WO2018233391A1 - 接入控制方法、装置及系统、安全区域确定方法及装置 - Google Patents

接入控制方法、装置及系统、安全区域确定方法及装置 Download PDF

Info

Publication number
WO2018233391A1
WO2018233391A1 PCT/CN2018/085983 CN2018085983W WO2018233391A1 WO 2018233391 A1 WO2018233391 A1 WO 2018233391A1 CN 2018085983 W CN2018085983 W CN 2018085983W WO 2018233391 A1 WO2018233391 A1 WO 2018233391A1
Authority
WO
WIPO (PCT)
Prior art keywords
wireless access
terminal
access device
distance
anchor
Prior art date
Application number
PCT/CN2018/085983
Other languages
English (en)
French (fr)
Inventor
刘鹏
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP18820664.3A priority Critical patent/EP3644629A4/en
Publication of WO2018233391A1 publication Critical patent/WO2018233391A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/63—Location-dependent; Proximity-dependent
    • H04W12/64—Location-dependent; Proximity-dependent using geofenced areas
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/021—Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/086—Access security using security domains
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/023—Services making use of location information using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/025—Services making use of location information using location based information parameters
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H04W48/04—Access restriction performed under specific conditions based on user or terminal location or mobility data, e.g. moving direction, speed

Definitions

  • the present disclosure relates to the field of communications technologies, and, for example, to an access control method, apparatus and system, and security area determining method and apparatus.
  • the means for the user's wireless router to securely access and protect the user is generally implemented by an Access Control List (ACL) technology.
  • ACL Access Control List
  • a media access control (MAC) address list of the terminal device that is allowed to access, or a MAC address list of the terminal device that is prohibited from accessing is provided in advance on the wireless router; and a MAC address of the terminal device that is allowed to access For the list, the user needs to pre-set the terminal device that allows the wireless router to be used. Only the terminal device recorded in the MAC address list of the terminal device that is allowed to access can connect to the wireless router to access the Internet; for the MAC address of the terminal device that is prohibited from accessing For the address list, the user needs to preset the terminal device that is prohibited from accessing the wireless router. Only the terminal device that is not in the MAC address list of the terminal device that is prohibited from accessing can connect to the wireless router to access the Internet.
  • the implementation of the above technical solution is not flexible enough, the security access control of the terminal device is rigid, and there is also a large security hole.
  • the security access control of the terminal device is rigid, and there is also a large security hole.
  • the user For example, for the scheme of setting the access control of the MAC address list of the terminal device that is allowed to access, the user needs to know in advance which terminal devices should have the right to access the wireless router. If there is any omission, the user terminal needs to manually enter the missing terminal device.
  • the scheme of setting the access control of the MAC address list of the terminal device that prohibits access the user needs to know in advance which terminal devices need to prohibit the connection to access the wireless router.
  • Each step of the above security control scheme requires the participation of the user, and may result in a security breach due to human error.
  • the wireless router adopts the access control list technology
  • the hacker can perform the crack attack by disguising the MAC address of the terminal device as a legitimate user.
  • the access security of wireless routers needs to be improved.
  • the embodiment of the present invention provides an access control method, device, and system, and a security area determining method and device, which are effective for improving access security of a wireless access device.
  • an embodiment of the present application provides an access control method, including:
  • the wireless access device acquires location information of the terminal in a three-dimensional coordinate system constructed by the wireless access device and the anchor device;
  • the embodiment of the present application provides a security area determining method, including:
  • the predetermined terminal includes a terminal that is recognized by the wireless access device as being legal;
  • an embodiment of the present application provides an access control apparatus, configured in a wireless access device, including: a first positioning module, a security area detecting module, and an access control module;
  • the first positioning module is configured to acquire location information of the terminal in a three-dimensional coordinate system constructed by the wireless access device and the anchor device;
  • the security area detecting module is configured to determine, according to the location information of the terminal in the three-dimensional coordinate system, whether the terminal is in a security area of the wireless access device;
  • the access control module is configured to perform an access control operation corresponding to the determination result according to the determination result.
  • the embodiment of the present application provides a security area determining apparatus, including:
  • a second positioning module configured to acquire, after the one or more predetermined terminals are connected to the wireless access device, the one or more predetermined terminals in a three-dimensional coordinate system constructed by the wireless access device and the anchor device Location information, wherein the predetermined terminal includes a terminal that the wireless access device identifies as legitimate;
  • the processing module is configured to perform, according to the obtained location information of the one or more predetermined terminals in the three-dimensional coordinate system, at least one of: establishing a security area of the wireless access device, and adjusting the wireless connection Enter the security zone of the device.
  • an embodiment of the present application provides an access control system, including: an anchor device and a wireless access device, where the wireless access device is configured with the access control device of the third aspect, and the anchor device Connected to the wireless access device.
  • the embodiment of the present application further provides a wireless access device, including: a memory, a processor, and an access control program stored on the memory and operable on the processor, the control access control program
  • a wireless access device including: a memory, a processor, and an access control program stored on the memory and operable on the processor, the control access control program
  • the access control method of the first aspect described above is implemented when executed by the processor.
  • the embodiment of the present application further provides a machine readable medium storing an access control program, where the access control program is executed by a processor to implement the access control method of the first aspect.
  • the wireless access device can be effectively ensured that the wireless access device is not maliciously attacked by the surrounding hacker or the password of the wireless access device is cracked, thereby improving Access security for wireless access devices.
  • the positioning of the terminal is performed by the cooperation of the wireless access device and the anchor device, thereby improving the positioning accuracy.
  • the predetermined terminal is positioned by the cooperation of the wireless access device and the anchor device to determine the security area, and the accuracy and applicability of the security area are improved.
  • FIG. 1 is a flowchart of an access control method according to an embodiment of the present application
  • FIG. 2 is a schematic diagram of a location of a wireless access device and an anchor device according to Embodiment 1 of the present application;
  • FIG. 3 is a schematic diagram of determining a location information of a terminal by using a wireless access device and an anchor device in the first embodiment of the present application;
  • FIG. 4 is a schematic diagram of another location of a wireless access device and an anchor device according to Embodiment 1 of the present application;
  • FIG. 5 is a flowchart of a security area establishment and detection process of a wireless router according to Embodiment 2 of the present application;
  • FIG. 6 is a schematic diagram of a security area of a wireless router according to Embodiment 2 of the present application.
  • FIG. 7 is a schematic diagram of a security area of another wireless router in Embodiment 2 of the present application.
  • FIG. 8 is a schematic diagram of a security area of another wireless router according to Embodiment 2 of the present application.
  • FIG. 9 is a flowchart 1 of the third embodiment of the present application.
  • FIG. 10 is a second flowchart of the third embodiment of the present application.
  • FIG. 11 is a third flowchart of the third embodiment of the present application.
  • FIG. 12 is a schematic diagram of a wireless access device according to an embodiment of the present disclosure.
  • FIG. 13 is a flowchart of a method for determining a security area according to an embodiment of the present application.
  • FIG. 14 is a schematic diagram of a security area determining apparatus according to an embodiment of the present application.
  • FIG. 1 is a flowchart of an access control method according to an embodiment of the present application. As shown in FIG. 1, the access control method in this embodiment includes the following steps:
  • the wireless access device acquires location information of the terminal in a three-dimensional coordinate system constructed by the wireless access device and the anchor device.
  • S102 Determine, according to the location information of the terminal in the three-dimensional coordinate system, whether the terminal is in a security area of the wireless access device.
  • the wireless access device may include at least one of the following: a wireless router and a Customer Premise Equipment (CPE).
  • the anchor device may refer to a wireless communication device capable of transmitting a positioning signal and a data transmission signal.
  • the anchor device may be a WiFi signal transmitting and receiving device for ranging based on a FTM (Fine Timing Measurement). The measured distance information is transmitted to the wireless access device by using a WiFi signal.
  • FTM Freine Timing Measurement
  • the method in this embodiment may further include: establishing or adjusting a security area of the wireless access device by using at least one of the following manners:
  • UI user interface
  • Establishing or adjusting a security area of the wireless access device by acquiring location information in the three-dimensional coordinate system after the one or more predetermined terminals are connected to the wireless access device, wherein the predetermined terminal includes the wireless access device being recognized as legal Terminal.
  • the predetermined terminal may include a terminal that is recognized by the wireless access device as being legal; for example, the first terminal that accesses the wireless access device, or the terminal that is recorded in the MAC address list that the wireless access device allows to access.
  • this application is not limited thereto.
  • the wireless access device may establish the security zone by using the foregoing at least one manner; subsequently, the wireless access device may adjust the established security zone by using the foregoing at least one manner.
  • the wireless access device may establish a security zone by acquiring location information in a three-dimensional coordinate system after the predetermined terminal is connected to the wireless access device, and then, according to information input by the UI, adjust the established security zone; or, the wireless access device
  • the security area may be established according to the preset information, and then the established security area is adjusted by acquiring the location information in the three-dimensional coordinate system after the predetermined terminal is connected to the wireless access device.
  • this application is not limited thereto.
  • the security area of the wireless access device is a three-dimensional space.
  • the security zone may be a three-dimensional volume including a horizontal security zone and a vertical security zone.
  • this application is not limited thereto.
  • the shape of the secure area is not limited in the present application.
  • the horizontal security area may be a regular shape such as a polygon, a circle, an ellipse, or other irregular shapes.
  • the security zone of the wireless access device may be determined by the wireless access device; at this time, by acquiring location information of the one or more predetermined terminals after connecting the wireless access device in the three-dimensional coordinate system, establishing or Adjusting the security zone of the wireless access device can include:
  • the wireless access device detects a distance between the wireless access device and one or more predetermined terminals, a distance between the wireless access device and each anchor device, and receives the anchor device from the anchor device with one or more The distance between the predetermined terminals; or the wireless access device detects the distance between the wireless access device and the one or more predetermined terminals, and receives the distance between the anchor device and the wireless access device from the anchor device The distance between the anchor device and one or more predetermined terminals;
  • the wireless access device can then be based on the distance between the wireless access device and one or more predetermined terminals, the distance between the wireless access device and the anchor device, and between the anchor device and the one or more predetermined terminals. Distance, calculating the three-dimensional coordinates of one or more predetermined terminals under the three-dimensional coordinate system constructed by the wireless access device and the anchor device, that is, acquiring position information of one or more predetermined terminals in the three-dimensional coordinate system.
  • the wireless access device may determine the security zone according to the location information of the multiple legal terminals connected thereto in the three-dimensional coordinate system at a predetermined time; or, the wireless access device The security area may be determined according to location information of the plurality of legal terminals connected thereto in a three-dimensional coordinate system at a plurality of different moments; or the wireless access device may move according to a predetermined moving speed according to a legal terminal connected thereto Obtaining the location information to determine the security zone; or the wireless access device may determine the security zone according to the periodic location information of a legitimate terminal connected thereto.
  • this application is not limited thereto.
  • the security zone of the wireless access device may be determined by the anchor device, and then the anchor device transmits the determined information of the security zone to the wireless access device; wherein the anchor device may be established by: Or adjust the security zone of the wireless access device:
  • the anchor device detects a distance between the anchor device and the predetermined terminal, and a distance between the anchor device and the wireless access device, and receives a distance between the wireless access device and the predetermined terminal from the wireless access device; or The anchor device detects a distance between the anchor device and the predetermined terminal, and receives a distance between the wireless access device and the anchor device, and a distance between the wireless access device and the predetermined terminal from the wireless access device;
  • the anchor device can calculate the three-dimensional coordinates of the wireless access device and the anchor device according to the distance from the predetermined terminal, the distance between the wireless access device, and the distance between the wireless access device and the predetermined terminal.
  • the three-dimensional coordinates of the predetermined terminal are calculated, that is, the position information of the predetermined terminal in the three-dimensional coordinate system is acquired.
  • the security area is a three-dimensional space including a horizontal security area and a vertical security area.
  • determining whether the terminal is in the security area of the wireless access device may include:
  • the location information of the terminal it is determined whether the terminal is located in the horizontal security zone.
  • the terminal is not located in the horizontal security zone, it is determined that the terminal is not in the security zone; if the terminal is located in the horizontal security zone, it is determined whether the terminal is located in the vertical security zone; the terminal is located in the vertical security zone. In the case of the inside, it is determined that the terminal is not in the security zone, and if the terminal is not located in the vertical security zone, it is determined that the terminal is not in the security zone.
  • a terminal if it is determined that the terminal is located in the horizontal security zone or in the vertical security zone according to the location information of the terminal in the three-dimensional coordinate system, it is determined that the terminal is in the security zone of the wireless access device. If it is determined that the terminal is not located in the horizontal security area or not in the vertical security area according to the location information of the terminal in the three-dimensional coordinate system, it is determined that the terminal is not in the security area of the wireless access device.
  • step S103 may include:
  • the wireless access device detects that any terminal is successfully connected to the wireless access device, if the terminal is determined to be in the secure area of the wireless access device, the terminal is allocated a traffic bandwidth that satisfies the first condition, and satisfies the A conditional traffic bandwidth may be referred to as a first traffic bandwidth;
  • the terminal When it is determined that the terminal is not in the security area of the wireless access device, the terminal is allocated a traffic bandwidth that satisfies the second condition, or stops allocating the traffic bandwidth to the terminal, and the traffic bandwidth that satisfies the second condition may be referred to as Second traffic bandwidth;
  • the traffic bandwidth that satisfies the first condition is greater than the traffic bandwidth that satisfies the second condition.
  • the terminal may be allocated sufficient Internet traffic bandwidth, and the terminal is in the non-secure area of the wireless access device and connected to the wireless device. After accessing the device, you can limit or stop allocating Internet traffic bandwidth to the terminal, but will not actively disconnect the terminal.
  • step S103 may include:
  • the wireless access device detects that the number of failures of any terminal to continuously connect to the wireless access device within a predetermined time period satisfies a threshold condition, if it is determined that the terminal is in a secure area of the wireless access device, temporarily stopping the terminal Continue the connection behavior and give a prompt to confirm whether the terminal is abnormal;
  • the connection behavior of the terminal is blocked and the request of the terminal is not responded.
  • the threshold condition may include: the number of failures of consecutively connecting the wireless access device within the predetermined duration is greater than or equal to a security threshold.
  • the terminal when the number of consecutive connection failures of the terminal within a predetermined duration satisfies a threshold condition (ie, it is considered that there is a possibility of hacking), if the terminal is in the security area of the wireless access device, the administrator is notified. Confirm that if the terminal is not in the security zone, the terminal is blacked out.
  • a threshold condition ie, it is considered that there is a possibility of hacking
  • step S103 may include:
  • the terminal After periodically obtaining the location information of the terminal connected to the wireless access device, in the case that the terminal is determined to be in the security zone of the wireless access device, the terminal is allocated a traffic bandwidth that satisfies the third condition, and the third condition is satisfied.
  • the traffic bandwidth can be referred to as the third traffic bandwidth;
  • the terminal When it is determined that the terminal is not in the security zone of the wireless access device, the terminal is allocated a traffic bandwidth that satisfies the fourth condition, and the traffic bandwidth that satisfies the fourth condition may be referred to as a fourth traffic bandwidth.
  • the traffic bandwidth that satisfies the third condition is greater than the traffic bandwidth that satisfies the fourth condition.
  • the terminal when the terminal is in the security zone of the wireless access device, the terminal may be allocated sufficient Internet traffic bandwidth.
  • the terminal may be restricted or stopped.
  • the terminal allocates Internet traffic bandwidth, but does not actively disconnect from the terminal.
  • the traffic bandwidth that satisfies the third condition may be the same as or different from the traffic bandwidth that meets the first condition
  • the traffic bandwidth that satisfies the fourth condition may be the same as or different from the traffic bandwidth that meets the second condition.
  • this application is not limited thereto.
  • the application does not limit the access control operation performed, and the access control operation required to be performed may be adaptively adjusted according to an actual application scenario to improve the wireless access device. Access security.
  • the number of anchor devices may include at least two;
  • the wireless access device acquires location information of the terminal in a three-dimensional coordinate system constructed by the wireless access device and the anchor device, and includes: the wireless access device acquires the terminal by the wireless access device and the The position information in the three-dimensional coordinate system constructed by the at least two anchor devices is configured, wherein the three-dimensional coordinate system constructed by the wireless access device and the at least two anchor devices may be a spatial rectangular coordinate system.
  • step S101 may include:
  • the wireless access device detects a distance between the wireless access device and the terminal, and a distance between the wireless access device and each of the at least two anchor devices, and receives the anchor device from the anchor device The distance between the terminals; or,
  • the wireless access device detects a distance between the wireless access device and the terminal, and receives a distance between the anchor device and the wireless access device from the anchor device, and the anchor point The distance between the device and the terminal; or,
  • the wireless access device receives location information of the terminal from one of the at least two anchor devices.
  • the wireless access device may calculate the distance according to the distance between the wireless access device and each anchor device, the distance between each anchor device and the terminal, and the distance between the wireless access device and the terminal.
  • the three-dimensional coordinates of the terminal in the Cartesian coordinate system may be calculated by one of the anchor devices, and the anchor device transmits to the wireless access device after calculating the three-dimensional coordinates of the terminal.
  • the wireless access device detects the distance between the wireless access device and the terminal, and the distance between the wireless access device and each anchor device, and may include:
  • the wireless access device detects the distance between the wireless access device and the terminal and the distance between the wireless access device and each anchor device through a precision time measuring mechanism (FTM). In this way, the accuracy of the location information is improved.
  • FTM precision time measuring mechanism
  • This embodiment describes a manner in which a wireless access device (taking a wireless router as an example) cooperates with an anchor device (for example, a WiFi signal transceiving device) to locate a terminal (for example, a WiFi terminal).
  • an anchor device for example, a WiFi signal transceiving device
  • the number of anchor devices may be three, and the positional relationship between the three anchor devices (for example, the anchor device A, the anchor device B, and the anchor device C) and the wireless router may be as shown in FIG. 2 . Shown. Among them, three anchor devices and wireless routers can construct a spatial rectangular coordinate system.
  • the anchor device A, the anchor device B, and the wireless router are in the same horizontal plane position, and the angle between the anchor device A and the line where the wireless router is located and the line between the anchor device B and the wireless router are shown. It is 90 degrees (ie, perpendicular to each other); the anchor device C and the wireless router are perpendicular to the horizontal plane.
  • the rectangular antenna system is set with the antenna position of the wireless router (for example, the WiFi antenna position) as the origin, and the three anchor devices A, B, and C are respectively disposed on the horizontal X axis, the horizontal Y axis, and the vertical Z axis. As shown in FIG.
  • the antenna position of the wireless router is recorded as the origin O point, and the positions of the three anchor devices can be sequentially recorded as A(a, 0, 0), B (0, b, 0), C (0). , 0, c).
  • the location of the terminal connected to the wireless router can be recorded as P(x, y, z), where the location P(x, y, z) of the terminal is unknown.
  • the distance between the anchor device A, B, and C devices to the wireless router may be preset.
  • the distance between the preset anchor device A and the wireless router may be a
  • the distance between the anchor device B and the wireless router may be b
  • the distance from the anchor device C to the wireless router may be c.
  • this application is not limited thereto.
  • the wireless router can obtain the distance from each anchor device by means of an associated measurement.
  • the anchor devices A, B, and C can transmit and receive WiFi signals, and the wireless router can detect the wireless router and the terminal, and the wireless router and each anchor device by using FTM (Fine Timing Measurement).
  • FTM Freine Timing Measurement
  • the distance between each anchor device can be detected by the FTM and the distance between the terminals, and the distance between the respective detected terminals and the terminal is transmitted to the wireless router through the WiFi signal; then, the wireless router can be detected according to the The distance between the wireless router and the terminal, the distance between the wireless router and each anchor device, and the distance between each anchor device and the terminal received, calculate the three-dimensional coordinates of the terminal in the Cartesian coordinate system.
  • FTM comes from the draft IEEE 802.11 REVmc standard, and the theoretical accuracy of FTM is at the picosecond level.
  • the wireless router and the anchor device can perform distance detection, so that the wireless router can calculate the precise location of the terminal.
  • the detailed ranging principle of the FTM in this embodiment will not be described again.
  • the final coordinate position of the position P of the terminal is:
  • the accuracy of the position P of the terminal in this embodiment is related to the accuracy of the distance between the anchor devices A, B, and C to the antenna position O of the wireless router; the more accurate these distances are, the final calculated The more precise the coordinate position of the terminal.
  • each anchor device may also be configured to transmit and receive a positioning signal such as laser or infrared; and the anchor device detects the distance between the terminal and the terminal through the positioning signal, and transmits the data through the data transmission.
  • a signal eg, a WiFi signal
  • data transmission may also be performed between the anchor devices, and any anchor device may be responsible for calculating the three-dimensional coordinates of the terminal and transmitting the calculated three-dimensional coordinates to the wireless router.
  • the position of the anchor device may not need to be set in particular in accordance with the position of the Cartesian coordinate system.
  • the position of the wireless router and the three anchor devices can be as shown in FIG. 4, and a suitable spatial rectangular coordinate system can be derived from the three-dimensional cone structure.
  • the distance between the wireless router and the three anchor devices may not be pre-designed.
  • the following initialization operations may be performed on the location of each anchor device: the distance between the wireless router, the anchor device A, the anchor device B, and the anchor device C is measured by the FTM, as shown in FIG. Shown, respectively, the distance a between the anchor device A and the wireless router, the distance c between the anchor device C and the wireless router, the distance b between the anchor device B and the wireless router, the anchor device A and the anchor.
  • the distance d between the point devices C, the distance e between the anchor device A and the anchor device B, and the distance f between the anchor device C and the anchor device B and then calculated according to the structure of the three-dimensional cone Cartesian coordinate system.
  • the wireless router detects an undesired state and can pass The user interface UI mode notifies the user to reposition the anchor device.
  • the location of the wireless router and the auxiliary anchor device may not be moved after the determination, so as to avoid the problem that the wireless router determines that the security zone is inaccurate; in addition, the number of anchor devices is at least three. At this time, the placement positions of the wireless router and the anchor device are prevented from appearing in the same plane position, that is, the wireless router and the at least three anchor devices are not placed in the same plane, thereby avoiding the problem that the positioning of the terminal is inaccurate.
  • This embodiment describes a process of establishing a security zone of a wireless access device (taking a wireless router as an example) and a process of detecting a security zone, as shown in FIG. 5.
  • the security area is a three-dimensional space including a horizontal security area and a vertical security area, that is, the three-dimensional space can be obtained by combining the horizontal security area and the vertical security area.
  • the wireless router first enters the secure area learning mode when first used; wherein the security area learning is divided into two parts: a horizontal security area and a vertical security area.
  • the legal terminal is connected to the wireless router.
  • a legal WiFi terminal is connected to the WiFi wireless router.
  • the wireless router performs horizontal security area learning
  • the wireless router For the establishment of the horizontal security zone, after the legal terminal is connected to the wireless router, the wireless router performs the positioning operation on the legal terminal in a short interval (for example, 10s) (for example, as described in the first embodiment).
  • a short interval for example, 10s
  • the legal terminal should circle one or more circles along the boundary of the indoor area; if the positioning period of the wireless router is 10s, then the movement of the legal terminal in actual operation
  • the speed can be kept at around 0.1m/s.
  • the wireless router obtains a polygon horizontal security area composed of several points by optimizing the collected position information (for example, the user intervenes to fine-tune the horizontal area shape later), as shown in FIG. 6.
  • S504 The wireless router performs vertical security area learning
  • the legal terminal moves in the vertical direction; when the legitimate terminal moves to the roof, it is kept for a period of time, so that the wireless router collects the vertical direction.
  • the height H2 of the highest point in addition, the legal terminal is held for a period of time after moving to the floor, so that the wireless router collects the height H1 of the lowest point in the vertical direction; thereby, establishing a vertical security area of the room.
  • the wireless router turns off the security zone learning mode.
  • the wireless router enters a normal working mode
  • the security area learning mode of the wireless router is turned off and the normal working mode is entered.
  • the wireless router detects location information of the terminal.
  • the terminal when the wireless router detects whether the terminal is in the secure area, the terminal first performs the location detection on the terminal by using the terminal positioning manner in the first embodiment, and assumes that the coordinate position of the terminal is detected as (x, y, z). ), then, first determine whether the point (x, y) is in the horizontal polygon security area, if not, the terminal is not in the security area of the wireless router; if (x, y) is in the horizontal polygon area, then It is required to detect whether the vertical coordinate z of the terminal satisfies: H1 ⁇ z ⁇ H2, that is, whether the terminal is in the vertical security zone; if the terminal is in the vertical security zone, the terminal is in the security zone of the wireless router.
  • the priority sequence of the learning of the horizontal security zone and the learning of the vertical security zone is not limited, and the two may also be performed simultaneously; the present application is directed to the detection of the horizontal security zone and the detection process of the vertical security zone. The order is also limited.
  • the present application is not limited to the shape of the horizontal safety zone.
  • the horizontal security area may be a polygon; as shown in FIG. 7, the horizontal security area may be circular, such as an ellipse.
  • the legal terminal can move around the circular horizontal area, and then the wireless router periodically locates the location of the legal terminal on the regional boundary; when the legal terminal follows the circular area After moving one circle, the polygons connected by several boundary points are replaced by positioning instead of the circular area boundaries.
  • more polygons connected by boundary points are needed to achieve the effect of the circular area as much as possible.
  • the positioning period of the wireless router can be reduced, for example, the positioning calculation is performed once for the legal terminal every 5 seconds; in addition, the moving rate of the legal terminal can be reduced, for example, the circular shape is performed at a speed of 0.5 m/s. The area moves. In this way, more boundary points can be obtained after one week of moving the legitimate terminal.
  • the horizontal security zone is divided into two spaces by the barrier wall: a horizontal security zone-I and a horizontal security zone-II. Since the signal quality of the Wi-Fi signal will be attenuated after passing through the wall, the error in the FTM ranging will be large. Therefore, in the present implementation, a set of wireless routers and an auxiliary positioning anchor device according to the first embodiment of the present application may be placed in two spaces defined by the horizontal security zone -I and the horizontal security zone -II, and then The two wireless routers can separately calculate and learn their own security zones in their respective spaces. Finally, the two wireless routers can share the security zone information of the other party.
  • the wireless router-II learns the horizontal security zone-II as an example, the wireless router-I and the wireless router-II can determine that their security zones include the horizontal security zone-I and Horizontal safety zone - II.
  • the wireless router determines its own security area by learning, and can improve the accuracy and applicability of the security area.
  • This embodiment describes a manner in which a wireless router actively defends against hacker attacks and prevents Internet traffic from leaking.
  • the user when using the wireless router, the user must first fix the location of the wireless router and the anchor device (such as the location shown in Embodiment 1), and then the wireless router is powered on; the following steps are as follows:
  • the first step when the user first uses the wireless router, first set the wireless router to the secure area learning mode.
  • the user connects to the wireless router by using a legal terminal (for example, a Wi-Fi terminal), and then carries the legal terminal as many times as possible along the indoor boundary, so that the wireless router learns to grasp the indoor space area as completely as possible.
  • a legal terminal for example, a Wi-Fi terminal
  • the user confirms the learning situation of the wireless router in the indoor space area through the UI (User Interface) interaction mode; if necessary, the range of the security area can be appropriately adjusted through the UI.
  • UI User Interface
  • the security zone learning mode of the wireless router is turned off, and the wireless router enters the active defense mode (normal working mode).
  • the wireless router After the fourth step, the wireless router has established its own security zone.
  • the positioning detection of the WiFi terminal is triggered once; when the WiFi terminal is in the security area of the wireless router, the WiFi terminal is normally connected to the Internet, that is, The wireless router will allocate enough Internet traffic bandwidth (assuming the wireless router can allocate a maximum of 10 Mbps bandwidth to each user) to the WiFi terminal; if the WiFi terminal is not in the secure area of the wireless router, the wireless router reduces or disables the pair.
  • the WiFi terminal's Internet traffic bandwidth is allocated, but the connection with the WiFi terminal is not actively disconnected.
  • the situation may also trigger a wireless router to perform a location detection on the WiFi terminal.
  • the WiFi terminal In the case that the WiFi terminal is in the secure area of the wireless router, the wireless router actively informs the administrator by other means to confirm whether the WiFi terminal is abnormal, and temporarily blocks the connection of the WiFi terminal; the WiFi terminal is not in the wireless router security. In the case of the area, the WiFi terminal is blacked out, that is, any message from the Wi-Fi terminal is completely discarded, and no response is given.
