WO2017147745A1 - 一种对接入点ap的认证方法、系统及相关设备 - Google Patents

一种对接入点ap的认证方法、系统及相关设备 Download PDF

Info

Publication number
WO2017147745A1
WO2017147745A1 PCT/CN2016/074818 CN2016074818W WO2017147745A1 WO 2017147745 A1 WO2017147745 A1 WO 2017147745A1 CN 2016074818 W CN2016074818 W CN 2016074818W WO 2017147745 A1 WO2017147745 A1 WO 2017147745A1
Authority
WO
WIPO (PCT)
Prior art keywords
feature
terminal
message
generation rule
response message
Prior art date
Application number
PCT/CN2016/074818
Other languages
English (en)
French (fr)
Inventor
陈曦
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2016/074818 priority Critical patent/WO2017147745A1/zh
Priority to CN201680004671.2A priority patent/CN107113615B/zh
Priority to US16/080,663 priority patent/US11134384B2/en
Publication of WO2017147745A1 publication Critical patent/WO2017147745A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/5014—Internet protocol [IP] addresses using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/11—Allocation or use of connection identifiers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a method, system, and related device for authenticating an Access Point (AP).
  • AP Access Point
  • Wireless Local Area Network is currently widely used in home gateways and enterprise networks.
  • Carrier-grade WLANs are now scaled to provide WLAN broadband services in support of WLAN-enabled terminals in outdoor environments.
  • the terminal can access the broadband network by selecting the SSID by searching for the Service Set Identifier (SSID) of the available WLAN.
  • SSID Service Set Identifier
  • phishing access point (AP) hotspots are usually disguised as carrier hotspots or are set to open WLAN systems. If the terminal uses the WLAN system provided by the phishing AP hotspot, the phishing AP hotspot will intercept the sent by the terminal. Sensitive information, causing losses to end users.
  • the phishing AP hotspot is pretending to be the same hotspot as the WLAN hotspot name CMCC-WEB of a certain mobile operator, and the power is large, the terminal automatically connects to the phishing AP hotspot, and the phishing AP hotspot is used without the terminal user's knowledge.
  • the embodiments of the present invention provide a method, a system, and a related device for authenticating an access point AP, which are used to improve the security of an AP that accesses the WLAN.
  • an embodiment of the present invention provides a method for authenticating an access point AP, where the method includes:
  • the terminal determines the AP feature according to a feature generation rule corresponding to the access point AP of the WLAN of the WLAN;
  • the terminal determines, according to the response message and the determined AP feature, whether the AP passes the authentication.
  • the terminal determines the AP feature according to the feature generation rule corresponding to the AP, and after sending the request message for requesting the AP feature to the AP, the terminal obtains the response message returned by the AP, and determines according to the response message returned by the AP and the determined AP feature. Whether the AP is authenticated or not can authenticate the legitimacy of the AP and improve the security of the AP hotspot where the terminal accesses the WLAN.
  • the terminal before the determining, by the terminal, the AP feature according to the feature generation rule corresponding to the access point AP of the WLAN, acquires the feature generation rule corresponding to the AP from the server for managing the AP.
  • unified management of feature generation rules corresponding to the AP is implemented by setting a server for managing the AP.
  • the terminal determines, according to the response message and the determined AP feature, whether the AP is authenticated or not.
  • the specific process is as follows: the terminal determines whether the response message includes an AP feature; if not, the terminal The terminal determines that the AP authentication fails; if yes, and the terminal determines that the AP feature included in the response message is the same as the determined AP feature, determining that the AP authentication passes.
  • the terminal determines that the AP feature included in the response message is different from the determined AP feature, the terminal determines that the AP authentication fails;
  • the terminal determines that the AP feature included in the response message is different from the determined AP feature, and determines that the duration of the update to the feature generation rule does not exceed a set threshold, determining, by the terminal, the AP included in the response message Whether the feature is the same as the AP feature determined according to the feature generation rule before the update, if the same, the AP authentication is determined to pass, otherwise, the AP authentication is determined to have failed.
  • the AP feature included in the response message is determined by the server for managing the AP according to the feature generation rule corresponding to the AP, and then configured to the AP.
  • the AP feature is directly configured for the AP by the server for managing the AP, which simplifies the computational complexity on the AP side and improves data transmission efficiency.
  • the AP feature included in the response message is determined by the AP according to a feature generation rule corresponding to the AP configured by the server for managing the AP.
  • the feature generation rule corresponding to the AP is configured by the server for managing the AP, and the security can be further improved.
  • the terminal sends a request message requesting the AP feature to the AP, and obtains a response message that is returned by the AP according to the request message, where the specific process is as follows: the terminal sends a probe to the AP. a request frame, the frame body of the probe request frame carries a special service set identifier SSID, where the special SSID is used to request the AP to provide an AP feature; the terminal receives a probe response frame returned by the AP, and the probe response The frame body of the frame includes the special SSID and the supported rate field corresponding to the special SSID, where the supported rate field corresponding to the special SSID carries the AP feature provided by the AP or is empty.
  • the AP feature can be acquired from the AP by using the existing probe request frame and the probe response frame, and the frame structure of the existing probe request frame and the probe response frame need not be modified.
  • the terminal sends a request message requesting the AP feature to the AP, and obtains a response message that is returned by the AP according to the request message, where the specific process is as follows: the terminal sends a dynamic to the AP.
  • the host configures a protocol DHCP message, where the DHCP message includes an option extension field that is a preset value, and the option extension field that is a preset value is used to request the AP to provide an AP feature;
  • the DHCP response packet returned by the AP where the DHCP response packet is an AP feature that is provided in the option extension field of the preset value and is provided by the AP or is null.
  • the AP feature can be obtained from the AP by using the existing dynamic host configuration protocol DHCP message, and the packet structure does not need to be modified.
  • the feature generation rule corresponding to the AP is updated by the server for managing the AP.
  • the feature generation rule corresponding to the AP is updated by a server for managing the AP, thereby further improving security.
  • the embodiment of the present invention further provides a method for authenticating an access point AP, where the method includes:
  • the access point AP of the WLAN WLAN receives the request sent by the terminal to provide the AP feature. Request message
  • the AP returns a response message to the terminal according to the request message.
  • the AP returns a response message to the terminal according to the request of the terminal to provide the AP feature, and the terminal determines whether the AP passes the authentication according to the response message and the AP feature determined by the feature generation rule corresponding to the AP, so that the AP can The legality of the AP is authenticated, which improves the security of the AP hotspot where the terminal accesses the WLAN.
  • the AP receives an AP feature for managing a server configuration of the AP.
  • the AP feature is directly configured for the AP by the server for managing the AP, which simplifies the computational complexity on the AP side and improves data transmission efficiency.
  • the AP receives a feature generation rule for managing a server configuration of the AP, and determines an AP feature according to the feature generation rule.
  • the feature generation rule is configured for the AP by the server for managing the AP, and the security can be further improved.
  • the AP receives a probe request frame sent by the terminal, where a frame body of the probe request frame carries a special service set identifier SSID, where the special SSID is used to request the AP to provide an AP feature;
  • a probe response frame to the terminal, where the frame body of the probe response frame carries the special SSID and the information carried in the supported rate field corresponding to the special SSID, where the special SSID corresponds to
  • the supported rate field carries the AP feature provided by the AP or is empty.
  • the AP feature can be acquired from the AP by using the existing probe request frame and the probe response frame, and the frame structure of the existing probe request frame and the probe response frame need not be modified.
  • the AP receives a dynamic host configuration protocol DHCP message sent by the terminal, where the DHCP message includes an option extension field whose value is a preset value, and the value is an option of a preset value.
  • the extension field is used to request the AP to provide an AP feature, and the AP returns a DHCP response message to the terminal, where the DHCP response message carries the value in the option extension field of the preset value.
  • the AP feature provided by the AP is either empty. In this embodiment, the AP feature can be obtained from the AP by using the existing dynamic host configuration protocol DHCP message, and the packet structure does not need to be modified.
  • the embodiment of the present invention further provides a WLAN authentication system for a wireless local area network, including:
  • the terminal is configured to determine an AP feature according to a feature generation rule corresponding to the access point AP of the WLAN of the WLAN, send a request message requesting the AP feature to the AP, and obtain a response message returned by the AP according to the request message. Determining, according to the response message and the determined AP feature, whether the AP is authenticated or not;
  • the AP is configured to receive a request message that is sent by the terminal and request an AP feature, and return the response message to the terminal according to the request message.
  • the terminal determines the AP feature according to the feature generation rule corresponding to the AP, and after sending the request message for requesting the AP feature to the AP, the terminal obtains the response message returned by the AP, and determines according to the response message returned by the AP and the determined AP feature. Whether the AP is authenticated or not can authenticate the legitimacy of the AP and improve the security of the AP hotspot where the terminal accesses the WLAN.
  • the WLAN authentication system further includes a server for managing the AP, and is configured to provide the terminal with a feature generation rule corresponding to the AP.
  • a server for managing the AP is configured to provide the terminal with a feature generation rule corresponding to the AP.
  • unified management of feature generation rules corresponding to the AP is implemented by setting a server for managing the AP.
  • the WLAN authentication system further includes a server for managing the AP, configured to configure an AP feature for the AP.
  • the AP feature is directly configured for the AP by the server for managing the AP, which simplifies the computational complexity on the AP side and improves data transmission efficiency.
  • the WLAN authentication system further includes a server for managing the AP, where the server for managing the AP is configured to configure a feature generation rule for the AP;
  • the AP feature is determined according to the feature generation rule of the server configuration for managing the AP.
  • the feature generation rule corresponding to the AP is configured by a server for managing the AP, so that security can be further improved.
  • the embodiment of the present invention further provides a terminal, including:
  • a processing module configured to generate a feature corresponding to an access point AP of a WLAN of a wireless local area network Rules determine AP characteristics
  • a communication module configured to send a request message requesting the AP feature to the AP, and obtain a response message returned by the AP according to the request message;
  • an authentication module configured to determine, according to the response message that is obtained by the communication module, and the AP feature that is determined by the processing module, whether the AP is authenticated or not.
  • the terminal determines the AP feature according to the feature generation rule corresponding to the AP, and after sending the request message for requesting the AP feature to the AP, the terminal obtains the response message returned by the AP, and determines according to the response message returned by the AP and the determined AP feature. Whether the AP is authenticated or not can authenticate the legitimacy of the AP and improve the security of the AP hotspot where the terminal accesses the WLAN.
  • the communication module acquires a feature generation rule corresponding to the AP from a server for managing the AP.
  • unified management of feature generation rules corresponding to the AP is implemented by setting a server for managing the AP.
  • the authentication module determines whether the AP message is included in the response message; if not, determines that the AP authentication fails; if yes, and determines an AP feature included in the response message and the The determined AP features are the same, and the AP authentication is determined to pass.
  • the authentication module determines that the AP feature included in the response message is different from the determined AP feature, determining that the AP authentication fails;
  • the authentication module determines that the AP feature included in the response message is different from the determined AP feature, and determines that the duration of the update to the feature generation rule does not exceed a set threshold, determining that the response message includes Whether the AP feature is the same as the AP feature determined according to the feature generation rule before the update. If the AP feature is the same, the AP authentication is determined to pass. Otherwise, the AP authentication fails.
  • the AP feature included in the response message is determined by the server for managing the AP according to the feature generation rule corresponding to the AP, and then configured to the AP.
  • the AP feature is directly configured for the AP by the server for managing the AP, which simplifies the computational complexity on the AP side and improves data transmission efficiency.
  • the AP feature included in the response message is determined by the AP according to a feature generation rule corresponding to the AP configured by the server for managing the AP.
  • the feature generation rule corresponding to the AP is configured by a server for managing the AP, so that security can be further improved.
