信任公钥集合中对应的无线接入点都是经过认证服务器第二身份认证成功的无线接入点。
一些例子中，在第二身份认证成功后，认证服务器将无线接入点对应的第二公钥与无线接入点的对应关系添加至可信任公钥集合中，允许用户终端向认证服务器查询该无线接入点，并认证该无线接入点是否为可信任无线接入点。同时，认证服务器允许该无线接入点向认证服务器查询用户终端的用户信息对应的主密钥。
示例性地，可信任公钥集合如下表一所示：
Figure PCTCN2017072186-appb-000001
Figure PCTCN2017072186-appb-000002
表一
如表一所示，无线接入点A对应的第二公钥为“公钥1”；无线接入点B对应的第二公钥为“公钥2”；无线接入点C对应的第二公钥为“公钥3”；无线接入点D对应的第二公钥为“公钥4”。
认证服务器对无线接入点的第二身份认证过程如图5B所示。在图5B中，无线接入点120向认证服务器160发送硬件信息，注册该无线接入点120的商家终端180向认证服务器160发送拥有者信息和管理员信息，认证服务器160对接收到的硬件信息、拥有者信息和管理员信息进行身份认证，在第二身份认证成功后，批准该无线接入点120加入可信任无线接入点中。
第二阶段，包括步骤507；
步骤507，用户终端通过独立通道向认证服务器注册用户信息和与用户信息对应的密钥信息。
独立通道是不经过无线接入点的通信通道。
一些例子中，密钥信息包括密码和证书中的至少一种。
认证服务器在生成与用户终端对应的用户信息和密钥信息时，将用户终端与用户信息和密钥信息之间的对应关系存储至认证服务器中，并将用户信息和密钥信息发送给用户终端。
一些例子中，认证服务器将用户终端注册的用户信息和密钥信息以用户信息-密码对的形式进行存储，或者认证服务器将用户终端注册的用户信息和密钥信息以用户信息-证书对的形式进行存储。
示例性地，认证服务器以用户信息-密码对的形式进行存储的对应关系如下表二所示：
用户信息 密码
用户A 密码1
用户B 密码2
用户C 密码3
表二
一些例子中，用户终端向认证服务器注册的用户信息和密钥信息是唯一的。也即，每一个用户终端对应唯一一个用户信息和密钥信息，用户终端与用户信息之间是一一对应的关系。
用户终端向认证服务器注册用户信息和密钥信息的过程如图5C所示，以用户终端向认证服务器注册用户信息和密码为例进行举例说明。在图5C中，用户终端140与认证服务器160之间通过独立通道完成用户信息和密码的注册，也即，用户信息和密码的注册过程在不经过无线接入点的通信通道中完成的。
一些例子中，用户终端向认证服务器注册用户信息和密钥信息时，可以通过用户终端中的通信类客户端或浏览器客户端等向认证服务器注册用户信息和密钥信息。
第三阶段，包括步骤508和步骤509；
步骤508，用户终端向无线接入点发送第一接入请求。第一接入请求携带有用户终端的用户信息。
用户终端存储有预先在认证服务器中注册的用户信息和密钥信息。
在存在待接入的无线接入点时，用户终端向该无线接入点发送第一接入请求，该第一接入请求中携带有与用户终端对应的用户信息。
用户终端向无线接入点发送第一接入请求的方式包括：
一些例子中，用户终端通过应用程序中的扫码功能扫描商家提供的携带有无线接入点的硬件信息的二维码，则用户终端通过扫描二维码向无线接入点发送第一接入请求。
一些例子中，用户终端根据商家提供的携带有无线接入点的硬件信息的公众号向该无线接入点发送第一接入请求。
一些例子中，用户终端根据商家提供的携带有无线接入点的硬件信息的单独的无线网络客户端向该无线接入点发送第一接入请求。
比如：用户终端利用微信中的扫一扫功能，扫描商家提供的携带有无线接入点的硬件信息的二维码，通过微信向无线接入点发送第一接入请求。又比如：用户终端直接利用浏览器中的扫一扫功能，扫描商家提供的携带有无线接入点的硬件信息的二维码，通过浏览器直接向无线接入点发送第一接入请求。
又比如：用户终端利用微信中的关注功能，对商家提供的公众号进行关注，并通过公众号向无线接入点发送第一接入请求。还比如：用户终端安装商家提供的携带有无线接入点的硬件信息的单独的无线网络客户端，通过单独的无线网络客户端向无线接入点发送第一接入请求。
对应地，无线接入点接收用户终端发送的第一接入请求。
步骤509，无线接入点向认证服务器发送第二接入请求，第二接入请求携带有用户信息。
无线接入点在接收到用户终端发送的第一接入请求后，向认证服务器发送第二接入请求，第二接入请求中携带有用户信息。
一些例子中，第二接入请求中还携带有与无线接入点对应的第二公钥。
无线接入点在接收到用户终端发送的第一接入请求后，将与无线接入点对应的第二公钥和第一接入请求中携带的用户信息发送给认证服务器。
一些例子中，无线接入点向认证服务器发送第二接入请求，第二接入请求中携带有用户信息和与无线接入点对应的第二公钥。
一些例子中，无线接入点向认证服务器发送第二接入请求，第二接入请求携带有用户信息和与无线接入点对应的第二公钥。第二接入请求是无线接 入点使用与认证服务器对应的第一公钥进行加密的请求。
一些例子中，无线接入点向认证服务器发送第二接入请求，第二接入请求携带有第一密文和与无线接入点对应的第二公钥。第二接入请求是无线接入点使用与认证服务器对应的第一公钥进行加密的请求。第一密文是无线接入点使用与无线接入点对应的第二私钥对用户信息进行加密的密文。
本实施例中以第三种可能的实现方式进行举例说明。
对应地，认证服务器接收无线接入点发送的第二接入请求。
第四阶段，包括步骤510至步骤519；
步骤510，认证服务器获取查询密钥请求中携带的第一密文和与无线接入点对应的第二公钥。
认证服务器在接收到无线接入点发送的第二接入请求后，获取第二接入请求中携带的第一密文和与无线接入点对应的第二公钥。
一些例子中，认证服务器接收到第二接入请求后，可以直接获取第二接入请求中携带的用户信息和与无线接入点对应的第二公钥。
一些例子中，认证服务器接收到第二接入请求后，可以使用与认证服务器对应的第一私钥对第二接入请求进行解密，获取第二接入请求携带的用户信息和与无线接入点对应的第二公钥。
其中，第二接入请求是无线接入点通过与认证服务器对应的第一公钥对第一密文和与无线接入点对应的第二公钥进行加密的请求。
步骤511，认证服务器验证与无线接入点对应的第二公钥是否存在于可信任公钥集合中；若与无线接入点对应的第二公钥存在于可信任公钥集合中，则将无线接入点验证为可信任无线接入点。
其中，可信任公钥集合存储有成功通过认证服务器的身份认证的无线接入点对应的第二公钥，第一密文包括用户信息。
认证服务器在获取到与无线接入点对应的第二公钥后，验证与无线接入点对应的第二公钥是否存在于可信任公钥集合中，若存在于可信任公钥集合中，则认证服务器确定该无线接入点为可信任无线接入点。
比如：如表一中示例性的可信任公钥集合为例，假定认证服务器获取到的与无线接入点对应的第二公钥为公钥2，则认证服务器将获取到的公钥2与表一中所示的可信任公钥集合中的第二公钥进行匹配，结果发现公钥2是属于可信任公钥集合中，则认证服务器确定该无线接入点为可信任无线接入点。
一些例子中，当认证服务器验证该无线接入点不属于可信任无线接入点时，则不执行后续步骤。
步骤512，认证服务器在无线接入点属于可信任无线接入点时，使用与无线接入点对应的第二公钥对第二接入请求中携带的第一密文进行解密，得到用户信息。
认证服务器在确定该无线接入点为可信任无线接入点后，使用获取到的 与无线接入点对应的第二公钥对获取到的第一密文进行解密，解密后得到第一密文中携带的用户信息。
第一密文是无线接入点通过与无线接入点对应的第二私钥对用户信息进行加密的密文，
步骤513，认证服务器根据用户信息查询与用户信息对应的密钥信息。
认证服务器在对第一密文解密得到第一密文携带的用户信息后，查询与用户信息对应的密钥信息。
比如：如表二中示例性的用户信息和密码之间的对应关系为例，假定认证服务器获取到的第二接入请求中携带的用户信息为“用户B”，则认证服务器到用户信息和密码之间的对应关系中查询与“用户B”对应的密码，则如表二所示，查询到的密码为“密码2”。
步骤514，认证服务器使用密钥信息与用户终端进行第一身份认证。
认证服务器在查询到与用户信息对应的密钥信息后，使用该密钥信息与用户终端进行第一身份认证。一些例子中，第一身份认证是指认证服务器与用户终端之间的双向认证。也即，认证服务器需要根据密钥信息对用户终端进行身份认证；用户终端也需要根据密钥信息对认证服务器进行身份认证。
一些例子中，第一身份认证为单向认证。也即认证服务器根据密钥信息对用户终端进行身份认证；或，用户终端需要根据密钥信息对认证服务器进行身份认证。
认证服务器与用户终端进行第一身份认证和协商生成主密钥的过程是通过建立TLS(Transport Layer Security，安全传输层协议)通道，通过无线接入点的转发进行第一身份认证和协商生成主密钥。
一些例子中，认证服务器与用户终端进行第一身份认证的过程符合PEAP(Protected Extensible Authentication Protocol，基于保护信道的认证协议)对用户接入的协议。
步骤515，在第一身份认证成功时，认证服务器与用户终端协商生成主密钥，并向用户终端发送主密钥。
在第一身份认证成功时，认证服务器与用户终端根据密钥信息协商生成主密钥。
一些例子中，认证服务器与用户终端协商生成的主密钥为PMK(Pairwise Master Key，主成对密钥)。
认证服务器与用户终端协商生成主密钥后，认证服务器将协商生成的主密钥通过TLS通道发送给用户终端。
步骤516，认证服务器使用与无线接入点对应的第二公钥对协商生成的主密钥进行第一加密。
认证服务器将主密钥发送给无线接入点的方式包括三种：
一些例子中，认证服务器可以直接通过加密通道将主密钥发送给无线接入点；
一些例子中，认证服务器可以使用与认证服务器对应的第一私钥对主密钥进行加密，将加密后的主密钥发送给无线接入点；
一些例子中，认证服务器可以首先使用与无线接入点对应的第二公钥对主密钥进行第一加密；再使用与认证服务器对应的第一私钥对第一加密后的主密钥进行第二加密；将第二加密后的主密钥发送给无线接入点。本实施例中，以采用该方式为例进行说明。
其中，与无线接入点对应的第二公钥是认证服务器对无线接入点的身份认证成功时保存的。
认证服务器在与用户终端协商生成主密钥后，使用与无线接入点对应的第二公钥对主密钥进行第一加密。
步骤517，认证服务器使用与认证服务器对应的第一私钥对第一加密后的主密钥进行第二加密，向无线接入点发送第二加密后的主密钥。
认证服务器在使用与无线接入点对应的第二公钥对主密钥进行第一加密后，再使用与认证服务器对应的第一私钥对第一加密后的主密钥进行第二加密。将两次加密后的主密钥发送给无线接入点。
一些例子中，本实施例中，仅以先使用与无线接入点对应的第二公钥对主密钥进行第一加密，再使用与认证服务器对应的第一私钥对第一加密后的主密钥进行第二加密进行举例说明。本实施例中，对主密钥的加密顺序不作具体限定，可以先使用与认证服务器对应的第一私钥对主密钥进行第一加密，再使用与无线接入点对应的第二公钥对第一加密后的主密钥进行第二加密。本实施例中认证服务器对主密钥的加密方式不作具体限定。
对应地，无线接入点接收认证服务器发送的加密的主密钥。
一些例子中，无线接入点接收认证服务发送的第一加密后的主密钥，第一加密后的主密钥是认证服务器在无线接入点属于可信任无线接入点时，使用与无线接入点对应的第二公钥对主密钥进行加密后的主密钥。
一些例子中，无线接入点接收认证服务器发送的第二加密后的主密钥，第二加密后的主密钥是认证服务器在无线接入点属于可信任无线接入点时，使用与无线接入点对应的第二公钥对主密钥进行第一加密，再使用与认证服务器对应的第一私钥对第一加密后的主密钥进行第二加密后的主密钥。
步骤518，无线接入点使用与认证服务器对应的第一公钥对第二加密后的主密钥进行解密，得到第二密文。
无线接入点在接收到认证服务器发送的加密的主密钥后，使用与认证服务器对应的第一公钥对第二加密后的主密钥进行解密，得到第二密文。
其中，第二密文是认证服务器通过与无线接入点对应的第二公钥对主密钥进行加密的密文。
步骤519，无线接入点使用与无线接入点对应的第二私钥对第二密文进行解密，得到主密钥。
无线接入点通过与认证服务器对应的第一公钥解密得到第二密文后，使 用与无线接入点对应的第二私钥对第二密文进行解密，得到主密钥。
一些例子中，若认证服务器仅使用与无线接入点对应的第二公钥对与用户信息对应的主密钥进行加密，则无线接入点仅需要使用与无线接入点对应的第二私钥对加密后的主密钥进行解密，即可得到主密钥。