  • Step 7 periodically performing positioning detection on each WiFi terminal connected to the wireless router; if the WiFi terminal is in the security area of the wireless router, the WiFi terminal is normally connected to the Internet, and is not restricted; In the case where the WiFi terminal is not in the secure area of the wireless router, the wireless router reduces or disables the bandwidth allocation of the Internet traffic to the WiFi terminal.
  • the fifth step to the seventh step will be described in detail below with reference to FIGS. 9 to 11 respectively.
  • the embodiment can actively prevent traffic leakage.
  • This embodiment includes the following steps:
  • the WiFi terminal is connected to the wireless router
  • the wireless router After the WiFi terminal is successfully connected to the wireless router, the wireless router performs a positioning operation on the WiFi terminal (refer to the manner described in Embodiment 1);
  • the wireless router determines whether the WiFi terminal is in the secure area of the wireless router; if the WiFi terminal is in the secure area, executing S904, if the WiFi terminal is not in the secure area, executing S905;
  • this embodiment can actively defend against the hacker brute force cracking the WiFi password of the wireless router in the attack room.
  • This embodiment includes the following steps:
  • the wireless router detects an event that the WiFi terminal fails to connect continuously in a short time, and the number of attempts of the WiFi terminal device to connect exceeds a predetermined threshold within a predetermined time. At this time, the wireless router is triggered to perform positioning on the WiFi terminal. operating;
  • the wireless router detects location information of the WiFi terminal (refer to Embodiment 1);
  • the wireless router determines whether the WiFi terminal is in the secure area of the wireless router; if the WiFi terminal is in the secure area, executing S1004, if the WiFi terminal is not in the secure area, executing S1005;
  • S1004 notify the administrator to check whether the WiFi terminal has a problem, and temporarily prevent the WiFi terminal from continuing to connect;
  • S1005 directly blocking the connection behavior of the Wi-Fi terminal, and no longer responding to any request of the Wi-Fi terminal device.
  • the embodiment can implement active defense against traffic leakage.
  • This embodiment includes the following steps:
  • the wireless router performs a positioning operation on each connected WiFi terminal periodically with a predetermined interval duration (see Embodiment 1);
  • the wireless router determines whether the WiFi terminal device is in the secure area of the wireless router; if the WiFi terminal is in the secure area, S1103 is executed, and if the WiFi terminal is not in the secure area, S1104 is performed;
  • the traffic bandwidth allocated to the WiFi terminal is halved (for example, the minimum amount that can be allocated is 1 Kbps).
  • the traffic bandwidth allocated by the WiFi terminal is 2 Mbps. If the WiFi terminal is detected to be out of the security zone in the first cycle, the traffic bandwidth allocated by the WiFi terminal becomes 1 Mbps; The period will be reduced to 512Kbps.
  • the embodiment of the present application further provides an access control apparatus, which is configured in a wireless access device, and includes: a first positioning module 1201, a security area detecting module 1202, and an access control module 1203;
  • the first positioning module 1201 is configured to acquire location information of the terminal in a three-dimensional coordinate system constructed by the wireless access device and the anchor device;
  • the security area detecting module 1202 is configured to determine, according to location information of the terminal in the three-dimensional coordinate system, whether the terminal is in a security area of the wireless access device;
  • the access control module 1203 is configured to perform an access control operation corresponding to the determination result according to the determination result.
  • the device may further include: a security area determining module 1204, configured to establish or adjust a security area of the wireless access device by using at least one of the following manners:
  • the security area of the wireless access device is established or adjusted by acquiring location information in the three-dimensional coordinate system after the one or more predetermined terminals are connected to the wireless access device.
  • the security zone may be a three-dimensional volume including a horizontal security zone and a vertical security zone; the security zone detection module 1202 may be configured to determine whether the terminal is within the security zone of the wireless access device by:
  • the terminal is not located in the horizontal security zone, it is determined that the terminal is not in the security zone; if the terminal is located in the horizontal security zone, it is determined whether the terminal is located in the vertical security zone; the terminal is located in the vertical security zone. In the case of the inside, it is determined that the terminal is in the secure area, and if the terminal is not located in the vertical security area, it is determined that the terminal is not in the secure area.
  • the access control module 1203 may include at least one of the following:
  • the first processing unit is configured to allocate, when the terminal is successfully connected to the wireless access device, the traffic bandwidth that satisfies the first condition, if the terminal is determined to be in the security area of the wireless access device, When it is determined that the terminal is not in the security area of the wireless access device, the terminal is allocated a traffic bandwidth that satisfies the second condition, or stops allocating the traffic bandwidth to the terminal; wherein, the traffic bandwidth that satisfies the first condition is greater than The traffic bandwidth that satisfies the second condition;
  • a second processing unit configured to temporarily block the terminal when it is determined that the terminal fails to connect the wireless access device within a predetermined duration to meet a threshold condition, and if the terminal is determined to be in a secure area of the wireless access device Ending the connection behavior of the terminal, and giving a prompt to confirm whether the terminal is abnormal; in case determining that the terminal is not in the security area of the wireless access device, blocking the connection behavior of the terminal, and not responding to the request of the terminal;
  • a third processing unit configured to: after periodically obtaining the location information of the terminal connected to the wireless access device, in the case that the terminal is determined to be in the security zone of the wireless access device, assign the terminal to meet the third condition Traffic bandwidth; if it is determined that the terminal is not in the security zone of the wireless access device, the terminal is allocated a traffic bandwidth that satisfies the fourth condition; wherein the traffic bandwidth that satisfies the third condition is greater than the traffic that satisfies the fourth condition bandwidth.
  • the number of anchor devices may include at least two, and the wireless access device and the at least two anchor devices may construct a spatial Cartesian coordinate system.
  • the first positioning module 1201 may be configured to acquire location information of the terminal in a three-dimensional coordinate system constructed by the wireless access device and the anchor device by:
  • Detecting a distance between the wireless access device and the terminal and receiving a distance between the anchor device and the wireless access device from the anchor device, and the anchor device and the a distance between the terminals, a distance between the wireless access device and the terminal, a distance between the anchor device and the wireless access device, and the anchor device and the terminal The distance between the two, calculating and obtaining the position information of the terminal in the three-dimensional coordinate system; or
  • the wireless access device receives location information of the terminal from an anchor device.
  • the first positioning module 1201 may detect the distance between the wireless access device and the terminal and the distance between the wireless access device and any of the anchor devices through the FTM.
  • the first positioning module 1201 that is, the positioning module configured in the access control device, may be configured to perform precise positioning of the terminal by the wireless router, and the location information of the terminal will be used for the security area detecting module. 1202.
  • the security area detection module 1202 determines, based on the location information of the terminal detected by the first location module 1201, whether the terminal is in the security zone according to the learned security zone; the access control module 1203 is responsible for actively protecting the hacker malicious WiFi. Crack attacks and prevent the leakage of Internet traffic.
  • the embodiment of the present application further provides an access control system, including the wireless access device and the anchor device as described in the foregoing embodiments, where the wireless access device is configured with an access control device.
  • an access control system including the wireless access device and the anchor device as described in the foregoing embodiments, where the wireless access device is configured with an access control device.
  • the embodiment of the present application further provides a wireless access device, including: a memory, a processor, and an access control program stored on the memory and operable on the processor, where the access control program is executed by the processor
  • a wireless access device including: a memory, a processor, and an access control program stored on the memory and operable on the processor, where the access control program is executed by the processor
  • the embodiment of the present application further provides a machine readable medium storing an access control program, where the access control program is implemented by a processor to implement the foregoing access control method.
  • the embodiment of the present application further provides a security area determining method, including:
  • S1301 After connecting one or more predetermined terminals to the wireless access device, acquire location information of one or more predetermined terminals in a three-dimensional coordinate system constructed by the wireless access device and the anchor device;
  • S1302 Perform at least one of: establishing a security area of the wireless access device, and adjusting a security area of the wireless access device according to the obtained location information of the one or more predetermined terminals in the three-dimensional coordinate system.
  • the method of this embodiment may further include at least one of the following:
  • the user can adjust the established security zone through the UI to make the security zone more reasonable.
  • the established security zone can be adjusted according to preset information.
  • the preset information may include that the vertical distance between the highest point and the lowest point of the vertical security area is greater than or equal to a preset value, and may detect whether the maximum vertical distance in the established vertical security area meets the preset defined by the preset information. The value, if not satisfied, can be adjusted according to the preset value.
  • a three-dimensional volume determined according to the acquired location information may be used as a secure area of the wireless access device.
  • the secure area of the wireless access device is a three-dimensional space.
  • the number of anchor devices includes at least two, and the wireless access device and the at least two anchor devices may construct a Cartesian coordinate system.
  • step S1301 when the security area determining method of the embodiment is applied to the wireless access device, step S1301 may include:
  • the wireless access device detects a distance between the wireless access device and one or more predetermined terminals, a distance between the wireless access device and each anchor device, and receives an anchor device from the anchor device and the predetermined terminal The distance between the wireless access device and the one or more predetermined terminals, the distance between the wireless access device and each anchor device, and the anchor device and Calculating and obtaining location information of the one or more predetermined terminals in the three-dimensional coordinate system by describing a distance between one or more predetermined terminals; or
  • the wireless access device detects a distance between the wireless access device and the one or more predetermined terminals, and receives a distance between the anchor device and the wireless access device from the anchor device, and the anchor device and the one or more a distance between the predetermined terminals, a distance between the wireless access device and the one or more predetermined terminals, a distance between the anchor device and the wireless access device, and the anchor point And calculating, by the distance between the device and the one or more predetermined terminals, location information of the one or more predetermined terminals in the three-dimensional coordinate system.
  • step S1301 when the security area determining method of the embodiment is applied to the anchor device, step S1301 may include:
  • the anchor device detects a distance between the anchor device and the one or more predetermined terminals, a distance between the anchor device and the wireless access device, and receives the wireless access device from the wireless access device with the one or more reservations a distance between the terminals, a distance between the anchor device and the one or more predetermined terminals, a distance between the anchor device and the wireless access device, and the wireless access device Calculating and obtaining location information of the one or more predetermined terminals in the three-dimensional coordinate system with a distance between the one or more predetermined terminals; or
  • the anchor device detects a distance between the anchor device and the one or more predetermined terminals, and receives a distance between the wireless access device and the anchor device, the wireless access device, and the one or more reservations from the wireless access device a distance between the terminals, a distance between the anchor device and the one or more predetermined terminals, a distance between the wireless access device and the anchor device, and the wireless access device Position information of the one or more predetermined terminals in the three-dimensional coordinate system is calculated and obtained from a distance between the one or more predetermined terminals.
  • the distance between the wireless access device and each anchor device, the distance between each anchor device and one or more predetermined terminals, and the wireless access device and one or more predetermined terminals The distance between them can be obtained by FTM.
  • the embodiment of the present application provides a security area determining apparatus, including: a second positioning module 1401 (ie, a positioning module configured in the security area determining device) and a processing module 1402;
  • the second positioning module 1401 is configured to acquire, after the one or more predetermined terminals are connected to the wireless access device, the location of the one or more predetermined terminals in a three-dimensional coordinate system constructed by the wireless access device and the anchor device. information;
  • the processing module 1402 is configured to perform at least one of: establishing a security area of the wireless access device, and adjusting the wireless access device according to the acquired location information of the one or more predetermined terminals in the three-dimensional coordinate system. Safe area.
  • the apparatus of this embodiment may further include at least one of the following:
  • the first adjustment module 1403 is configured to adjust a security area of the wireless access device according to the information input by the UI;
  • the second adjustment module 1404 is configured to adjust a security area of the wireless access device according to the preset information.
  • the embodiment of the present application further provides an apparatus, including: a memory, a processor, and a secure area determining program stored on the memory and operable on the processor, where the secure area determining program is executed by the processor to implement the secure area. Determine the method.
  • the device in this embodiment may be a wireless access device or an anchor device.
  • the embodiment of the present application further provides a machine readable medium storing a security area determining program, where the security area determining program is implemented by a processor to implement the foregoing security area determining method.
  • a security area determining program is implemented by a processor to implement the foregoing security area determining method.
  • Some or all of the components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit.
  • a processor such as a digital signal processor or microprocessor
  • Such software may be distributed on a machine-readable medium, such as a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • a computer-readable medium which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • computer storage medium includes volatile and nonvolatile, implemented in any method or technology for storing information, such as computer readable instructions, data structures, program modules or other data. Sex, removable and non-removable media.
  • Computer storage media includes, but is not limited to, RAM, ROM, electrically erasable programmable read only memory EEPROM, flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical disk storage, magnetic enclosure, A magnetic tape, disk storage or other magnetic storage device, or any other medium that can be used to store the desired information and can be accessed by a computer.
  • communication media typically includes computer readable instructions, data structures, program modules or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and can include any information delivery media. .
  • the present disclosure is based on the accurate positioning of the terminal and the access control of the security area of the wireless access device, which can effectively ensure that the wireless access device is not maliciously attacked by surrounding hackers or crack the password of the wireless access device, thereby improving the wireless access device.
  • Access security The positioning of the terminal is performed by the cooperation of the wireless access device and the anchor device, thereby improving the positioning accuracy.
  • the predetermined terminal is positioned by the cooperation of the wireless access device and the anchor device to determine the security area, and the accuracy and applicability of the security area are improved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本文公开了一种接入控制方法包括：无线接入设备获取终端在由无线接入设备和锚点装置构建的三维坐标系下的位置信息；根据终端在所述三维坐标系下的位置信息，判断终端是否处于无线接入设备的安全区域内；根据判断结果，执行与判断结果对应的接入控制操作。还公开了一种接入控制装置、系统，一种无线接入设备、存储介质，以及一种安全区域确定方法及装置。