  • the communication module sends a probe request frame to the AP, where the frame body of the probe request frame carries a special service set identifier SSID, where the special SSID is used to request the AP to provide an AP feature;
  • the communication module receives the probe response frame returned by the AP, where the frame body of the probe response frame includes the special SSID and a supported rate field corresponding to the special SSID, where the special SSID is supported by The rate field carries the AP feature provided by the AP or is empty.
  • the AP feature can be acquired from the AP by using the existing probe request frame and the probe response frame, and the frame structure of the existing probe request frame and the probe response frame need not be modified.
  • the communication module sends a dynamic host configuration protocol (DHCP) message to the AP, where the DHCP message includes an option extension field that is a preset value, and the value is an option of a preset value.
  • the extension field is configured to request the AP to provide an AP feature, and the communication module receives the DHCP response packet returned by the AP, where the DHCP response packet is carried in an option extension field of the preset value.
  • the AP feature provided by the AP is either empty. In this embodiment, the AP feature can be obtained from the AP by using the existing dynamic host configuration protocol DHCP message, and the packet structure does not need to be modified.
  • the feature generation rule corresponding to the AP is updated by the server for managing the AP.
  • the feature generation rule corresponding to the AP is updated by a server for managing the AP, thereby further improving security.
  • an embodiment of the present invention further provides an access point AP, including:
  • a receiving module configured to receive a request message sent by the terminal to provide an AP feature
  • a sending module configured to return a response message to the terminal according to the request message received by the receiving module.
  • the AP returns a response message to the terminal according to the request of the terminal to provide the AP feature, and the terminal determines whether the AP passes the authentication according to the response message and the AP feature determined by the feature generation rule corresponding to the AP, so that the AP can The legality of the AP is authenticated, which improves the security of the AP hotspot where the terminal accesses the WLAN.
  • the receiving module receives an AP feature for managing a server configuration of the AP.
  • the AP feature is directly configured for the AP by the server for managing the AP, which simplifies the computational complexity on the AP side and improves data transmission efficiency.
  • the receiving module receives a feature generation rule for managing a server configuration of the AP, and further includes a processing module, configured to determine an AP feature according to the feature generation rule received by the receiving module.
  • the feature generation rule is configured for the AP by the server for managing the AP, and the security can be further improved.
  • the receiving module receives a probe request frame sent by the terminal, where a frame body of the probe request frame carries a special service set identifier SSID, where the special SSID is used to request the AP to provide an AP feature.
  • the sending module returns a probe response frame to the terminal, where the frame body of the probe response frame carries the special SSID and the information carried in the supported rate field corresponding to the special SSID, where the special SSID
  • the corresponding supported rate field carries the AP feature provided by the AP or is empty.
  • the AP feature can be acquired from the AP by using the existing probe request frame and the probe response frame, and the frame structure of the existing probe request frame and the probe response frame need not be modified.
  • the receiving module receives a dynamic host configuration protocol (DHCP) message sent by the terminal, where the DHCP message includes an option extension field that is a preset value, where the value is a preset value.
  • the option extension field is configured to request the AP to provide an AP feature, and the sending module returns a DHCP response message to the terminal, where the DHCP response message is carried in an option extension field of the preset value.
  • the AP feature provided by the AP is either empty. In this embodiment, the AP feature can be obtained from the AP by using the existing dynamic host configuration protocol DHCP message, and the packet structure does not need to be modified.
  • an embodiment of the present invention further provides a terminal, including a processor, a memory, and a transceiver, where the transceiver is configured to receive and transmit data under control of the processor, where the memory is saved.
  • a terminal including a processor, a memory, and a transceiver, where the transceiver is configured to receive and transmit data under control of the processor, where the memory is saved.
  • the processor reads a program saved in the memory, and executes the following process according to the program:
  • the terminal determines the AP feature according to the feature generation rule corresponding to the AP, and after sending the request message for requesting the AP feature to the AP, the terminal obtains the response message returned by the AP, and determines according to the response message returned by the AP and the determined AP feature. Whether the AP is authenticated or not can authenticate the legitimacy of the AP and improve the security of the AP hotspot where the terminal accesses the WLAN.
  • the processor acquires, by using the transceiver, a feature generation rule corresponding to the AP from a server for managing the AP.
  • a feature generation rule corresponding to the AP is implemented by setting a server for managing the AP.
  • the processor determines whether the AP message is included in the response message; if not, determines that the AP authentication fails; if yes, and determines an AP feature included in the response message and the The determined AP features are the same, and the AP authentication is determined to pass.
  • the processor determines that the AP feature included in the response message is different from the determined AP feature, determining that the AP authentication fails;
  • the AP authentication fails.
  • the AP feature included in the response message is determined by the server for managing the AP according to the feature generation rule corresponding to the AP, and then configured to the AP.
  • the AP feature is directly configured for the AP by the server for managing the AP, which simplifies the computational complexity on the AP side and improves data transmission efficiency.
  • the AP feature included in the response message is determined by the AP according to a feature generation rule corresponding to the AP configured by the server for managing the AP.
  • the feature generation rule corresponding to the AP is configured by a server for managing the AP, so that security can be further improved.
  • the processor sends a probe request frame to the AP by using the transceiver, where a frame body of the probe request frame carries a special service set identifier SSID, where the special SSID is used to request the AP Providing an AP feature; receiving, by the transceiver, a probe response frame returned by the AP, where the frame body of the probe response frame includes the special SSID and a supported rate field corresponding to the special SSID, where the The supported rate field corresponding to the special SSID carries the AP feature provided by the AP or is empty.
  • the AP feature can be acquired from the AP by using the existing probe request frame and the probe response frame, and the frame structure of the existing probe request frame and the probe response frame need not be modified.
  • the processor sends a dynamic host configuration protocol (DHCP) message to the AP by using the transceiver, where the DHCP message includes an option extension field whose value is a preset value, where the value is The option extension field of the preset value is used to request the AP to provide an AP feature, and the DHCP response message returned by the AP is received by the transceiver, where the DHCP response packet is an option of the preset value.
  • the AP feature provided in the extension field for the AP is either empty.
  • the AP feature can be obtained from the AP by using the existing dynamic host configuration protocol DHCP message, and the packet structure does not need to be modified.
  • the feature generation rule corresponding to the AP is updated by the server for managing the AP.
  • the feature generation rule corresponding to the AP is updated by a server for managing the AP, thereby further improving security.
  • an embodiment of the present invention further provides an access point AP, including a processor, a memory, and a transceiver, where the transceiver is configured to receive and send data under control of the processor, A preset program is stored in the memory, and the processor reads the program saved in the memory, and executes the following process according to the program:
  • the AP returns a response to the terminal according to the request message of the AP that provides the AP feature.
  • the terminal determines whether the AP passes the authentication according to the response message and the AP feature generated by the feature generation rule corresponding to the AP, so that the UE can authenticate the legitimacy of the AP and improve the security of the AP hotspot of the terminal accessing the WLAN. .
  • the processor receives, by the transceiver, an AP feature for managing a server configuration of the AP.
  • the AP feature is directly configured for the AP by the server for managing the AP, which simplifies the computational complexity on the AP side and improves data transmission efficiency.
  • the processor receives, by the transceiver, a feature generation rule for managing a server configuration of the AP; and determining an AP feature according to the feature generation rule received by the transceiver.
  • the feature generation rule is configured for the AP by the server for managing the AP, and the security can be further improved.
  • the processor receives, by using the transceiver, a probe request frame sent by the terminal, where a frame body of the probe request frame carries a special service set identifier SSID, where the special SSID is used to request the
  • the AP provides an AP feature
  • the probe sends a probe response frame to the terminal, where the frame body of the probe response frame carries the special SSID and the information carried in the supported rate field corresponding to the special SSID,
  • the supported rate field corresponding to the special SSID carries the AP feature provided by the AP or is empty.
  • the AP feature can be acquired from the AP by using the existing probe request frame and the probe response frame, and the frame structure of the existing probe request frame and the probe response frame need not be modified.
  • the processor receives, by using the transceiver, a dynamic host configuration protocol (DHCP) message sent by the terminal, where the DHCP message includes an option extension field that is a preset value, and the value is An option extension field that is a preset value is used to request the AP to provide an AP feature; and the transceiver returns a DHCP response message to the terminal, where the DHCP response message takes an option of the preset value.
  • the AP feature provided in the extension field for the AP is either empty.
  • the AP feature can be obtained from the AP by using the existing dynamic host configuration protocol DHCP message, and the packet structure does not need to be modified.
  • FIG. 1 is a schematic structural diagram of a system for authenticating an access point AP according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a method for a terminal to authenticate an AP according to an embodiment of the present invention
  • FIG. 3 is a schematic flowchart of a method for authenticating an AP's legality by a terminal according to an embodiment of the present disclosure
  • FIG. 4 is a schematic diagram of a process for a terminal to authenticate an AP in a specific scenario according to an embodiment of the present invention
  • FIG. 5 is a schematic structural diagram of a Probe Request Frame according to an embodiment of the present invention.
  • FIG. 6 is a schematic structural diagram of a Probe Response Frame according to an embodiment of the present invention.
  • FIG. 7 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 8 is a schematic structural diagram of an AP according to an embodiment of the present invention.
  • FIG. 9 is a schematic structural diagram of another terminal according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of another AP according to an embodiment of the present invention.
  • FIG. 1 is a schematic structural diagram of a system for authenticating an access point AP according to an embodiment of the present invention, where the system includes a terminal 11 and one or more APs 12 of the WLAN. Among them, the terminal has a WLAN communication function. Optionally, the system also includes a server 13 for managing one or more APs 12.
  • FIG. 2 a schematic flowchart of a method for authenticating an AP's legality by using a terminal is as follows:
  • Step 201 The terminal determines the AP feature according to the feature generation rule corresponding to the AP of the WLAN.
  • the feature generation rule corresponding to the AP may be any calculation method that can calculate an output parameter according to the specified input parameter, and the embodiment of the present invention does not limit the specific implementation form of the feature generation rule.
  • the feature generation rule sets the calculation rule and the input parameters used in the calculation. It is necessary to ensure that the feature generation rules are output under the same input parameters. The result is the same.
  • the feature generation rule is specifically: the preset password is combined with the SSID of the AP to obtain a new string, and the new string is the feature of the AP.
  • the feature generation rule is specifically: the result obtained by dividing the digital part included in the preset password by the ASCII code value of the SSID of the AP, as a feature of the AP.
  • the terminal there are multiple ways for the terminal to obtain the feature generation rule corresponding to the AP.
  • the following is a description of the two specific implementation modes. .
  • the terminal is pre-configured with a feature generation rule corresponding to the AP.
  • the terminal is pre-configured with a correspondence between the SSID of the AP and the feature generation rule.
  • the terminal after searching for the SSID of the AP, acquires the feature generation rule corresponding to the SSID of the AP from the corresponding relationship between the SSID of the pre-configured AP and the feature generation rule according to the SSID of the AP.
  • the feature generation rule corresponding to the AP of each operator may be configured when the terminal is shipped from the factory.
  • the AP side has the following two configurations:
  • the same feature generation rule as that on the AP is configured on the AP to ensure that the feature generation rules used by the terminal and the AP are the same.
  • the feature generation rule configured by the AP may be pre-configured at the factory or configured by a server for managing the AP.
  • the AP is configured to use the AP feature defined by the feature generation rule configured by the terminal to ensure that the AP feature provided by the AP is the same as the AP feature calculated by the terminal.
  • the AP feature configured by the AP may be pre-configured at the factory or configured by a server for managing the AP.