步骤520，无线接入点与用户终端根据各自持有的主密钥协商生成本次连接所使用的临时密钥，使用临时密钥建立加密无线网络连接。
一些例子中，无线接入点和用户终端使用PMK协商生成本次连接所使用的PTK(Pairwise Temporary Key，临时成对密钥)，无线接入点和用户终端使用PTK建立加密无线网络连接。
无线接入点在获取到认证服务器发送的主密钥后，无线接入点和用户终端使用各自获取到的主密钥作为PMK，完成WPA2(Wi-Fi Protected Access II，Wi-Fi联盟推出的无线网络安全认证协议)加密协议。利用主密钥作为PMK，协商生成本次连接使用的PTK，用户终端与无线接入点使用协商生成的PTK建立加密无线网络连接。
无线接入点与用户终端之间通过PTK建立加密无线网络连接的具体过程如下：
第一、无线接入点生成一个随机数A，无线接入点向用户终端发送消息M1，消息M1种携带有随机数A；
第二、用户终端生成一个随机数B，用户终端根据主密钥、随机数A和随机数B计算得到本次连接所使用的PTK；用户终端向无线接入点发送消息M2，消息M2中携带有随机数B；且使用计算得到的PTK中的确认密钥部分对消息M2进行MIC(Message Integrity Code，消息完整性)认证；
第三、无线接入点得到随机数B，并根据主密钥、随机数A和随机数B计算得到本次连接所使用的PTK，并使用计算得到的PTK中的确认密钥部分对消息M2进行MIC校验。若校验失败则丢弃消息M2，若校验正确则向用户终端发送消息M3，消息M3中包含一个MIC校验，使得用户终端核实无线接入点拥有主密钥。
第四、用户终端收到消息M3后，对消息M3进行MIC校验，校验成功后装入PTK，并向无线接入点发送消息M4，消息M4用于表明用户终端已装入PTK。无线接入点在接收到消息M4后，也装入PTK即完成建立加密无线网络连接的过程。
本实施例中无线接入点与用户终端之间完成WPA2加密协议的核心加密算法以WPE2-PEAP(WPE2-PEAP，基于保护信道的认证协议)进行举例说明，但完成WPA2加密协议的核心加密算法还可以包括但不限于：EAP-TLS(Extensible Authentication Protocol-Transport Layer Security，基于信道的认证协议和传输层加密协议)、EAP-TTLS/MSCHAPv2、PEAPv0/EAP-MSCHAPv2、PEAPv1/EAP-GTC、PEAP-TLS(Protected Extensible Authentication Protocol-Transport Layer Security，基于传输层安全的 受保护的可扩展身份验证协议)、EAP-SIM(EPA-Subscriber Identity Module，基于客户身份识别卡的认证协议)、EAP-AKA(EAP-Authentication and Key Agreement，认证与密钥协商)和EAP-FAST(EAP-Flexible Authentication via Secure Tunneling，基于安全隧道的灵活认证协议)。
一些例子中，用户终端接入无线接入点的过程如图5D所示。用户终端140向无线接入点120发送用户信息，无线接入点120将用户信息转发给认证服务器160，认证服务器160在确认无线接入点属于可信任无线接入点后与用户终端140进行第一身份认证，在第一身份认证成功时，分别向用户终端140和无线接入点120发送与用户信息对应的主密钥，用户终端140与无线接入点120以获取到的主密钥为PMK，协商建立加密无线网络连接。
综上所述，本实施例提供的无线网络接入方法，通过用户终端向无线接入点发送第一接入请求；无线接入点向认证服务器发送第二接入请求；认证服务器在接收到第二接入请求后，验证无线接入点是否属于可信任无线接入点，在无线接入点属于可信任无线接入点时与用户终端进行第一身份认证，在第一身份认证成功时与用户终端协商生成主密钥；认证服务器向无线接入点发送与用户信息对应的主密钥；无线接入点与用户终端根据各自持有的主密钥协商建立加密无线网络连接；解决了用户使用现有的接入方法使得用户终端接入假冒的公众Wi-Fi时，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，只有可信任无线接入点才能获取与用户信息对应的主密钥，从而与用户终端根据各自持有的主密钥建立加密无线网络连接，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
同时，认证服务器与无线接入点之间通过加密通道进行数据传输，提高了传输过程中数据的安全性。
需要说明的一点是，本实施例中对步骤501至步骤506和步骤507的先后顺序不作具体限制。也即，无线接入点在认证服务器中的认证过程和用户终端向认证服务器注册用户信息和密钥信息的过程之间没有必然的先后顺序；但是与用户终端建立加密无线网络连接的无线接入点必须是存储于认证服务器的可信任无线接入点。
需要说明的另一点是，本申请实施例中，无线接入点与认证服务器在通过加密通道进行数据传输时，在传输的数据中还可以携带的信息有各自生成的随机数、发送数据的时间戳等。比如：无线接入点向认证服务器发送数据时，在数据中还携带有无线接入点生成的随机数、发送该数据的时间戳等信息。本申请实施例无线接入点与认证服务器进行数据传输过程中，除上述实施例中数据携带的信息外，对数据中还可以携带的信息不作具体限定。同理，用户终端与认证服务器通过独立通道进行数据传输时，在传输的数据中还可以携带的信息有各自生成的随机数、发送数据的时间戳等，此处不再赘述。针对数据还可以携带的信息的变换实施例都是本申请实施例的等同替换实 施例，包含在本申请的保护范围之内。
在一个具体的实施例中，假如黑客设置假冒的无线接入点，该假冒的无线接入点与真实的无线接入点具有完全相同的硬件信息。
第一，用户终端在获取到假冒的无线接入点时，向该假冒的无线接入点发送第一接入请求，该接入请求中携带有用户终端对应的用户信息。
第二、假冒的无线接入点向认证服务器发送第二接入请求，第二接入请求携带有用户信息。
假冒的无线接入点获取与认证服务器对应的第一公钥，并使用与认证服务器对应的第一公钥对第二接入请求进行加密，并将加密后的第二接入请求发送给认证服务器。
第三、认证服务器通过与认证服务器对应的第一私钥对第二接入请求进行解密，得到与假冒的无线接入点对应的第二公钥和用户信息。
第四、认证服务器验证与假冒的无线接入点对应的第二公钥是否存在于可信任公钥集合中。
虽然假冒的无线接入点与真实的无线接入点具有完全相同的硬件信息，但与假冒的无线接入点对应的第二公钥和与真实的无线接入点对应的第二公钥是不相同的，因此，认证服务器在验证与假冒的无线接入点对应的第二公钥是否存在于可信任公钥集合中时，会将假冒的无线接入点确定为不可信任无线接入点。认证服务器在确定该无线接入点为假冒的无线接入点后，不会将与用户信息对应的主密钥发送给假冒的无线接入点。
综上所述，假如黑客设置假冒的无线接入点，该假冒的无线接入点与真实的无线接入点具有完全相同的硬件信息时，在图5A所示的实施例提供的无线网络接入方法中，假冒的无线接入点也无法与用户终端建立加密无线网络连接。在步骤511中，与假冒的无线接入点对应的第二公钥并不存在于认证服务器存储的可信任公钥集合中，因此被认证服务器确定为不可信任无线接入点。因此，图5A实施例提供的无线网络接入方法，提高了用户终端传输的数据以及用户终端内部数据的安全性。
请参考图6，其示出了本申请一个实施例提供的无线网络连接装置的结构方框图。该无线网络连接装置可以通过软件、硬件或者两者的结合实现成为图1A中无线接入点的全部或一部分。该无线网络连接装置包括：
第一接收模块610，用于接收用户终端发送的第一接入请求，第一接入请求携带有用户终端的用户信息；
第二接收模块620，用于向认证服务器发送第二接入请求，第二接入请求携带有用户信息；
密钥接收模块630，用于接收认证服务器发送的与用户信息对应的主密钥，主密钥是认证服务器在接收到第二接入请求后，验证无线接入点属于可信任无线接入点时，与用户终端进行第一身份认证成功后协商生成的密钥；
网络连接模块640，用于与用户终端根据各自持有的主密钥协商建立加密无线网络连接。
综上所述，本实施例提供的无线网络接入装置，通过接收用户终端发送的第一接入请求；向认证服务器发送第二接入请求；接收认证服务器发送的与用户信息对应的主密钥；与用户终端根据各自持有的主密钥协商建立加密无线网络连接；解决了用户使用现有的接入方法使得用户终端接入假冒的公众Wi-Fi时，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，只有可信任无线接入点才能获取与用户信息对应的主密钥，从而与用户终端根据各自持有的主密钥建立加密无线网络连接，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
请参考图7，其示出了本申请另一个实施例提供的无线网络连接装置的结构方框图。该无线网络连接装置可以通过软件、硬件或者两者的结合实现成为图1A中无线接入点的全部或一部分。该无线网络连接装置包括：
密钥生成模块710，用于生成与无线接入点对应的第二公钥和第二私钥；
公钥获取模块720，用于获取与认证服务器对应的第一公钥；
信息发送模块730，用于向认证服务器发送身份认证请求，身份认证请求携带有认证信息和与无线接入点对应的第二公钥，认证信息和与无线接入点对应的第二公钥均使用与认证服务器对应的第一公钥进行加密，认证信息至少包括硬件信息和/或拥有者信息。
在一种可能的实现方式中，认证信息是通过与无线接入点对应的第二私钥进行加密的信息。
第一接收模块740，用于接收用户终端发送的第一接入请求，第一接入请求携带有用户终端的用户信息。
第二接收模块750，用于向认证服务器发送第二接入请求，第二接入请求携带有用户信息。
密钥接收模块760，用于接收认证服务器发送的与用户信息对应的主密钥，主密钥是认证服务器在接收到第二接入请求后，验证无线接入点属于可信任无线接入点时，与用户终端进行第一身份认证成功后协商生成的密钥。
在一种可能的实现方式中，密钥接收模块760，还用于接收认证服务器发送的第一加密后的主密钥，第一加密后的主密钥是认证服务器在无线接入点属于可信任无线接入点时，使用与无线接入点对应的第二公钥对主密钥进行加密后的主密钥。
在另一种可能的实现方式中，密钥接收模块760，还用于接收认证服务器发送的第二加密后的主密钥，第二加密后的主密钥是认证服务器在无线接入点属于可信任无线接入点时，使用与无线接入点对应的第二公钥对主密钥进行第一加密，再使用与认证服务器对应的第一私钥对第一加密后的主密钥进行第二加密后的主密钥。
网络连接模块770，用于根据主密钥与用户终端协商建立加密无线网络连接。
在第一种可能的实现方式中，网络连接模块770，可以包括：第一解密单元771和第一连接单元772；
第一解密单元771，用于使用与无线接入点对应的第二私钥对第一加密后的主密钥进行解密，得到主密钥。
第一连接单元772，用于与用户终端根据各自持有的主密钥协商建立加密无线网络连接。
在第二种可能的实现方式中，网络连接模块770，可以包括：第二解密单元773、第三解密单元774和第二连接单元775。
第二解密单元773，用于使用与认证服务器对应的第一公钥对第二加密后的主密钥进行解密，得到第二密文。
第三解密单元774，用于使用与无线接入点对应的第二私钥对第二密文进行解密，得到主密钥。
第二连接单元775，用于与用户终端根据各自持有的主密钥协商建立加密无线网络连接。
其中，第二密文是认证服务器通过与无线接入点对应的第二公钥对主密钥进行加密的密文。
在第三种可能的实现方式中，网络连接模块770，还用于与用户终端使用各自持有的主密钥，协商生成本次连接所使用的临时密钥，使用临时密钥与用户终端建立加密无线网络连接。
综上所述，本实施例提供的无线网络接入装置，通过接收用户终端发送的第一接入请求；向认证服务器发送第二接入请求；接收认证服务器发送的与用户信息对应的主密钥；与用户终端根据各自持有的主密钥协商建立加密无线网络连接；解决了用户使用现有的接入方法使得用户终端接入假冒的公众Wi-Fi时，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，只有可信任无线接入点才能获取与用户信息对应的主密钥，从而与用户终端根据各自持有的主密钥建立加密无线网络连接，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