Description

接入控制方法、装置及系统、安全区域确定方法及装置 技术领域
本公开涉及通信技术领域，例如涉及一种接入控制方法、装置及系统、安全区域确定方法及装置。
背景技术
目前，家用的无线路由器对用户安全访问与保护的手段一般是通过访问控制列表(Access Control List，ACL)技术来实现。其中，在无线路由器上预先提供允许接入的终端设备的介质访问控制(Media Access Control，MAC)地址列表、或者禁止接入的终端设备的MAC地址列表；对于允许接入的终端设备的MAC地址列表，用户需要预先设置允许使用该无线路由器的终端设备，只有在该允许接入的终端设备的MAC地址列表中记录的终端设备才可以连接该无线路由器上网；对于禁止接入的终端设备的MAC地址列表，用户需要预先设置禁止接入该无线路由器的终端设备，只有不在该禁止接入的终端设备的MAC地址列表中的终端设备才可以正常连接该无线路由器上网。
然而，上述技术方案的实现不够灵活，终端设备的安全访问权限控制死板，而且还会存在较大的安全漏洞。比如，对于设置允许接入的终端设备的MAC地址列表进行访问控制的方案，用户需要预先了解到哪些终端设备应该有连接访问无线路由器的权限，如果有遗漏，后续还需要手动录入遗漏的终端设备；对于设置禁止接入的终端设备的MAC地址列表进行访问控制的方案，用户需要事先了解哪些终端设备需要禁止连接访问无线路由器的权限。上述安全控制方案中每一步均需要用户的参与，并且可能会因为人为操作失误而导致安全漏洞的出现。
另外，即使无线路由器采用了访问控制列表技术，黑客也可以通过将终端设备的MAC地址伪装成合法用户来进行破解攻击。综上可见，无线路由器的访问安全性有待提高。
发明内容
本申请实施例提供一种接入控制方法、装置及系统、安全区域确定方法及装置，实现有效提高无线接入设备的访问安全性。
第一方面，本申请实施例提供一种接入控制方法，包括：
无线接入设备获取终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息；
根据所述终端在所述三维坐标系下的位置信息，判断所述终端是否处于所述无线接入设备的安全区域内；
根据判断结果，执行与所述判断结果对应的接入控制操作。
第二方面，本申请实施例提供一种安全区域确定方法，包括：
在一个或多个预定终端连接到无线接入设备之后，获取所述一个或多个预定终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息，其中，所述预定终端包括所述无线接入设备识别为合法的终端；
根据获取的所述一个或多个预定终端在所述三维坐标系下的位置信息，执行以下至少之一：建立所述无线接入设备的安全区域、和调整所述无线接入设备的安全区域。
第三方面，本申请实施例提供一种接入控制装置，配置在无线接入设备中，包括：第一定位模块、安全区域检测模块以及接入控制模块；
其中，所述第一定位模块，设置为获取终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息；
所述安全区域检测模块，设置为根据所述终端在所述三维坐标系下的位置信息，判断所述终端是否处于所述无线接入设备的安全区域内；
所述接入控制模块，设置为根据判断结果，执行与所述判断结果对应的接入控制操作。
第四方面，本申请实施例提供一种安全区域确定装置，包括：
第二定位模块，设置为在一个或多个预定终端连接到无线接入设备之后，获取所述一个或多个预定终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息，其中，所述预定终端包括所述无线接入设备识别为合法的 终端；
处理模块，设置为根据获取的所述一个或多个预定终端在所述三维坐标系下的位置信息，执行以下至少之一：建立所述无线接入设备的安全区域、和调整所述无线接入设备的安全区域。
第五方面，本申请实施例提供一种接入控制系统，包括：锚点装置以及无线接入设备，所述无线接入设备配置有上述第三方面的接入控制装置，所述锚点装置与所述无线接入设备连接。
此外，本申请实施例还提供一种无线接入设备，包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的接入控制程序，所述控制接入控制程序被所述处理器执行时实现上述第一方面的接入控制方法。
此外，本申请实施例还提供一种机器可读介质，存储有接入控制程序，所述接入控制程序被处理器执行时实现上述第一方面的接入控制方法。
在本申请实施例中，基于对终端的准确定位和无线接入设备的安全区域进行接入控制，可以有效确保无线接入设备不被周边黑客恶意攻击或者破解无线接入设备的密码，从而提高无线接入设备的访问安全性。通过无线接入设备和锚点装置的配合对终端进行定位，提高了定位准确性。
在本申请实施例中，通过无线接入设备和锚点装置的配合对预定终端进行定位来确定安全区域，提高了安全区域的准确性和适用性。
附图说明
图1为本申请实施例提供的一种接入控制方法的流程图；
图2为本申请实施例一中无线接入设备与锚点装置的一种位置示意图；
图3为本申请实施例一中无线接入设备与锚点装置配合确定终端的位置信息的示意图；
图4为本申请实施例一中无线接入设备与锚点装置的另一种位置示意图；
图5为本申请实施例二中无线路由器的安全区域建立和检测过程的流程图；
图6为本申请实施例二中一种无线路由器的安全区域的示意图；
图7为本申请实施例二中另一种无线路由器的安全区域的示意图；
图8为本申请实施例二中再一种无线路由器的安全区域的示意图；
图9为本申请实施例三的流程图一；
图10为本申请实施例三的流程图二；
图11为本申请实施例三的流程图三；
图12为本申请实施例提供的无线接入设备的示意图；
图13为本申请实施例提供的安全区域确定方法的流程图；
图14为本申请实施例提供的安全区域确定装置的示意图。
具体实施方式
在附图的流程图示出的步骤可以在诸如一组计算机可执行指令的计算机系统中执行。虽然在流程图中示出了逻辑顺序，但是在部分情况下，可以以不同于此处的顺序执行所示出或描述的步骤。
图1为本申请实施例提供的一种接入控制方法的流程图。如图1所示，本实施例的接入控制方法包括以下步骤：
S101、无线接入设备获取终端在由无线接入设备和锚点装置构建的三维坐标系下的位置信息；
S102、根据该终端在所述三维坐标系下的位置信息，判断该终端是否处于无线接入设备的安全区域内；
S103、根据判断结果，执行与该判断结果对应的接入控制操作。
本实施例中，无线接入设备可以包括以下至少之一：无线路由器、客户终端设备(Customer Premise Equipment，CPE)。锚点装置可以指能够传输定位信号和数据传输信号的无线通信设备，比如，锚点装置可以为WiFi信号发射和接收设备，用于基于精准测时机制(FTM，Fine Timing Measurement)进行测距，并采用WiFi信号将测量得到的距离信息传输给无线接入设备。
在示例性实施方式中，本实施例的方法还可以包括：通过以下至少一种方式建立或调整无线接入设备的安全区域：
根据用户界面(User Interface，UI)输入的信息，建立或调整无线接入设备的安全区域；
根据预设信息，建立或调整无线接入设备的安全区域；
通过获取一个或多个预定终端连接无线接入设备后在三维坐标系下的位置信息，建立或调整无线接入设备的安全区域，其中，所述预定终端包括所述无线接入设备识别为合法的终端。
其中，预定终端可以包括无线接入设备识别为合法的终端；比如，首个接入无线接入设备的终端，或者，无线接入设备允许接入的MAC地址列表中记录的终端。然而，本申请对此并不限定。
在本实施方式中，在步骤S101之前，无线接入设备可以通过上述至少一种方式建立安全区域；后续，无线接入设备可以通过上述至少一种方式调整已建立的安全区域。比如，无线接入设备可以通过获取预定终端连接无线接入设备后在三维坐标系下的位置信息，建立安全区域，然后，根据UI输入的信息调整已建立的安全区域；或者，无线接入设备可以根据预设信息，建立安全区域，然后，通过获取预定终端连接无线接入设备后在三维坐标系下的位置信息，调整已建立的安全区域。然而，本申请对此并不限定。
本实施例中，无线接入设备的安全区域为三维立体空间。在示例性实施方式中，安全区域可以为包括水平安全区域和垂直安全区域的三维立体空间。然而，本申请对此并不限定。
在一实施例中，本申请对于安全区域的形状并不限定。比如，水平安全区域可以为多边形、圆形、椭圆形等规则形状，或者其他不规则形状。
在示例性实施方式中，无线接入设备的安全区域可以由无线接入设备确定；此时，通过获取一个或多个预定终端连接无线接入设备后在三维坐标系下的位置信息，建立或调整无线接入设备的安全区域，可以包括：
无线接入设备检测无线接入设备与一个或多个预定终端之间的距离、无线接入设备与每个锚点装置之间的距离，并从锚点装置接收该锚点装置与一个或多个预定终端之间的距离；或者，无线接入设备检测无线接入设备与一个或多个预定终端之间的距离，并从锚点装置接收该锚点装置与无线接入设备之间的 距离、该锚点装置与一个或多个预定终端之间的距离；
然后，无线接入设备可以根据无线接入设备与一个或多个预定终端之间的距离、无线接入设备与锚点装置之间的距离以及锚点装置与一个或多个预定终端之间的距离，在无线接入设备和锚点装置构建的三维坐标系下计算一个或多个预定终端的三维坐标，即，获取一个或多个预定终端在所述三维坐标系下的位置信息。
在本实施方式中，在安全区域的建立过程中，无线接入设备可以根据与其连接的多个合法终端在预定时刻下在三维坐标系下的位置信息，确定安全区域；或者，无线接入设备可以根据与其连接的多个合法终端在多个不同时刻下在三维坐标系下的位置信息，确定安全区域；或者，无线接入设备可以根据与其连接的一个合法终端按照预定移动速度的移动过程中获取到的位置信息，确定安全区域；或者，无线接入设备可以根据与其连接的一个合法终端周期性的位置信息，确定安全区域。然而，本申请对此并不限定。
在示例性实施方式中，无线接入设备的安全区域可以由锚点装置确定，然后，锚点装置将确定的安全区域的信息发送给无线接入设备；其中，锚点装置可以通过以下方式建立或调整无线接入设备的安全区域：
锚点装置检测锚点装置与预定终端之间的距离、以及锚点装置与无线接入设备之间的距离，并从无线接入设备接收无线接入设备与预定终端之间的距离；或者，锚点装置检测锚点装置与预定终端之间的距离，并从无线接入设备接收无线接入设备与锚点装置之间的距离、无线接入设备与预定终端之间的距离；