  • the terminal acquires a feature generation rule corresponding to the AP provided by the server for managing the AP.
  • the server for managing the AP In the configuration mode a, the server for managing the AP generates a feature generation rule corresponding to the managed AP, and configures the feature generation rule to the terminal and the managed AP.
  • the server for managing the AP selects a feature generation rule from the feature generation rule pool, and makes the selected feature generation rule take effect.
  • the server for managing the AP may periodically or irregularly update the feature generation rule corresponding to the AP, and configure the feature generation rule corresponding to the updated AP to the terminal and the managed AP.
  • the terminal After acquiring the feature generation rule corresponding to the updated AP provided by the server of the AP, the terminal updates the locally generated feature generation rule corresponding to the AP that is updated.
  • the AP managed by the server updates the locally saved feature generation rule by using the updated feature generation rule.
  • the server for managing the AP In the configuration mode b, the server for managing the AP generates a feature generation rule corresponding to the managed AP, and calculates an AP feature according to the feature generation rule, and configures the feature generation rule to the terminal, and configures the calculated AP feature to AP.
  • the server for managing the AP configures the AP feature to the managed AP through the trusted management network.
  • the server for managing the AP may periodically or irregularly update the feature generation rule corresponding to the AP, and configure the feature generation rule corresponding to the updated AP to the terminal, and generate a rule according to the feature corresponding to the updated AP.
  • the updated AP feature is calculated, and the AP feature of the AP is updated by using the updated AP feature.
  • the server for managing the APs configures the same feature generation rule or the same AP feature for the APs with the same SSID. .
  • Step 202 The terminal sends a request message requesting the AP feature to the AP, and obtains a response message returned by the AP according to the request message.
  • the specific implementation manner in which the terminal requests the AP to provide the AP feature and obtains the response message returned by the AP is not limited, and only the message that the terminal and the AP mutually agree to transmit and the parsing manner of the message can be implemented.
  • the manner of obtaining information related to the AP feature includes but is not limited to the following two types:
  • the terminal and the AP agree to use a Probe Request Frame and a Probe Response Frame.
  • the terminal sends a probe request frame to the AP, where the frame body of the probe request frame carries a special SSID, where the special SSID is used to request the AP to provide the AP feature; the terminal receives the probe response frame returned by the AP, and the frame of the probe response frame
  • the specific SSID and the supported rate (Support Rate) field corresponding to the special SSID are included in the body, where the supported rate field corresponding to the special SSID carries the AP feature provided by the AP or is empty.
  • the specific implementation does not need to change the communication mode between the existing terminal and the AP and the structure of the communication message. Only a special SSID needs to be agreed between the terminal and the AP, and the existing communication message between the terminal and the AP can be utilized.
  • the special SSID and the Support Rate pair implement the transmission of the AP feature.
  • the terminal and the AP use DHCP packets and DHCP response packets.
  • the terminal sends a dynamic host configuration protocol (DHCP) packet to the AP, where the DHCP packet includes an option extension field whose value is a preset value, and the value is an option of a preset value.
  • the extension field is used to request the AP to provide the AP feature; the terminal receives the DHCP response message returned by the AP, and the information carried in the Options extension field of the DHCP response message is the AP feature provided by the AP. Or empty.
  • DHCP dynamic host configuration protocol
  • the specific implementation does not need to change the communication mode between the existing terminal and the AP, and the structure of the communication message. Only an Option extension field of the DHCP message that is set to a preset value is required between the terminal and the AP.
  • the AP feature transmission is implemented by using the Options extension field in the existing DHCP message of the terminal and the AP.
  • Step 203 The terminal determines, according to the response message returned by the AP in step 202 and the AP feature determined in step 201, whether the AP passes the authentication.
  • the AP feature is an identifier used to characterize the legitimacy of the AP.
  • the terminal determines whether the response message returned by the AP includes the AP feature; if not, the terminal determines that the AP authentication fails; if yes, and the terminal determines that the AP returns a message message packet
  • the AP feature is the same as the AP feature determined by the terminal, and the AP authentication is determined to pass.
  • the terminal determines that the AP feature included in the response message returned by the AP is different from the determined AP feature, the terminal determines that the AP authentication fails.
  • the terminal determines that the AP feature included in the response message returned by the AP is different from the determined AP feature, and determines that the update is current.
  • the duration of the feature generation rule does not exceed the set threshold, and it is determined whether the AP feature included in the response message returned by the AP is the same as the AP feature determined according to the feature generation rule before the update. If the same, the AP authentication is determined to pass, otherwise, the determination is performed. The AP certification failed. This implementation can avoid judging errors in the critical situation caused by the feature generation rule switching.
  • the AP feature may be one or a combination of a number, a character string, and the like, and the AP feature is used to identify a trusted AP in the WLAN system.
  • the AP feature is "123456".
  • Figure 3 is a schematic flowchart of the method for authenticating the validity of the AP by using the terminal.
  • Step 301 The server for managing the AP generates a feature generation rule corresponding to the AP.
  • the feature generation rule corresponding to the AP is: multiplying the ASCII code corresponding to each character in the password agreed by the terminal and the server, and the current date and time. Multiply, taking the last 6 bits of the resulting product as the AP feature;
  • Step 302 The server for managing the AP calculates the AP feature by using a feature generation rule corresponding to the generated AP.
  • Step 303 The server for managing the AP configures the AP feature to each managed AP, and the server for managing the AP recalculates the AP feature according to the feature calculation rule at the daily zero point, and updates the configuration to each managed device.
  • AP characteristics of APs
  • Step 304 After the terminal passes the authentication, query the server for managing the AP to query the feature generation rule corresponding to the AP.
  • Step 305 The server for managing the AP returns a feature generation rule corresponding to the AP to the terminal.
  • Step 306 The terminal calculates an AP feature according to a feature generation rule corresponding to the AP provided by the server of the user management AP.
  • Step 307 The terminal accesses the AP, and requests the AP to provide the AP feature.
  • Step 308 The AP provides the AP feature to the terminal.
  • Step 309 The terminal determines whether the AP feature provided by the AP is consistent with the AP feature calculated in step 306. If the AP is not the same, the terminal determines that the AP is a phishing AP, and the authentication fails. If the AP is a valid AP, the authentication succeeds.
  • FIG. 4 is a schematic diagram of a terminal-to-AP authentication process in a specific scenario, where AP1 is a legal AP managed by a server for managing an AP, AP2 is a phishing AP, and AP2 is set to
  • the process of authenticating the terminal with the same SSID as AP1 is as follows:
  • the process of the AP1 is configured to provide the terminal with the feature generation rule corresponding to the AP1, and the process for configuring the AP1 to configure the AP feature for the AP1, as described in steps 301 to 306.
  • the process is exactly the same and will not be repeated here.
  • the process of authenticating AP1 and AP2 by the terminal is as follows:
  • Step 407 The terminal accesses AP1, and requests AP1 to provide an AP feature.
  • Step 408 The terminal obtains the AP feature returned by the AP1.
  • Step 409 The terminal determines that the AP feature provided by the AP1 is consistent with the AP feature calculated in step 406, and the AP1 authentication is determined, that is, the AP1 is determined to be a trusted AP.
  • Step 410 The terminal accesses AP2, and requests AP2 to provide an AP feature.
  • Step 411 The terminal obtains information returned by the AP2.
  • Step 412 If the terminal determines that the AP2 does not return the AP feature, or determines that the AP feature returned by the AP2 is inconsistent with the AP feature calculated in step 406, it is determined that the AP2 authentication fails, that is, the AP2 is determined to be an untrusted AP, that is, the phishing AP.
  • the terminal is implemented by using a Probe Request Frame of the WLAN underlying protocol and an extended field in the Probe Response Frame, specifically: adding an SSID to the Frame Body part of the Probe Request Frame. Supported Rate Pair.
  • the terminal sends a Probe Request Frame to the AP, and carries a random value in the Supported Rate field in the extended SSID and Supported Rate pairs in the frame of the Probe Request Frame.
  • the AP returns a Probe Response Frame to the terminal and is in the Probe Response Frame frame.
  • FIG. 5 is a schematic structural diagram of a WLAN underlying protocol Probe Request Frame
  • FIG. 6 is a schematic structural diagram of a WLAN underlying protocol Probe Response Frame.
  • the steps 407 to 408 can also be implemented by using an option extension field in the underlying DHCP message of the TCP/IP.
  • the options extension field in the DHCP message can be used to store control information that is not defined in the common protocol.
  • the parameter is specifically: an option extension field is defined in the DHCP message, and the terminal and the AP agree to use the field to transmit the value of the AP feature.
  • the terminal sends a DHCP message to the AP, and an options extension field in the DHCP message is a preset value, for example, 250; the AP returns a DHCP response message to the terminal, and the DHCP response message is in the options extension field corresponding to the preset value.
  • the value of the AP feature is carried in the terminal.
  • the terminal receives the DHCP response packet returned by the AP, and obtains the value of the AP feature carried in the options extension field corresponding to the preset value in the DHCP response packet.
  • the terminal mainly includes:
  • the processing module 701 is configured to determine an AP feature according to a feature generation rule corresponding to the access point AP of the WLAN of the WLAN;
  • the communication module 702 is configured to send a request message for requesting the AP feature to the AP, and obtain a response message that is returned by the AP according to the request message;
  • the authentication module 703 is configured to determine, according to the response message that is obtained by the communication module 702 and the AP feature that is determined by the processing module 701, whether the AP is authenticated or not.
  • processing module 701 refers to the specific description of the step 201 in the foregoing method embodiment.
  • communication module 702 refers to the specific description of the step 202 in the foregoing method embodiment.
  • a detailed description of the method embodiment section regarding step 203 will not be described in detail herein.
  • the AP mainly includes:
  • the receiving module 801 is configured to receive a request message sent by the terminal to request an AP feature.
  • the sending module 802 is configured to return a response message to the terminal according to the request message received by the receiving module 801.
  • a processing module 803 is also included.
  • the receiving module 801 is configured to receive an AP feature sent by a server for managing the AP
  • the processing module 803 is configured to save the AP feature received by the receiving module 801.
  • the processing module 803 is configured to obtain the saved AP feature according to the request message received by the receiving module 801, and return the AP feature to the terminal by using the sending module 802.
  • the receiving module 801 is configured to receive a feature generation rule sent by a server for managing the AP; the processing module determines an AP feature according to a feature generation rule received by the receiving module, and saves the AP feature.
  • the processing module 803 is configured to obtain the saved AP feature according to the request message received by the receiving module 801, and return the AP feature to the terminal by using the sending module 802.
  • the embodiment of the present invention further provides another terminal.
  • the terminal mainly includes processing.
  • the processor is used to implement the processing module 701 and the authentication module 703 of the terminal shown in FIG. 7 .
  • the functions described, the transceiver implements the functions of the communication module 702 of the terminal shown in FIG. 7 under the control of the processor, and will not be described in detail herein.
  • the AP mainly includes The processor 1001, the memory 1002, and the transceiver 1003, wherein the transceiver 1003 is configured to receive and transmit data under the control of the processor 1001, the memory 1002 stores a preset program, and the processor 1001 reads the saved in the memory 1002.
  • Program according to the program to perform the following process:
  • the transceiver 1003 is instructed to return a response message to the terminal according to the request message.
  • the processor is configured to control the transceiver 1003 to complete the functions of the receiving module and the sending module shown in FIG. 7, and details are not described herein.
  • the processor, the memory, and the transceiver may be connected by a bus, and the bus architecture may include any number of interconnected buses and bridges, specifically one or more represented by the processor.
  • the various circuits of the memory represented by the processor and memory are linked together.
  • the bus architecture can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and, therefore, will not be further described herein.
  • the bus interface provides an interface.
  • the transceiver can be a plurality of components, including a transmitter and a transceiver, providing means for communicating with various other devices on a transmission medium.
  • the processor is responsible for managing the bus architecture and the usual processing, and the memory can store the data that the processor uses when performing operations.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It should be understood that the flow chart can be implemented by computer program instructions And/or a combination of the processes and/or blocks in the block diagrams, and the flowcharts and/or blocks in the flowcharts. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Small-Scale Networks (AREA)