请参考图8，其示出了本申请一个实施例提供的无线网络连接装置的结构方框图。该无线网络连接装置可以通过软件、硬件或者两者的结合实现成为图1A中认证服务器的全部或一部分。该无线网络连接装置包括：
请求接收模块810，用于接收无线接入点发送的第二接入请求，第二接入请求携带有用户信息；
信任验证模块820，用于在接收到第二接入请求后，验证无线接入点是否属于可信任无线接入点；
用户认证模块830，用于在无线接入点属于可信任无线接入点时与用户 终端进行第一身份认证；
密钥生成模块840，用于在第一身份认证成功时，与用户终端协商生成主密钥，并向用户终端发送主密钥。
密钥发送模块850，用于在无线接入点属于可信任无线接入点时向无线接入点发送与用户信息对应的密钥信息，以便无线接入点与用户终端根据各自持有的主密钥协商建立加密无线网络连接。
综上所述，本实施例提供的无线网络接入装置，通过接收无线接入点发送的第二接入请求；在接收到第二接入请求后，验证无线接入点是否属于可信任无线接入点；在无线接入点属于可信任无线接入点时与用户终端进行第一身份认证，在第一身份认证成功时与用户终端协商生成主密钥，并向用户终端发送主密钥；向无线接入点发送与用户信息对应的主密钥；解决了用户使用现有的接入方法使得用户终端接入假冒的公众Wi-Fi时，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，只有可信任无线接入点才能获取与用户信息对应的主密钥，从而与用户终端根据各自持有的主密钥建立加密无线网络连接，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
请参考图9，其示出了本申请另一个实施例提供的无线网络连接装置的结构方框图。该无线网络连接装置可以通过软件、硬件或者两者的结合实现成为图1A中认证服务器的全部或一部分。该无线网络连接装置包括：
认证接收模块910，用于接收无线接入点发送的身份认证请求，身份认证请求携带有认证信息和与无线接入点对应的第二公钥，认证信息和与无线接入点对应的第二公钥均使用与认证服务器对应的第一公钥进行加密，认证信息至少包括硬件信息和/或拥有者信息。
信息解密模块920，用于通过与认证服务器对应的第一私钥对身份认证请求进行解密，得到认证信息和与无线接入点对应的第二公钥。
信息认证模块930，用于对认证信息进行第二身份认证，在第二身份认证成功时，将与无线接入点对应的第二公钥添加至可信任公钥集合中。
一些例子中，认证信息是无线接入点通过与无线接入点对应的第二私钥进行加密的信息。
作为一种可能的实现方式，信息认证模块930，可以包括：第一解密单元931和第一认证单元932。
第一解密单元931，用于通过与无线接入点对应的第二公钥对认证信息进行解密，得到硬件信息和/或拥有者信息；
第一认证单元932，用于对硬件信息和/或拥有者信息进行第二身份认证，在第二身份认证成功时，将与无线接入点对应的第二公钥添加至可信任公钥集合中。
请求接收模块940，用于接收无线接入点发送的第二接入请求，第二接 入请求携带有用户信息。
信任验证模块950，用于在接收到第二接入请求后，验证无线接入点是否属于可信任无线接入点。
作为一种可能的实现方式，本实施例中，信任验证模块950，可以包括：公钥获取单元951和第一验证单元952。
公钥获取单元951，用于获取第二接入请求中携带的第一密文和与无线接入点对应的第二公钥。
一些例子中，公钥获取单元951，还用于通过与认证服务器对应的第一私钥对第二接入请求进行解密，得到第一密文和与无线接入点对应的第二公钥；
其中，第二接入请求是无线接入点通过与认证服务器对应的第一公钥对第一密文和与无线接入点对应的第二公钥进行加密的请求。
第一验证单元952，用于验证与无线接入点对应的第二公钥是否存在于可信任公钥集合中；若与无线接入点对应的第二公钥存在于可信任公钥集合中，则将无线接入点验证为可信任无线接入点；
其中，可信任公钥集合存储有成功通过第二身份认证的无线接入点对应的第二公钥。
用户认证模块960，用于在无线接入点属于可信任无线接入点时与用户终端进行第一身份认证。
作为一种可能的实现方式，本实施例中，用户认证模块960，可以包括：密文解密单元961、密钥查询单元962和密钥认证单元963。
密文解密单元961，用于在无线接入点属于可信任无线接入点时，使用与无线接入点对应的第二公钥对第二接入请求中携带的第一密文进行解密，得到用户信息。
密钥查询单元962，用于查询与用户信息对应的密钥信息；
密钥认证单元963，用于根据密钥信息与用户终端进行第一身份认证。
其中，第一密文是无线接入点通过与无线接入点对应的第二私钥对用户信息进行加密的密文。
密钥生成模块970，用于在第一身份认证成功时，与用户终端协商生成主密钥，并向用户终端发送主密钥。
密钥发送模块980，用于向无线接入点发送与用户信息对应的主密钥，以便无线接入点与用户终端根据各自持有的主密钥协商建立加密无线网络连接。
一些例子中，密钥发送模块980，还用于使用与无线接入点对应的第二公钥对协商生成的主密钥进行第一加密，向无线接入点发送第一加密后的主密钥。
一些例子中，密钥发送模块980，还用于使用与认证服务器对应的第一私钥对第一加密后的主密钥进行第二加密，向无线接入点发送第二加密后的 主密钥。
综上所述，本实施例提供的无线网络接入装置，通过接收无线接入点发送的第二接入请求；在接收到第二接入请求后，验证无线接入点是否属于可信任无线接入点；在无线接入点属于可信任无线接入点时与用户终端进行第一身份认证，在第一身份认证成功时与用户终端协商生成主密钥，并向用户终端发送主密钥；向无线接入点发送与用户信息对应的主密钥；解决了用户使用现有的接入方法使得用户终端接入假冒的公众Wi-Fi时，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，只有可信任无线接入点才能获取与用户信息对应的主密钥，从而与用户终端根据各自持有的主密钥建立加密无线网络连接，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
请参考图10，其示出了本申请实施例提供的一种无线网络连接系统的结构方框图，该系统包括：用户终端1020、无线接入点1040和认证服务器1060；
用户终端1020，用于向无线接入点发送第一接入请求，以及与认证服务器进行第一身份认证；
无线接入点1040，包括如图6所示实施例或图7所示实施例任一所述的无线网络连接装置；
认证服务器1060，包括如图8所示实施例或图9所示实施例任一所述的无线网络连接装置。
本申请实施例还提供一种无线接入点认证方法。
请参考图11，其示出了本申请一个示例性实施例提供的无线接入点系统的结构示意图。该无线接入点系统包括：无线接入点1120、管理终端1140和认证服务器1160。
无线接入点1120可以是路由器、Wi-Fi热点和无线网关等提供无线网络接入服务的设备的统称。本申请实施例中，以无线接入点1120是路由器来举例说明。无线接入点1120与管理终端1140之间通过无线网络连接，无线接入点1120与用户终端(图中未示出)建立无线网络连接之前，需要通过认证服务器1160对该无线接入点1120的身份认证。无线接入点1120与认证服务器1160之间通过无线网络或有线网络建立连接。本申请实施例对无线接入点1120和认证服务器1160之间的通信方式不做限定。
管理终端1140即上文中的商家终端180。管理终端1140可以是手机、平板电脑、电子书阅读器、膝上型便携计算机和台式计算机等等。一些例子中，管理终端1140中安装有专门用于管理公众Wi-Fi的应用程序，比如，腾讯QQ、微信、微博等。
管理终端1140与认证服务器1160之间通过无线网络或有线网络建立连接。一些例子中，管理终端1140通过加密通道向认证服务器1160发送信息， 其中，加密通道是指管理终端1140与认证服务器1160之间的独立通道，比如：使用https通道发送信息。本申请实施例对管理终端1140和认证服务器1160之间的通信方式不做限定。
认证服务器1160中存储有可信任无线接入点列表、与认证服务器1160对应的第二公钥和第二私钥。一些例子中，与认证服务器1160对应的第二公钥不止一个，不同的第二公钥分别用于签名、会话等。认证服务器1160可以是一台服务器、多台服务器组成的服务器集群或云计算中心。
请参考图12，其示出了本申请一个实施例提供的无线接入点认证方法的流程图。本实施例以该无线接入点认证方法应用于图11所示的认证服务器1160中来举例说明。该方法包括：
步骤1201，接收无线接入点发送的第一信息，第一信息包括：无线接入点的硬件信息和与无线接入点对应的第一公钥。
硬件信息包括：无线接入点的SSID(Service Set Identifier，服务集标识)、无线接入点的BSSID(Basic Service Set Identifier，基本服务集标识)和无线接入点的MAC(Media Access Control，设备的物理地址)。
步骤1202，接收管理终端发送的第二信息，第二信息包括：无线接入点的硬件信息和无线接入点的拥有者信息。
拥有者信息包括但不限于：经纬度坐标、拥有者名称和拥有者地址中的至少一种。
步骤1203，在接收到第二信息后，对硬件信息和拥有者信息进行身份认证，在身份认证通过时，将无线接入点添加至可信任无线接入点列表，并存储与无线接入点对应的第一公钥。
综上所述，本实施例提供的无线接入点认证方法，通过接收无线接入点发送的第一信息；接收管理终端发送的第二信息；在接收到第二信息后，对硬件信息和拥有者信息进行身份认证，在身份认证通过时，将无线接入点添加至可信任无线接入点列表，并存储与无线接入点对应的第一公钥；解决了现有的认证方法，认证服务器会将假冒的公众Wi-Fi默认为可信任的公众Wi-Fi，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，使得只有真实的无线接入点才可以通过认证服务器的身份认证，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
请参考图13，其示出了本申请另一个实施例提供的无线接入点认证方法的流程图。本实施例以该无线接入点认证方法应用于图11所示的无线接入点认证系统中来举例说明。该方法包括：
步骤1301，无线接入点向认证服务器发送第一信息，第一信息包括：无线接入点的硬件信息和与无线接入点对应的第一公钥。
硬件信息包括：无线接入点的SSID、无线接入点的BSSID和无线接入 点的MAC。
步骤1302，管理终端向认证服务器发送第二信息，第二信息包括：无线接入点的硬件信息和无线接入点的拥有者信息。
拥有者信息包括但不限于：经纬度坐标、拥有者名称和拥有者地址中的至少一种。
步骤1303，认证服务器在接收到第二信息后，对硬件信息和拥有者信息进行身份认证，在身份认证通过时，将无线接入点添加至可信任无线接入点列表，并存储与无线接入点对应的第一公钥。
综上所述，本实施例提供的无线接入点认证方法，通过无线接入点向认证服务器发送第一信息；管理终端向认证服务器发送第二信息；认证服务器在接收到第二信息后，对硬件信息和拥有者信息进行身份认证，在身份认证通过时，将无线接入点添加至可信任无线接入点列表，并存储与无线接入点对应的第一公钥；解决了现有的认证方法，认证服务器会将假冒的公众Wi-Fi默认为可信任的公众Wi-Fi，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，使得只有真实的无线接入点才可以通过认证服务器的身份认证，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
请参考图14，其示出了本申请再一个实施例提供的无线接入点认证方法的流程图。本实施例以该无线接入点认证方法应用于图11所示的无线网络接入系统中来举例说明。该方法包括：
步骤1401，无线接入点向认证服务器发送第一信息，第一信息包括：无线接入点的硬件信息和与无线接入点对应的第一公钥。
无线接入点首先向认证服务器发送第一信息，第一信息包括无线接入点的硬件信息和与该无线接入点对应的第一公钥。
无线接入点的硬件信息包括：无线接入点的SSID、无线接入点的BSSID和无线接入点的MAC。
一些例子中，一个无线接入点中至少包括一个SSID和一个BSSID；若一个无线接入点中包括多个SSID和多个BSSID，则无线接入点将多个SSID和多个BSSID同时携带在硬件信息中发送给认证服务器。
无线接入点向认证服务器发送第一信息之前，无线接入点生成与无线接入点对应的第一公钥和第一私钥，将与无线接入点对应的第一公钥发送给认证服务器。