然后，锚点装置可以根据与预定终端之间的距离、与无线接入设备之间的距离以及无线接入设备与预定终端之间的距离，在无线接入设备和锚点装置构建的三维坐标系下计算预定终端的三维坐标，即，获取预定终端在所述三维坐标系下的位置信息。
在示例性实施方式中，安全区域为包括水平安全区域和垂直安全区域的三维立体空间；此时，步骤S102中，判断终端是否处于无线接入设备的安全区域内，可以包括：
根据终端的位置信息，判断该终端是否位于水平安全区域内。
在该终端没有位于水平安全区域内的情况下，判定该终端不在安全区域内；在该终端位于水平安全区域内的情况下，判断该终端是否位于垂直安全区域内；在该终端位于垂直安全区域内的情况下，判定该终端处安全区域内，在该终端没有位于垂直安全区域内的情况下，判定该终端不在安全区域内。
在本实现方式中，针对一个终端，在根据该终端在三维坐标系下的位置信息，判定终端位于水平安全区域也位于垂直安全区域内的情况下，判定该终端处于无线接入设备的安全区域内，在根据该终端在三维坐标系下的位置信息，判定终端不位于水平安全区域内或者不位于垂直安全区域内的情况下，判定该终端不处于无线接入设备的安全区域内。
在示例性实施方式中，步骤S103可以包括：
当无线接入设备检测到任一终端成功连接到无线接入设备时，在确定该终端处于无线接入设备的安全区域内的情况下，给该终端分配满足第一条件的流量带宽，满足第一条件的流量带宽可以称为第一流量带宽；
在确定该终端不处于无线接入设备的安全区域内的情况下，给该终端分配满足第二条件的流量带宽，或者，停止给该终端分配流量带宽，满足第二条件的流量带宽可以称为第二流量带宽；
其中，该满足第一条件的流量带宽大于该满足第二条件的流量带宽。
在本实施方式中，在终端处于无线接入设备的安全区域且成功连接无线接入设备之后，可以给该终端分配足够的上网流量带宽，在终端处于无线接入设备的非安全区域且连接无线接入设备后，可以限制或停止给该终端分配上网流量带宽，但是不会主动断开与该终端的连接。
在示例性实施方式中，步骤S103可以包括：
当无线接入设备检测到任一终端在预定时长内连续连接无线接入设备的失败次数满足阈值条件时，在确定该终端处于无线接入设备的安全区域内的情况下，暂时阻止该终端的继续连接行为，并给出确认该终端是否异常的提示；
在确定该终端不处于无线接入设备的安全区域内的情况下，阻止该终端的连接行为，且不响应该终端的请求。
其中，阈值条件可以包括：预定时长内连续连接无线接入设备的失败次数 大于或等于安全阈值。
在本实施方式中，当终端在预定时长内的连续连接失败次数满足阈值条件(即被认为存在黑客攻击可能性)时，若终端处于无线接入设备的安全区域内时，则通知管理员进行确认，若终端没有处于安全区域内时，则拉黑该终端。
在示例性实施方式中，步骤S103可以包括：
在周期性获取已连接到无线接入设备的终端的位置信息之后，在确定终端处于无线接入设备的安全区域内的情况下，给该终端分配满足第三条件的流量带宽，满足第三条件的流量带宽可以称为第三流量带宽；
在确定该终端不处于无线接入设备的安全区域内的情况下，给该终端分配满足第四条件的流量带宽，满足第四条件的流量带宽可以称为第四流量带宽；
其中，该满足第三条件的流量带宽大于该满足第四条件的流量带宽。
在本实施方式中，当终端处于无线接入设备的安全区域内时，可以给该终端分配足够的上网流量带宽，在该终端不处于无线接入设备的安全区域内时，可以限制或停止给该终端分配上网流量带宽，但是不会主动断开与该终端的连接。其中，满足第三条件的流量带宽可以与满足第一条件的流量带宽相同或不同，满足第四条件的流量带宽可以与满足第二条件的流量带宽相同或不同。然而，本申请对此并不限定。
在一实施例中，在上述示例性实施方式中，本申请并不限定执行的接入控制操作，可以根据实际应用场景，适应性调整所需执行的接入控制操作，以提高无线接入设备的访问安全性。
在示例性实施方式中，锚点装置的数目可以包括至少两个；
所述无线接入设备获取终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息，包括：所述无线接入设备获取终端在由所述无线接入设备和所述至少两个锚点装置构建的三维坐标系下的位置信息，其中，无线接入设备与至少两个锚点装置构建的三维坐标系可以为空间直角坐标系。
在本实施方式中，步骤S101可以包括：
无线接入设备检测无线接入设备与终端之间的距离、以及无线接入设备与至少两个锚点装置中的每个锚点装置之间的距离，并从锚点装置接收锚点装置 与终端之间的距离；或者，
无线接入设备检测所述无线接入设备与所述终端之间的距离，并从所述锚点装置接收所述锚点装置与所述无线接入设备之间的距离、以及所述锚点装置与所述终端之间的距离；或者，
无线接入设备从至少两个锚点装置中的一个锚点装置接收终端的位置信息。
然后，无线接入设备可以根据无线接入设备与每个锚点装置之间的距离、每个锚点装置与该终端之间的距离以及无线接入设备与该终端之间的距离，计算该终端在该直角坐标系下的三维坐标。
或者，终端在直角坐标系下的三维坐标可以由其中一个锚点装置计算，锚点装置在计算得到终端的三维坐标之后传输给无线接入设备。
在示例性实施方式中，无线接入设备检测无线接入设备与终端之间的距离、无线接入设备与每个锚点装置之间的距离，可以包括：
无线接入设备通过精准测时机制(FTM)检测无线接入设备与终端之间的距离、以及无线接入设备与每个锚点装置之间的距离。如此，提高位置信息的准确性。
下面通过多个实施例对本申请进行详细说明。
实施例一
本实施例说明无线接入设备(以无线路由器为例)与锚点装置(比如，WiFi信号收发设备)配合对终端(比如，WiFi终端)进行定位的方式。
本实施例中，锚点装置的数目可以为三个，三个锚点装置(比如，锚点装置A、锚点装置B及锚点装置C)与无线路由器之间的位置关系可以如图2所示。其中，三个锚点装置和无线路由器可以构建一个空间直角坐标系。
如图2所示，锚点装置A、锚点装置B以及无线路由器处于同一水平面位置，并且锚点装置A与无线路由器所处直线和锚点装置B与无线路由器所处直线之间的夹角为90度(即，相互垂直)；锚点装置C与无线路由器所处直线与水平面垂直。其中，以无线路由器的天线位置(比如，WiFi天线位置)作为原点设置直角坐标系，且三个锚点装置A、B、C分别安置在水平X轴、水平Y轴以及垂直Z轴上。如图3所示，以无线路由器的天线位置记为原点O点，三 个锚点装置的位置可以依次记为A(a，0，0)、B(0，b，0)、C(0，0，c)。连接无线路由器的终端的位置可以记为P(x，y，z)，其中，终端的位置P(x，y，z)未知。
其中，锚点装置A、B、C三个设备到无线路由器的距离可以预设，比如，预设锚点装置A到无线路由器的距离可以为a，锚点装置B到无线路由器的距离可以为b，锚点装置C到无线路由器的距离可以为c。然而，本申请对此并不限定。在其他实现方式中，无线路由器可以通过相关的测量方式得到与每个锚点装置之间的距离。
本实施例中，锚点装置A、B、C可以发射和接收WiFi信号，无线路由器可以采用精准测时机制(FTM，Fine Timing Measurement)检测无线路由器与终端、以及无线路由器与每个锚点装置之间的距离；每个锚点装置可以采用FTM检测与终端之间的距离，并通过WiFi信号将各自检测得到的与终端之间的距离发送给无线路由器；然后，无线路由器可以根据检测到的无线路由器与终端之间的距离、无线路由器与每个锚点装置之间的距离以及接收到的每个锚点装置与终端之间的距离，计算终端在直角坐标系中的三维坐标。
其中，FTM来自于IEEE 802.11REVmc标准草案，FTM的理论精度在皮秒级别。在本实施例中，借助FTM测距方法，无线路由器与锚点装置可以进行距离检测，使得无线路由器可以计算出终端的精确位置。本实施例中关于FTM的详细测距原理不再赘述。
下面参照图3说明终端的位置P的计算过程。比如，终端的位置P分别到无线路由器的天线位置O，以及锚点装置A、B、C位置的距离，分别记为
Figure PCTCN2018085983-appb-000001
Figure PCTCN2018085983-appb-000002
那么，即可得出如下方程：
Figure PCTCN2018085983-appb-000003
终端的位置P的最终坐标位置为：
Figure PCTCN2018085983-appb-000004
在一实施例中，本实施例中终端的位置P的精度与锚点装置A、B、C分别到无线路由器的天线位置O的距离的精准度相关；这些距离越精确，最终计算得出的终端的坐标位置也就越精确。
在一实施例中，在其他实现方式中，每个锚点装置还可以设置为发射和接收激光、红外等定位信号；锚点装置通过定位信号检测到与终端之间的距离之后，通过数据传输信号(比如，WiFi信号)将检测到的距离传输给无线路由器，以便于无线路由器计算终端的三维坐标。
在其他实现方式中，锚点装置之间还可以进行数据传输，任一个锚点装置可以负责计算终端的三维坐标，并将计算得到的三维坐标传输给无线路由器。
在其他实现方式中，锚点装置的位置可以不需要特别按照直角坐标系的位置进行设置。比如，无线路由器和三个锚点装置的位置可以如图4所示，可以根据三维锥形的结构推算出合适的空间直角坐标系。
在其他实现方式中，可以不需要预先设计无线路由器到三个锚点装置之间的距离。在本实现方式中，可以对每个锚点装置的位置进行以下初始化操作：通过FTM测量出无线路由器、锚点装置A、锚点装置B以及锚点装置C之间的距离，如图4所示，分别测量出锚点装置A与无线路由器之间的距离a，锚点装置C与无线路由器之间的距离c，锚点装置B与无线路由器之间的距离b，锚点装置A和锚点装置C之间的距离d，锚点装置A与锚点装置B之间的距离e，以及锚点装置C和锚点装置B之间的距离f，然后根据三维锥形的结构推算出合适的直角坐标系。
在其他实现方式中，如果锚点装置的摆放位置不够理想(比如，锚点装置的位置以及无线路由器的位置几乎处于同一平面)，那么在初始化阶段无线路 由器会检测出不理想状态，可以通过用户界面UI方式通知用户重新摆放锚点装置的位置。
在一实施例中，无线路由器以及辅助的锚点装置的位置在确定之后就不可以随意挪动，避免会出现无线路由器对安全区域判断不准确的问题；另外，在锚点装置的数目为至少三个时，无线路由器和锚点装置的摆放位置避免出现在同一平面位置，即，无线路由器和至少三个锚点装置不放置在同一平面内，避免会出现对终端的定位不准确的问题。