Abstract

一种对接入点AP的认证方法、系统及相关设备，用以提高终端接入WLAN的AP的安全性。该方法为：终端根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特征；所述终端向所述AP发送请求提供AP特征的请求消息，并获取所述AP根据所述请求消息返回的响应消息；所述终端根据所述响应消息以及确定的AP特征判断所述AP是否认证通过。

Description

一种对接入点AP的认证方法、系统及相关设备 技术领域
本发明涉及通信技术领域，尤其涉及一种对接入点(Access Point，AP)的认证方法、系统及相关设备。
背景技术
无线局域网络(Wireless Local Area Network，WLAN)当前广泛应用于家庭网关以及企业网络。现在运营级WLAN已经形成规模，在室外环境中为了支持具有WLAN功能的终端提供WLAN宽带服务。
终端通过搜索可用WLAN的服务集标识(Service Set Identifier，SSID)，通过选择SSID即可接入宽带网络。
目前，一些钓鱼接入点(Access Point，AP)热点通常伪装成运营商热点或者设置为开放的WLAN系统，如果终端使用该钓鱼AP热点提供的WLAN系统，该钓鱼AP热点将会截获终端发送的敏感信息，对终端用户造成损失。
例如，钓鱼AP热点伪装为与某移动运营商的WLAN热点名称CMCC-WEB一样的热点，并且功率较大，终端自动连接该钓鱼AP热点，在终端用户不知情的情况下使用该钓鱼AP热点。
发明内容
本发明实施例提供一种对接入点AP的认证方法、系统及相关设备，用以提高终端接入WLAN的AP的安全性。
本发明实施例提供的具体技术方案如下：
第一方面，本发明实施例提供了一种对接入点AP的认证方法，该方法包括：
终端根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特征；
所述终端向所述AP发送请求提供AP特征的请求消息，并获取所述AP根据所述请求消息返回的响应消息；
所述终端根据所述响应消息以及确定的AP特征判断所述AP是否认证通过。
该实施例中，终端根据AP对应的特征生成规则确定AP特征，向AP发送请求提供AP特征的请求消息后，获取该AP返回的响应消息，根据该AP返回的响应消息以及确定的AP特征判断该该AP是否认证通过，从而能够对AP的合法性进行认证，提高了终端接入WLAN的AP热点的安全性。
可能的实施方式中，所述终端根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特征之前，从用于管理所述AP的服务器获取所述AP对应的特征生成规则。该实施方式中，通过设置用于管理所述AP的服务器实现对AP对应的特征生成规则的统一管理。
可能的实施方式中，所述终端根据所述响应消息以及确定的AP特征判断所述AP是否认证通过，具体过程如下：所述终端判断所述响应消息中是否包含AP特征；若不包含，所述终端确定所述AP认证未通过；若包含，且所述终端确定所述响应消息中包含的AP特征与所述确定的AP特征相同，确定所述AP认证通过。
可能的实施方式中，所述终端若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，确定所述AP认证未通过；或者，
所述终端若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，且确定更新为所述特征生成规则的时长未超过设定阈值，判断所述响应消息中包含的AP特征与根据更新之前的特征生成规则确定的AP特征是否相同，若相同，确定所述AP认证通过，否则，确定所述AP认证未通过。
可能的实施方式中，所述响应消息中包含的AP特征，由所述用于管理所述AP的服务器根据所述AP对应的特征生成规则确定后配置给所述AP。该实施方式中，由用于管理所述AP的服务器直接为AP配置AP特征，可以简化AP侧的计算复杂度，提高数据传输效率。
可能的实施方式中，所述响应消息中包含的AP特征，由所述AP根据所述用于管理所述AP的服务器配置的所述AP对应的特征生成规则确定。该实施方式中，由用于管理所述AP的服务器配置所述AP对应的特征生成规则，可以进一步提高安全性。
可能的实施方式中，所述终端向所述AP发送请求提供AP特征的请求消息，并获取所述AP根据所述请求消息返回的响应消息，具体过程如下：所述终端向所述AP发送探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；所述终端接收所述AP返回的探测响应帧，所述探测响应帧的帧体中包括所述特殊SSID以及所述特殊SSID对应的所支持的速率字段，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。该实施方式，利用现有的探测请求帧和探测响应帧即可从AP获取AP特征，并且无需对现有的探测请求帧和探测响应帧的帧结构进行修改。
可能的实施方式中，所述终端向所述AP发送请求提供AP特征的请求消息，并获取所述AP根据所述请求消息返回的响应消息，具体过程如下：所述终端向所述AP发送动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；所述终端接收所述AP返回的DHCP响应报文，所述DHCP响应报文中取值为所述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。该实施方式中，利用现有的动态主机配置协议DHCP报文即可从AP获取AP特征，并且无需对报文结构进行修改。
可能的实施方式中，所述AP对应的特征生成规则由所述用于管理所述AP的服务器更新。该实施方式中，由用于管理所述AP的服务器更新所述AP对应的特征生成规则，进一步提高安全性。
第二方面，本发明实施例还提供了一种对接入点AP的认证方法，该方法包括：
无线局域网络WLAN的接入点AP接收终端发送的请求提供AP特征的 请求消息；
所述AP根据所述请求消息向所述终端返回响应消息。
该实施例中，AP根据终端的请求提供AP特征的请求消息向终端返回响应消息，由终端根据该响应消息以及根据AP对应的特征生成规则生成确定的AP特征判断AP是否认证通过，从而能够对AP的合法性进行认证，提高了终端接入WLAN的AP热点的安全性。
可能的实施方式中，所述AP接收用于管理所述AP的服务器配置的AP特征。该实施方式中，由用于管理所述AP的服务器直接为AP配置AP特征，可以简化AP侧的计算复杂度，提高数据传输效率。
可能的实施方式中，所述AP接收用于管理所述AP的服务器配置的特征生成规则，并根据所述特征生成规则确定AP特征。该实施方式中，由用于管理所述AP的服务器为AP配置特征生成规则，可进一步提高安全性。
可能的实施方式中，所述AP接收所述终端发送的探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；所述AP向所述终端返回探测响应帧，所述探测响应帧的帧体中携带所述特殊SSID以及所述特殊SSID对应的所支持的速率字段中携带的信息，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。该实施方式中，利用现有的探测请求帧和探测响应帧即可从AP获取AP特征，并且无需对现有的探测请求帧和探测响应帧的帧结构进行修改。
可能的实施方式中，所述AP接收所述终端发送的动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；所述AP向所述终端返回DHCP响应报文，所述DHCP响应报文中取值为所述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。该实施方式中，利用现有的动态主机配置协议DHCP报文即可从AP获取AP特征，并且无需对报文结构进行修改。
第三方面，本发明实施例还提供了一种无线局域网络WLAN认证系统，包括：
终端，用于根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特征，向所述AP发送请求提供AP特征的请求消息，并获取所述AP根据所述请求消息返回的响应消息，根据所述响应消息以及确定的AP特征判断所述AP是否认证通过；
所述AP，用于接收所述终端发送的请求提供AP特征的请求消息，根据所述请求消息向所述终端返回所述响应消息。
该实施例中，终端根据AP对应的特征生成规则确定AP特征，向AP发送请求提供AP特征的请求消息后，获取该AP返回的响应消息，根据该AP返回的响应消息以及确定的AP特征判断该该AP是否认证通过，从而能够对AP的合法性进行认证，提高了终端接入WLAN的AP热点的安全性。
可能的实施方式中，所述WLAN认证系统还包括用于管理所述AP的服务器，用于为所述终端提供所述AP对应的特征生成规则。该实施方式中，通过设置用于管理所述AP的服务器实现对AP对应的特征生成规则的统一管理。
可能的实施方式中，所述WLAN认证系统还包括用于管理所述AP的服务器，用于为所述AP配置AP特征。该实施方式中，由用于管理所述AP的服务器直接为AP配置AP特征，可以简化AP侧的计算复杂度，提高数据传输效率。
可能的实施方式中，所述WLAN认证系统还包括用于管理所述AP的服务器，所述用于管理所述AP的服务器，用于为所述AP配置特征生成规则；所述AP，还用于根据所述用于管理所述AP的服务器配置的特征生成规则确定AP特征。该实施方式中，由用于管理所述AP的服务器配置所述所述AP对应的特征生成规则，可以进一步提高安全性。
第四方面，本发明实施例还提供了一种终端，包括：
处理模块，用于根据无线局域网络WLAN的接入点AP对应的特征生成 规则确定AP特征；
通信模块，用于向所述AP发送请求提供AP特征的请求消息，并获取所述AP根据所述请求消息返回的响应消息；
认证模块，用于根据所述通信模块获取的所述响应消息以及所述处理模块确定的AP特征判断所述AP是否认证通过。
该实施例中，终端根据AP对应的特征生成规则确定AP特征，向AP发送请求提供AP特征的请求消息后，获取该AP返回的响应消息，根据该AP返回的响应消息以及确定的AP特征判断该该AP是否认证通过，从而能够对AP的合法性进行认证，提高了终端接入WLAN的AP热点的安全性。
可能的实施方式中，所述通信模块从用于管理所述AP的服务器获取所述AP对应的特征生成规则。该实施方式中，通过设置用于管理所述AP的服务器实现对AP对应的特征生成规则的统一管理。
可能的实施方式中，所述认证模块判断所述响应消息中是否包含AP特征；若不包含，确定所述AP认证未通过；若包含，且确定所述响应消息中包含的AP特征与所述确定的AP特征相同，确定所述AP认证通过。
可能的实施方式中，所述认证模块若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，确定所述AP认证未通过；或者，
所述认证模块若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，且确定更新为所述特征生成规则的时长未超过设定阈值，判断所述响应消息中包含的AP特征与根据更新之前的特征生成规则确定的AP特征是否相同，若相同，确定所述AP认证通过，否则，确定所述AP认证未通过。
可能的实施方式中，所述响应消息中包含的AP特征，由所述用于管理所述AP的服务器根据所述AP对应的特征生成规则确定后配置给所述AP。该实施方式中，由用于管理所述AP的服务器直接为AP配置AP特征，可以简化AP侧的计算复杂度，提高数据传输效率。
可能的实施方式中，所述响应消息中包含的AP特征，由所述AP根据所述用于管理所述AP的服务器配置的所述AP对应的特征生成规则确定。该实 施方式中，由用于管理所述AP的服务器配置所述AP对应的特征生成规则，可以进一步提高安全性。
可能的实施方式中，所述通信模块向所述AP发送探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；所述通信模块接收所述AP返回的探测响应帧，所述探测响应帧的帧体中包括所述特殊SSID以及所述特殊SSID对应的所支持的速率字段，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。该实施方式，利用现有的探测请求帧和探测响应帧即可从AP获取AP特征，并且无需对现有的探测请求帧和探测响应帧的帧结构进行修改。
