WO2018000674A1 - 网络连接方法、网络连接装置和终端 - Google Patents

网络连接方法、网络连接装置和终端 Download PDF

Info

Publication number
WO2018000674A1
WO2018000674A1 PCT/CN2016/103876 CN2016103876W WO2018000674A1 WO 2018000674 A1 WO2018000674 A1 WO 2018000674A1 CN 2016103876 W CN2016103876 W CN 2016103876W WO 2018000674 A1 WO2018000674 A1 WO 2018000674A1
Authority
WO
WIPO (PCT)
Prior art keywords
access point
wireless network
connection
preset
network access
Prior art date
Application number
PCT/CN2016/103876
Other languages
English (en)
French (fr)
Inventor
田永胜
Original Assignee
宇龙计算机通信科技(深圳)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 宇龙计算机通信科技(深圳)有限公司 filed Critical 宇龙计算机通信科技(深圳)有限公司
Publication of WO2018000674A1 publication Critical patent/WO2018000674A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a network connection method, a network connection device, and a terminal.
  • AP Access Point
  • WIFI Wireless Fidelity hotspots
  • SSID Service Set Identifier
  • some illegal elements will use the phishing AP hotspot that builds the same SSID and connection key as an AP hotspot to induce the user's terminal (such as mobile phone, tablet, etc.) to automatically connect, thereby stealing user information.
  • the user is A public hotspot with SSID AAA and PPP connection key is connected somewhere, and an automatic connection is set. After the phishing AP hotspot with the same SSID and connection key is established, the user sets the automatic connection function. When entering the coverage area of the phishing AP hotspot, the user's terminal will immediately connect to the phishing AP hotspot, and then the illegal elements can use the relevant technology to steal the user information.
  • the BSSID Basic Service Set Identifier
  • the SSID and the connection key must also verify the BSSID, so as to avoid the connection to the phishing AP hotspot.
  • some advanced illegal elements can use the technical means to disguise the BSSID of the phishing AP hotspot, that is, the BSSID pretending to be a legitimate AP. This makes it possible to prevent the connection to the phishing AP hotspot from being invalidated by verifying the BSSID of the AP in the technical solution.
  • the invention is based on the above problems, and proposes a new technical solution, which can effectively improve the security of automatically connecting to the wireless network, avoiding connection to the phishing network, thereby ensuring user information security and improving the user's use security experience.
  • a network connection method including: determining, when scanning a wireless network access point, whether an SSID, a BSSID, and a connection key of the wireless network access point correspond to Stored in the preset security network list; when the determination result is yes, the preset authentication information corresponding to the wireless network access point is encrypted and processed by the preset encryption key, and then sent to the wireless network access. Detecting whether the response information of the wireless network access point to the encrypted authentication processing is received; and when detecting the response information, determining whether to use the connection according to the response information A key establishes a connection with the wireless network access point.
  • the terminal when the terminal initiates the automatic connection network function and scans to the previously connected wireless network access point, before the automatic connection, first determine whether the wireless network access point is a secure access point, that is, determine the Whether the SSID, the BSSID, and the connection key are correspondingly stored in the preset security network list, and when the determination is yes, the preset authentication information corresponding to the wireless network access point is encrypted and sent by using a preset encryption key.
  • the SSID and the connection key of the wireless network access point are first determined to be stored in a preset security network list, and when the determination is yes, the wireless network connection is further determined. Whether the inbound BSSID is stored in the preset security network list corresponding to the SSID and the connection key to perform preliminary security verification on the wireless network access point.
  • determining, according to the response information, whether to establish a connection with the wireless network access point by using the connection key specifically: determining Whether the response message matches the preset information; when it is determined that the response information matches the preset information, establishing a connection with the wireless network access point by using the connection key; and determining the response information and the location
  • the preset information does not match, the user is prompted whether to establish a connection with the wireless network access point by using the connection key.
  • the wireless network is a trusted security network.
  • the connection key is automatically used to establish a connection with the wireless network access point. Otherwise, the wireless network access point may be established.
  • the preset mode sends a prompt to the user, for example, prompting the user by means of text combined with sound and/or light, and then determining whether to use the corresponding connection key to establish with the wireless network access point and using the wireless network access point Network services to meet the needs of users connected to the network.
  • the method before determining whether the response message matches the preset information, includes: decrypting the response information by using a preset decryption key; and determining the Whether the response message matches the preset information includes: determining whether the response message decrypted by the preset decryption key matches the preset information.
  • the response information when receiving the response message of the wireless network access point to the encrypted authentication default authentication information, the response information is first decrypted by using a preset decryption key, and then determined by the decryption process. Whether the response information matches the preset information to determine whether to establish a connection with the wireless network access point by using the corresponding connection key, that is, the transmission process of the preset authentication information and the response information between the wireless network access point and the wireless network access point In the process of encryption and decryption, to improve the security of the information transmission process, and further improve the security of the network connection.
  • the preset encryption key and the preset decryption key may be correspondingly stored in the preset security network list for unified management. Further, the preset encryption key and the preset decryption key are the same key, that is, In the preset security network list, the SSID, the BSSID, the connection key, the preset authentication information, and the encryption and decryption processing for the preset authentication information are stored correspondingly to any wirelessly connected wireless network access point. Decrypt the key.
  • the user when detecting that the response information is not received within a preset time, the user is prompted whether to establish a connection with the wireless network access point by using the connection key.
  • the preset information may be preset.
  • the method sends a prompt to the user, for example, prompting the user by means of text combined with sound and/or light, and then determining whether to use the corresponding connection key to establish with the wireless network access point and using the network service provided by the wireless network access point. In order to meet the needs of users connected to the network.
  • a network connection apparatus comprising: a determining module configured to determine whether an SSID, a BSSID, and a connection key of the wireless network access point are when scanning to a wireless network access point Correspondingly stored in the preset security network list; the processing module is configured to: when the determination result of the determining module is yes, obtain and preset the preset authentication information corresponding to the wireless network access point by using a preset encryption key Encrypted and sent to the wireless network access point; the detecting module is configured to detect whether the wireless network access point receives the response information of the encrypted authentication information, and the determining module is set to be The detecting module detects, when receiving the response information, determining, according to the response information, whether to establish a connection with the wireless network access point by using the connection key.
  • the terminal when the terminal initiates the automatic connection network function and scans to the previously connected wireless network access point, before the automatic connection, first determine whether the wireless network access point is a secure access point, that is, determine the Whether the SSID, the BSSID, and the connection key are correspondingly stored in the preset security network list, and when the determination is yes, the preset authentication information corresponding to the wireless network access point is encrypted and sent by using a preset encryption key.
  • the SSID and the connection key of the wireless network access point are first determined to be stored in a preset security network list, and when the determination is yes, the wireless network connection is further determined. Whether the inbound BSSID is stored in the preset security network list corresponding to the SSID and the connection key to perform preliminary security verification on the wireless network access point.
  • the determining module specifically includes: a determining submodule configured to determine whether the response message matches the preset information; and a network connection submodule configured to determine, when the determining submodule determines When the response information matches the preset information, the connection key is used to establish a connection with the wireless network access point; and the prompting submodule is configured to: when the determining submodule determines the response information and the preset When the information does not match, the user is prompted whether to establish a connection with the wireless network access point by using the connection key.
  • the wireless network is a trusted security network.
  • the connection key is automatically used to establish a connection with the wireless network access point. Otherwise, the wireless network access point may be established.
  • the preset mode sends a prompt to the user, for example, prompting the user by means of text combined with sound and/or light, and then determining whether to use the corresponding connection key to establish with the wireless network access point and using the wireless network access point Network services to meet the needs of users connected to the network.
  • the determining module specifically includes: a decryption submodule configured to decrypt the response information by using a preset decryption key; and the determining submodule is specifically configured to: Determining whether the response message decrypted by the preset decryption key matches the preset information.
  • the response information when receiving the response message of the wireless network access point to the encrypted authentication default authentication information, the response information is first decrypted by using a preset decryption key, and then determined by the decryption process. Whether the response information matches the preset information to determine whether to establish a connection with the wireless network access point by using the corresponding connection key, that is, the transmission process of the preset authentication information and the response information between the wireless network access point and the wireless network access point In the process of encryption and decryption, to improve the security of the information transmission process, and further improve the security of the network connection.
  • the preset encryption key and the preset decryption key may be correspondingly stored in the preset security network list for unified management. Further, the preset encryption key and the preset decryption key are the same key, that is, In the preset security network list, the SSID, the BSSID, the connection key, the preset authentication information, and the encryption and decryption processing for the preset authentication information are stored correspondingly to any wirelessly connected wireless network access point. Decrypt the key.
  • the method further includes: a prompting module, configured to prompt the user whether to use the connection key and the saying when the detecting module detects that the response information is not received within a preset time
  • the wireless network access point establishes a connection.
  • the preset information may be preset.
  • the method sends a prompt to the user, for example, prompting the user by means of text combined with sound and/or light, and then determining whether to use the corresponding connection key to establish with the wireless network access point and using the network service provided by the wireless network access point. In order to meet the needs of users connected to the network.