实施例二
本实施例说明无线接入设备(以无线路由器为例)的安全区域的建立过程以及安全区域的检测过程，如图5所示。
本实施例中，安全区域为包括水平安全区域和垂直安全区域的三维立体空间，即三维立体空间可以通过水平安全区域和垂直安全区域组合得到。
本实施例的过程包括以下步骤：
S501、无线路由器在首次使用时先进入安全区域学习模式；其中，安全区域学习分为两部分进行：水平安全区域；垂直安全区域。
S502、合法终端连接到无线路由器，比如，合法的WiFi终端连接到WiFi无线路由器；
S503、无线路由器进行水平安全区域学习；
其中，对于水平安全区域的建立，在合法终端连接到无线路由器后，无线路由器以较短的时间间隔为周期(比如设置为10s)对该合法终端进行定位操作(比如，采用实施例一所述的方式确定合法终端的三维坐标)；与此同时，合法终端尽量沿着室内区域的边界绕行一圈或多圈；假设无线路由器的定位周期为10s，那么在实际操作时，合法终端的移动速度可以保持在0.1m/s左右。无线路由器通过对采集到的位置信息进行优化处理(比如后期由用户介入微调水平区域形状)，得到由若干点组成的多边形水平安全区域，如图6所示。
S504、无线路由器进行垂直安全区域学习；
其中，对于垂直安全区域的建立，参见图6，当合法终端连接到无线路由器后，合法终端在垂直方向上移动；当合法终端移动到屋顶时保持一段时间，以 让无线路由器采集到垂直方向的最高点的高度H2；另外，合法终端移动到地板后保持一段时间，以让无线路由器采集到垂直方向的最低点的高度H1；由此，建立室内的垂直安全区域。
S505、无线路由器关闭安全区域学习模式；
S506、无线路由器进入正常工作模式；
本实施例中，当水平方向上多边形安全区域以及垂直方向安全区域建立成功之后，关闭无线路由器的安全区域学习模式并进入正常工作模式。
S507、无线路由器检测终端的位置信息；
S508、判断该终端是否处于水平安全区域内；在该终端处于水平安全区域内的情况下，执行S509，在该终端不在水平安全区域内的情况下，执行S510；
S509、判断该终端是否处于垂直安全区域内；在该终端处于垂直安全区域内的情况下，执行S511，在该终端不在垂直安全区域内的情况下，执行S510；
S510、判定该终端不在无线路由器的安全区域内；
S511、判定该终端处于无线路由器的安全区域内。
在本实施例中，当无线路由器检测终端是否处于安全区域时，首先通过实施例一所述的终端定位方式对该终端进行定位检测，假设检测到该终端的坐标位置为(x，y，z)，那么，首先判断点(x，y)是否处于水平多边形安全区域内，如果不是，则该终端不处于无线路由器的安全区域内；如果(x，y)在水平多边形区域内，接下来还需要检测终端的垂直坐标z是否满足：H1≤z≤H2，即终端是否处于垂直安全区域内；如果终端处于垂直安全区域内，那么该终端处于无线路由器的安全区域内。
在一实施例中，本申请对于水平安全区域的学习和垂直安全区域的学习的先后顺序并不限定，两者也可以同时进行；本申请对于水平安全区域的检测和垂直安全区域的检测过程的先后顺序也并限定。
在一实施例中，本申请对于水平安全区域的形状并不限定。如图6所示，水平安全区域可以是多边形；如图7所示，水平安全区域可以为圆形，比如椭圆形。在建立如图7所示的水平安全区域的过程中，合法终端可以绕着圆形水平区域移动，然后无线路由器周期地定位计算合法终端在区域边界上的位置； 当合法终端沿着圆形区域移动一圈之后，通过定位得到若干边界点连接起来的多边形代替圆形区域边界。其中，为了对圆形区域的描述更加准确，需要更多边界点连接的多边形来尽可能达到圆形区域的效果。因此，在本实现方式中，可以减少无线路由器的定位周期，比如每隔5s对合法终端进行一次定位计算；另外，可以降低合法终端的移动速率，比如以0.5m/s的速度沿着圆形区域移动。如此，在合法终端移动一周之后可以得到更多的边界点。
在其他实现方式中，如图8所示，水平安全区域由阻碍墙分割为两个空间：水平安全区域-I以及水平安全区域-II。由于Wi-Fi信号在穿墙之后信号质量会衰减严重，会导致FTM测距时误差较大。因此，在本实现方式中，可以在水平安全区域-I以及水平安全区域-II确定的两个空间里分别放置一套本申请实施例一所示的无线路由器以及辅助定位的锚点装置，然后两个无线路由器可以分别在各自的空间中分别计算、学习自己的安全区域，最后这两个无线路由器可以共享对方的安全区域信息。以无线路由器-I学习到水平安全区域-I、无线路由器-II学习到水平安全区域-II为例，无线路由器-I和无线路由器-II可以确定自己的安全区域均包括水平安全区域-I以及水平安全区域-II。
在本实施例中，无线路由器通过学习方式确定自己的安全区域，可以提高安全区域的准确性和适用性。
实施例三
本实施例描述无线路由器主动防御黑客攻击以及防止上网流量外泄的方式。在本实施例中，用户在使用无线路由器时，首先必须固定无线路由器以及锚点装置的位置(比如实施例一所示的位置)，然后无线路由器开机；后续的步骤如下所述：
第一步、用户首次使用无线路由器时，首先设置无线路由器为安全区域学习模式。
第二步、用户使用合法终端(比如，Wi-Fi终端)连接到无线路由器上，然后携带该合法终端尽量沿着室内边界转几圈，让无线路由器尽可能完备地学习掌握到室内的空间区域情况。
第三步、用户通过UI(User Interface，用户界面)交互方式确认无线路由器对室内空间区域的学习情况；如有需要，可以通过UI适当进行调整安全区域 的范围。
第四步、在室内安全区域学习完毕后，关闭无线路由器的安全区域学习模式，无线路由器进入主动防御模式(正常工作模式)。
在第四步之后，无线路由器已经建立了自己的安全区域。
第五步、如果检测到一个WiFi终端成功连接到无线路由器上，则触发一次对该WiFi终端的定位检测；在该WiFi终端在无线路由器的安全区域内的情况下，该WiFi终端正常上网，即无线路由器将分配足够的上网流量带宽(假设无线路由器可以给每个用户分配最大10Mbps带宽)给该WiFi终端；在该WiFi终端不在无线路由器的安全区域内的情况下，无线路由器降低或者停用对该WiFi终端的上网流量带宽分配，但是不会主动断开与该WiFi终端的连接。
第六步、如果检测到一个WiFi终端设备在短时间内(比如，1分钟)一直连接失败，并且连接失败次数超过一个安全阈值，那么该情况也会触发无线路由器对该WiFi终端的一次定位检测；在该WiFi终端在无线路由器的安全区域内的情况下，无线路由器主动通过其他方式通知管理员确认该WiFi终端是否异常，并暂时阻止该WiFi终端的连接；在该WiFi终端不在无线路由器的安全区域内的情况下，对该WiFi终端进行拉黑阻止处理，即将来自该Wi-Fi终端的任何报文彻底丢弃，并且不给予任何响应。
第七步、周期性地对已连接到无线路由器的每个WiFi终端进行定位检测；在该WiFi终端在无线路由器的安全区域内的情况下，则该WiFi终端正常上网，不受限制；在该WiFi终端不在无线路由器的安全区域内的情况下，无线路由器降低或者停用对该WiFi终端的上网流量带宽分配。
下面通过图9至图11分别对第五步至第七步进行详细说明。
如图9所示，本实施例能够主动防御流量外泄，本实施例包括以下步骤：
S901、WiFi终端连接到无线路由器；
S902、该WiFi终端成功连接到无线路由器之后，无线路由器对该WiFi终端进行定位操作(参见实施例一所述的方式)；
S903、无线路由器判断该WiFi终端是否在该无线路由器的安全区域内；在该WiFi终端处于安全区域内的情况下，执行S904，在该WiFi终端不在安全区 域内的情况下，执行S905；
S904、分配给该WiFi终端足够流量带宽(假设无线路由器可以给每个用户分配最大10Mbps带宽)；
S905、不分配任何流量带宽给该WiFi终端。
如图10所示，本实施例能够主动防御黑客暴力破解攻击室内的无线路由器的WiFi密码。本实施例包括以下步骤：
S1001、无线路由器在短时间内检测到WiFi终端的持续连接失败的事件，并且在预定时间内该WiFi终端设备尝试连接次数超过一个预定阈值，此时，将触发无线路由器对该WiFi终端进行一次定位操作；
S1002、无线路由器检测WiFi终端的位置信息(参见实施例一)；
S1003、无线路由器判断该WiFi终端是否在该无线路由器的安全区域内；在该WiFi终端处于安全区域内的情况下，执行S1004，在该WiFi终端不在安全区域内的情况下，执行S1005；
S1004、通知管理员检查该WiFi终端是否出现了问题，并且暂时阻止该WiFi终端的继续连接行为；
S1005、直接阻止该Wi-Fi终端的连接行为，并且不再响应该Wi-Fi终端设备的任何请求。
如图11所示，本实施例能够实现主动防御流量外泄，本实施例包括以下步骤：
S1101、无线路由器以间隔预定时长周期性对已连接的每一个WiFi终端进行定位操作(参见实施例一)；
S1102、无线路由器判断WiFi终端设备是否在该无线路由器的安全区域内；在该WiFi终端处于安全区域内的情况下，执行S1103，在该WiFi终端不在安全区域内的情况下，执行S1104；
S1103、分配给该WiFi终端足够流量带宽；
S1104、分配给该WiFi终端的流量带宽减半(比如，可分配的最低额度为1Kbps)。
在一实施例中，假设WiFi终端开始分配到的流量带宽为2Mbps，如果第一个周期内检测到该WiFi终端不在安全区域内，那么该WiFi终端分配到的流量带宽变为1Mbps；在第二个周期将减到512Kbps。
如图12所示，本申请实施例还提供一种接入控制装置，配置在无线接入设备中，包括：第一定位模块1201、安全区域检测模块1202以及接入控制模块1203；
其中，第一定位模块1201设置为获取终端在由无线接入设备和锚点装置构建的三维坐标系下的位置信息；
安全区域检测模块1202设置为根据终端在所述三维坐标系下的位置信息，判断该终端是否处于无线接入设备的安全区域内；
接入控制模块1203设置为根据判断结果，执行与所述判断结果对应的接入控制操作。
其中，上述装置还可以包括：安全区域确定模块1204，设置为通过以下至少一种方式建立或调整无线接入设备的安全区域：
根据UI输入的信息，建立或调整无线接入设备的安全区域；
根据预设信息，建立或调整无线接入设备的安全区域；
通过获取一个或多个预定终端连接无线接入设备后在三维坐标系下的位置信息，建立或调整无线接入设备的安全区域。