一些例子中，无线接入点向认证服务器发送的第一信息还携带有第一随机数。
比如：无线接入点随机产生12字节的随机数，无线接入点对产生的12字节的随机数进行编码得到16字节的第一随机数。
一些例子中，无线接入点向认证服务器发送的第一信息还携带有与无线 接入点对应的固件/插件版本号。
一些例子中，无线接入点使用与无线接入点对应的第一私钥对第一信息进行第一签名，向认证服务器发送第一信息和第一签名。
在一个示意性的例子中，无线接入点将硬件信息、与无线接入点对应的第一公钥、第一随机数和固件/插件版本号都携带于第一信息中，无线接入点使用与无线接入点对应的第一私钥对第一信息进行签名，无线接入点将第一信息和第一签名同时发送给认证服务器。
比如：无线接入点通过URL(Uniform Resource Locator，统一资源定位符)为：“http：//[域名]/router/inform”的通道向认证服务器发送第一信息和第一签名。
示例性地，无线接入点发送给认证服务器的第一信息包括如表三三所示的内容：
Figure PCTCN2017072186-appb-000003
表三
如表三所示，表三中所示的无线接入点包括2个ssid。其中，字段代表不同信息的标识，如：ver代表无线接入点当前的固件/插件版本号；mac代表无线接入点的MAC地址；ssid代表无线接入点的SSID；bssid代表无线接入点的BSSID；ssid2代表无线接入点的第二个SSID；bssid2代表无线接入点的第二个BSSID；pbk代表与无线接入点对应的第二公钥，第二公钥是无线接入点根据Curve25519算法计算后使用base64编码得到的；x代表无线接入点产生的第一随机数，第一随机数是对无线接入点随机产生的12字节的随机数使用base64编码后得到的16字节的随机数；sig代表使用无线接入点对应的第二私钥对上述数据进行签名得到的第一签名。第一信息中所有信息的类型都是字符串的类型。
对应地，认证服务器接收无线接入点发送的第一信息。
步骤1402，认证服务器向无线接入点发送反馈信息和第二签名，第二签名是认证服务器使用与认证服务器对应的第二私钥对反馈信息进行的签名，反馈信息包括与认证服务器对应的第二公钥和第二随机数。
认证服务器在接收到无线接入点发送的第一信息后，通过与无线接入点对应的第一公钥验证第一信息是否被篡改，在第一信息未被篡改时，向无线接入点发送反馈信息和第二签名。一些例子中，反馈信息包括与认证服务器对应的第二公钥和第二随机数。认证服务器使用与认证服务器对应的第二私钥对反馈信息进行第二签名；认证服务器将反馈信息和第二签名一起发送给无线接入点。
一些例子中，反馈信息还可以包括与无线接入点对应的固件/插件最新版本号。与无线接入点对应的固件/插件最新版本号用于检测无线接入点中的固件/插件是否需要更新。
示例性地，认证服务器向无线接入点发送的反馈信息和第二签名如表四所示：
Figure PCTCN2017072186-appb-000004
表四
如表四所示，字段代表不同信息的标识，如：ret代表返回码；msg代表返回码文字信息；ver代表无线接入点的固件/插件最新版本号；pbk代表与认证服务器对应的第一公钥；y代表认证服务器产生的第二随机数，第二随机数用于计算加密密钥；sig代表使用与认证服务器对应的第一私钥对以上数据进行签名，无线接入点使用与认证服务器对应的第一公钥对签名进行验证。类型是指第二信息中各个信息的类型，包括整型和字符串。
对应地，无线接入点接收认证服务器发送的反馈信息和第二签名。
步骤1403，管理终端向无线接入点发送获取请求，获取请求用于获取无线接入点的硬件信息。
一些例子中，无线接入点提供一个无需验证的默认无线网络，管理终端接入该默认无线网络。然后，管理终端通过该默认无线网络向无线接入点发送获取请求，该获取请求用于获取与无线接入点对应的硬件信息。
比如：管理终端通过URL为：“http：//[域名]/admin/getrouterinfo”的通道向无线接入点发送获取请求，一些例子中，管理终端通过即时通讯程序“微信’向无线接入点发送获取请求，则获取请求中携带有微信登录后的openid身份标识，openid身份标识是管理终端的标识。
一些例子中，获取请求中携带有管理终端的标识。
一些例子中，管理终端通过无线接入点默认的无线网络与无线接入点建立连接，管理终端通过无线网络向无线接入点发送获取请求。
示例性地，管理终端向无线接入点发送的获取请求如表五所示：
字段 类型 说明 备注
openid String 微信登录后的openid 发给无线接入点
表五
如表五所示，字段openid代表管理终端的标识，类型为字符串型。
对应地，无线接入点接收管理终端发送的获取请求。
步骤1404，无线接入点向管理终端发送硬件信息。
无线接入点接收到管理终端发送的获取请求后，根据获取请求，向管理终端发送硬件信息。
一些例子中，无线接入点向管理终端发送的硬件信息包括但不限于：无线接入点的MAC地址、无线接入点的SSID和无线接入点的BSSID中的至少一种。
一些例子中，无线接入点在接收到管理终端发送的获取请求后，对获取请求中携带的管理终端的标识进行验证，在验证该标识具有管理权限时，向管理终端发送硬件信息。
一些例子中，管理终端预先存储有与无线接入点对应的第一公钥。无线接入点使用与无线接入点对应的第一私钥对全部或部分硬件信息和管理终端的标识进行第三签名。
比如：无线接入点使用与无线接入点对应的第一私钥对无线接入点的MAC地址和管理终端的标识进行第三签名。
一些例子中，无线接入点将硬件信息和第三签名发送给管理终端。
示例性地，无线接入点向管理终端发送的硬件信息如表六所示：
Figure PCTCN2017072186-appb-000005
Figure PCTCN2017072186-appb-000006
表六
如表六所示，字段代表不同信息的标识，如：ret代表返回码；msg代表返回码文字信息；mac代表无线接入点的MAC地址；ssid代表无线接入点的SSID；bssid代表无线接入点的BSSID，若无线接入点支持多个ssid和bssid，则定义为数组ssidlist，显示多个ssid和bssid；sig代表使用与无线接入点对应的第二私钥对openid和MAC地址进行签名。类型是指第二信息中各个信息的类型，包括整型和字符串。
对应地，管理终端接收无线接入点发送的硬件信息以及第三签名，并对第三签名进行验证。
步骤1405，管理终端向认证服务器发送第二信息，第二信息包括：无线接入点的硬件信息和无线接入点的拥有者信息。
管理终端在接收到无线接入点发送的硬件信息后，向认证服务器发送第二信息，第二信息包括无线接入点的硬件信息和无线接入点的拥有者信息。
一些例子中，管理终端通过加密连接向认证服务器发送第二信息，比如：加密连接为：采用https技术的连接。
例如，管理终端通过“https：//[域名]/admin/bind”通道向认证服务器发送第二信息。
无线接入点的拥有者信息包括但不限于：经纬度坐标、拥有者名称和拥有者地址中的至少一种。一些例子中，拥有者的经纬度坐标由管理终端通过定位自动获取。
本实施例中，对无线接入点的拥有者信息中包括的信息不作具体限定。
一些例子中，第二信息还包括：管理终端的标识和管理终端的访问令牌。管理终端的访问令牌用于表明该管理终端有请求认证服务器对该无线接入点进行认证的权限。
一些例子中，第二信息还包括第三签名。第三签名是指无线接入点使用与无线接入点对应的第一私钥对全部或部分硬件信息和管理终端的标识进行的签名。
示例性地，管理终端向认证服务器发送的第二信息如表七所示：
Figure PCTCN2017072186-appb-000007
Figure PCTCN2017072186-appb-000008
表七
如表七所示，字段代表不同信息的标识，如：openid代表管理终端的标识；token代表管理终端的访问令牌；mac代表无线接入点的MAC地址；ssid代表无线接入点的SSID；bssid代表无线接入点的BSSID；mark代表无线接入点的SSID的备注；ssid2代表无线接入点的第二个SSID；bssid2代表无线接入点的第二个BSSID；mark2代表无线接入点的第二个SSID的备注；sig代表使用与无线接入点对应的第二私钥对openid和MAC地址进行签名；position代表拥有者的经纬度坐标；company代表拥有者名称；address代表拥有者地址。类型是指第二信息中各个信息的为字符串类型。
对应地，认证服务器接收管理终端发送的第二信息。
步骤1406，认证服务器在接收到第二信息后，对硬件信息和拥有者信息进行身份认证，在身份认证通过时，将无线接入点添加至可信任无线接入点列表，并存储与无线接入点对应的第一公钥。
认证服务器在接收到管理终端发送的第二信息后，获取第二信息中的硬件信息和拥有者信息；对获取到的硬件信息和拥有者信息进行身份认证。
一些例子中，认证服务器对硬件信息和拥有者信息的身份认证包括：
1)认证服务器认证管理终端发送的硬件信息与无线接入点发送的硬件信息是否匹配；
2)认证服务器认证管理终端发送的拥有者信息是否正确。
在身份认证通过时，认证服务器将无线接入点添加至可信任无线接入点列表中，同时存储与无线接入点对应的第一公钥。认证服务器将无线接入点添加至可信任无线接入点列表是指认证服务器将身份认证通过的无线接入点提供的SSID添加至可信任无线接入点列表中。同时，认证服务器存储与无线接入点对应的第一公钥，以便认证服务器在对无线接入点进行身份认证时，认证无线接入点提供的第一公钥是否属于可信任无线接入点列表中对应的公钥。
认证服务器存储的与无线接入点对应的第一公钥用于在后续过程中对无 线接入点的身份认证。认证服务器对无线接入点的身份认证过程包括：认证服务器接收无线接入点提供的第一公钥，认证服务器验证与无线接入点对应的第一公钥是否属于与可信任无线接入点列表对应的公钥列表中，公钥列表是指与可信任无线接入点对应的公钥的列表。当无线接入点提供的第一公钥存在于可信任无线接入点列表对应的公钥列表中时，认证服务器确定该无线接入点是可信任无线接入点；当无线接入点提供的第一公钥不存在于可信任无线接入点列表对应的公钥列表时，认证服务器确定该无线接入点不是可信任无线接入点。
综上所述，本实施例提供的无线接入点认证方法，通过无线接入点向认证服务器发送第一信息；管理终端向认证服务器发送第二信息；认证服务器在接收到第二信息后，对硬件信息和拥有者信息进行身份认证，在身份认证通过时，将无线接入点添加至可信任无线接入点列表，并存储与无线接入点对应的第一公钥；解决了现有的认证方法，认证服务器会将假冒的公众Wi-Fi默认为可信任的公众Wi-Fi，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，使得只有真实的无线接入点才可以通过认证服务器的身份认证，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
另外，无线接入点使用与无线接入点对应的第一私钥对第一信息进行第一签名，向认证服务器发送第一信息和第一签名，使得第一信息不被篡改，提高了第一信息的安全性。
同时，无线接入点使用与无线接入点对应的第一私钥对全部或部分硬件信息和管理终端的标识进行第三签名，保证了管理终端接收到的无线接入点的硬件信息未被篡改，提高了数据的安全性。
需要说明的一点是，本实施例中有关认证服务器一侧的步骤可以单独实现成为认证服务器侧的无线接入点认证方法。
基于图14所示的无线接入点认证方法，认证服务器和无线接入点之间的信息传输可以通过加密的方式进行传输，也即，在步骤1402之后，还可以包括如下步骤，如图15A所示：
步骤1402a，认证服务器根据第一随机数、第二随机数和与无线接入点对应的第一公钥计算得出第一密钥，使用第一密钥对发送给无线接入点的信息进行加密。
认证服务器在向无线接入点发送反馈信息和第二签名后，根据第一随机数、第二随机数和与无线接入点对应的第一公钥计算得出第一密钥。认证服务器使用第一密钥对发送给无线接入点的信息进行加密。
一些例子中，认证服务器计算第一密钥所需的信息还包括数据包的序号。数据包的序号是指认证服务器发送给无线接入点的信息对应的序号。
比如：认证服务器第一次给无线接入点发送信息，此时数据包的序号为1；认证服务器第二次给无线接入点发送信息，此时数据包的序号为2，以此类推。
示例性地，认证服务器计算第一密钥的过程如下：
当数据包的序号为1时，认证服务器通过第一随机数和第二随机数计算得出会话密钥；认证服务器通过与无线接入点对应的第一公钥计算得出共享密钥；认证服务器根据会话密钥和共享密钥计算得出第一密钥；