  • a terminal comprising: the network connection device according to any one of the above aspects, wherein the terminal has the network connection device according to any one of the above aspects All the beneficial effects will not be described here.
  • the security of the automatically connected wireless network can be effectively improved, and the connection to the phishing network can be avoided, thereby ensuring the information security of the user and improving the user's use security experience.
  • FIG. 1 is a flow chart showing a network connection method according to a first embodiment of the present invention
  • FIG. 2 is a schematic flowchart showing a matching judgment process of response information and preset information according to an embodiment of the present invention
  • Figure 3 shows a schematic block diagram of a network connection device in accordance with an embodiment of the present invention
  • Figure 4 shows a schematic block diagram of the determination module shown in Figure 3;
  • Figure 5 shows a schematic block diagram of a terminal in accordance with an embodiment of the present invention
  • FIG. 6 is a schematic flow chart showing interaction between a terminal and a wireless network access point according to an embodiment of the present invention
  • FIG. 7 is a flow chart showing a network connection method according to a second embodiment of the present invention.
  • Figure 8 shows a schematic block diagram of a terminal in accordance with an embodiment of the present invention.
  • FIG. 1 is a flow chart showing a network connection method according to a first embodiment of the present invention.
  • the network connection method according to the first embodiment of the present invention includes the following process steps:
  • Step 102 When scanning to a wireless network access point, determining whether the SSID, the BSSID, and the connection key of the wireless network access point are correspondingly stored in a preset security network list;
  • Step 104 When the determination result is yes, the preset authentication information corresponding to the wireless network access point is obtained and encrypted by using a preset encryption key, and then sent to the wireless network access point.
  • Step 106 Detect whether the response information of the wireless network access point to the encrypted authentication information is received.
  • Step 108 When detecting that the response information is received, determining, according to the response information, whether to establish a connection with the wireless network access point by using the connection key.
  • the terminal when the terminal initiates the automatic connection network function and scans to the previously connected wireless network access point, before the automatic connection, first determine whether the wireless network access point is a secure access point, that is, determine the Whether the SSID, the BSSID, and the connection key are correspondingly stored in the preset security network list, and when the determination is yes, the preset authentication information corresponding to the wireless network access point is encrypted and sent by using a preset encryption key.
  • the SSID and the connection key of the wireless network access point are first determined to be stored in a preset security network list, and when the determination is yes, the wireless network connection is further determined.
  • the preset security network list may be expressed as As shown in Table 1 below:
  • the SSID is the wireless network name
  • the PSK Pre-shared Key
  • the BSSID is the BSSID of the access point to be connected.
  • the preset encryption key is the same as the preset decryption key.
  • the above table structure is the basic table structure, and can be added or deleted as needed.
  • the preset authentication information corresponding to the wireless network access point and the response information of the preset authentication information may be the same information, or may be different information, and may be a system default value or a user.
  • the setting is used for the verification of the network security between the terminal and the access point. For example, it may be a part or a variant of the SSID or BSSID of the wireless network, or a combination of the two.
  • step 108 specifically includes the following process steps:
  • Step 1082 Determine whether the response message matches the preset information.
  • Step 1084 when it is determined that the response information matches the preset information, establish a connection with the wireless network access point by using the connection key;
  • Step 1086 when it is determined that the response information does not match the preset information, prompting the user whether to establish a connection with the wireless network access point by using the connection key.
  • the wireless network is a trusted security network.
  • the connection key is automatically used to establish a connection with the wireless network access point. Otherwise, the wireless network access point may be established.
  • the preset mode sends a prompt to the user, for example, prompting the user by means of text combined with sound and/or light, and then determining whether to use the corresponding connection key to establish with the wireless network access point and using the wireless network access point Network services to meet the needs of users connected to the network.
  • the connection to the wireless network access point may be directly refused, thereby avoiding any security risks that may be caused by connecting to the wireless network access point.
  • the method before the step 1082, includes: decrypting the response information by using a preset decryption key; and step 1082 further specifically: determining that the decryption process is performed by using the preset decryption key Whether the response message matches the preset information.
  • the response information when receiving the response message of the wireless network access point to the encrypted authentication default authentication information, the response information is first decrypted by using a preset decryption key, and then determined by the decryption process. Whether the response information matches the preset information to determine whether to establish a connection with the wireless network access point by using the corresponding connection key, that is, the transmission process of the preset authentication information and the response information between the wireless network access point and the wireless network access point In the process of encryption and decryption, to improve the security of the information transmission process, and further improve the security of the network connection.
  • the preset encryption key and the preset decryption key may be correspondingly stored in the preset security network list for unified management. Further, the preset encryption key and the preset decryption key are the same key, that is, In the preset security network list, the SSID, the BSSID, the connection key, the preset authentication information, and the encryption and decryption processing for the preset authentication information are stored correspondingly to any wirelessly connected wireless network access point. Decrypt the key.
  • the detection result of the foregoing step 106 is that the wireless network access point does not receive the response information of the encrypted authentication default authentication information, and the unreceived time reaches the preset time, then Prompting the user whether to establish a connection with the wireless network access point using the connection key.
  • the encrypted authentication default authentication information is sent to the wireless network access point
  • the response information corresponding to the wireless network access point is not received within a preset time (for example, 2 minutes).
  • the user can be prompted by a preset manner, such as prompting the user by means of text combined with sound and/or light, and then the user decides whether to use the corresponding connection key to establish with the wireless network access point and use the wireless network to access.
  • the connection to the wireless network access point can be directly refused, thereby avoiding any security risks that may be caused by connecting to the wireless network access point.
  • Fig. 3 shows a schematic block diagram of a network connection device in accordance with a first embodiment of the present invention.
  • the network connection apparatus 300 includes a determination module 302, a processing module 304, a detection module 306, and a determination module 308.
  • the determining module 302 is configured to: when scanning to the wireless network access point, determine whether the SSID, the BSSID, and the connection key of the wireless network access point are correspondingly stored in the preset secure network list; and the processing module 304 sets When the determination result of the determining module 302 is YES, the preset authentication information corresponding to the wireless network access point is obtained and encrypted by using a preset encryption key, and then sent to the wireless network access point;
  • the module 306 is configured to detect whether the response information of the wireless network access point to the encrypted authentication information is received, and the determining module 308 is configured to: when the detecting module 306 detects that the response is received And determining, according to the response information, whether to establish a connection with the wireless network access point by using the connection key.
  • the terminal when the terminal initiates the automatic connection network function and scans to the previously connected wireless network access point, before the automatic connection, first determine whether the wireless network access point is a secure access point, that is, determine the Whether the SSID, the BSSID, and the connection key are correspondingly stored in the preset security network list, and when the determination is yes, the preset authentication information corresponding to the wireless network access point is encrypted and sent by using a preset encryption key.
  • the preset authentication information corresponding to the wireless network access point and the response information of the preset authentication information may be the same information, or may be different information, and may be a system default value or a user.
  • the setting is used for the verification of the network security between the terminal and the access point. For example, it may be a part or a variant of the SSID or BSSID of the wireless network, or a combination of the two.
  • the determining module 308 specifically includes: a determining submodule 3082, a network connecting submodule 3084, a prompting submodule 3086, and a decrypting submodule 3088.
  • the determining sub-module 3082 is configured to determine whether the response message matches the preset information.
  • the network connection sub-module 3084 is configured to, when the determining sub-module 3082 determines that the response information matches the preset information, Establishing a connection with the wireless network access point by using the connection key; the prompting sub-module 3086 is configured to prompt the user whether to use when the determining sub-module 3082 determines that the response information does not match the preset information.
  • the connection key establishes a connection with the wireless network access point.
  • the wireless network is a trusted security network.
  • the connection key is automatically used to establish a connection with the wireless network access point. Otherwise, the wireless network access point may be established.
  • the preset mode sends a prompt to the user, for example, prompting the user by means of text combined with sound and/or light, and then determining whether to use the corresponding connection key to establish with the wireless network access point and using the wireless network access point Network services to meet the needs of users connected to the network.
  • the connection to the wireless network access point may be directly refused, thereby avoiding any security risks that may be caused by connecting to the wireless network access point.
  • the decryption sub-module 3088 is configured to decrypt the response information by using a preset decryption key; and the determining sub-module 3082 is specifically configured to: determine, by the decryption processing after the preset decryption key Whether the response message matches the preset information.
  • the response information when receiving the response message of the wireless network access point to the encrypted authentication default authentication information, the response information is first decrypted by using a preset decryption key, and then determined by the decryption process. Whether the response information matches the preset information to determine whether to establish a connection with the wireless network access point by using the corresponding connection key, that is, the transmission process of the preset authentication information and the response information between the wireless network access point and the wireless network access point In the process of encryption and decryption, to improve the security of the information transmission process, and further improve the security of the network connection.