可能的实施方式中，所述通信模块向所述AP发送动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；所述通信模块接收所述AP返回的DHCP响应报文，所述DHCP响应报文中取值为所述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。该实施方式中，利用现有的动态主机配置协议DHCP报文即可从AP获取AP特征，并且无需对报文结构进行修改。
可能的实施方式中，所述AP对应的特征生成规则由所述用于管理所述AP的服务器更新。该实施方式中，由用于管理所述AP的服务器更新所述AP对应的特征生成规则，进一步提高安全性。
第五方面，本发明实施例还提供了一种接入点AP，包括：
接收模块，用于接收终端发送的请求提供AP特征的请求消息；
发送模块，用于根据所述接收模块接收的所述请求消息向所述终端返回响应消息。
该实施例中，AP根据终端的请求提供AP特征的请求消息向终端返回响应消息，由终端根据该响应消息以及根据AP对应的特征生成规则生成确定的AP特征判断AP是否认证通过，从而能够对AP的合法性进行认证，提高了终端接入WLAN的AP热点的安全性。
可能的实施方式中，所述接收模块接收用于管理所述AP的服务器配置的AP特征。该实施方式中，由用于管理所述AP的服务器直接为AP配置AP特征，可以简化AP侧的计算复杂度，提高数据传输效率。
可能的实施方式中，所述接收模块接收用于管理所述AP的服务器配置的特征生成规则；还包括处理模块，用于根据所述接收模块接收的所述特征生成规则确定AP特征。该实施方式中，由用于管理所述AP的服务器为AP配置特征生成规则，可进一步提高安全性。
可能的实施方式中，所述接收模块接收所述终端发送的探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；所述发送模块向所述终端返回探测响应帧，所述探测响应帧的帧体中携带所述特殊SSID以及所述特殊SSID对应的所支持的速率字段中携带的信息，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。该实施方式中，利用现有的探测请求帧和探测响应帧即可从AP获取AP特征，并且无需对现有的探测请求帧和探测响应帧的帧结构进行修改。
可能的实施方式中，所述接收模块接收所述终端发送的动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；所述发送模块向所述终端返回DHCP响应报文，所述DHCP响应报文中取值为所述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。该实施方式中，利用现有的动态主机配置协议DHCP报文即可从AP获取AP特征，并且无需对报文结构进行修改。
第六方面，本发明实施例还提供了一种终端，包括处理器、存储器和收发机，其中，所述收发机用于在所述处理器的控制下接收和发送数据，所述存储器中保存有预设的程序，所述处理器读取所述存储器中保存的程序，按照该程序执行以下过程：
根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特 征；
通过所述收发机向所述AP发送请求提供AP特征的请求消息，并通过所述收发机获取所述AP根据所述请求消息返回的响应消息；
根据所述AP返回的响应消息以及确定的AP特征判断所述AP是否认证通过。
该实施例中，终端根据AP对应的特征生成规则确定AP特征，向AP发送请求提供AP特征的请求消息后，获取该AP返回的响应消息，根据该AP返回的响应消息以及确定的AP特征判断该该AP是否认证通过，从而能够对AP的合法性进行认证，提高了终端接入WLAN的AP热点的安全性。
可能的实施方式中，所述处理器通过所述收发机从用于管理所述AP的服务器获取所述AP对应的特征生成规则。该实施方式中，通过设置用于管理所述AP的服务器实现对AP对应的特征生成规则的统一管理。
可能的实施方式中，所述处理器判断所述响应消息中是否包含AP特征；若不包含，确定所述AP认证未通过；若包含，且确定所述响应消息中包含的AP特征与所述确定的AP特征相同，确定所述AP认证通过。
可能的实施方式中，所述处理器若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，确定所述AP认证未通过；或者，
若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，且确定更新为所述特征生成规则的时长未超过设定阈值，判断所述响应消息中包含的AP特征与根据更新之前的特征生成规则确定的AP特征是否相同，若相同，确定所述AP认证通过，否则，确定所述AP认证未通过。
可能的实施方式中，所述响应消息中包含的AP特征，由所述用于管理所述AP的服务器根据所述AP对应的特征生成规则确定后配置给所述AP。该实施方式中，由用于管理所述AP的服务器直接为AP配置AP特征，可以简化AP侧的计算复杂度，提高数据传输效率。
可能的实施方式中，所述响应消息中包含的AP特征，由所述AP根据所述用于管理所述AP的服务器配置的所述AP对应的特征生成规则确定。该实 施方式中，由用于管理所述AP的服务器配置所述AP对应的特征生成规则，可以进一步提高安全性。
可能的实施方式中，所述处理器通过所述收发机向所述AP发送探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；通过所述收发机接收所述AP返回的探测响应帧，所述探测响应帧的帧体中包括所述特殊SSID以及所述特殊SSID对应的所支持的速率字段，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。该实施方式，利用现有的探测请求帧和探测响应帧即可从AP获取AP特征，并且无需对现有的探测请求帧和探测响应帧的帧结构进行修改。
可能的实施方式中，所述处理器通过所述收发机向所述AP发送动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；通过所述收发机接收所述AP返回的DHCP响应报文，所述DHCP响应报文中取值为所述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。该实施方式中，利用现有的动态主机配置协议DHCP报文即可从AP获取AP特征，并且无需对报文结构进行修改。
可能的实施方式中，所述AP对应的特征生成规则由所述用于管理所述AP的服务器更新。该实施方式中，由用于管理所述AP的服务器更新所述AP对应的特征生成规则，进一步提高安全性。
第七方面，本发明实施例还提供了一种接入点AP，包括处理器、存储器和收发机，其中，所述收发机用于在所述处理器的控制下接收和发送数据，所述存储器中保存有预设的程序，所述处理器读取所述存储器中保存的程序，按照该程序执行以下过程：
通过所述收发机接收终端发送的请求提供AP特征的请求消息；
根据所述请求消息指示所述收发机向所述终端返回响应消息。
该实施例中，AP根据终端的请求提供AP特征的请求消息向终端返回响 应消息，由终端根据该响应消息以及根据AP对应的特征生成规则生成确定的AP特征判断AP是否认证通过，从而能够对AP的合法性进行认证，提高了终端接入WLAN的AP热点的安全性。
可能的实施方式中，所述处理器通过所述收发机接收用于管理所述AP的服务器配置的AP特征。该实施方式中，由用于管理所述AP的服务器直接为AP配置AP特征，可以简化AP侧的计算复杂度，提高数据传输效率。
可能的实施方式中，所述处理器通过所述收发机接收用于管理所述AP的服务器配置的特征生成规则；根据通过所述收发机接收的所述特征生成规则确定AP特征。该实施方式中，由用于管理所述AP的服务器为AP配置特征生成规则，可进一步提高安全性。
可能的实施方式中，所述处理器通过所述收发机接收所述终端发送的探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；通过所述收发机向所述终端返回探测响应帧，所述探测响应帧的帧体中携带所述特殊SSID以及所述特殊SSID对应的所支持的速率字段中携带的信息，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。该实施方式中，利用现有的探测请求帧和探测响应帧即可从AP获取AP特征，并且无需对现有的探测请求帧和探测响应帧的帧结构进行修改。
可能的实施方式中，所述处理器通过所述收发机接收所述终端发送的动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；通过所述收发机向所述终端返回DHCP响应报文，所述DHCP响应报文中取值为所述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。该实施方式中，利用现有的动态主机配置协议DHCP报文即可从AP获取AP特征，并且无需对报文结构进行修改。
附图说明
图1为本发明实施例中对接入点AP认证的系统架构示意图；
图2为本发明实施例中终端对AP进行认证的方法流程示意图；
图3为本发明实施例中终端对AP的合法性进行认证的方法流程示意图；
图4为本发明实施例中为特定场景下终端对AP认证的过程示意图；
图5为本发明实施例中Probe Request Frame的结构示意图；
图6为本发明实施例中Probe Response Frame的结构示意图；
图7为本发明实施例中终端结构示意图；
图8为本发明实施例中AP结构示意图；
图9为本发明实施例中另一终端结构示意图；
图10为本发明实施例中另一AP结构示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
如图1所示为本发明实施例中对接入点AP认证的系统架构示意图，该系统包括终端11和WLAN的一个或多个AP12。其中，终端具有WLAN通信功能。可选地，该系统中还包括用于管理一个或多个AP12的服务器13。
基于该系统架构，本发明实施例中，如图2所示为终端对AP的合法性进行认证的方法流程示意图，具体如下：
步骤201：终端根据WLAN的AP对应的特征生成规则确定AP特征。
实施中，AP对应的特征生成规则可以为任意一个能够根据指定的输入参数计算得到一个输出参数的计算方法，本发明实施例并不限定特征生成规则的具体实现形式。具体地，该特征生成规则设定了计算规则以及计算所采用的输入参数。需要保证的是，特征生成规则在输入参数相同的条件下输出的 结果相同。
例如，特征生成规则具体为：预设密码与AP的SSID进行字符串拼接后得到新的字符串，该新的字符串即为该AP的特征。或者，特征生成规则具体为：预设密码中包含的数字部分除以AP的SSID的ASCII码值后的取整后所得结果，作为该AP的特征。
实施中，终端获取AP对应的特征生成规则的方式有多种，以下列举两种具体实现方式，需要说明的是，此处仅为举例说明，并不排除其它获取AP对应的特征生成规则的方式。
第一种实现方式，终端预先配置有AP对应的特征生成规则。
具体地，终端预先配置有AP的SSID与特征生成规则之间的对应关系。
实施中，终端在搜索到某个AP的SSID后，根据该AP的SSID从预先配置的AP的SSID与特征生成规则之间的对应关系中获取该AP的SSID对应的特征生成规则。
实际应用中，可以是在终端出厂时已经配置有各运营商的AP对应的特征生成规则。
该实现方式中，AP侧有以下两种配置方式：
配置方式a，AP侧需要配置与终端侧相同的特征生成规则，以保证终端与AP侧采用的特征生成规则相同。AP配置的特征生成规则可以是在出厂时预先配置，也可以是通过用于管理该AP的服务器进行配置。
配置方式b，AP侧需要配置采用终端配置的特征生成规则确定的AP特征，以保证AP提供的AP特征与终端计算得到的AP特征相同。AP配置的AP特征可以是在出厂时预先配置，也可以是通过用于管理该AP的服务器进行配置。
第二种实现方式，终端获取用于管理AP的服务器提供的AP对应的特征生成规则。
该实现方式中，根据AP的配置方式的不同，可以有以下两种具体配置方式：
配置方式a，用于管理AP的服务器生成所管理的AP对应的特征生成规则，并将该特征生成规则分别配置给终端以及所管理的AP。
具体地，用于管理AP的服务器从特征生成规则池中选取一种特征生成规则，并使选择的特征生成规则生效。
该配置方式中，用于管理AP的服务器可以定期或不定期更新AP对应的特征生成规则，并将更新后的AP对应的特征生成规则配置给终端以及所管理的AP。终端获取用于管理AP的服务器提供的更新后的AP对应的特征生成规则后，更新本地保存的发生更新的该AP对应的特征生成规则。该服务器所管理的AP采用更新后的特征生成规则更新本地保存的特征生成规则。
配置方式b，用于管理AP的服务器生成所管理的AP对应的特征生成规则，并根据该特征生成规则计算得到AP特征，将该特征生成规则配置给终端，将计算得到的该AP特征配置给AP。