当数据包的序号不为1时，认证服务器根据上一个会话密钥和共享密钥计算得出第一密钥。
认证服务器计算得出第一密钥后，使用第一密钥对发送给无线接入点的信息进行加密。
步骤1402b，无线接入点根据第一随机数、第二随机数和与认证服务器对应的第二公钥计算得出第二密钥，使用第二密钥对发送给认证服务器的信息进行加密。
无线接入点在接收到认证服务器发送的反馈信息和第二签名后，根据与认证服务器对应的第二公钥验证反馈信息是否被篡改，在反馈信息未被篡改时，根据第一随机数、第二随机数和与认证服务器对应的第二公钥计算得出第二密钥。无线接入点使用第二密钥对发送给认证服务器的信息进行加密。
一些例子中，无线接入点计算第二密钥所需的信息还包括数据包的序号。数据包的序号是指无线接入点发送给认证服务器的信息对应的序号。
比如：无线接入点第一次给认证服务器发送信息，此时数据包的序号为1；无线接入点第二次给认证服务器发送信息，此时数据包的序号为2，以此类推。
示例性地，无线接入点计算第二密钥的过程如下：
当数据包的序号为1时，无线接入点通过第一随机数和第二随机数计算得出会话密钥；无线接入点通过与认证服务器对应的第二公钥计算得出共享密钥；无线接入点根据会话密钥和共享密钥计算得出第二密钥；
当数据包的序号不为1时，无线接入点根据上一个会话密钥和共享密钥计算得出第二密钥。
无线接入点计算得出第二密钥后，使用第二密钥对发送给认证服务器的信息进行加密。
综上所述，通过认证服务器使用第一密钥对发送给无线接入点的信息进行加密，和无线接入点使用第二密钥对发送给认证服务器的信息进行加密，保证了无线接入点和认证服务器之间信息传输的安全性。
基于图14所示的无线接入点认证方法，管理终端可以通过认证服务器获取认证服务器中的认证网络列表。并对认证网络列表中的硬件信息进行删除。也即，在步骤1406之后，还可以包括如下步骤，如图15B所示：
步骤1407，管理终端向认证服务器发送列表获取请求。
列表获取请求用于获取认证服务器中的认证网络列表，认证网络列表是可信任无线接入点提供的各个可信SSID的列表。
管理终端在需要查看或删除与无线接入点对应的认证网络时，向认证服务器发送列表获取请求。该列表获取请求用于获取认证服务器中可信任无线接入点提供的各个可信SSID的列表。
一些例子中，列表获取请求中携带有管理终端的标识。比如：获取请求中携带有微信登录后的openid和访问令牌。
比如：管理终端通过“http：//[域名]/admin/getrouterlist”向认证服务器发送列表获取请求。
示例性地，管理终端向认证服务器发送的列表获取请求如表八所示：
字段 类型 说明 备注
openid String 微信登录的openid  
token String 微信登录的accesstoken  
表八
如表八所示，列表获取请求中携带有管理终端的标识。字段openid代表管理终端的标识，token代表管理终端的访问令牌，两者的类型都为字符串型。
对应地，认证服务器接收管理终端发送的列表获取请求。
步骤1408，认证服务器向管理终端发送认证网络列表。
认证在接收到列表获取请求后，向管理终端发送认证网络列表。其中，认证网络列表是可信任无线接入点提供的各个可信SSID的列表。
示例性地，认证服务器向管理终端发送的认证网络列表如表九所示：
Figure PCTCN2017072186-appb-000009
表九
如表九所示，字段代表不同信息的标识，如：ret代表返回码；msg代表返回码文字信息；mac代表无线接入点的MAC地址；ssid代表无线接入点的SSID；bssid代表无线接入点的BSSID，若无线接入点支持多个ssid和bssid，则建立数组ssidlist和routerlist，显示多个ssid和bssid；mark代表无线接入点的SSID的备注。类型是指认证网络列表中各个信息的类型，包括整型和字符串。
对应地，管理终端接收认证服务器发送的认证网络列表。
步骤1409，管理终端向认证服务器发送取消绑定请求，取消绑定请求包括无线接入点提供的可信SSID。
管理终端接收到认证网络列表后，向认证服务器发送取消绑定请求，取消绑定请求包括无线接入点提供的可信SSID。取消绑定请求用于在认证服务器中的认证网络列表中取消对应的无线接入点提供的可信SSID。比如：管理终端通过“http：//[域名]/admin/unbind”向认证服务器发送取消绑定请求。
一些例子中，取消绑定请求还包括管理终端的标识。
假定无线接入点列表中的一个无线接入点中包括有多个SSID，则取消绑定请求可以取消该无线接入点中的所有SSID，也可以取消该无线接入点中的部分SSID。
取消绑定请求中包括的无线接入点提供的可信SSID是指无线接入点中需取消的SSID。
示例性地，管理终端向认证服务器发送的取消绑定请求如表十所示：
Figure PCTCN2017072186-appb-000010
表十
如表十所示，表十中所示的无线接入点包括2个ssid。其中，字段代表不同信息的标识，如：字段openid代表管理终端的标识，token代表管理终端的访问令牌；mac代表无线接入点的MAC地址；ssid代表无线接入点的SSID；bssid代表无线接入点的BSSID；ssid2代表无线接入点的第二个SSID；bssid2代表无线接入点的第二个BSSID。取消绑定请求中所有信息的类型都是字符串的类型。
对应地，认证服务器接收管理终端发送的取消绑定请求。
步骤1410，认证服务器根据取消绑定请求，在认证网络列表中删除无线接入点提供的可信SSID。
认证服务器接收到取消绑定请求后，获取取消绑定请求中携带的无线接入点提供的可信SSID，根据该硬件信息，在认证网络列表中删除无线接入点提供的可信SSID。
基于图14所示的无线接入点认证方法，管理终端确定无线接入点的SSID为认证网络时，将确定后的无线接入点的SSID发送给认证服务器。也即，在步骤1406之后，还可以包括如下步骤，如图15C所示：
步骤1411，管理终端向认证服务器发送网络确认请求，网络确认请求携带有无线接入点的SSID。
管理终端通过认证服务器连接到无线接入点后，将无线接入点的SSID指定为认证网络的SSID；并将指定的无线接入点的SSID携带在网络确认请求中发送给认证服务器。
比如：管理终端通过“http：//[域名]/admin/setwifi”向认证服务器发送网络确认请求。
对应地，认证服务器接收管理终端发送的网络确认请求。
步骤1412，认证服务器根据网络确认请求，将指定的SSID添加至认证网络列表。
认证服务器在接收到管理终端发送的网络确认请求后，获取网络确认请求中指定的无线接入点的SSID；认证服务器将指定的SSID添加至认证网络列表。
认证网络列表是指可信任无线接入点提供的各个可信SSID的列表。
请参考图16，其示出了本申请一个实施例提供的无线接入点认证装置的结构方框图。该无线接入点认证装置可以通过软件、硬件或者两者的结合实现成为图11中认证服务器的全部或一部分。该无线接入点认证装置包括：
第一接收模块1620，用于接收无线接入点发送的第一信息，第一信息包括：无线接入点的硬件信息和与无线接入点对应的第一公钥。
第二接收模块1640，用于接收管理终端发送的第二信息，第二信息包括：无线接入点的硬件信息和无线接入点的拥有者信息。
身份认证模块1660，用于在接收到第二信息后，对硬件信息和拥有者信息进行身份认证，在身份认证通过时，将无线接入点添加至可信任无线接入点列表，并存储与无线接入点对应的第一公钥。
综上所述，本实施例提供的无线接入点认证装置，通过接收无线接入点发送的第一信息；接收管理终端发送的第二信息；在接收到第二信息后，对硬件信息和拥有者信息进行身份认证，在身份认证通过时，将无线接入点添加至可信任无线接入点列表，并存储与无线接入点对应的第一公钥；解决了现有的认证方法，认证服务器会将假冒的公众Wi-Fi默认为可信任的公众Wi-Fi，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，使得只有真实的无线接入点才可以通过认证服务器的身份认证，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
请参考图17，其示出了本申请另一个实施例提供的无线接入点认证装置的结构方框图。该无线接入点认证装置可以通过软件、硬件或者两者的结合实现成为图11中认证服务器的全部或一部分。该无线接入点认证装置包括：
第一接收模块1710，用于接收无线接入点发送的第一信息，第一信息包 括：无线接入点的硬件信息和与无线接入点对应的第一公钥。
一些例子中，本实施例中，第一接收模块1710，还用于接收无线接入点发送的第一信息和第一签名，第一签名是无线接入点使用与无线接入点对应的第一私钥对第一信息进行的签名。
一些例子中，第一信息还携带有第一随机数。
本实施例中，无线接入点认证装置还可以包括：反馈发送模块1720和密钥计算模块1730。
反馈发送模块1720，用于向无线接入点发送反馈信息和第二签名，第二签名是认证服务器使用与认证服务器对应的第二私钥对反馈信息进行的签名，反馈信息包括与认证服务器对应的第二公钥和第二随机数。
密钥计算模块1730，用于根据第一随机数、第二随机数和与无线接入点对应的第一公钥计算得出第一密钥，使用第一密钥对发送给无线接入点的信息进行加密。
第二接收模块1740，用于接收管理终端发送的第二信息，第二信息包括：无线接入点的硬件信息和无线接入点的拥有者信息。
身份认证模块1750，用于在接收到第二信息后，对硬件信息和拥有者信息进行身份认证，在身份认证通过时，将无线接入点添加至可信任无线接入点列表，并存储与无线接入点对应的第一公钥。
一些例子中，本实施例中，无线接入点认证装置还可以包括：请求接收模块1760和列表发送模块1770。
请求接收模块1760，用于接收管理终端发送的列表获取请求，列表获取请求用于获取认证服务器中的认证网络列表，认证网络列表是可信任无线接入点提供的各个可信服务集标识SSID的列表。
列表发送模块1770，用于向管理终端发送认证网络列表。
一些例子中，本实施例中，无线接入点认证装置还可以包括：取消接收模块1780和信息删除模块1790。
取消接收模块1780，用于接收管理终端发送的取消绑定请求，取消绑定请求包括无线接入点提供的可信SSID。
信息删除模块1790，用于根据取消绑定请求，在认证网络列表中删除无线接入点提供的可信SSID。
综上所述，本实施例提供的无线接入点认证装置，通过无线接入点向认证服务器发送第一信息；管理终端向认证服务器发送第二信息；认证服务器在接收到第二信息后，对硬件信息和拥有者信息进行身份认证，在身份认证通过时，将无线接入点添加至可信任无线接入点列表，并存储与无线接入点对应的第一公钥；解决了现有的认证方法，认证服务器会将假冒的公众Wi-Fi默认为可信任的公众Wi-Fi，导致用户终端向假冒的公众Wi-Fi所传输的数据以及用户终端内部的数据均会受到安全威胁的问题；达到了通过认证服务器对无线接入点进行身份认证，使得只有真实的无线接入点才可以通过认证服 务器的身份认证，提高了用户终端传输的数据以及用户终端内部的数据安全性的效果。
另外，无线接入点使用与无线接入点对应的第一私钥对第一信息进行第一签名，向认证服务器发送第一信息和第一签名，使得第一信息不被篡改，提高了第一信息的安全性。
同时，无线接入点使用与无线接入点对应的第一私钥对全部或部分硬件信息和管理终端的标识进行第三签名，保证了管理终端接收到的无线接入点的硬件信息未被篡改，提高了数据的安全性。
请参考图18，其示出了本申请实施例提供的一种无线接入点认证系统的结构方框图，该系统包括：管理终端1820、无线接入点1840和认证服务器1860；
管理终端1820，用于向认证服务器发送第二信息；
无线接入点1840，用于向认证服务器发送第一信息；
认证服务器1860，包括如图16所示实施例或图17所示实施例任一所述的无线接入点认证装置。
需要说明的是，上述实施例中，不是所有的步骤和模块都是必须的。步骤的执行顺序也可以根据需要进行调整。上述实施例提供的无线网络连接的装置在连接无线网络时，仅以上述各功能模块的划分进行举例说明。实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将设备的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的无线网络连接与无线网络连接的方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。