在示例性实施方式中，安全区域可以为包括水平安全区域和垂直安全区域的三维立体空间；安全区域检测模块1202可以设置为通过以下方式判断终端是否处于无线接入设备的安全区域内：
根据终端在三维坐标系下的位置信息，判断终端是否位于水平安全区域内；
在该终端没有位于水平安全区域内的情况下，判定该终端不在安全区域内；在该终端位于水平安全区域内的情况下，判断该终端是否位于垂直安全区域内；在该终端位于垂直安全区域内的情况下，判定该终端处于安全区域内，在该终端没有位于垂直安全区域内的情况下，判定该终端不在安全区域内。
在示例性实施方式中，接入控制模块1203可以包括以下至少之一：
第一处理单元，设置为在检测到一终端成功连接到无线接入设备时，在确定该终端处于无线接入设备的安全区域内的情况下，给该终端分配满足第一条件的流量带宽，在确定该终端不处于无线接入设备的安全区域内的情况下，给该终端分配满足第二条件的流量带宽，或者，停止给该终端分配流量带宽；其中，满足第一条件的流量带宽大于满足第二条件的流量带宽；
第二处理单元，设置为在检测到一终端在预定时长内连续连接无线接入设备的失败次数满足阈值条件时，在确定该终端处于无线接入设备的安全区域内的情况下，暂时阻止该终端的继续连接行为，并给出确认该终端是否异常的提示；在确定该终端不处于无线接入设备的安全区域内的情况下，阻止该终端的连接行为，且不响应该终端的请求；
第三处理单元，设置为在周期性获取已连接到无线接入设备的终端的位置信息之后，在确定该终端处于无线接入设备的安全区域内的情况下，给该终端分配满足第三条件的流量带宽；在确定该终端不处于无线接入设备的安全区域内的情况下，给该终端分配满足第四条件的流量带宽；其中，满足第三条件的流量带宽大于满足第四条件的流量带宽。
在示例性实施方式中，锚点装置的数目可以包括至少两个，无线接入设备与至少两个锚点装置可以构建空间直角坐标系。
其中，第一定位模块1201可以设置为通过以下方式获取终端在由无线接入设备和锚点装置构建的三维坐标系下的位置信息：
检测无线接入设备与终端之间的距离、以及无线接入设备与每个锚点装置之间的距离，并从锚点装置接收锚点装置与该终端之间的距离，根据所述无线接入设备与所述终端之间的距离、所述无线接入设备与每个锚点装置之间的距离、以及所述锚点装置与所述终端之间的距离，计算并获得所述终端在所述三维坐标系下的位置信息；或者，
检测所述无线接入设备与所述终端之间的距离，并从所述锚点装置接收所述锚点装置与所述无线接入设备之间的距离、以及所述锚点装置与所述终端之间的距离，根据所述无线接入设备与所述终端之间的距离、所述锚点装置与所述无线接入设备之间的距离、以及所述锚点装置与所述终端之间的距离，计算并获得所述终端在所述三维坐标系下的位置信息；或者
无线接入设备从一个锚点装置接收该终端的位置信息。
在示例性实施方式中，第一定位模块1201可以通过FTM检测无线接入设备与终端之间的距离、以及无线接入设备与任一锚点装置之间的距离。
在示例性实施方式中，第一定位模块1201，即，配置在接入控制装置中的定位模块，可以设置为无线路由器对终端进行精确定位，该终端的位置信息将会用于安全区域检测模块1202、安全区域确定模块1204和接入控制模块1203；安全区域确定模块1204基于合法终端连接到无线路由器后，通过第一定位模块1201不断地探测合法终端的位置信息，学习构造出该无线路由器的安全区域；安全区域检测模块1202基于第一定位模块1201检测到的终端的位置信息，根据已经学习到的安全区域判断该终端是否在安全区域内；接入控制模块1203负责主动防护黑客恶意的WiFi破解攻击以及防止上网流量的外泄等。
关于本实施例提供的无线接入设备的相关说明可以参照上述方法实施例的说明，故于此不再赘述。
此外，本申请实施例还提供一种接入控制系统，包括如上实施例所述的无线接入设备以及锚点装置，无线接入设备配置有接入控制装置。关于无线接入设备和锚点装置的位置关系可以参照实施例一所述，故于此不再赘述。
此外，本申请实施例还提供一种无线接入设备，包括：存储器、处理器及存储在存储器上并可在处理器上运行的接入控制程序，所述接入控制程序被处理器执行时实现上述接入控制方法。
此外，本申请实施例还提供一种机器可读介质，存储有接入控制程序，所述接入控制程序被处理器执行时实现上述接入控制方法。
如图13所示，本申请实施例还提供一种安全区域确定方法，包括：
S1301、在一个或多个预定终端连接无线接入设备后，获取一个或多个预定终端在由无线接入设备和锚点装置构建的三维坐标系下的位置信息；
S1302、根据获取的所述一个或多个预定终端在所述三维坐标系下的位置信息，执行以下至少之一：建立无线接入设备的安全区域、和调整无线接入设备的安全区域。
在示例性实施方式中，在建立无线接入设备的安全区域之后，本实施例的 方法还可以包括以下至少之一：
根据UI输入的信息，调整无线接入设备的安全区域；
根据预设信息，调整无线接入设备的安全区域。
比如，在建立安全区域之后，用户可以通过UI对已建立的安全区域进行调整，使得安全区域更合理；或者，在建立安全区域后，可以根据预设信息，对已建立的安全区域进行调整，例如，预设信息可以包括垂直安全区域的最高点至最低点之间的垂直距离大于或等于预设值，可以检测已建立的垂直安全区域内的最大垂直距离是否满足预设信息定义的预设值，若不满足，则可以根据预设值调整已建立的垂直安全区域。
在示例性实施方式中，可以将根据获取的位置信息确定的三维立体空间作为无线接入设备的安全区域。换言之，无线接入设备的安全区域为一个三维立体空间。
在示例性实施方式中，锚点装置的数目包括至少两个，无线接入设备与至少两个锚点装置可以构建一个直角坐标系。
在示例性实施方式中，在本实施例的安全区域确定方法应用于无线接入设备时，步骤S1301可以包括：
无线接入设备检测无线接入设备与一个或多个预定终端之间的距离、无线接入设备与每个锚点装置之间的距离，并从锚点装置接收锚点装置与该预定终端之间的距离，根据所述无线接入设备与所述一个或多个预定终端之间的距离、所述无线接入设备与每个锚点装置之间的距离、以及所述锚点装置与所述一个或多个预定终端之间的距离，计算并获得所述一个或多个预定终端在所述三维坐标系下的位置信息；或者，
无线接入设备检测无线接入设备与一个或多个预定终端之间的距离，并从锚点装置接收锚点装置与无线接入设备之间的距离、以及锚点装置与该一个或多个预定终端之间的距离，根据所述无线接入设备与所述一个或多个预定终端之间的距离、所述锚点装置与所述无线接入设备之间的距离、以及所述锚点装置与所述一个或多个预定终端之间的距离，计算并获得所述一个或多个预定终端在所述三维坐标系下的位置信息。
在示例性实施方式中，在本实施例的安全区域确定方法应用于锚点装置时，步骤S1301可以包括：
锚点装置检测锚点装置与一个或多个预定终端之间的距离、锚点装置与无线接入设备之间的距离，并从无线接入设备接收无线接入设备与该一个或多个预定终端之间的距离，根据所述锚点装置与所述一个或多个预定终端之间的距离、所述锚点装置与所述无线接入设备之间的距离、以及所述无线接入设备与所述一个或多个预定终端之间的距离，计算并获得所述一个或多个预定终端在所述三维坐标系下的位置信息；或者，
锚点装置检测锚点装置与一个或多个预定终端之间的距离，并从无线接入设备接收无线接入设备与锚点装置之间的距离、无线接入设备与该一个或多个预定终端之间的距离，根据所述锚点装置与所述一个或多个预定终端之间的距离、所述无线接入设备与所述锚点装置之间的距离、以及所述无线接入设备与所述一个或多个预定终端之间的距离，计算并获得所述一个或多个预定终端在所述三维坐标系下的位置信息。
在示例性实施方式中，无线接入设备与每个锚点装置之间的距离、每个锚点装置与一个或多个预定终端之间的距离以及无线接入设备与一个或多个预定终端之间的距离可以通过FTM得到。
关于本实施例的相关说明可以参照实施例一和实施例二的描述，故于此不再赘述。
如图14所示，本申请实施例提供一种安全区域确定装置，包括：第二定位模块1401(即配置在安全区域确定装置中的定位模块)以及处理模块1402；
其中，第二定位模块1401设置为在一个或多个预定终端连接无线接入设备后，获取所述一个或多个预定终端在由无线接入设备和锚点装置构建的三维坐标系下的位置信息；
处理模块1402，设置为根据获取的所述一个或多个预定终端在所述三维坐标系下的位置信息，执行以下至少之一：建立无线接入设备的安全区域、和调整无线接入设备的安全区域。
在示例性实施方式中，本实施例的装置还可以包括以下至少之一：
第一调整模块1403，设置为根据UI输入的信息，调整无线接入设备的安全区域；
第二调整模块1404，设置为根据预设信息，调整无线接入设备的安全区域。
关于本实施例提供的安全区域确定装置的说明可以参照上述安全区域确定方法的描述，故于此不再赘述。
此外，本申请实施例还提供一种设备，包括：存储器、处理器及存储在存储器上并可在处理器上运行的安全区域确定程序，上述安全区域确定程序被处理器执行时实现上述安全区域确定方法。其中，本实施例的设备可以是无线接入设备或者锚点装置。
此外，本申请实施例还提供一种机器可读介质，存储有安全区域确定程序，所述安全区域确定程序被处理器执行时实现上述安全区域确定方法。本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、系统、装置中的功能模块/单元可以被实施为软件、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些组件或所有组件可以被实施为由处理器，如数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在机器可读介质(比如，计算机可读介质)上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、电可擦可编程只读存储器EEPROM、闪存或其他存储器技术、光盘只读存储器CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
工业实用性
本公开基于对终端的准确定位和无线接入设备的安全区域进行接入控制，可以有效确保无线接入设备不被周边黑客恶意攻击或者破解无线接入设备的密码，从而提高无线接入设备的访问安全性。通过无线接入设备和锚点装置的配合对终端进行定位，提高了定位准确性。通过无线接入设备和锚点装置的配合对预定终端进行定位来确定安全区域，提高了安全区域的准确性和适用性。