具体地，用于管理AP的服务器通过可信的管理网络将AP特征配置给所管理的AP。
该配置方式中，用于管理AP的服务器可以定期或不定期更新AP对应的特征生成规则，并将更新后的AP对应的特征生成规则配置给终端，以及根据更新后的AP对应的特征生成规则计算得到更新后的AP特征，采用该更新后的AP特征更新配置给AP的AP特征。
具体地，以上配置方式中，如果用于管理AP的服务器所管理的AP分别归属不同的SSID，则用于管理AP的服务器针对具有相同的SSID的AP配置相同的特征生成规则或相同的AP特征。
步骤202：终端向该AP发送请求提供AP特征的请求消息，并获取该AP根据该请求消息返回的响应消息。
本发明实施例中不限制终端请求AP提供AP特征并获取该AP返回的响应消息的具体实现方式，只需终端与AP之间相互约定传送的消息以及消息的解析方式即可实现。
本发明实施例，获取AP特征相关的信息的方式包括但不限于以下两种：
第一种实现方式中，终端与AP之间约定采用探测请求帧(Probe Request Frame)以及探测响应帧(Probe Response Frame)实现。
具体地，终端向AP发送探测请求帧，该探测请求帧的帧体中携带特殊SSID，该特殊SSID用于请求AP提供AP特征；终端接收该AP返回的探测响应帧，该探测响应帧的帧体中包括该特殊SSID以及该特殊SSID对应的所支持的速率(Support Rate)字段，其中，该特殊SSID对应的所支持的速率字段携带该AP提供的AP特征或者为空。
该具体实现方式不需要改变现有的终端与AP之间的通信方式以及通信消息的结构，仅需要在终端与AP之间约定一个特殊SSID，即可利用终端与AP已有的通信消息中的该特殊SSID以及Support Rate对，实现AP特征的传输。
第二种实现方式中，终端与AP之间采用DHCP报文以及DHCP响应报文实现。
具体地，终端向AP发送动态主机配置协议(Dynamic Host Configuration Protocol，DHCP)报文，该DHCP报文包括取值为预设值的选项(Options)扩展字段，该取值为预设值的Options扩展字段用于请求AP提供AP特征；终端接收该AP返回的DHCP响应报文，该DHCP响应报文中取值为所述预设值的Options扩展字段中携带的信息为该AP提供的AP特征或者为空。
该具体实现方式不需要改变现有的终端与AP之间通信方式以及通信消息的结构，仅需要在终端与AP之间约定DHCP报文的一个取值为预设值的Options扩展字段，即可利用终端与AP已有的DHCP报文中的该Options扩展字段实现AP特征的传输。
步骤203：终端根据步骤202中该AP返回的响应消息以及步骤201中确定的AP特征判断该AP是否认证通过。
其中，AP特征为用于表征AP合法性的标识。
实施中，终端判断AP返回的响应消息中是否包含AP特征；若不包含，终端确定该AP认证未通过；若包含，且终端确定该AP返回的消息消息中包 含的AP特征与终端确定的AP特征相同，确定该AP认证通过。
一个可选地实现方式中，终端若确定AP返回的响应消息中包含的AP特征与所确定的AP特征不相同，确定AP认证未通过。
另一个可选地实现方式中，终端在更新AP对应的特征生成规则的情况下，终端若确定AP返回的响应消息中包含的AP特征与所确定的AP特征不相同，且确定更新为当前的特征生成规则的时长未超过设定阈值，判断该AP返回的响应消息中包含的AP特征与根据更新之前的特征生成规则确定的AP特征是否相同，若相同，确定该AP认证通过，否则，确定该AP认证未通过。该实现方式可以避免在特征生成规则切换导致的临界情况下判断错误。
本发明实施例中，AP特征可以是数字、字符串等中的一种或组合，AP特征用于标识WLAN系统中的可信AP。例如，AP特征为“123456”。
以下通过具体实施例对终端对AP的合法性进行认证的过程进行举例说明，如图3所示为终端对AP的合法性进行认证的方法流程示意图，具体为：
步骤301：用于管理AP的服务器生成AP对应的特征生成规则，例如AP对应的特征生成规则为：终端以及服务器约定的密码中的每个字符对应的ASCII码相乘后与当前的年月日相乘，取所得的乘积的后6位作为AP特征；
步骤302：用于管理AP的服务器使用生成的AP对应的特征生成规则计算AP特征；
步骤303：用于管理AP的服务器将AP特征配置给管理的每个AP，并且，用于管理AP的服务器在每日零点按照该特征计算规则重新计算AP特征，并更新配置给所管理的每个AP的AP特征；
步骤304：终端通过认证后向该用于管理AP的服务器查询AP对应的特征生成规则；
步骤305：用于管理AP的服务器向终端返回AP对应的特征生成规则；
步骤306：终端根据用户管理AP的服务器提供的AP对应的特征生成规则计算AP特征；
步骤307：终端访问AP，并请求AP提供AP特征；
步骤308：AP将AP特征提供给终端；
步骤309：终端判断AP提供的AP特征与步骤306计算得到的AP特征是否一致，如果不一致，则确定该AP为钓鱼AP，认证未通过，如果一致，则确定该AP为合法AP，认证通过。
基于该具体实施例所提供的认证过程，如图4所示为特定场景下终端对AP认证的过程示意图，AP1为用于管理AP的服务器所管理的合法AP，AP2为钓鱼AP，AP2设置为与AP1相同的SSID，终端进行合法性认证的过程如下：
步骤401～步骤406所描述的用于管理AP1的服务器为终端提供AP1对应的特征生成规则的过程，以及用于管理AP1的服务器为AP1配置AP特征的过程，与步骤301～步骤306所描述的过程完全相同，此处不再重复。
终端对AP1和AP2进行认证的过程如下：
步骤407：终端访问AP1，并请求AP1提供AP特征；
步骤408：终端获得AP1返回的AP特征；
步骤409：终端确定AP1提供的AP特征与步骤406计算得到的AP特征一致，则认为AP1认证通过，即确定AP1为可信AP；
步骤410：终端访问AP2，并请求AP2提供AP特征；
步骤411：终端获得AP2返回的信息；
步骤412：终端若确定AP2未返回AP特征，或者确定AP2返回的AP特征与步骤406计算得到的AP特征不一致，确定AP2认证未通过，即确定AP2为不可信AP，即钓鱼AP。
具体地，步骤407～步骤408中，终端通过WLAN底层协议的Probe Request Frame以及Probe Response Frame中的扩展字段实现，具体为：在Probe Request Frame中的帧体(Frame Body)部分新增一个SSID与Supported Rate对。终端向AP发送Probe Request Frame，并在Probe Request Frame的帧体中扩展的SSID与Supported Rate对中的Supported Rate字段中携带随机值；AP向终端返回Probe Response Frame，并在Probe Response Frame帧体中扩展的SSID与 Supported Rate对中的Supported Rate字段中携带AP特征的值，例如“123456”；终端接收AP返回的Probe Response Frame，并提取该Probe Response Frame帧体的该扩展的SSID与Supported Rate对中的Supported Rate字段中携带的AP特征的值。如图5所示为WLAN底层协议Probe Request Frame的结构示意图，如图6所示为WLAN底层协议Probe Response Frame的结构示意图。
具体地，步骤407～步骤408也可以通过TCP/IP底层的DHCP报文中的选项(options)扩展字段实现，DHCP报文中的options扩展字段可以用来存放普通协议中没有定义的控制信息和参数，具体为：在DHCP报文中定义一个options扩展字段，终端与AP约定采用该字段传输AP特征的值。终端向AP发送DHCP报文，该DHCP报文中的一个options扩展字段为预设值，例如250；AP向终端返回DHCP响应报文，该DHCP响应报文在该预设值对应的options扩展字段中携带AP特征的值；终端接收AP返回的DHCP响应报文，获取该DHCP响应报文中该预设值对应的options扩展字段中携带的AP特征的值。
基于同一发明构思，本发明实施例中提供了一种终端，该终端的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图7所示，该终端主要包括：
处理模块701，用于根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特征；
通信模块702，用于向所述AP发送请求提供AP特征的请求消息，并获取所述AP根据所述请求消息返回的响应消息；
认证模块703，用于根据所述通信模块702获取的所述响应消息以及所述处理模块701确定的AP特征判断所述AP是否认证通过。
其中，处理模块701的具体实施可参见上述方法实施例部分关于步骤201的具体描述，通信模块702的具体实施可参见上述方法实施例部分关于步骤202的具体描述，认证模块的具体实施可参见上述方法实施例部分关于步骤203的具体描述，此处不再详述。
基于同一发明构思，本发明实施例中提供了一种AP，该AP的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图8所示，该AP主要包括：
接收模块801，用于接收终端发送的请求提供AP特征的请求消息；
发送模块802，用于根据所述接收模块801接收的所述请求消息向所述终端返回响应消息。
实施中，还包括处理模块803。
具体地，接收模块801用于接收用于管理所述AP的服务器发送的AP特征；处理模块803用于保存接收模块801接收的AP特征。处理模块803用于根据接收模块801接收的所述请求消息获取保存的AP特征，通过发送模块802向终端返回该AP特征。
具体地，接收模块801用于接收用于管理所述AP的服务器发送的特征生成规则；处理模块根据接收模块接收的特征生成规则确定AP特征，并保存该AP特征。处理模块803用于根据接收模块801接收的所述请求消息获取保存的AP特征，通过发送模块802向终端返回该AP特征。
基于同一发明构思，本发明实施例还提供了另一种终端，该终端的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图9所示，该终端主要包括处理器901、存储器902和收发机903，其中，收发机903用于在处理器901的控制下接收和发送数据，存储器902中保存有预设的程序，处理器901读取存储器902中保存的程序，按照该程序执行以下过程：
根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特征；
通过收发机903向所述AP发送请求提供AP特征的请求消息，并通过收发机903获取所述AP根据所述请求消息返回的响应消息；
根据所述AP返回的响应消息以及确定的AP特征判断所述AP是否认证通过。
其中，处理器用于实现图7所示的终端的处理模块701以及认证模块703 所描述的功能，收发机在处理器的控制下实现图7所示的终端的通信模块702的功能，此处不再详述。
基于同一发明构思，本发明实施例中还提供了另一种AP，该AP的具体实施可参见上述方法实施例部分的描述，重复之处不再赘述，如图10所示，该AP主要包括处理器1001、存储器1002和收发机1003，其中，收发机1003用于在处理器1001的控制下接收和发送数据，存储器1002中保存有预设的程序，处理器1001读取存储器1002中保存的程序，按照该程序执行以下过程：
通过收发机1003接收终端发送的请求提供AP特征的请求消息；
根据所述请求消息指示收发机1003向所述终端返回响应消息。
其中，处理器用于控制收发机1003完成图7所示的接收模块和发送模块的功能，此处不再详述。
其中，图9和图10所示的结构中，处理器、存储器以及收发机之间可以通过总线连接，总线架构可以包括任意数量的互联的总线和桥，具体由处理器代表的一个或多个处理器和存储器代表的存储器的各种电路链接在一起。总线架构还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供接口。收发机可以是多个元件，即包括发送机和收发机，提供用于在传输介质上与各种其他装置通信的单元。处理器负责管理总线架构和通常的处理，存储器可以存储处理器在执行操作时所使用的数据。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图 和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (39)