Claims (48)

  1. 一种无线网络连接方法，其特征在于，所述方法包括：
    接收无线接入点发送的接入请求，所述接入请求携带有试图接入所述无线接入点的用户终端的用户信息；
    在接收到所述接入请求后，验证所述无线接入点是否为可信任无线接入点；
    确定所述无线接入点为可信任无线接入点时，与用户终端进行第一身份认证；
    在所述第一身份认证成功时，为所述用户终端生成主密钥，并向所述用户终端发送所述主密钥；
    向所述无线接入点发送与所述用户信息对应的主密钥，以使所述无线接入点与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接。
  2. 根据权利要求1所述的方法，其特征在于，所述验证所述无线接入点是否属于可信任无线接入点，包括：
    获取所述接入请求中携带的第一密文和与所述无线接入点对应的第一公钥；
    验证所述第一公钥是否存在于可信任公钥集合中；若所述第一公钥存在于所述可信任公钥集合中，则将所述无线接入点验证为可信任无线接入点；
    其中，所述可信任公钥集合存储有通过第二身份认证的无线接入点对应的公钥。
  3. 根据权利要求2所述的方法，其特征在于，所述获取所述接入请求中携带的第一密文和与所述第一公钥，包括：
    通过与所述认证服务器对应的第一私钥对所述接入请求进行解密，得到所述第一密文和所述第一公钥；
    其中，所述接入请求是所述无线接入点通过与所述认证服务器对应的第二公钥对所述第一密文和所述第一公钥进行加密的请求。
  4. 根据权利要求2所述的方法，其特征在于，确定所述无线接入点为可信任无线接入点时与所述用户终端进行第一身份认证，包括：
    确定所述无线接入点为可信任无线接入点时，使用所述第一公钥对所述接入请求中携带的第一密文进行解密，得到所述用户信息；
    查询与所述用户信息对应的密钥信息；
    根据所述密钥信息与所述用户终端进行第一身份认证；
    其中，所述第一密文是所述无线接入点通过与所述无线接入点对应的第 二私钥对所述用户信息进行加密的密文。
  5. 根据权利要求4所述的方法，其特征在于，所述向所述无线接入点发送与所述用户信息对应的所述主密钥，包括：
    使用所述第一公钥对所述主密钥进行第一加密，向所述无线接入点发送第一加密后的所述主密钥。
  6. 根据权利要求5所述的方法，其特征在于，向所述无线接入点发送第一加密后的所述主密钥，包括：
    使用与所述认证服务器对应的第一私钥对第一加密后的所述主密钥进行第二加密，向所述无线接入点发送第二加密后的所述主密钥。
  7. 根据权利要求1至6任一所述的方法，其特征在于，所述接收无线接入点发送的接入请求之前，还包括：
    接收所述无线接入点发送的身份认证请求，所述身份认证请求携带有认证信息和与所述无线接入点对应的第一公钥，所述认证信息和所述第一公钥均使用与所述认证服务器对应的第二公钥进行加密，所述认证信息至少包括硬件信息和/或拥有者信息；
    通过与所述认证服务器对应的第一私钥对所述身份认证请求进行解密，得到所述认证信息和与所述第一公钥；
    对所述认证信息进行第二身份认证，在所述第二身份认证成功时，将所述第一公钥添加至所述可信任公钥集合中。
  8. 根据权利要求7所述的方法，其特征在于，所述认证信息是所述无线接入点通过与所述无线接入点对应的第二私钥进行加密的信息；
    所述对所述认证信息进行第二身份认证，包括：
    通过所述第一公钥对所述认证信息进行解密，得到所述硬件信息和/或所述拥有者信息；
    对所述硬件信息和/或所述拥有者信息进行所述第二身份认证，在所述第二身份认证成功时，将所述第一公钥添加至所述可信任公钥集合中。
  9. 根据权利要求1所述的方法，其特征在于，进一步包括：
    接收所述无线接入点发送的第一信息，所述第一信息包括：所述无线接入点的硬件信息和与所述无线接入点对应的第一公钥；
    接收管理终端发送的第二信息，所述第二信息包括：所述无线接入点的硬件信息和所述无线接入点的拥有者信息；
    在接收到所述第二信息后，对所述硬件信息和所述拥有者信息进行身份认证，在所述身份认证通过时，将所述无线接入点添加至可信任无线接入点列表，并存储与所述无线接入点对应的第一公钥。
  10. 根据权利要求9所述的方法，其特征在于，所述接收无线接入点发送的第一信息，包括：
    接收所述无线接入点发送的所述第一信息和第一签名，所述第一签名是所述无线接入点使用与所述无线接入点对应的第二私钥对所述第一信息进行的签名。
  11. 根据权利要求10所述的方法，其特征在于，所述第一信息还携带有第一随机数；
    所述接收所述无线接入点发送的所述第一信息和第一签名之后，还包括：
    向所述无线接入点发送反馈信息和第二签名，所述第二签名是所述认证服务器使用与所述认证服务器对应的第一私钥对所述反馈信息进行的签名，所述反馈信息包括与所述认证服务器对应的第二公钥和第二随机数；
    根据所述第一随机数、所述第二随机数和与所述无线接入点对应的第一公钥计算得出第一密钥，使用所述第一密钥对发送给所述无线接入点的信息进行加密。
  12. 根据权利要求9至11任一所述的方法，其特征在于，所述将所述无线接入点添加至可信任无线接入点列表之后，还包括：
    接收所述管理终端发送的列表获取请求，所述列表获取请求用于获取所述认证服务器中的认证网络列表，所述认证网络列表是所述可信任无线接入点提供的各个可信服务集标识SSID的列表；
    向所述管理终端发送所述认证网络列表。
  13. 根据权利要求12所述的方法，其特征在于，所述向所述管理终端发送所述认证网络列表之后，还包括：
    接收所述管理终端发送的取消绑定请求，所述取消绑定请求包括所述无线接入点提供的可信服务集标识SSID；
    根据所述取消绑定请求，在所述认证网络列表中删除所述可信服务集标识SSID。
  14. 一种无线网络连接方法，其特征在于，所述方法包括：
    接收用户终端发送的第一接入请求，所述第一接入请求携带有所述用户终端的用户信息；
    向认证服务器发送第二接入请求，所述第二接入请求携带有所述用户信息；
    接收所述认证服务器发送的与所述用户信息对应的主密钥，所述主密钥是所述认证服务器在接收到所述第二接入请求后，验证无线接入点属于可信任无线接入点时，与用户终端进行第一身份认证成功后为所述用户终端生成 的密钥；
    与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接。
  15. 根据权利要求14所述的方法，其特征在于，所述接收所述认证服务器发送的与所述用户信息对应的主密钥，包括：
    接收所述认证服务器发送的第一加密后的主密钥，所述第一加密后的主密钥是所述认证服务器在所述无线接入点属于所述可信任无线接入点时，使用与所述无线接入点对应的第二公钥对所述主密钥进行加密后的主密钥。
  16. 根据权利要求14所述的方法，其特征在于，所述接收所述认证服务器发送的与所述用户信息对应的主密钥，包括：
    接收所述认证服务器发送的第二加密后的主密钥，所述第二加密后的主密钥是所述认证服务器在所述无线接入点属于所述可信任无线接入点时，使用与所述无线接入点对应的第二公钥对所述主密钥进行第一加密，再使用与所述认证服务器对应的第一私钥对第一加密后的所述主密钥进行第二加密后的主密钥。
  17. 根据权利要求15所述的方法，其特征在于，所述与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接，包括：
    使用与所述无线接入点对应的第二私钥对所述第一加密后的主密钥进行解密，得到所述主密钥；
    与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接。
  18. 根据权利要求16所述的方法，所述与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接，包括：
    使用与所述认证服务器对应的第一公钥对第二加密后的所述主密钥进行解密，得到第二密文；
    使用与所述无线接入点对应的第二私钥对所述第二密文进行解密，得到所述主密钥；
    与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接；
    其中，所述第二密文是所述认证服务器通过与所述无线接入点对应的第二公钥对所述主密钥进行加密的密文。
  19. 根据权利要求14所述的方法，其特征在于，所述向所述认证服务器发送第二接入请求之前，还包括：
    生成与所述无线接入点对应的第二公钥和第二私钥；
    获取与所述认证服务器对应的第一公钥；
    向所述认证服务器发送身份认证请求，所述身份认证请求携带有认证信息和与所述无线接入点对应的第二公钥，所述认证信息和与所述无线接入点对应的第二公钥均使用与所述认证服务器对应的第一公钥进行加密，所述认证信息至少包括硬件信息和/或拥有者信息。
  20. 根据权利要求19所述的方法，其特征在于，所述认证信息是通过与所述无线接入点对应的第二私钥进行加密的信息。
  21. 根据权利要求14至20中任一所述的方法，其特征在于，所述与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接，包括：
    与所述用户终端使用各自持有的所述主密钥，协商生成本次连接所使用的临时密钥，根据所述临时密钥与所述用户终端建立加密无线网络连接。
  22. 一种无线网络连接装置，其特征在于，所述装置包括：
    请求接收模块，用于接收无线接入点发送的接入请求，所述接入请求携带有试图接入所述无线接入点的用户终端的用户信息；
    信任验证模块，用于在接收到所述第二接入请求后，验证所述无线接入点是否为可信任无线接入点；
    用户认证模块，用于在确定所述无线接入点为可信任无线接入点时与所述用户终端进行第一身份认证；
    密钥生成模块，用于在所述第一身份认证成功时，为所述用户终端生成主密钥，并向所述用户终端发送所述主密钥；
    密钥发送模块，用于向所述无线接入点发送与所述用户信息对应的所述主密钥，以使所述无线接入点与用户终端根据各自持有的所述主密钥与用户终端协商建立加密无线网络连接。
  23. 根据权利要求22所述的装置，其特征在于，所述信任验证模块，包括：
    公钥获取单元，用于获取所述第二接入请求中携带的第一密文和与所述无线接入点对应的第一公钥；
    第一验证单元，用于验证所述第一公钥是否存在于可信任公钥集合中；若所述第一公钥存在于所述可信任公钥集合中，则将所述无线接入点验证为所述可信任无线接入点；
    其中，所述可信任公钥集合存储有通过第二身份认证的无线接入点对应的公钥。
  24. 根据权利要求23所述的装置，其特征在于，所述公钥获取单元，还用于通过与所述认证服务器对应的第一私钥对所述接入请求进行解密，得到 第一密文和所述第一公钥；
    其中，所述接入请求是所述无线接入点通过与所述认证服务器对应的第二公钥对所述第一密文和所述第一公钥进行加密的请求。
  25. 根据权利要求23所述的方法，其特征在于，所述用户认证模块，包括：
    密文解密单元，用于在确定所述无线接入点为可信任无线接入点时，使用与所述无线接入点对应的第二公钥对所述接入请求中携带的第一密文进行解密，得到所述用户信息；
    密钥查询单元，用于查询与所述用户信息对应的密钥信息；
    密钥认证单元，用于根据所述密钥信息与所述用户终端进行第一身份认证；
    其中，所述第一密文是所述无线接入点通过与所述无线接入点对应的第二私钥对所述用户信息进行加密的密文。