  • the preset encryption key and the preset decryption key may be correspondingly stored in the preset security network list for unified management. Further, the preset encryption key and the preset decryption key are the same key, that is, In the preset security network list, the SSID, the BSSID, the connection key, the preset authentication information, and the encryption and decryption processing for the preset authentication information are stored correspondingly to any wirelessly connected wireless network access point. Decrypt the key.
  • the method further includes: a prompting module 310, configured to prompt the user whether to use the connection key when the detecting module 306 detects that the response information is not received within a preset time.
  • the wireless network access point establishes a connection.
  • the preset information may be preset.
  • the method sends a prompt to the user, for example, prompting the user by means of text combined with sound and/or light, and then determining whether to use the corresponding connection key to establish with the wireless network access point and using the network service provided by the wireless network access point. In order to meet the needs of users connected to the network.
  • the connection to the wireless network access point can be directly refused, thereby avoiding any security risks that may be caused by connecting to the wireless network access point.
  • FIG. 5 shows a schematic block diagram of a terminal in accordance with an embodiment of the present invention.
  • a terminal 500 includes: the network connection device 300 according to any one of the above aspects, wherein the terminal 500 has any one of the above technical solutions. All the beneficial effects of the network connection device 300 will not be described herein.
  • FIG. 6 shows an interaction process between a terminal and a wireless network access point according to an embodiment of the present invention, which specifically includes the following steps:
  • Step 602 When the terminal determines that the currently connected wireless network access point is a secure access point, the SSID, the BSSID, and the connection key of the wireless network access point are correspondingly stored in a preset secure network list, and the wireless network is configured for the wireless network.
  • the access point sets the preset authentication information and the preset encryption and decryption key, and stores the preset authentication information and the preset encryption and decryption key in the preset security network list.
  • Step 604 When the terminal starts the network automatic connection function and scans to the same wireless network access point, it is determined whether the SSID of the wireless network access point is stored in the preset safety network list, and when the determination is yes, the execution is performed. Step 606.
  • Step 606 Determine whether the BSSID of the wireless network access point is stored in the preset secure network list. When the determination is yes, step 608 is performed.
  • Step 608 The terminal encrypts the preset authentication information by using a preset encryption and decryption key, and sends the encrypted preset authentication information to the wireless network access point.
  • Step 610 The wireless network access point decrypts the encrypted preset authentication information sent by the terminal by using the stored preset encryption and decryption key, and determines whether the decrypted preset authentication information is stored with the preset authentication. The information matches, and if yes, step 612 is performed.
  • Step 612 The wireless network access point encrypts the decrypted preset authentication information by using a preset encryption and decryption key, and sends the encrypted preset authentication information to the terminal.
  • Step 614 The terminal decrypts the encrypted preset authentication information sent by the wireless network access point by using the stored preset encryption and decryption key, and determines whether the decrypted preset authentication information is related to the stored preset authentication information. Match, if yes, go to step 616.
  • step 616 the terminal establishes a connection with the wireless network access point by using the connection key.
  • the terminal and the wireless network access point jointly maintain a set of preset authentication information and a preset encryption and decryption key. If the wireless network access point having the same SSID, connection key, and BSSID cannot decrypt the preset authentication information that the terminal encrypts by using the preset encryption/decryption key, the wireless network access point may be determined to be a phishing network. The terminal does not establish a connection with the wireless network access point.
  • FIG. 7 is a flow chart showing a network connection method according to a second embodiment of the present invention.
  • the network connection method according to the second embodiment of the present invention specifically includes the following process steps:
  • Step 702 After the user determines that the currently connected AP hotspot is a security hotspot, the AP information is added to the secure AP hotspot table (that is, the preset secure network list), and the terminal generates an encryption and decryption key for the AP hotspot.
  • the terminal and the AP side maintain the same, that is, the terminal side and the AP side simultaneously store one-to-one encryption and decryption keys, that is, the preset encryption key and the preset decryption key used for encryption and decryption processing on the terminal side and the AP side. Is the same key.
  • step 704 when the terminal scans the AP hotspot with the same SSID and PSK as the previously connected AP hotspot, and the terminal turns on the automatic connection function, the following steps are added before the automatic connection.
  • Step 706 Determine whether the AP information is in the secure AP hotspot table, that is, determine whether the SSID of the AP hotspot is in the security hotspot AP table. If not in the table, the default is a dangerous AP hotspot, and the prompt is performed by the user in the terminal. Decide whether to make an automatic connection, if there is an execution step 708.
  • Step 708 Determine whether the BSSID of the AP hotspot is consistent with the current table, that is, whether the current AP-side MAC (Media Access Control) address is consistent with the MAC address corresponding to the security hotspot AP table. The default is the dangerous AP hotspot.
  • the prompt in the terminal is determined by the user whether to perform automatic connection. If yes, go to step 710.
  • Step 710 Encrypt the authentication information by using a corresponding encryption key, and send the encrypted information to the AP side.
  • Step 712 It is determined whether the authentication response (response) returned by the AP side is received, that is, the AP side feedback Response information is waited for, that is, the authentication information is decrypted by using the same key on the AP side, and if there is no feedback information in a fixed period, In the terminal, the user decides whether to perform automatic connection. If the feedback information is received, the matching feedback information is consistent with the information in the table. If they match, an automatic connection request is sent to perform automatic connection.
  • step 714 according to the automatic connection request, the connection is performed according to the WIFI connection policy.
  • step 702 the AP side and the terminal side are required to jointly maintain the encryption and decryption key and the authentication information, and the AP side performs maintenance on the connected device, and stores the encryption and decryption key and the authentication information.
  • step 702 the AP side needs to decrypt the authentication information using the same encryption and decryption key, and sends the decryption information back to the terminal side.
  • the phishing AP hotspot will not decrypt it because there is no encryption and decryption key, and it does not know what Response is sent back, and finally guarantees the security of the AP hotspot.
  • the purpose of the technical solution is to maintain a secure AP hotspot table confirmed by the user.
  • the AP hotspot with the same SSID and password is encountered, the three times of the above determination are used to confirm whether it is a secure connectable AP hotspot.
  • the user is prevented from connecting to the phishing AP hotspot with the same SSID and the connection key after the automatic connection of the AP hotspot function is enabled, that is, after the user connects to an AP hotspot, if the user determines this If the AP hotspot is secure, the AP hotspot information is added to the security hotspot AP table, and the mobile terminal and the AP side jointly maintain an encryption and decryption key and authentication information; when the user turns on the automatic connection function, the user has the same SSID.
  • the authentication process is added before the automatic connection: first, whether it is in the security hotspot AP table, if it is determined whether the BSSID of the current AP is consistent with the saved in the AP list, if yes, the corresponding AP is used.
  • the encryption key encrypts the authentication information and sends it to the AP side. If the connection response returned by the AP side is received, and the decrypted authentication information is correct (only the AP with the decryption key can decrypt and match before responding to the Response) Perform further automatic connection operations, for AP hotspots that are not in the secure AP hotspot table, the BSSID is incorrect, and there is no feedback. Response hotspot connection is not automatic operation, so can greatly improve user security experience, have a beneficial effect.
  • FIG. 8 is a schematic structural diagram of a terminal provided by an embodiment of the present invention.
  • the terminal 500 includes at least one processor 501, such as a CPU, at least one receiver 503, at least one memory 504, at least one transmitter 505, and at least one communication bus 502.
  • the communication bus 502 is used to implement connection communication between these components.
  • the receiver 503 and the transmitter 505 may be wired transmission ports, or may be wireless devices, for example, including antenna devices for performing data communication with other devices.
  • the memory 504 may be a high speed RAM memory or a non-transitory memory.
  • the processor 501 can execute the operating system of the terminal 500 and various installed application programs, program codes, and the like.
  • each module described above includes the determining module 302, the processing module 304, and the like.
  • Program code is stored in the memory 504, and the processor 501 can invoke program code stored in the memory 504 via the communication bus 502 to perform related functions.
  • the various modules or sub-modules eg, the determination module 302, the processing module 304, etc.
  • FIGS. 3, 4 are program codes stored in the memory 504, and are executed by the processor 501. Executed to implement the functions of the various modules.
  • the memory 504 stores a plurality of instructions that are executed by the processor 501 to implement a network connection method.
  • the performing, by the processor 501, the multiple instructions includes: when scanning to a wireless network access point, determining whether the SSID, the BSSID, and the connection key of the wireless network access point are correspondingly stored in a pre- When the determination result is yes, the preset authentication information corresponding to the wireless network access point is obtained and encrypted by the preset encryption key, and then sent to the wireless network access point; Receiving, by the wireless network access point, response information of the encrypted authentication processed information; when detecting the response information, determining whether to use the connection key according to the response information The wireless network access point establishes a connection.
  • determining, according to the response information, whether to establish a connection with the wireless network access point by using the connection key specifically: determining the response Whether the message matches the preset information; when it is determined that the response information matches the preset information, establishing a connection with the wireless network access point by using the connection key; and determining the response information and the pre-determination When the information does not match, the user is prompted whether to establish a connection with the wireless network access point by using the connection key.
  • the processor 501 decrypts the response information by using a preset decryption key; and the determining the response Whether the message matches the preset information includes: determining whether the response message decrypted by the preset decryption key matches the preset information.
  • the processor 501 when detecting that the response information is not received within a preset time, the processor 501 prompts the user whether to establish a connection with the wireless network access point using the connection key.
  • the technical solution of the present invention is described in detail with reference to the accompanying drawings.
  • the technical solution of the present invention can effectively improve the security of automatically connecting to a wireless network, avoiding connection to a phishing network, thereby ensuring user information security and improving user safety. Sexual experience.