  1. 一种对接入点AP的认证方法，其特征在于，包括：
    终端根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特征；
    所述终端向所述AP发送请求提供AP特征的请求消息，并获取所述AP根据所述请求消息返回的响应消息；
    所述终端根据所述响应消息以及确定的AP特征判断所述AP是否认证通过。
  2. 如权利要求1所述的方法，其特征在于，所述终端根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特征之前，还包括：
    所述终端从用于管理所述AP的服务器获取所述AP对应的特征生成规则。
  3. 如权利要求1或2所述的方法，其特征在于，所述终端根据所述响应消息以及确定的AP特征判断所述AP是否认证通过，包括：
    所述终端判断所述响应消息中是否包含AP特征；
    若不包含，所述终端确定所述AP认证未通过；
    若包含，且所述终端确定所述响应消息中包含的AP特征与所述确定的AP特征相同，确定所述AP认证通过。
  4. 如权利要求3所述的方法，其特征在于，所述方法还包括：
    所述终端若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，确定所述AP认证未通过；
    或者，
    所述终端若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，且确定更新为所述特征生成规则的时长未超过设定阈值，判断所述响应消息中包含的AP特征与根据更新之前的特征生成规则确定的AP特征是否相同，若相同，确定所述AP认证通过，否则，确定所述AP认证未通过。
  5. 如权利要求3所述的方法，其特征在于，所述响应消息中包含的AP特征，由所述用于管理所述AP的服务器根据所述AP对应的特征生成规则确定后配置给所述AP；
    或者，
    所述响应消息中包含的AP特征，由所述AP根据所述用于管理所述AP的服务器配置的所述AP对应的特征生成规则确定。
  6. 如权利要求1-5任一项所述的方法，其特征在于，所述终端向所述AP发送请求提供AP特征的请求消息，并获取所述AP根据所述请求消息返回的响应消息，包括：
    所述终端向所述AP发送探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；
    所述终端接收所述AP返回的探测响应帧，所述探测响应帧的帧体中包括所述特殊SSID以及所述特殊SSID对应的所支持的速率字段，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。
  7. 如权利要求1-5任一项所述的方法，其特征在于，所述终端向所述AP发送请求提供AP特征的请求消息，并获取所述AP根据所述请求消息返回的响应消息，包括：
    所述终端向所述AP发送动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；
    所述终端接收所述AP返回的DHCP响应报文，所述DHCP响应报文中取值为所述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。
  8. 如权利要求2所述的方法，其特征在于，所述AP对应的特征生成规则由所述用于管理所述AP的服务器更新。
  9. 一种对接入点AP的认证方法，其特征在于，包括：
    无线局域网络WLAN的接入点AP接收终端发送的请求提供AP特征的 请求消息；
    所述AP根据所述请求消息向所述终端返回响应消息。
  10. 如权利要求9所述的方法，其特征在于，所述方法还包括：
    所述AP接收用于管理所述AP的服务器配置的AP特征；
    或者，
    所述AP接收用于管理所述AP的服务器配置的特征生成规则，并根据所述特征生成规则确定AP特征。
  11. 如权利要求9或10所述的方法，其特征在于，所述AP接收终端发送的请求提供AP特征的请求消息，包括：
    所述AP接收所述终端发送的探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；
    所述AP根据所述请求消息向所述终端返回响应消息，包括：
    所述AP向所述终端返回探测响应帧，所述探测响应帧的帧体中携带所述特殊SSID以及所述特殊SSID对应的所支持的速率字段中携带的信息，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。
  12. 如权利要求9或10所述的方法，其特征在于，所述AP接收终端发送的请求提供AP特征的请求消息，包括：
    所述AP接收所述终端发送的动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；
    所述AP根据所述请求消息向所述终端返回响应消息，包括：
    所述AP向所述终端返回DHCP响应报文，所述DHCP响应报文中取值为所述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。
  13. 一种无线局域网络WLAN认证系统，其特征在于，包括：
    终端，用于根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特征，向所述AP发送请求提供AP特征的请求消息，并获取所述AP 根据所述请求消息返回的响应消息，根据所述响应消息以及确定的AP特征判断所述AP是否认证通过；
    所述AP，用于接收所述终端发送的请求提供AP特征的请求消息，根据所述请求消息向所述终端返回所述响应消息。
  14. 如权利要求13所述的系统，其特征在于，还包括用于管理所述AP的服务器，用于为所述终端提供所述AP对应的特征生成规则。
  15. 如权利要求13所述的系统，其特征在于，还包括用于管理所述AP的服务器，用于为所述AP配置AP特征；
    或者，
    所述用于管理所述AP的服务器，用于为所述AP配置特征生成规则；
    所述AP，还用于根据所述用于管理所述AP的服务器配置的特征生成规则确定AP特征。
  16. 一种终端，其特征在于，包括：
    处理模块，用于根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特征；
    通信模块，用于向所述AP发送请求提供AP特征的请求消息，并获取所述AP根据所述请求消息返回的响应消息；
    认证模块，用于根据所述通信模块获取的所述响应消息以及所述处理模块确定的AP特征判断所述AP是否认证通过。
  17. 如权利要求16所述的终端，其特征在于，所述通信模块还用于：
    从用于管理所述AP的服务器获取所述AP对应的特征生成规则。
  18. 如权利要求16或17所述的终端，其特征在于，所述认证模块具体用于：
    判断所述响应消息中是否包含AP特征；
    若不包含，确定所述AP认证未通过；
    若包含，且确定所述响应消息中包含的AP特征与所述确定的AP特征相同，确定所述AP认证通过。
  19. 权利要求18所述的终端，其特征在于，所述认证模块还用于：
    若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，确定所述AP认证未通过；
    或者，
    若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，且确定更新为所述特征生成规则的时长未超过设定阈值，判断所述响应消息中包含的AP特征与根据更新之前的特征生成规则确定的AP特征是否相同，若相同，确定所述AP认证通过，否则，确定所述AP认证未通过。
  20. 权利要求18所述的终端，其特征在于，所述响应消息中包含的AP特征，由所述用于管理所述AP的服务器根据所述AP对应的特征生成规则确定后配置给所述AP；
    或者，
    所述响应消息中包含的AP特征，由所述AP根据所述用于管理所述AP的服务器配置的所述AP对应的特征生成规则确定。
  21. 如权利要求16-20任一项所述的终端，其特征在于，所述通信模块具体用于：
    向所述AP发送探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；
    接收所述AP返回的探测响应帧，所述探测响应帧的帧体中包括所述特殊SSID以及所述特殊SSID对应的所支持的速率字段，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。
  22. 如权利要求16-20任一项所述的终端，其特征在于，所述通信模块具体用于：
    向所述AP发送动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；
    接收所述AP返回的DHCP响应报文，所述DHCP响应报文中取值为所 述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。
  23. 如权利要求17所述的终端，其特征在于，所述AP对应的特征生成规则由所述用于管理所述AP的服务器更新。
  24. 一种接入点AP，其特征在于，包括：
    接收模块，用于接收终端发送的请求提供AP特征的请求消息；
    发送模块，用于根据所述接收模块接收的所述请求消息向所述终端返回响应消息。
  25. 如权利要求24所述的AP，其特征在于，所述接收模块具体用于：
    接收用于管理所述AP的服务器配置的AP特征；
    或者，
    所述接收模块具体用于：
    接收用于管理所述AP的服务器配置的特征生成规则；
    还包括处理模块，用于根据所述接收模块接收的所述特征生成规则确定AP特征。
  26. 如权利要求24或25所述的AP，其特征在于，所述接收模块具体用于：
    接收所述终端发送的探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；
    所述发送模块具体用于：
    向所述终端返回探测响应帧，所述探测响应帧的帧体中携带所述特殊SSID以及所述特殊SSID对应的所支持的速率字段中携带的信息，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。
  27. 如权利要求24或25所述的AP，其特征在于，所述接收模块具体用于：
    接收所述终端发送的动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；
    所述发送模块具体用于：
    向所述终端返回DHCP响应报文，所述DHCP响应报文中取值为所述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。
  28. 一种终端，其特征在于，包括处理器、存储器和收发机，其中，所述收发机用于在所述处理器的控制下接收和发送数据，所述存储器中保存有预设的程序，所述处理器读取所述存储器中保存的程序，按照该程序执行以下过程：
    根据无线局域网络WLAN的接入点AP对应的特征生成规则确定AP特征；
    通过所述收发机向所述AP发送请求提供AP特征的请求消息，并通过所述收发机获取所述AP根据所述请求消息返回的响应消息；
    根据所述AP返回的响应消息以及确定的AP特征判断所述AP是否认证通过。
  29. 如权利要求28所述的终端，其特征在于，所述处理器还用于通过所述收发机从用于管理所述AP的服务器获取所述AP对应的特征生成规则。
  30. 如权利要求28或29所述的终端，其特征在于，所述处理器具体用于：
    判断所述响应消息中是否包含AP特征；
    若不包含，确定所述AP认证未通过；
    若包含，且确定所述响应消息中包含的AP特征与所述确定的AP特征相同，确定所述AP认证通过。
  31. 权利要求30所述的终端，其特征在于，所述处理器还用于：
    若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，确定所述AP认证未通过；
    或者，
    若确定所述响应消息中包含的AP特征与所述确定的AP特征不相同，且确定更新为所述特征生成规则的时长未超过设定阈值，判断所述响应消息中 包含的AP特征与根据更新之前的特征生成规则确定的AP特征是否相同，若相同，确定所述AP认证通过，否则，确定所述AP认证未通过。
  32. 如权利要求30所述的终端，其特征在于，所述响应消息中包含的AP特征，由所述用于管理所述AP的服务器根据所述AP对应的特征生成规则确定后配置给所述AP；
    或者，
    所述响应消息中包含的AP特征，由所述AP根据所述用于管理所述AP的服务器配置的所述AP对应的特征生成规则确定。
  33. 如权利要求28-32任一项所述的终端，其特征在于，所述处理器具体用于：
    通过所述收发机向所述AP发送探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；
    通过所述收发机接收所述AP返回的探测响应帧，所述探测响应帧的帧体中包括所述特殊SSID以及所述特殊SSID对应的所支持的速率字段，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。
  34. 如权利要求28-32任一项所述的终端，其特征在于，所述处理器具体用于：
    通过所述收发机向所述AP发送动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；
    通过所述收发机接收所述AP返回的DHCP响应报文，所述DHCP响应报文中取值为所述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。
  35. 如权利要求29所述的终端，其特征在于，所述AP对应的特征生成规则由所述用于管理所述AP的服务器更新。
  36. 一种接入点AP，其特征在于，包括处理器、存储器和收发机，其中， 所述收发机用于在所述处理器的控制下接收和发送数据，所述存储器中保存有预设的程序，所述处理器读取所述存储器中保存的程序，按照该程序执行以下过程：
    通过所述收发机接收终端发送的请求提供AP特征的请求消息；
    根据所述请求消息指示所述收发机向所述终端返回响应消息。
  37. 如权利要求36所述的AP，其特征在于，所述处理器具体用于：
    通过所述收发机接收用于管理所述AP的服务器配置的AP特征；
    或者，
    所述处理器具体用于：
    通过所述收发机接收用于管理所述AP的服务器配置的特征生成规则；
    根据通过所述收发机接收的所述特征生成规则确定AP特征。
  38. 如权利要求36或37所述的AP，其特征在于，所述处理器具体用于：
    通过所述收发机接收所述终端发送的探测请求帧，所述探测请求帧的帧体中携带特殊服务集标识SSID，所述特殊SSID用于请求所述AP提供AP特征；
    通过所述收发机向所述终端返回探测响应帧，所述探测响应帧的帧体中携带所述特殊SSID以及所述特殊SSID对应的所支持的速率字段中携带的信息，其中，所述特殊SSID对应的所支持的速率字段携带所述AP提供的AP特征或者为空。
  39. 如权利要求36或37所述的AP，其特征在于，所述处理器具体用于：
    通过所述收发机接收所述终端发送的动态主机配置协议DHCP报文，所述DHCP报文包括取值为预设值的选项扩展字段，所述取值为预设值的选项扩展字段用于请求所述AP提供AP特征；
    通过所述收发机向所述终端返回DHCP响应报文，所述DHCP响应报文中取值为所述预设值的选项扩展字段中携带的为所述AP提供的AP特征或者为空。
PCT/CN2016/074818 2016-02-29 2016-02-29 一种对接入点ap的认证方法、系统及相关设备 WO2017147745A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
PCT/CN2016/074818 WO2017147745A1 (zh) 2016-02-29 2016-02-29 一种对接入点ap的认证方法、系统及相关设备
CN201680004671.2A CN107113615B (zh) 2016-02-29 2016-02-29 一种对接入点ap的认证方法、系统及相关设备
US16/080,663 US11134384B2 (en) 2016-02-29 2016-02-29 Access point AP authentication method, system, and related device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/074818 WO2017147745A1 (zh) 2016-02-29 2016-02-29 一种对接入点ap的认证方法、系统及相关设备