  26. 根据权利要求25所述的装置，其特征在于，所述密钥发送模块，还用于使用所述第一公钥对所述主密钥进行第一加密，向所述无线接入点发送第一加密后的所述主密钥。
  27. 根据权利要求26所述的装置，其特征在于，所述密钥发送模块，还用于使用与所述认证服务器对应的第一私钥对第一加密后的所述主密钥进行第二加密，向所述无线接入点发送第二加密后的所述主密钥。
  28. 根据权利要求22至27中任一所述的装置，其特征在于，所述装置，还包括：
    认证接收模块，用于接收所述无线接入点发送的身份认证请求，所述身份认证请求携带有认证信息和与所述无线接入点对应的第一公钥，所述认证信息和所述第一公钥均使用与所述认证服务器对应的第二公钥进行加密，所述认证信息至少包括硬件信息和/或拥有者信息；
    信息解密模块，用于通过与所述认证服务器对应的第一私钥对所述身份认证请求进行解密，得到所述认证信息和所述第一公钥；
    信息认证模块，用于对所述认证信息进行第二身份认证，在所述第二身份认证成功时，将所述第一公钥添加至所述可信任公钥集合中。
  29. 根据权利要求28所述的装置，其特征在于，所述认证信息是所述无线接入点通过与所述无线接入点对应的第二私钥进行加密的信息；
    所述信息认证模块，包括：
    第一解密单元，用于通过所述第一公钥对所述认证信息进行解密，得到所述硬件信息和/或所述拥有者信息；
    第一认证单元，用于对所述硬件信息和/或所述拥有者信息进行第二身份认证，在所述第二身份认证成功时，将所述第一公钥添加至所述可信任公钥集合中。
  30. 根据权利要求22所述的装置，其特征在于，进一步包括：
    第一接收模块，用于接收所述无线接入点发送的第一信息，所述第一信息包括：所述无线接入点的硬件信息和与所述无线接入点对应的第一公钥；
    第二接收模块，用于接收所述管理终端发送的第二信息，所述第二信息包括：所述无线接入点的硬件信息和所述无线接入点的拥有者信息；
    身份认证模块，用于在接收到所述第二信息后，对所述硬件信息和所述拥有者信息进行身份认证，在所述身份认证通过时，将所述无线接入点添加至可信任无线接入点列表，并存储与所述无线接入点对应的第一公钥。
  31. 根据权利要求22所述的装置，其特征在于，所述第一接收模块还用于接收所述无线接入点发送的所述第一信息和第一签名，所述第一签名是所述无线接入点使用与所述无线接入点对应的第一私钥对所述第一信息进行的签名，所述第一信息还携带有第一随机数；
    所述装置还包括：
    反馈发送模块，用于向所述无线接入点发送反馈信息和第二签名，所述第二签名是所述认证服务器使用与所述认证服务器对应的第二私钥对所述反馈信息进行的签名，所述反馈信息包括与所述认证服务器对应的第二公钥和第二随机数；
    密钥计算模块，用于根据所述第一随机数、所述第二随机数和与所述无线接入点对应的第一公钥计算得出第一密钥，使用所述第一密钥对发送给所述无线接入点的信息进行加密。
  32. 根据权利要求30或31所述的装置，其特征在于，所述装置还包括：
    请求接收模块，用于接收所述管理终端发送的列表获取请求，所述列表获取请求用于获取所述认证服务器中的认证网络列表，所述认证网络列表是所述可信任无线接入点提供的各个可信服务集标识SSID的列表；
    列表发送模块，用于向所述管理终端发送所述认证网络列表。
  33. 根据权利要求32所述的装置，其特征在于，所述装置还包括：
    取消接收模块，用于接收所述管理终端发送的取消绑定请求，所述取消绑定请求包括所述无线接入点提供的可信服务集标识SSID；
    信息删除模块，用于根据所述取消绑定请求，在所述认证网络列表中删除所述可信服务集标识SSID。
  34. 一种无线网络连接装置，其特征在于，所述装置包括：
    第一接收模块，用于接收用户终端发送的第一接入请求，所述第一接入请求携带有所述用户终端的用户信息；
    第二接收模块，用于向认证服务器发送第二接入请求，所述第二接入请求携带有所述用户信息；
    密钥接收模块，用于接收所述认证服务器发送的与所述用户信息对应的主密钥，所述主密钥是所述认证服务器在接收到所述第二接入请求后，验证无线接入点属于可信任无线接入点时，与用户终端进行第一身份认证成功后协商生成的密钥；
    网络连接模块，用于与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接。
  35. 根据权利要求34所述的装置，其特征在于，所述密钥接收模块，还用于接收所述认证服务器发送的第一加密后的主密钥，所述第一加密后的主密钥是所述认证服务器在所述无线接入点属于所述可信任无线接入点时，使用与所述无线接入点对应的第二公钥对所述主密钥进行加密后的主密钥。
  36. 根据权利要求34所述的装置，其特征在于，所述密钥接收模块，还用于接收所述认证服务器发送的第二加密后的主密钥，所述第二加密后的主密钥是所述认证服务器在所述无线接入点属于所述可信任无线接入点时，使用与所述无线接入点对应的第二公钥对所述主密钥进行第一加密，再使用与所述认证服务器对应的第一私钥对第一加密后的所述主密钥进行第二加密后的主密钥。
  37. 根据权利要求35所述的装置，其特征在于，所述网络连接模块，包括：
    第一解密单元，用于使用与所述无线接入点对应的第二私钥对所述第一加密后的主密钥进行解密，得到所述主密钥；
    第一连接单元，用于与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接。
  38. 根据权利要求36所述的装置，其特征在于，所述网络连接模块，包括：
    第二解密单元，用于使用与所述认证服务器对应的第一公钥对第二加密后的所述主密钥进行解密，得到第二密文；
    第三解密单元，用于使用与所述无线接入点对应的第二私钥对所述第二密文进行解密，得到所述主密钥；
    第二连接单元，用于与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接；
    其中，所述第二密文是所述认证服务器通过与所述无线接入点对应的第 二公钥对所述主密钥进行加密的密文。
  39. 根据权利要求34所述的装置，其特征在于，所述装置还包括：
    密钥生成模块，用于生成与所述无线接入点对应的第二公钥和第二私钥；
    公钥获取模块，用于获取与所述认证服务器对应的第一公钥；
    信息发送模块，用于向所述认证服务器发送身份认证请求，所述身份认证请求携带有认证信息和与所述无线接入点对应的第二公钥，所述认证信息和与所述无线接入点对应的第二公钥均使用与所述认证服务器对应的第一公钥进行加密，所述认证信息至少包括硬件信息和/或拥有者信息。
  40. 根据权利要求39所述的装置，其特征在于，所述认证信息是通过与所述无线接入点对应的第二私钥进行加密的信息。
  41. 根据权利要求34至40中任一所述的装置，其特征在于，所述网络连接模块，还用于与所述用户终端使用各自持有的所述主密钥，协商生成本次连接所使用的临时密钥，使用所述临时密钥与所述用户终端建立加密无线网络连接。
  42. 一种机器可读存储介质，存储有一系列机器可执行指令，其特征在于，所述指令可以使至少一个处理器执行以下操作：
    接收无线接入点发送的接入请求，所述接入请求携带有试图接入所述无线接入点的用户终端的用户信息；
    在接收到所述接入请求后，验证所述无线接入点是否为可信任无线接入点；
    确定所述无线接入点为可信任无线接入点时，与用户终端进行第一身份认证；
    在所述第一身份认证成功时，为所述用户终端生成主密钥，并向所述用户终端发送所述主密钥；
    向所述无线接入点发送与所述用户信息对应的主密钥，以使所述无线接入点与所述用户终端根据各自持有的所述主密钥协商建立加密无线网络连接。
  43. 根据权利要求42所述的存储介质，其特征在于，所述指令可以使至少一个处理器执行以下操作：
    获取所述接入请求中携带的第一密文和与所述无线接入点对应的第一公钥；
    验证所述第一公钥是否存在于可信任公钥集合中；若所述第一公钥存在于所述可信任公钥集合中，则将所述无线接入点验证为可信任无线接入点；
    其中，所述可信任公钥集合存储有通过第二身份认证的无线接入点对应 的公钥。
  44. 根据权利要求42所述的存储介质，其特征在于，所述指令可以使至少一个处理器执行以下操作：
    接收所述无线接入点发送的第一信息，所述第一信息包括：所述无线接入点的硬件信息和与所述无线接入点对应的第一公钥；
    接收管理终端发送的第二信息，所述第二信息包括：所述无线接入点的硬件信息和所述无线接入点的拥有者信息；
    在接收到所述第二信息后，对所述硬件信息和所述拥有者信息进行身份认证，在所述身份认证通过时，将所述无线接入点添加至可信任无线接入点列表，并存储与所述无线接入点对应的第一公钥。
  45. 一种机器可读存储介质，存储有一系列机器可执行指令，其特征在于，所述指令可以使至少一个处理器执行以下操作：
    接收用户终端发送的第一接入请求，所述第一接入请求携带有所述用户终端的用户信息；
    向认证服务器发送第二接入请求，所述第二接入请求携带有所述用户信息；
    接收所述认证服务器发送的与所述用户信息对应的主密钥，所述主密钥是所述认证服务器在接收到所述第二接入请求后，验证发送所述第二接入请求的无线接入点为可信任无线接入点时，与用户终端进行第一身份认证成功后为所述用户终端生成的密钥；
    与所述用户终端根据各自持有的所述主密钥进行加密通信。
  46. 根据权利要求45所述的存储介质，其特征在于，所述指令可以使至少一个处理器执行以下操作：
    接收所述认证服务器发送的第一加密后的主密钥，所述第一加密后的主密钥是所述认证服务器在确定发送所述第二接入请求的无线接入点为可信任无线接入点时，使用与所述无线接入点对应的第二公钥对所述主密钥进行加密后的主密钥。
  47. 根据权利要求45所述的存储介质，其特征在于，所述指令可以使至少一个处理器执行以下操作：
    接收所述认证服务器发送的第二加密后的主密钥，所述第二加密后的主密钥是所述认证服务器在确定发送所述第二接入请求的无线接入点属于所述可信任无线接入点时，使用与所述无线接入点对应的第二公钥对所述主密钥进行第一加密，再使用与所述认证服务器对应的第一私钥对第一加密后的所述主密钥进行第二加密后的主密钥。
  48. 根据权利要求45所述的存储介质，其特征在于，所述指令可以使至少一个处理器执行以下操作：
    生成第二公钥和第二私钥；
    获取与所述认证服务器对应的第一公钥；
    向所述认证服务器发送身份认证请求，所述身份认证请求携带有认证信息和所述第二公钥，所述认证信息和所述第二公钥均使用与所述认证服务器对应的第一公钥进行加密，所述认证信息至少包括硬件信息和/或拥有者信息。
PCT/CN2017/072186 2016-01-29 2017-01-23 无线网络连接方法、装置及存储介质 WO2017129089A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
KR1020187020181A KR102134302B1 (ko) 2016-01-29 2017-01-23 무선 네트워크 접속 방법 및 장치, 및 저장 매체
EP17743704.3A EP3410758B1 (en) 2016-01-29 2017-01-23 Wireless network connecting method and apparatus, and storage medium
US15/913,644 US10638321B2 (en) 2016-01-29 2018-03-06 Wireless network connection method and apparatus, and storage medium