Abstract

本发明提出了一种网络连接方法、网络连接装置和终端，其中，所述网络连接方法包括：当扫描到无线网络接入点时，判断所述无线网络接入点的SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中；当判断结果为是时，获取并将与所述无线网络接入点对应的预设认证信息通过预设加密密钥加密处理后发送至所述无线网络接入点；检测是否接收到所述无线网络接入点对经加密处理后的所述预设认证信息的响应信息；当检测接收到所述响应信息时，根据所述响应信息确定是否使用所述连接密钥与所述无线网络接入点建立连接。该技术方案，可以有效地提高自动连接无线网络的安全性，避免连接到钓鱼网络，从而确保用户的信息安全，提升用户的使用安全性体验。

Description

网络连接方法、网络连接装置和终端
本申请要求于2016年6月30日提交中国专利局，申请号为201610514279.4、发明名称为“网络连接方法、网络连接装置和终端”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及通信技术领域，具体而言，涉及一种网络连接方法、网络连接装置和终端。
背景技术
目前，AP（Access Point，接入点）热点（也称WIFI（Wireless Fidelity，无线网络）热点）安全问题越来越受重视。其中一个使用场景如下：用户习惯于将WIFI设置中的自动连接功能打开，当下次碰到具有相同的SSID（Service Set Identifier，服务集识别码）和连接密钥的AP热点时可以自动连接，比如，曾经连接过某商场的公共AP热点后，下次再次来到该商场后即可自动连接到该AP热点，从而畅游网络。
但是，一些违法分子会利用搭建与某AP热点相同的SSID和连接密钥的钓鱼AP热点，诱导用户的终端（比如手机、平板电脑等）进行自动连接，从而盗取用户信息，比如，用户在某处连接过SSID为AAA、连接密钥为PPP的公共热点，同时设置了自动连接，则在违法分子建立了具有相同的SSID和连接密钥的钓鱼AP热点后，由于用户设置了自动连接功能，当进入到钓鱼AP热点的覆盖区域时，用户的终端则会立即连接到该钓鱼AP热点，然后违法分子便可以利用相关技术窃取用户信息。
同时，在某些技术方案中，用户的终端在连接合法AP热点后，获取此AP热点的BSSID（Basic Service Set Identifier，基础服务集标识）并记录到终端中，当下次再次连接时，在验证SSID和连接密钥的同时也要验证BSSID，从而达到避免连接到钓鱼AP热点的目的，但某些高级违法分子，可以通过技术手段伪装钓鱼AP热点的BSSID，即伪装成合法AP的BSSID，从而使得该技术方案中通过验证AP的BSSID来避免连接到钓鱼AP热点失去效力。
因此，如何提高自动连接无线网络的安全性，避免连接到钓鱼网络，从而确保用户的信息安全，提升用户的使用安全性体验，成为亟待解决的技术问题。
发明内容
本发明正是基于上述问题，提出了一种新的技术方案，可以有效地提高自动连接无线网络的安全性，避免连接到钓鱼网络，从而确保用户的信息安全，提升用户的使用安全性体验。
有鉴于此，根据本发明的第一方面，提出了一种网络连接方法，包括：当扫描到无线网络接入点时，判断所述无线网络接入点的SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中；当判断结果为是时，获取并将与所述无线网络接入点对应的预设认证信息通过预设加密密钥加密处理后发送至所述无线网络接入点；检测是否接收到所述无线网络接入点对经加密处理后的所述预设认证信息的响应信息；当检测接收到所述响应信息时，根据所述响应信息确定是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当终端启动自动连接网络功能并扫描到之前连接过的无线网络接入点时，在自动连接之前，首先判断该无线网络接入点是否为安全接入点，即判断其SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中，并在判定为是时，通过预设加密密钥对与该无线网络接入点对应的预设认证信息进行加密处理后发送至该无线网络接入点，进而根据该无线网络接入点反馈的对上述经过加密处理的预设认证信息的响应信息确定是否使用对应的连接密钥与该无线网络接入点建立连接，如此，通过多层验证实现对合法的无线网络的验证识别，从而避免连接到钓鱼网络，确保用户的信息安全，则有效地提高了自动连接无线网络的安全性，提升了用户的使用安全性体验。
在上述技术方案中，优选地，可以先判断所述无线网络接入点的SSID和连接密钥是否对应存储在预设安全网络列表中，并当判定为是时，进一步判断所述无线网络接入点的BSSID是否与所述SSID和连接密钥对应存储在所述预设安全网络列表中，以对该无线网络接入点进行初步的安全验证。
在上述技术方案中，优选地，所述当检测接收到所述响应信息时，根据所述响应信息确定是否使用所述连接密钥与所述无线网络接入点建立连接，具体包括：判断所述响应消息是否与预设信息匹配；当判定所述响应信息与所述预设信息匹配时，使用所述连接密钥与所述无线网络接入点建立连接；当判定所述响应信息与所述预设信息不匹配时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当接收到无线网络接入点对经加密处理的预设认证信息的响应消息时，根据该响应信息是否与预设信息匹配的判断结果确定是否可以使用对应的连接密钥安全地连接至该无线网络接入点，即通过与无线网络接入点之间预先协商好的安全验证方式，在自动连接该无线网络接入点之前先进行安全性验证，则可以确保连接的无线网络为可信任的安全网络，具体地，当无线网络接入点反馈的响应信息与预设信息匹配时，则使用对应的连接密钥自动与该无线网络接入点建立连接，否则可以通过预设方式向用户发出提示，比如通过文字结合声音和/或光的方式提示用户，进而由用户决定是否使用对应的连接密钥与无线网络接入点建立而使用该无线网络接入点提供的网络服务，以全方位满足用户连接网络的需求。
在上述任一技术方案中，优选地，在所述判断所述响应消息是否与预设信息匹配之前，包括：通过预设解密密钥对所述响应信息进行解密处理；以及所述判断所述响应消息是否与预设信息匹配，具体包括：判断通过所述预设解密密钥解密处理后的所述响应消息是否与所述预设信息匹配。
在该技术方案中，当接收到无线网络接入点对经加密处理的预设认证信息的响应消息时，首先通过预设解密密钥对该响应信息进行解密处理，进而通过判断经解密处理后的响应信息是否与预设信息匹配，以确定是否使用对应的连接密钥与该无线网络接入点建立连接，即在与无线网络接入点之间进行预设认证信息和响应信息的传输过程中，进行加解密处理，以提高信息传输过程中的安全性，进一步提高网络连接的安全性。
其中，预设加密密钥和预设解密密钥可以对应的存储在上述预设安全网络列表中进行统一管理，进一步地，预设加密密钥和预设解密密钥为同一密钥，即在该预设安全网络列表中，对应存储任一已安全连接过的无线网络接入点的SSID、BSSID、连接密钥、预设认证信息以及用于对该预设认证信息进行加解密处理的加解密密钥。
在上述任一技术方案中，优选地，当检测在预设时间内未接收所述响应信息时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当向无线网络接入点发送经加密处理的预设认证信息后，若在预设时间内未接收到该无线网络接入点对应的响应信息时，即可通过预设方式向用户发出提示，比如通过文字结合声音和/或光的方式提示用户，进而由用户决定是否使用对应的连接密钥与无线网络接入点建立而使用该无线网络接入点提供的网络服务，以全方位满足用户连接网络的需求。
根据本发明的第二方面，提出了一种网络连接装置，包括：判断模块，设置为当扫描到无线网络接入点时，判断所述无线网络接入点的SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中；处理模块，设置为当所述判断模块的判断结果为是时，获取并将与所述无线网络接入点对应的预设认证信息通过预设加密密钥加密后发送至所述无线网络接入点；检测模块，设置为检测是否接收到所述无线网络接入点对经加密处理后的所述预设认证信息的响应信息；确定模块，设置为当所述检测模块检测接收到所述响应信息时，根据所述响应信息确定是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当终端启动自动连接网络功能并扫描到之前连接过的无线网络接入点时，在自动连接之前，首先判断该无线网络接入点是否为安全接入点，即判断其SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中，并在判定为是时，通过预设加密密钥对与该无线网络接入点对应的预设认证信息进行加密处理后发送至该无线网络接入点，进而根据该无线网络接入点反馈的对上述经过加密处理的预设认证信息的响应信息确定是否使用对应的连接密钥与该无线网络接入点建立连接，如此，通过多层验证实现对合法的无线网络的验证识别，从而避免连接到钓鱼网络，确保用户的信息安全，则有效地提高了自动连接无线网络的安全性，提升了用户的使用安全性体验。
在上述技术方案中，优选地，可以先判断所述无线网络接入点的SSID和连接密钥是否对应存储在预设安全网络列表中，并当判定为是时，进一步判断所述无线网络接入点的BSSID是否与所述SSID和连接密钥对应存储在所述预设安全网络列表中，以对该无线网络接入点进行初步的安全验证。
在上述技术方案中，优选地，所述确定模块具体包括：判断子模块，设置为判断所述响应消息是否与预设信息匹配；网络连接子模块，设置为当所述判断子模块判定所述响应信息与所述预设信息匹配时，使用所述连接密钥与所述无线网络接入点建立连接；提示子模块，设置为当所述判断子模块判定所述响应信息与所述预设信息不匹配时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当接收到无线网络接入点对经加密处理的预设认证信息的响应消息时，根据该响应信息是否与预设信息匹配的判断结果确定是否可以使用对应的连接密钥安全地连接至该无线网络接入点，即通过与无线网络接入点之间预先协商好的安全验证方式，在自动连接该无线网络接入点之前先进行安全性验证，则可以确保连接的无线网络为可信任的安全网络，具体地，当无线网络接入点反馈的响应信息与预设信息匹配时，则使用对应的连接密钥自动与该无线网络接入点建立连接，否则可以通过预设方式向用户发出提示，比如通过文字结合声音和/或光的方式提示用户，进而由用户决定是否使用对应的连接密钥与无线网络接入点建立而使用该无线网络接入点提供的网络服务，以全方位满足用户连接网络的需求。
在上述任一技术方案中，优选地，所述确定模块具体还包括：解密子模块，设置为通过预设解密密钥对所述响应信息进行解密处理；以及所述判断子模块具体设置为：判断通过所述预设解密密钥解密处理后的所述响应消息是否与所述预设信息匹配。
在该技术方案中，当接收到无线网络接入点对经加密处理的预设认证信息的响应消息时，首先通过预设解密密钥对该响应信息进行解密处理，进而通过判断经解密处理后的响应信息是否与预设信息匹配，以确定是否使用对应的连接密钥与该无线网络接入点建立连接，即在与无线网络接入点之间进行预设认证信息和响应信息的传输过程中，进行加解密处理，以提高信息传输过程中的安全性，进一步提高网络连接的安全性。