Publications (1)

Publication Number Publication Date
WO2017147745A1 true WO2017147745A1 (zh) 2017-09-08

Family

ID=59676390

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/074818 WO2017147745A1 (zh) 2016-02-29 2016-02-29 一种对接入点ap的认证方法、系统及相关设备

Country Status (3)

Country Link
US (1) US11134384B2 (zh)
CN (1) CN107113615B (zh)
WO (1) WO2017147745A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111417171A (zh) * 2019-01-07 2020-07-14 苹果公司 用于多频段和多基本服务集发现的主动扫描增强

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107979594B (zh) * 2017-11-21 2020-08-04 重庆邮电大学 一种基于质数分解验证的防范wlan断关联攻击的方法
CN109951857A (zh) * 2017-12-21 2019-06-28 深圳Tcl新技术有限公司 一种路由器ssid冲突检测方法、装置及存储介质
CN112738829B (zh) * 2020-12-29 2023-07-21 青岛海尔科技有限公司 应答报文的处理方法及装置、存储介质及电子装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7885639B1 (en) * 2006-06-29 2011-02-08 Symantec Corporation Method and apparatus for authenticating a wireless access point
CN103856957A (zh) * 2012-12-04 2014-06-11 航天信息股份有限公司 探测无线局域网中仿冒ap的方法和装置
CN104023336A (zh) * 2014-06-13 2014-09-03 张力军 移动终端的无线接入方法及移动终端
CN104580152A (zh) * 2014-12-03 2015-04-29 中国科学院信息工程研究所 一种防护wifi钓鱼的保护方法及系统
CN105119901A (zh) * 2015-07-17 2015-12-02 中国科学院信息工程研究所 一种钓鱼热点的检测方法及系统

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7995753B2 (en) * 2005-08-29 2011-08-09 Cisco Technology, Inc. Parallel cipher operations using a single data pass
CN101263685A (zh) 2005-09-09 2008-09-10 松下电器产业株式会社 无线通信终端和网络侧通信设备
US8327143B2 (en) * 2008-08-04 2012-12-04 Broadcom Corporation Techniques to provide access point authentication for wireless network
CN104767740A (zh) 2009-09-14 2015-07-08 交互数字专利控股公司 用于来自用户平台的可信认证和接入的方法
EP2372971A1 (en) * 2010-03-30 2011-10-05 British Telecommunications Public Limited Company Method and system for authenticating a point of access
GB2495550A (en) * 2011-10-14 2013-04-17 Ubiquisys Ltd An access point that can be used to establish connections with UE devices using both cellular and wifi air interfaces
CN104469764A (zh) * 2013-09-16 2015-03-25 中兴通讯股份有限公司 一种wlan组网方法及系统
CN105120462B (zh) * 2015-09-11 2018-10-02 中国联合网络通信集团有限公司 网络接入方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7885639B1 (en) * 2006-06-29 2011-02-08 Symantec Corporation Method and apparatus for authenticating a wireless access point
CN103856957A (zh) * 2012-12-04 2014-06-11 航天信息股份有限公司 探测无线局域网中仿冒ap的方法和装置
CN104023336A (zh) * 2014-06-13 2014-09-03 张力军 移动终端的无线接入方法及移动终端
CN104580152A (zh) * 2014-12-03 2015-04-29 中国科学院信息工程研究所 一种防护wifi钓鱼的保护方法及系统
CN105119901A (zh) * 2015-07-17 2015-12-02 中国科学院信息工程研究所 一种钓鱼热点的检测方法及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111417171A (zh) * 2019-01-07 2020-07-14 苹果公司 用于多频段和多基本服务集发现的主动扫描增强

Also Published As

Publication number Publication date
CN107113615B (zh) 2020-02-14
US20200252796A1 (en) 2020-08-06
CN107113615A (zh) 2017-08-29
US11134384B2 (en) 2021-09-28

Similar Documents

Publication Publication Date Title
US11272365B2 (en) Network authentication method, and related device and system
US10791506B2 (en) Adaptive ownership and cloud-based configuration and control of network devices
EP1935143B1 (en) Virtual lan override in a multiple bssid mode of operation
US10575300B2 (en) Bandwidth control method and bandwidth control device
US9253636B2 (en) Wireless roaming and authentication
US8582476B2 (en) Communication relay device and communication relay method
WO2018197194A1 (en) Network policy configuration
WO2022236137A1 (en) Methods and systems of wireless sensor authentication
CN108738019B (zh) 融合网络中的用户认证方法及装置
WO2017147745A1 (zh) 一种对接入点ap的认证方法、系统及相关设备
US20220294623A1 (en) Method, apparatus, and device for key generation and terminal provisioning
WO2021196818A1 (zh) 密钥生成方法和装置、设备及计算机可读存储介质
WO2022028259A1 (zh) 用户签约数据的获取方法及装置
WO2014127751A1 (zh) 无线终端配置方法及装置和无线终端
WO2022002244A1 (zh) 在线签约方法、装置及系统
EP1947818A1 (en) A communication system and a communication method
CN109391937A (zh) 公钥的获取方法、设备及系统
CN110139274A (zh) 一种蓝牙设备的鉴权方法、电子设备和可存储介质
CN102761940B (zh) 一种802.1x认证方法和设备
CN105101274A (zh) 报文转发方式的配置方法和装置
US20150359017A1 (en) Method and System for Implementing Communication in WLAN
US20170201506A1 (en) Communication Method, Apparatus, and System
CN109981462B (zh) 一种报文处理方法及装置
US12063504B2 (en) Systems and methods for providing access to a wireless communication network based on radio frequency response information and context information
US20230388285A1 (en) Methods and systems for communications

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16891938

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 16891938

Country of ref document: EP

Kind code of ref document: A1