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN201610067779.8A CN105554760B (zh) 2016-01-29 2016-01-29 无线接入点认证方法、装置及系统
CN201610067787.2A CN105554747B (zh) 2016-01-29 2016-01-29 无线网络连接方法、装置及系统
CN201610067779.8 2016-01-29
CN201610067787.2 2016-01-29

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/913,644 Continuation US10638321B2 (en) 2016-01-29 2018-03-06 Wireless network connection method and apparatus, and storage medium

Publications (1)

Publication Number Publication Date
WO2017129089A1 true WO2017129089A1 (zh) 2017-08-03

Family

ID=59397434

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/072186 WO2017129089A1 (zh) 2016-01-29 2017-01-23 无线网络连接方法、装置及存储介质

Country Status (4)

Country Link
US (1) US10638321B2 (zh)
EP (1) EP3410758B1 (zh)
KR (1) KR102134302B1 (zh)
WO (1) WO2017129089A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112822758A (zh) * 2020-12-31 2021-05-18 深圳市晨北科技有限公司 接入网络的方法、设备及存储介质
US20210243603A1 (en) * 2019-01-11 2021-08-05 Tencent Technology (Shenzhen) Company Limited Wireless network access method, apparatus, device, equipment and system
CN116015958A (zh) * 2023-01-04 2023-04-25 航天宏图信息技术股份有限公司 一种服务互信认证方法及系统
CN119051864A (zh) * 2024-11-04 2024-11-29 深圳竹云科技股份有限公司 基于本地通用物理存储的安全云存储方法、装置及设备
US12160413B2 (en) * 2017-01-30 2024-12-03 Telefonaktiebolaget Lm Ericsson (Publ) Parameter exchange during emergency access using extensible authentication protocol messaging

Families Citing this family (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108282783B (zh) * 2017-09-15 2021-03-09 阿里巴巴（中国）有限公司 公共wifi认证方法、装置、用户终端及存储介质
CN110891272B (zh) * 2018-09-10 2022-12-09 奇点新源国际技术开发(北京)有限公司 一种无线网络接入认证方法及装置
WO2020091434A1 (ko) * 2018-11-02 2020-05-07 엘지전자 주식회사 무선 통신 시스템에서 생체정보를 이용하여 인증을 하기 위한 방법 및 장치
US10887051B2 (en) * 2019-01-03 2021-01-05 Qualcomm Incorporated Real time MIC recovery
JP7259334B2 (ja) 2019-01-09 2023-04-18 ブラザー工業株式会社 端末装置と端末装置のためのコンピュータプログラム
KR102235553B1 (ko) * 2019-05-02 2021-04-02 엔에이치엔 주식회사 네트워크 상의 액세스 포인트와 통신하는 인증 서버 및 그것의 동작 방법
US11777715B2 (en) * 2019-05-15 2023-10-03 Amir Keyvan Khandani Method and apparatus for generating shared secrets
CN110912686B (zh) * 2019-10-15 2023-05-05 福建联迪商用设备有限公司 一种安全通道的密钥的协商方法及系统
CN111988289B (zh) * 2020-08-04 2021-07-23 厦门理工学院 Epa工业控制网络安全测试系统及方法
US20220085984A1 (en) * 2020-09-14 2022-03-17 Amir Keyvan Khandani Methods and apparatus for randomized encryption, with an associated randomized decryption
KR102802979B1 (ko) 2020-09-21 2025-04-30 주식회사 엘지에너지솔루션 상호 인증 방법 및 그 방법을 제공하는 인증장치
CN113141609B (zh) * 2021-03-17 2023-02-07 深圳市高格通讯技术有限公司 加密通信方法、终端
US11533615B2 (en) * 2021-05-06 2022-12-20 Nile Global, Inc. Methods and systems of wireless sensor authentication
CN113194471B (zh) * 2021-05-21 2023-04-07 中国联合网络通信集团有限公司 基于区块链网络的无线网络接入方法、装置和终端
CN117278204B (zh) * 2021-11-19 2024-10-25 荣耀终端有限公司 数据保护方法及存储介质
US12096216B2 (en) * 2021-12-15 2024-09-17 International Business Machines Corporation Telecommunication information collection with separate certification
WO2024144340A1 (ko) * 2022-12-29 2024-07-04 엘지전자 주식회사 무선랜 시스템에서 다중 액세스 포인트 동작 기반 보안 키 관련 정보 송신 또는 수신 방법 및 장치
WO2024177348A1 (en) * 2023-02-22 2024-08-29 Samsung Electronics Co., Ltd. Method and apparatus for dynamic data encryption in a communication system with forward secrecy
CN117939573A (zh) * 2023-06-12 2024-04-26 小米汽车科技有限公司 车载网络接入方法、装置、存储介质及芯片

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101212296A (zh) * 2006-12-28 2008-07-02 中国移动通信集团公司 基于证书及sim的wlan接入认证方法及系统
CN101232378A (zh) * 2007-12-29 2008-07-30 西安西电捷通无线网络通信有限公司 一种无线多跳网络的认证接入方法
CN101282215A (zh) * 2008-05-29 2008-10-08 杭州华三通信技术有限公司 证书鉴别方法和设备
CN101448262A (zh) * 2008-12-15 2009-06-03 广州杰赛科技股份有限公司 基于wapi的无线网状网的认证方法
CN103024743A (zh) * 2012-12-17 2013-04-03 北京航空航天大学 一种无线局域网可信安全接入方法
WO2015042471A1 (en) * 2013-09-23 2015-03-26 Qualcomm Incorporated Method for configuring a remote station with a certificate from a local root certificate authority for securing a wireless network
CN105554747A (zh) * 2016-01-29 2016-05-04 腾讯科技（深圳）有限公司 无线网络连接方法、装置及系统
CN105554760A (zh) * 2016-01-29 2016-05-04 腾讯科技（深圳）有限公司 无线接入点认证方法、装置及系统

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6453159B1 (en) * 1999-02-25 2002-09-17 Telxon Corporation Multi-level encryption system for wireless network
US8249256B2 (en) * 2007-11-06 2012-08-21 Motorola Solutions, Inc. Method for providing fast secure handoff in a wireless mesh network
US9105031B2 (en) 2008-02-22 2015-08-11 Microsoft Technology Licensing, Llc Authentication mechanisms for wireless networks
WO2009150493A1 (en) * 2008-06-13 2009-12-17 Nokia Corporation Methods, apparatuses, and computer program products for providing fresh security context during intersystem mobility
CN101527908B (zh) * 2009-04-08 2011-04-20 中兴通讯股份有限公司 一种无线局域网终端的预鉴别方法及无线局域网系统
KR101038096B1 (ko) * 2010-01-04 2011-06-01 전자부품연구원 바이너리 ｃｄｍａ에서 키 인증 방법
US8473002B2 (en) * 2010-04-23 2013-06-25 Qualcomm Incorporated Method and apparatus for network personalization of subscriber devices
US8886935B2 (en) * 2010-04-30 2014-11-11 Kabushiki Kaisha Toshiba Key management device, system and method having a rekey mechanism
WO2014028691A1 (en) * 2012-08-15 2014-02-20 Interdigital Patent Holdings, Inc. Enhancements to enable fast security setup
US9801099B2 (en) * 2013-05-15 2017-10-24 Blackberry Limited Method and system for use of cellular infrastructure to manage small cell access
CN104394533B (zh) 2014-11-24 2018-03-23 中国联合网络通信集团有限公司 无线保真WiFi连接方法、服务器及终端

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101212296A (zh) * 2006-12-28 2008-07-02 中国移动通信集团公司 基于证书及sim的wlan接入认证方法及系统
CN101232378A (zh) * 2007-12-29 2008-07-30 西安西电捷通无线网络通信有限公司 一种无线多跳网络的认证接入方法
CN101282215A (zh) * 2008-05-29 2008-10-08 杭州华三通信技术有限公司 证书鉴别方法和设备
CN101448262A (zh) * 2008-12-15 2009-06-03 广州杰赛科技股份有限公司 基于wapi的无线网状网的认证方法
CN103024743A (zh) * 2012-12-17 2013-04-03 北京航空航天大学 一种无线局域网可信安全接入方法
WO2015042471A1 (en) * 2013-09-23 2015-03-26 Qualcomm Incorporated Method for configuring a remote station with a certificate from a local root certificate authority for securing a wireless network
CN105554747A (zh) * 2016-01-29 2016-05-04 腾讯科技（深圳）有限公司 无线网络连接方法、装置及系统
CN105554760A (zh) * 2016-01-29 2016-05-04 腾讯科技（深圳）有限公司 无线接入点认证方法、装置及系统

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US12160413B2 (en) * 2017-01-30 2024-12-03 Telefonaktiebolaget Lm Ericsson (Publ) Parameter exchange during emergency access using extensible authentication protocol messaging
US20210243603A1 (en) * 2019-01-11 2021-08-05 Tencent Technology (Shenzhen) Company Limited Wireless network access method, apparatus, device, equipment and system
US12231888B2 (en) * 2019-01-11 2025-02-18 Tencent Technology (Shenzhen) Company Limited Wireless network access method, apparatus, device, equipment and system
CN112822758A (zh) * 2020-12-31 2021-05-18 深圳市晨北科技有限公司 接入网络的方法、设备及存储介质
CN116015958A (zh) * 2023-01-04 2023-04-25 航天宏图信息技术股份有限公司 一种服务互信认证方法及系统
CN119051864A (zh) * 2024-11-04 2024-11-29 深圳竹云科技股份有限公司 基于本地通用物理存储的安全云存储方法、装置及设备
CN119051864B (zh) * 2024-11-04 2025-03-04 深圳竹云科技股份有限公司 基于本地通用物理存储的安全云存储方法、装置及设备

Also Published As

Publication number Publication date
US10638321B2 (en) 2020-04-28
EP3410758A1 (en) 2018-12-05
EP3410758A4 (en) 2018-12-05
KR20180095873A (ko) 2018-08-28
EP3410758B1 (en) 2020-02-26
US20180199205A1 (en) 2018-07-12
KR102134302B1 (ko) 2020-07-15

Similar Documents

Publication Publication Date Title
WO2017129089A1 (zh) 无线网络连接方法、装置及存储介质
CN105554747B (zh) 无线网络连接方法、装置及系统
CN106302312B (zh) 获取电子文件的方法及装置
CN105554760B (zh) 无线接入点认证方法、装置及系统
WO2017190616A1 (zh) 无线网络连接方法、无线接入点、服务器及系统
KR101730459B1 (ko) 로컬 기능을 갖는 아이덴티티 관리
US8327143B2 (en) Techniques to provide access point authentication for wireless network
KR101490214B1 (ko) 공유된 일시적 키 데이터의 세트를 갖는 교환들을 인코딩하기 위한 시스템들 및 방법들
US8707029B2 (en) Mobile handset identification and communication authentication
CN112566119B (zh) 终端认证方法、装置、计算机设备及存储介质
WO2017028593A1 (zh) 网络接入设备接入无线网络接入点的方法、网络接入设备、应用程序服务器和非易失性计算机可读存储介质
WO2022100356A1 (zh) 身份认证系统、方法、装置、设备及计算机可读存储介质
CA2879910C (en) Terminal identity verification and service authentication method, system and terminal
KR20110113565A (ko) 공중 무선 네트워크를 통한 사설 네트워크로의 보안 접근
CN101807998A (zh) 认证
WO2010078755A1 (zh) 电子邮件的传送方法、系统及wapi终端
US11824989B2 (en) Secure onboarding of computing devices using blockchain
US11522702B1 (en) Secure onboarding of computing devices using blockchain
CN112235290B (zh) 基于区块链的物联网设备管理方法及第一物联网设备
CN109561431B (zh) 基于多口令身份鉴别的wlan接入访问控制系统及方法
CN213938340U (zh) 5g应用接入认证网络架构
CN106714158B (zh) 一种WiFi接入方法及装置
JP2017139026A (ja) 信頼できる認証およびログオンのための方法および装置
KR101431010B1 (ko) 하드웨어 인증 모듈을 이용한 액세스 포인트 인증 장치 및 방법
CN110225011B (zh) 用户节点的认证方法、设备及计算机可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17743704

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 20187020181

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 1020187020181

Country of ref document: KR

NENP Non-entry into the national phase

Ref country code: DE