其中，预设加密密钥和预设解密密钥可以对应的存储在上述预设安全网络列表中进行统一管理，进一步地，预设加密密钥和预设解密密钥为同一密钥，即在该预设安全网络列表中，对应存储任一已安全连接过的无线网络接入点的SSID、BSSID、连接密钥、预设认证信息以及用于对该预设认证信息进行加解密处理的加解密密钥。
在上述任一技术方案中，优选地，还包括：提示模块，设置为当所述检测模块检测在预设时间内未接收所述响应信息时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当向无线网络接入点发送经加密处理的预设认证信息后，若在预设时间内未接收到该无线网络接入点对应的响应信息时，即可通过预设方式向用户发出提示，比如通过文字结合声音和/或光的方式提示用户，进而由用户决定是否使用对应的连接密钥与无线网络接入点建立而使用该无线网络接入点提供的网络服务，以全方位满足用户连接网络的需求。
根据本发明的第三方面，提出了一种终端，包括：如上述技术方案中任一项所述的网络连接装置，因此，该终端具有如上述技术方案中任一项所述的网络连接装置的所有有益效果，在此不再赘述。
通过本发明的技术方案，可以有效地提高自动连接无线网络的安全性，避免连接到钓鱼网络，从而确保用户的信息安全，提升用户的使用安全性体验。
 附图说明
图1示出了根据本发明的第一实施例的网络连接方法的流程示意图；
图2示出了根据本发明的实施例的响应信息与预设信息的匹配判断流程示意图；
图3示出了根据本发明的实施例网络连接装置的示意框图；
图4示出了图3中所示的确定模块的示意框图；
图5示出了根据本发明的实施例的终端的示意框图；
图6示出了根据本发明的实施例的终端和无线网络接入点的交互流程示意图；
图7示出了根据本发明的第二实施例的网络连接方法的流程示意图；
图8示出了根据本发明的实施例的终端的示意框图。
具体实施方式
为了可以更清楚地理解本发明的上述目的、特征和优点，下面结合附图和具体实施方式对本发明进行进一步的详细描述。需要说明的是，在不冲突的情况下，本申请的实施例及实施例中的特征可以相互组合。
在下面的描述中阐述了很多具体细节以便于充分理解本发明，但是，本发明还可以采用其他不同于在此描述的其他方式来实施，因此，本发明的保护范围并不受下面公开的具体实施例的限制。
图1示出了根据本发明的第一实施例的网络连接方法的流程示意图。
如图1所示，根据本发明的第一实施例的网络连接方法，包括以下流程步骤：
步骤102，当扫描到无线网络接入点时，判断所述无线网络接入点的SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中；
步骤104，当判断结果为是时，获取并将与所述无线网络接入点对应的预设认证信息通过预设加密密钥加密处理后发送至所述无线网络接入点；
步骤106，检测是否接收到所述无线网络接入点对经加密处理后的所述预设认证信息的响应信息；
步骤108，当检测接收到所述响应信息时，根据所述响应信息确定是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当终端启动自动连接网络功能并扫描到之前连接过的无线网络接入点时，在自动连接之前，首先判断该无线网络接入点是否为安全接入点，即判断其SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中，并在判定为是时，通过预设加密密钥对与该无线网络接入点对应的预设认证信息进行加密处理后发送至该无线网络接入点，进而根据该无线网络接入点反馈的对上述经过加密处理的预设认证信息的响应信息确定是否使用对应的连接密钥与该无线网络接入点建立连接，如此，通过多层验证实现对合法的无线网络的验证识别，从而避免连接到钓鱼网络，确保用户的信息安全，则有效地提高了自动连接无线网络的安全性，提升了用户的使用安全性体验。
在上述技术方案中，优选地，可以先判断所述无线网络接入点的SSID和连接密钥是否对应存储在预设安全网络列表中，并当判定为是时，进一步判断所述无线网络接入点的BSSID是否与所述SSID和连接密钥对应存储在所述预设安全网络列表中，以对该无线网络接入点进行初步的安全验证，具体地，预设安全网络列表可以表现为如下表1所示：
表1
编号 SSID PSK BSSID 加解密密钥 认证信息
1 SSID1 xxx BSSID1 密钥1 认证信息1
2 SSID2 xxx BSSID2 密钥2 认证信息2
… … … … … …
在该表1中，SSID即为无线网络名称，PSK（Pre-shared Key，预共享密钥）表示连接到对应的无线网络的连接密钥，BSSID即要连接的接入点的BSSID，这里，预设加密密钥和预设解密密钥相同，上述表结构为基础表结构，如有需要可适当增删。
其中，与该无线网络接入点对应的预设认证信息和其对该预设认证信息的响应信息可以为相同的信息，也可以为不同的信息，具体可以为系统默认值也可以由用户自行设定，以用于终端与接入点之间的进行网络安全性的验证协商，比如，可以为无线网络的SSID或BSSID中一个部分或变形，也可以为二者的组合。
如图2所示，步骤108具体包括以下流程步骤：
步骤1082，判断所述响应消息是否与预设信息匹配；
步骤1084，当判定所述响应信息与所述预设信息匹配时，使用所述连接密钥与所述无线网络接入点建立连接；
步骤1086，当判定所述响应信息与所述预设信息不匹配时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当接收到无线网络接入点对经加密处理的预设认证信息的响应消息时，根据该响应信息是否与预设信息匹配的判断结果确定是否可以使用对应的连接密钥安全地连接至该无线网络接入点，即通过与无线网络接入点之间预先协商好的安全验证方式，在自动连接该无线网络接入点之前先进行安全性验证，则可以确保连接的无线网络为可信任的安全网络，具体地，当无线网络接入点反馈的响应信息与预设信息匹配时，则使用对应的连接密钥自动与该无线网络接入点建立连接，否则可以通过预设方式向用户发出提示，比如通过文字结合声音和/或光的方式提示用户，进而由用户决定是否使用对应的连接密钥与无线网络接入点建立而使用该无线网络接入点提供的网络服务，以全方位满足用户连接网络的需求。
当然，在该技术方案中，当检测到响应信息与预设信息不匹配时，可以直接拒绝连接到该无线网络接入点，避免任何由于连接到该无线网络接入点可能带来的安全隐患。
根据本发明的实施例，在上述步骤1082之前，包括：通过预设解密密钥对所述响应信息进行解密处理；以及步骤1082进一步地具体包括：判断通过所述预设解密密钥解密处理后的所述响应消息是否与所述预设信息匹配。
在该技术方案中，当接收到无线网络接入点对经加密处理的预设认证信息的响应消息时，首先通过预设解密密钥对该响应信息进行解密处理，进而通过判断经解密处理后的响应信息是否与预设信息匹配，以确定是否使用对应的连接密钥与该无线网络接入点建立连接，即在与无线网络接入点之间进行预设认证信息和响应信息的传输过程中，进行加解密处理，以提高信息传输过程中的安全性，进一步提高网络连接的安全性。
其中，预设加密密钥和预设解密密钥可以对应的存储在上述预设安全网络列表中进行统一管理，进一步地，预设加密密钥和预设解密密钥为同一密钥，即在该预设安全网络列表中，对应存储任一已安全连接过的无线网络接入点的SSID、BSSID、连接密钥、预设认证信息以及用于对该预设认证信息进行加解密处理的加解密密钥。
在上述任一实施例中，若上述步骤106的检测结果为未接收到无线网络接入点对经加密处理的预设认证信息的响应信息，且未接收到的时间达到了预设时间，则提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当向无线网络接入点发送经加密处理的预设认证信息后，若在预设时间（比如2分钟）内未接收到该无线网络接入点对应的响应信息时，即可通过预设方式向用户发出提示，比如通过文字结合声音和/或光的方式提示用户，进而由用户决定是否使用对应的连接密钥与无线网络接入点建立而使用该无线网络接入点提供的网络服务，以全方位满足用户连接网络的需求。
当然，在该技术方案中，当未接收到响应信息时，可以直接拒绝连接到该无线网络接入点，避免任何由于连接到该无线网络接入点可能带来的安全隐患。
图3示出了根据本发明的第一实施例的网络连接装置的示意框图。
如图3所示，根据本发明的第一实施例的网络连接装置300，包括：判断模块302、处理模块304、检测模块306和确定模块308。
其中，判断模块302，设置为当扫描到无线网络接入点时，判断所述无线网络接入点的SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中；处理模块304，设置为当所述判断模块302的判断结果为是时，获取并将与所述无线网络接入点对应的预设认证信息通过预设加密密钥加密后发送至所述无线网络接入点；检测模块306，设置为检测是否接收到所述无线网络接入点对经加密处理后的所述预设认证信息的响应信息；确定模块308，设置为当所述检测模块306检测接收到所述响应信息时，根据所述响应信息确定是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当终端启动自动连接网络功能并扫描到之前连接过的无线网络接入点时，在自动连接之前，首先判断该无线网络接入点是否为安全接入点，即判断其SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中，并在判定为是时，通过预设加密密钥对与该无线网络接入点对应的预设认证信息进行加密处理后发送至该无线网络接入点，进而根据该无线网络接入点反馈的对上述经过加密处理的预设认证信息的响应信息确定是否使用对应的连接密钥与该无线网络接入点建立连接，如此，通过多层验证实现对合法的无线网络的验证识别，从而避免连接到钓鱼网络，确保用户的信息安全，则有效地提高了自动连接无线网络的安全性，提升了用户的使用安全性体验。
其中，与该无线网络接入点对应的预设认证信息和其对该预设认证信息的响应信息可以为相同的信息，也可以为不同的信息，具体可以为系统默认值也可以由用户自行设定，以用于终端与接入点之间的进行网络安全性的验证协商，比如，可以为无线网络的SSID或BSSID中一个部分或变形，也可以为二者的组合。
如图4所示，所述确定模块308具体包括：判断子模块3082、网络连接子模块3084、提示子模块3086和解密子模块3088。
其中，判断子模块3082，设置为判断所述响应消息是否与预设信息匹配；网络连接子模块3084，设置为当所述判断子模块3082判定所述响应信息与所述预设信息匹配时，使用所述连接密钥与所述无线网络接入点建立连接；提示子模块3086，设置为当所述判断子模块3082判定所述响应信息与所述预设信息不匹配时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当接收到无线网络接入点对经加密处理的预设认证信息的响应消息时，根据该响应信息是否与预设信息匹配的判断结果确定是否可以使用对应的连接密钥安全地连接至该无线网络接入点，即通过与无线网络接入点之间预先协商好的安全验证方式，在自动连接该无线网络接入点之前先进行安全性验证，则可以确保连接的无线网络为可信任的安全网络，具体地，当无线网络接入点反馈的响应信息与预设信息匹配时，则使用对应的连接密钥自动与该无线网络接入点建立连接，否则可以通过预设方式向用户发出提示，比如通过文字结合声音和/或光的方式提示用户，进而由用户决定是否使用对应的连接密钥与无线网络接入点建立而使用该无线网络接入点提供的网络服务，以全方位满足用户连接网络的需求。
当然，在该技术方案中，当检测到响应信息与预设信息不匹配时，可以直接拒绝连接到该无线网络接入点，避免任何由于连接到该无线网络接入点可能带来的安全隐患。
其中，解密子模块3088，设置为通过预设解密密钥对所述响应信息进行解密处理；以及所述判断子模块3082具体设置为：判断通过所述预设解密密钥解密处理后的所述响应消息是否与所述预设信息匹配。
在该技术方案中，当接收到无线网络接入点对经加密处理的预设认证信息的响应消息时，首先通过预设解密密钥对该响应信息进行解密处理，进而通过判断经解密处理后的响应信息是否与预设信息匹配，以确定是否使用对应的连接密钥与该无线网络接入点建立连接，即在与无线网络接入点之间进行预设认证信息和响应信息的传输过程中，进行加解密处理，以提高信息传输过程中的安全性，进一步提高网络连接的安全性。
其中，预设加密密钥和预设解密密钥可以对应的存储在上述预设安全网络列表中进行统一管理，进一步地，预设加密密钥和预设解密密钥为同一密钥，即在该预设安全网络列表中，对应存储任一已安全连接过的无线网络接入点的SSID、BSSID、连接密钥、预设认证信息以及用于对该预设认证信息进行加解密处理的加解密密钥。
在上述任一技术方案中，优选地，还包括：提示模块310，设置为当所述检测模块306检测在预设时间内未接收所述响应信息时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
在该技术方案中，当向无线网络接入点发送经加密处理的预设认证信息后，若在预设时间内未接收到该无线网络接入点对应的响应信息时，即可通过预设方式向用户发出提示，比如通过文字结合声音和/或光的方式提示用户，进而由用户决定是否使用对应的连接密钥与无线网络接入点建立而使用该无线网络接入点提供的网络服务，以全方位满足用户连接网络的需求。
当然，在该技术方案中，当未接收到响应信息时，可以直接拒绝连接到该无线网络接入点，避免任何由于连接到该无线网络接入点可能带来的安全隐患。
图5示出了根据本发明的实施例的终端的示意框图。
如图5所示，根据本发明的实施例的终端500，包括：如上述技术方案中任一项所述的网络连接装置300，因此，该终端500具有如上述技术方案中任一项所述的网络连接装置300的所有有益效果，在此不再赘述。
图6示出了根据本发明的实施例的终端和无线网络接入点的交互流程，具体包括以下步骤：
步骤602，当终端判定当前连接的无线网络接入点为安全接入点时，将该无线网络接入点的SSID、BSSID和连接密钥对应存储在预设安全网络列表，同时针对该无线网络接入点设置预设认证信息和预设加解密密钥，并将预设认证信息、预设加解密密钥也对应存储在该预设安全网络列表。
步骤604，当终端开启网络自动连接功能，且扫描到相同的无线网络接入点时，判断该无线网络接入点的SSID是否存储在上述预设安全网络列表中，当判定为是时，执行步骤606。
步骤606，判断该无线网络接入点的BSSID是否存储在上述预设安全网络列表中，当判定为是时，执行步骤608。
步骤608，终端通过预设加解密密钥对预设认证信息进行加密，并将加密后的预设认证信息发送至无线网络接入点。
步骤610，无线网络接入点通过存储的预设加解密密钥对终端发来的经加密处理的预设认证信息进行解密处理，并判断解密后的预设认证信息是否与存储的预设认证信息匹配，若匹配，则执行步骤612。
步骤612，无线网络接入点通过预设加解密密钥对解密后的预设认证信息进行加密处理，并将加密后的预设认证信息发送至终端。
步骤614，终端通过存储的预设加解密密钥对无线网络接入点发送的经加密处理的预设认证信息进行解密处理，并判断解密后的预设认证信息是否与存储的预设认证信息匹配，若匹配，则执行步骤616。
步骤616，终端使用连接密钥与无线网络接入点建立连接。
在该实施例中终端和无线网络接入点共同维护一套预设认证信息和预设加解密密钥。若具有相同的SSID、连接密钥和BSSID的无线网络接入点无法对终端通过预设加解密密钥进行加密处理的预设认证信息进行解密，则可确定该无线网络接入点为钓鱼网络，终端不与无线网络接入点建立连接。
图7示出了根据本发明的第二实施例的网络连接方法的流程示意图。
如图7所示，根据本发明的第二实施例的网络连接方法，具体包括以下流程步骤：
步骤702，当用户判断当前所连接的AP热点为安全热点后，将此AP信息添加到安全AP热点表（即预设安全网络列表）中，同时，终端对此AP热点生成一个加解密密钥，由终端和AP侧共同维护，即终端侧和AP侧同时保存一个一对一的加解密密钥，即终端侧和AP侧用于加解密处理的预设加密密钥和预设解密密钥为同一密钥。
步骤704，当终端在移动过程中，扫描到了与之前连接的AP热点具有相同SSID和PSK的AP热点时，且终端开启了自动连接功能，在自动连接前增加执行以下步骤。
步骤706，判断此AP信息是否在安全AP热点表中，即判断此AP热点的SSID是否在安全热点AP表中，若不在此表中，则默认为危险AP热点，在终端中进行提示由用户决定是否进行自动连接，若存在执行步骤708。
步骤708，判断此AP热点的BSSID是否与当前表中的一致，即判断当前AP侧MAC（Media Access Control，媒体访问控制）地址是否与安全热点AP表中所对应的MAC地址保持一致，若不一致，则默认为危险AP热点，在终端中进行提示由用户决定是否进行自动连接，若存在执行步骤710。
步骤710，使用对应的加密密钥对认证信息进行加密，并将加密后的信息发送到AP侧。
步骤712，判断是否能收到AP侧返回的认证Response（响应），即等待AP侧反馈Response信息，即在AP侧对认证信息使用相同的密钥进行解密，若在固定周期内无反馈信息，在终端中进行提示由用户决定是否进行自动连接，若接收到反馈信息则匹配反馈信息是否与表中信息保持一致，若一致则发送自动连接请求，以进行自动连接。
步骤714，根据自动连接请求，根据WIFI连接策略进行连接。
在步骤702中，需要AP侧和终端侧共同维护加解密密钥和认证信息，AP侧针对所连接的设备进行维护，保存加解密密钥和认证信息。
在步骤702中，AP侧需要使用相同的加解密密钥对认证信息进行解密，并将解密信息发回到终端侧。而钓鱼AP热点由于没有加解密密钥则不会对其进行解密，也不知道发回什么Response，则最终保证AP热点的安全性。
综上，该技术方案的目的是维护用户确认的安全AP热点表，当碰到相同SSID和密码的AP热点时，通过上述三次判断来确认是否为安全可连接的AP热点。
通过上述实施例，利用三个层次的防范来防止用户在开启自动连接AP热点功能后连接到具有相同SSID和连接密钥的钓鱼AP热点，即当用户连接上某AP热点后，若用户确定此AP热点安全，则将此AP热点的信息添加到安全热点AP表中，同时移动终端与AP侧共同维护一个加解密密钥和认证信息；当用户在开启自动连接功能后，碰到具有相同SSID和密码的AP热点后，在自动连接之前增加认证过程：首先判断是否在安全热点AP表中，若是继续判断当前AP的BSSID与保存在AP列表中的是否保持一致，若是则使用此AP所对应的加密密钥对认证信息进行加密后发送给AP侧，若能收到AP侧反馈回来的连接Response并且解密出来的认证信息正确（只有具有解密密钥的AP进行解密匹配后才能反馈Response）则进行更进一步的自动连接操作，对不在安全AP热点表的AP热点、BSSID不正确、没有反馈连接Response的热点不进行自动连接操作，如此，可极大提高用户的安全体验，具有有益效果。
在进一步的实施例中，结合图3至图5，如图8所示，是本发明实施例提供的终端的结构示意图。所述的终端500包括：至少一个处理器501，例如CPU，至少一个接收器503，至少一个存储器504，至少一个发送器505，至少一个通信总线502。其中，所述通信总线502用于实现这些组件之间的连接通信。其中，所述接收器503和所述发送器505可以是有线发送端口，也可以为无线设备，例如包括天线装置，用于与其他设备进行数据通信。所述存储器504可以是高速RAM存储器，也可以是非暂态存储器（non-transitory memory）。
所述处理器501可执行所述终端500的操作系统以及安装的各类应用程序、程序代码等，例如，上述的各个模块，包括所述判断模块302、所述处理模块304等。
所述存储器504中存储有程序代码，且所述处理器501可通过通信总线502，调用所述存储器504中存储的程序代码以执行相关的功能。例如，图3、4中所述的各个模块或子模块（例如，所述判断模块302、所述处理模块304等）是存储在所述存储器504中的程序代码，并由所述处理器501所执行，从而实现所述各个模块的功能。
在本发明的一个实施例中，所述存储器504存储多个指令，所述多个指令被所述处理器501所执行以实现网络连接方法。具体而言，所述处理器501对所述多个指令的执行包括：当扫描到无线网络接入点时，判断所述无线网络接入点的SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中；当判断结果为是时，获取并将与所述无线网络接入点对应的预设认证信息通过预设加密密钥加密处理后发送至所述无线网络接入点；检测是否接收到所述无线网络接入点对经加密处理后的所述预设认证信息的响应信息；当检测接收到所述响应信息时，根据所述响应信息确定是否使用所述连接密钥与所述无线网络接入点建立连接。
在进一步的实施例中，所述当检测接收到所述响应信息时，根据所述响应信息确定是否使用所述连接密钥与所述无线网络接入点建立连接，具体包括：判断所述响应消息是否与预设信息匹配；当判定所述响应信息与所述预设信息匹配时，使用所述连接密钥与所述无线网络接入点建立连接；当判定所述响应信息与所述预设信息不匹配时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
在进一步的实施例中，在所述判断所述响应消息是否与预设信息匹配之前，所述处理器501通过预设解密密钥对所述响应信息进行解密处理；以及所述判断所述响应消息是否与预设信息匹配，具体包括：判断通过所述预设解密密钥解密处理后的所述响应消息是否与所述预设信息匹配。
在进一步的实施例中，当检测在预设时间内未接收所述响应信息时，所述处理器501提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
具体地，所述处理器501对上述指令的具体实现方法可参考图1-2与图6-7对应实施例中相关步骤的描述，在此不赘述。
以上结合附图详细说明了本发明的技术方案，通过本发明的技术方案，可以有效地提高自动连接无线网络的安全性，避免连接到钓鱼网络，从而确保用户的信息安全，提升用户的使用安全性体验。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (9)

  1. 一种网络连接方法，其特征在于，包括：
    当扫描到无线网络接入点时，判断所述无线网络接入点的SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中；
    当判断结果为是时，获取并将与所述无线网络接入点对应的预设认证信息通过预设加密密钥加密处理后发送至所述无线网络接入点；
    检测是否接收到所述无线网络接入点对经加密处理后的所述预设认证信息的响应信息；
    当检测接收到所述响应信息时，根据所述响应信息确定是否使用所述连接密钥与所述无线网络接入点建立连接。
  2. 根据权利要求1所述的网络连接方法，其特征在于，所述当检测接收到所述响应信息时，根据所述响应信息确定是否使用所述连接密钥与所述无线网络接入点建立连接，具体包括：
    判断所述响应消息是否与预设信息匹配；
    当判定所述响应信息与所述预设信息匹配时，使用所述连接密钥与所述无线网络接入点建立连接；
    当判定所述响应信息与所述预设信息不匹配时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
  3. 根据权利要求2所述的网络连接方法，其特征在于，在所述判断所述响应消息是否与预设信息匹配之前，包括：
    通过预设解密密钥对所述响应信息进行解密处理；以及
    所述判断所述响应消息是否与预设信息匹配，具体包括：
    判断通过所述预设解密密钥解密处理后的所述响应消息是否与所述预设信息匹配。
  4. 根据权利要求1至3中任一项所述的网络连接方法，其特征在于，当检测在预设时间内未接收所述响应信息时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
  5. 一种网络连接装置，其特征在于，包括：
    判断模块，设置为当扫描到无线网络接入点时，判断所述无线网络接入点的SSID、BSSID和连接密钥是否对应存储在预设安全网络列表中；
    处理模块，设置为当所述判断模块的判断结果为是时，获取并将与所述无线网络接入点对应的预设认证信息通过预设加密密钥加密后发送至所述无线网络接入点；
    检测模块，设置为检测是否接收到所述无线网络接入点对经加密处理后的所述预设认证信息的响应信息；
    确定模块，设置为当所述检测模块检测接收到所述响应信息时，根据所述响应信息确定是否使用所述连接密钥与所述无线网络接入点建立连接。
  6. 根据权利要求5所述的网络连接装置，其特征在于，所述确定模块具体包括：
    判断子模块，设置为判断所述响应消息是否与预设信息匹配；
    网络连接子模块，设置为当所述判断子模块判定所述响应信息与所述预设信息匹配时，使用所述连接密钥与所述无线网络接入点建立连接；
    提示子模块，设置为当所述判断子模块判定所述响应信息与所述预设信息不匹配时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
  7. 根据权利要求6所述的网络连接装置，其特征在于，所述确定模块具体还包括：
    解密子模块，设置为通过预设解密密钥对所述响应信息进行解密处理；以及
    所述判断子模块具体设置为：判断通过所述预设解密密钥解密处理后的所述响应消息是否与所述预设信息匹配。
  8. 根据权利要求5至7中任一项所述的网络连接装置，其特征在于，还包括：
    提示模块，设置为当所述检测模块检测在预设时间内未接收所述响应信息时，提示用户是否使用所述连接密钥与所述无线网络接入点建立连接。
  9. 一种终端，其特征在于，包括：如权利要求5至7中任一项所述的网络连接装置。
PCT/CN2016/103876 2016-06-30 2016-10-29 网络连接方法、网络连接装置和终端 WO2018000674A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610514279.4A CN106131834B (zh) 2016-06-30 2016-06-30 网络连接方法、网络连接装置和终端
CN201610514279.4 2016-06-30

Publications (1)

Publication Number Publication Date
WO2018000674A1 true WO2018000674A1 (zh) 2018-01-04

Family

ID=57468984

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/103876 WO2018000674A1 (zh) 2016-06-30 2016-10-29 网络连接方法、网络连接装置和终端

Country Status (2)

Country Link
CN (1) CN106131834B (zh)
WO (1) WO2018000674A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109495979A (zh) * 2018-11-20 2019-03-19 北京小米移动软件有限公司 无线网络连接方法及装置

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107148016A (zh) * 2017-04-20 2017-09-08 宇龙计算机通信科技(深圳)有限公司 终端连接方法、装置以及电子设备
CN107896164B (zh) * 2017-11-28 2021-10-29 上海华测导航技术股份有限公司 一种gnss接收机批量配置方法
CN108337679A (zh) * 2018-03-13 2018-07-27 徐磊 一种提高无线网络接入安全性的方法
CN111107551A (zh) * 2018-10-29 2020-05-05 杭州海康威视数字技术股份有限公司 无线网桥连网方法及装置
CN110366172B (zh) * 2019-08-23 2022-08-26 北京丁牛科技有限公司 一种无线访问接入点的安全性评级方法及装置
CN111511043B (zh) * 2020-04-14 2023-07-18 腾讯科技（深圳）有限公司 网络连接方法、装置、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103648094A (zh) * 2013-11-19 2014-03-19 华为技术有限公司 一种检测非法无线接入点的方法、装置及系统
CN104023336A (zh) * 2014-06-13 2014-09-03 张力军 移动终端的无线接入方法及移动终端
CN104394533A (zh) * 2014-11-24 2015-03-04 中国联合网络通信集团有限公司 无线保真WiFi连接方法、服务器及终端
CN105163316A (zh) * 2015-07-31 2015-12-16 腾讯科技（深圳）有限公司 接入Wi-Fi热点的方法及装置
CN105636037A (zh) * 2015-06-29 2016-06-01 宇龙计算机通信科技(深圳)有限公司 认证方法、装置及电子设备

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102843682B (zh) * 2012-08-20 2015-03-18 中国联合网络通信集团有限公司 接入点认证方法、装置及系统
CN105282821A (zh) * 2014-07-21 2016-01-27 中兴通讯股份有限公司 一种终端及终端连接无线保真WiFi热点的方法
CN105657706A (zh) * 2015-10-30 2016-06-08 东莞酷派软件技术有限公司 一种接入方法、相关设备及接入装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103648094A (zh) * 2013-11-19 2014-03-19 华为技术有限公司 一种检测非法无线接入点的方法、装置及系统
CN104023336A (zh) * 2014-06-13 2014-09-03 张力军 移动终端的无线接入方法及移动终端
CN104394533A (zh) * 2014-11-24 2015-03-04 中国联合网络通信集团有限公司 无线保真WiFi连接方法、服务器及终端
CN105636037A (zh) * 2015-06-29 2016-06-01 宇龙计算机通信科技(深圳)有限公司 认证方法、装置及电子设备
CN105163316A (zh) * 2015-07-31 2015-12-16 腾讯科技（深圳）有限公司 接入Wi-Fi热点的方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109495979A (zh) * 2018-11-20 2019-03-19 北京小米移动软件有限公司 无线网络连接方法及装置
CN109495979B (zh) * 2018-11-20 2022-05-20 北京小米移动软件有限公司 无线网络连接方法及装置

Also Published As

Publication number Publication date
CN106131834A (zh) 2016-11-16
CN106131834B (zh) 2020-01-10

Similar Documents

Publication Publication Date Title
WO2018000674A1 (zh) 网络连接方法、网络连接装置和终端
WO2015065063A1 (en) Method and apparatus to identity verification using asymmetric keys in wireless direct communication network
WO2014171707A1 (ko) 이동 통신에서 가입 사업자 재가입 혹은 추가 가입 제한 정책을 지원하는 보안 방안 및 시스템
WO2011081311A2 (ko) 이동 통신 시스템에서 보안을 지원하는 방법 및 시스템
US8046583B2 (en) Wireless terminal
KR100709622B1 (ko) 무선 홈 네트워크에 디바이스를 등록시키기 위한 방법
US9392453B2 (en) Authentication
WO2011021883A2 (en) Method and apparatus for reducing overhead for integrity check of data in wireless communication system
WO2010019020A2 (ko) 이동 통신 시스템의 보안화된 비계층 프로토콜 처리 방법
US20060094401A1 (en) Method and apparatus for authentication of mobile devices
WO2010062045A2 (en) Security system and method for wireless communication system
WO2015065165A1 (ko) 이동 통신 시스템 환경에서 프락시미티 기반 서비스 단말 간 발견 및 통신을 지원하기 위한 보안 방안 및 시스템
WO2015105402A1 (ko) 이동 통신 시스템에서 서비스 발견 및 그룹 통신을 위한 보안 지원방법 및 시스템
WO2016068655A1 (en) Method of performing device to device communication between user equipments
WO2011081242A1 (ko) 바이너리 cdma에서 키 인증 방법
WO2013005947A2 (en) Apparatus, method and system for creating and maintaining multicast data encryption key in machine to machine communication system
WO2017078459A1 (en) Method, ue and network node for protecting user privacy in networks
EP2460371A2 (en) Method and apparatus for creating security context and managing communication in mobile communication network
JP2004297783A (ja) 無線ネットワークハンドオフ暗号鍵
WO2019009557A1 (ko) Esim 단말과 서버가 디지털 인증서를 협의하는 방법 및 장치
WO2012093900A2 (en) Method and device for authenticating personal network entity
WO2022025566A1 (en) Methods and systems for deriving cu-up security keys for disaggregated gnb architecture
JP2006520571A (ja) セキュア鍵及びログオフを用いるｗｌａｎセッション管理技術
WO2015105401A1 (ko) 이동 통신에서 prose그룹 통신 또는 공공 안전을 지원하기 위한 보안 방안 및 시스템
WO2020067734A1 (ko) 넌어드레스 네트워크 장비 및 이를 이용한 통신 보안 시스템

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16907070

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16907070

Country of ref document: EP

Kind code of ref document: A1