Claims (23)

  1. 一种接入控制方法，包括：
    无线接入设备获取终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息；
    根据所述终端在所述三维坐标系下的位置信息，判断所述终端是否处于所述无线接入设备的安全区域内；
    根据判断结果，执行与所述判断结果对应的接入控制操作。
  2. 根据权利要求1所述的方法，还包括：通过以下至少一种方式建立或调整所述无线接入设备的安全区域：
    根据输入信息，建立或调整所述无线接入设备的安全区域；
    根据预设信息，建立或调整所述无线接入设备的安全区域；
    通过获取一个或多个预定终端连接所述无线接入设备后在所述三维坐标系下的位置信息，建立或调整所述无线接入设备的安全区域，其中，所述预定终端包括所述无线接入设备识别为合法的终端。
  3. 根据权利要求1或2所述的方法，其中，所述安全区域为包括水平安全区域和垂直安全区域的三维立体空间；
    所述判断所述终端是否处于所述无线接入设备的安全区域内，包括：根据所述终端的所述位置信息，判断所述终端是否位于所述水平安全区域内；
    在所述终端没有位于所述水平安全区域内的情况下，判定所述终端不在所述安全区域内；
    在所述终端位于所述水平安全区域内的情况下，判断所述终端是否位于所述垂直安全区域内；在所述终端位于所述垂直安全区域内的情况下，判定所述终端处于所述安全区域内，在所述终端没有位于所述垂直安全区域内的情况下，判定所述终端不在所述安全区域内。
  4. 根据权利要求1、2或3所述的方法，其中，所述根据判断结果，执行与所述判断结果对应的接入控制操作，包括：
    当所述无线接入设备检测到所述终端成功连接到所述无线接入设备时，在确定所述终端处于所述无线接入设备的安全区域内的情况下，给所述终端分配 满足第一条件的流量带宽；
    在确定所述终端不处于所述无线接入设备的安全区域内的情况下，给所述终端分配满足第二条件的流量带宽，或者，停止给所述终端分配流量带宽；
    其中，所述满足第一条件的流量带宽大于所述满足第二条件的流量带宽。
  5. 根据权利要求1、2或3所述的方法，其中，所述根据判断结果，执行与所述判断结果对应的接入控制操作，还包括：
    当所述无线接入设备检测到所述终端在预定时长内连续连接所述无线接入设备的失败次数满足阈值条件时，在确定所述终端处于所述无线接入设备的安全区域内的情况下，在预设时间内阻止所述终端的继续连接行为，并给出确认所述终端是否异常的提示；
    在确定所述终端不处于所述无线接入设备的安全区域内的情况下，阻止所述终端的连接行为，且不响应所述终端的请求。
  6. 根据权利要求1、2或3所述的方法，其中，所述根据判断结果，执行与所述判断结果对应的接入控制操作，还包括：
    当所述无线接入设备周期性获取已连接到所述无线接入设备的终端的位置信息之后，在确定所述终端处于所述无线接入设备的安全区域内的情况下，给所述终端分配满足第三条件的流量带宽；
    在确定所述终端不处于所述无线接入设备的安全区域内的情况下，给所述终端分配满足第四条件的流量带宽；
    其中，所述满足第三条件的流量带宽大于所述满足第四条件的流量带宽。
  7. 根据权利要求1所述的方法，其中，所述锚点装置的数目包括至少两个；
    所述无线接入设备获取终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息，包括：所述无线接入设备获取终端在由所述无线接入设备和所述至少两个锚点装置构建的三维坐标系下的位置信息，其中，所述无线接入设备与所述至少两个锚点装置构建的三维坐标系为空间直角坐标系。
  8. 根据权利要求7所述的方法，其中，所述无线接入设备获取终端在由所述无线接入设备和所述至少两个锚点装置构建的三维坐标系下的位置信息，包 括：
    所述无线接入设备检测所述无线接入设备与所述终端之间的距离、以及所述无线接入设备与每个锚点装置之间的距离，并从所述锚点装置接收所述锚点装置与所述终端之间的距离，根据所述无线接入设备与所述终端之间的距离、所述无线接入设备与每个锚点装置之间的距离、以及所述锚点装置与所述终端之间的距离，计算并获得所述终端在所述三维坐标系下的位置信息；或者，
    所述无线接入设备检测所述无线接入设备与所述终端之间的距离，并从所述锚点装置接收所述锚点装置与所述无线接入设备之间的距离、以及所述锚点装置与所述终端之间的距离，根据所述无线接入设备与所述终端之间的距离、所述锚点装置与所述无线接入设备之间的距离、以及所述锚点装置与所述终端之间的距离，计算并获得所述终端在所述三维坐标系下的位置信息；或者，
    所述无线接入设备从所述至少两个中的任一锚点装置接收所述终端的位置信息。
  9. 根据权利要求8所述的方法，其中，所述无线接入设备检测所述无线接入设备与所述终端之间的距离、以及所述无线接入设备与每个锚点装置之间的距离，包括：
    所述无线接入设备通过精准测时机制FTM检测所述无线接入设备与所述终端之间的距离、以及所述无线接入设备与每个锚点装置之间的距离。
  10. 一种安全区域确定方法，包括：
    在一个或多个预定终端连接到无线接入设备之后，获取所述一个或多个预定终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息，其中，所述预定终端包括所述无线接入设备识别为合法的终端；
    根据获取的所述一个或多个预定终端在所述三维坐标系下的位置信息，执行以下至少之一：建立所述无线接入设备的安全区域、和调整所述无线接入设备的安全区域。
  11. 根据权利要求10所述的方法，所述建立所述无线接入设备的安全区域之后，所述方法还包括以下至少之一：
    根据输入信息，调整所述无线接入设备的安全区域；
    根据预设信息，调整所述无线接入设备的安全区域。
  12. 根据权利要求10或11所述的方法，其中，所述锚点装置的数目包括至少两个，所述无线接入设备与所述至少两个锚点装置构建的三维坐标系为空间直角坐标系。
  13. 根据权利要求10、11或12所述的方法，其中，在所述安全区域确定方法应用于所述无线接入设备时，
    所述获取所述一个或多个预定终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息，包括：
    所述无线接入设备检测所述无线接入设备与所述一个或多个预定终端之间的距离、以及所述无线接入设备与每个锚点装置之间的距离，并从所述锚点装置接收所述锚点装置与所述一个或多个预定终端之间的距离，根据所述无线接入设备与所述一个或多个预定终端之间的距离、所述无线接入设备与每个锚点装置之间的距离、以及所述锚点装置与所述一个或多个预定终端之间的距离，计算并获得所述一个或多个预定终端在所述三维坐标系下的位置信息；或者，
    所述无线接入设备检测所述无线接入设备与所述一个或多个预定终端之间的距离，并从所述锚点装置接收所述锚点装置与所述无线接入设备之间的距离、以及所述锚点装置与所述一个或多个预定终端之间的距离，根据所述无线接入设备与所述一个或多个预定终端之间的距离、所述锚点装置与所述无线接入设备之间的距离、以及所述锚点装置与所述一个或多个预定终端之间的距离，计算并获得所述一个或多个预定终端在所述三维坐标系下的位置信息。
  14. 根据权利要求10、11或12所述的方法，其中，在所述安全区域确定方法应用于所述锚点装置时，
    所述获取所述一个或多个预定终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息，包括：
    所述锚点装置检测所述锚点装置与所述一个或多个预定终端之间的距离、以及所述锚点装置与所述无线接入设备之间的距离，并从所述无线接入设备接收所述无线接入设备与所述一个或多个预定终端之间的距离，根据所述锚点装置与所述一个或多个预定终端之间的距离、所述锚点装置与所述无线接入设备 之间的距离、以及所述无线接入设备与所述一个或多个预定终端之间的距离，计算并获得所述一个或多个预定终端在所述三维坐标系下的位置信息；或者，
    所述锚点装置检测所述锚点装置与所述一个或多个预定终端之间的距离，并从所述无线接入设备接收所述无线接入设备与所述锚点装置之间的距离、以及所述无线接入设备与所述一个或多个预定终端之间的距离，根据所述锚点装置与所述一个或多个预定终端之间的距离、所述无线接入设备与所述锚点装置之间的距离、以及所述无线接入设备与所述一个或多个预定终端之间的距离，计算并获得所述一个或多个预定终端在所述三维坐标系下的位置信息。
  15. 根据权利要求10所述的方法，其中，所述根据获取的所述一个或多个预定终端在所述三维坐标系下的位置信息，建立所述无线接入设备的安全区域，包括：
    将根据获取的所述位置信息确定的三维立体空间作为所述无线接入设备的安全区域。
  16. 一种接入控制装置，配置在无线接入设备中，包括：定位模块、安全区域检测模块以及接入控制模块；
    其中，所述定位模块，设置为获取终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息；
    所述安全区域检测模块，设置为根据所述终端在所述三维坐标系下的位置信息，判断所述终端是否处于所述无线接入设备的安全区域内；
    所述接入控制模块，设置为根据判断结果，执行与所述判断结果对应的接入控制操作。
  17. 根据权利要求16所述的装置，还包括：安全区域确定模块，设置为通过以下至少一种方式建立或调整所述无线接入设备的安全区域：
    根据输入信息，建立或调整所述无线接入设备的安全区域；
    根据预设信息，建立或调整所述无线接入设备的安全区域；
    通过获取一个或多个预定终端连接所述无线接入设备后在所述三维坐标系下的位置信息，建立或调整所述无线接入设备的安全区域，其中，所述预定终端包括所述无线接入设备识别为合法的终端。
  18. 根据权利要求16或17所述的装置，其中，所述接入控制模块包括以下至少之一：
    第一处理单元，设置为当检测到所述终端成功连接到所述无线接入设备时，在确定所述终端处于所述无线接入设备的安全区域内的情况下，给所述终端分配满足第一条件的流量带宽，在确定所述终端不在所述无线接入设备的安全区域内的情况下，给所述终端分配满足第二条件的流量带宽，或者，停止给所述终端分配流量带宽；其中，所述满足第一条件的流量带宽大于所述满足第二条件的流量带宽；
    第二处理单元，设置为当检测到所述终端在预定时长内连续连接所述无线接入设备的失败次数满足阈值条件时，在确定所述终端处于所述无线接入设备的安全区域内的情况下，在预设时间内阻止所述终端的继续连接行为，并给出确认所述终端是否异常的提示；在确定所述终端不在所述无线接入设备的安全区域内的情况下，阻止所述终端的连接行为，且不响应所述终端的请求；
    第三处理单元，设置为在周期性获取已连接到所述无线接入设备的终端的位置信息之后，在确定所述终端处于所述无线接入设备的安全区域内的情况下，给所述终端分配满足第三条件的流量带宽；在确定所述终端不在所述无线接入设备的安全区域内的情况下，给所述终端分配满足第四条件的流量带宽；其中，所述满足第三条件的流量带宽大于所述满足第四条件的流量带宽。
  19. 一种安全区域确定装置，包括：
    定位模块，设置为在一个或多个预定终端连接到无线接入设备之后，获取所述一个或多个预定终端在由所述无线接入设备和锚点装置构建的三维坐标系下的位置信息，其中，所述预定终端包括所述无线接入设备识别为合法的终端；
    处理模块，设置为根据获取的所述一个或多个预定终端在所述三维坐标系下的位置信息，执行以下至少之一：建立所述无线接入设备的安全区域、和调整所述无线接入设备的安全区域。
  20. 根据权利要求19所述的装置，还包括以下至少之一：
    第一调整模块，设置为根据输入信息，调整所述无线接入设备的安全区域；
    第二调整模块，设置为根据预设信息，调整所述无线接入设备的安全区域。
  21. 一种接入控制系统，包括：锚点装置以及无线接入设备，所述无线接入设备配置有如权利要求16至18中任一项所述的接入控制装置，所述锚点装置与所述无线接入设备连接。
  22. 一种无线接入设备，包括：存储器、处理器及存储在所述存储器上并可在所述处理器上运行的接入控制程序，所述控制接入控制程序被所述处理器执行时实现如权利要求1至9中任一项所述的接入控制方法。
  23. 一种机器可读介质，存储有接入控制程序，所述接入控制程序被处理器执行时实现如权利要求1至9中任一项所述的接入控制方法。
PCT/CN2018/085983 2017-06-20 2018-05-08 接入控制方法、装置及系统、安全区域确定方法及装置 WO2018233391A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP18820664.3A EP3644629A4 (en) 2017-06-20 2018-05-08 ACCESS CONTROL METHOD, DEVICE AND SYSTEM, AND SECURE REGION DETERMINATION METHOD AND DEVICE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710471032.3 2017-06-20
CN201710471032.3A CN107396303B (zh) 2017-06-20 2017-06-20 接入控制方法及系统、安全区域确定方法及装置

Publications (1)

Publication Number Publication Date
WO2018233391A1 true WO2018233391A1 (zh) 2018-12-27

Family

ID=60332661

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/085983 WO2018233391A1 (zh) 2017-06-20 2018-05-08 接入控制方法、装置及系统、安全区域确定方法及装置

Country Status (3)

Country Link
EP (1) EP3644629A4 (zh)
CN (1) CN107396303B (zh)
WO (1) WO2018233391A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114205739A (zh) * 2021-12-01 2022-03-18 南京天擎汽车电子有限公司 一种无线定位方法、无线定位装置及计算机可读存储介质

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107396303B (zh) * 2017-06-20 2022-03-29 中兴通讯股份有限公司 接入控制方法及系统、安全区域确定方法及装置
CN108712770A (zh) * 2018-05-29 2018-10-26 四川斐讯信息技术有限公司 一种防蹭网方法及系统
CN109151818B (zh) * 2018-08-07 2021-08-17 西安易朴通讯技术有限公司 一种终端验证方法、ap设备、终端及系统
CN111770094B (zh) * 2020-06-29 2022-12-13 Oppo广东移动通信有限公司 无线网络的接入控制方法及相关装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130212204A1 (en) * 2012-02-10 2013-08-15 Qualcomm Atheros, Inc. Method and system for monitoring and limiting wireless network access based upon location parameters
CN106792542A (zh) * 2016-12-30 2017-05-31 深圳天珑无线科技有限公司 移动设备联网行为的控制方法和装置
CN107396303A (zh) * 2017-06-20 2017-11-24 中兴通讯股份有限公司 接入控制方法及系统、安全区域确定方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101544315B1 (ko) * 2014-04-23 2015-08-13 서울대학교산학협력단 무선 네트워크에서의 삼변측량법을 이용한 효과적인 3차원 위치 추정 방법 및 이를 실시하기 위한 프로그램이 기록된 기록 매체
CN104618923B (zh) * 2015-01-22 2018-10-09 新华三技术有限公司 查找无线接入点的方法及装置
CN106330843B (zh) * 2015-07-02 2020-01-14 株式会社理光 用于区域受限访问的系统和方法
CN106507359A (zh) * 2016-11-16 2017-03-15 广东浪潮大数据研究有限公司 一种限定上网的方法、路由器和系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130212204A1 (en) * 2012-02-10 2013-08-15 Qualcomm Atheros, Inc. Method and system for monitoring and limiting wireless network access based upon location parameters
CN106792542A (zh) * 2016-12-30 2017-05-31 深圳天珑无线科技有限公司 移动设备联网行为的控制方法和装置
CN107396303A (zh) * 2017-06-20 2017-11-24 中兴通讯股份有限公司 接入控制方法及系统、安全区域确定方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3644629A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114205739A (zh) * 2021-12-01 2022-03-18 南京天擎汽车电子有限公司 一种无线定位方法、无线定位装置及计算机可读存储介质
CN114205739B (zh) * 2021-12-01 2024-02-06 南京天擎汽车电子有限公司 一种无线定位方法、无线定位装置及计算机可读存储介质

Also Published As

Publication number Publication date
CN107396303A (zh) 2017-11-24
CN107396303B (zh) 2022-03-29
EP3644629A1 (en) 2020-04-29
EP3644629A4 (en) 2020-10-28

Similar Documents

Publication Publication Date Title
WO2018233391A1 (zh) 接入控制方法、装置及系统、安全区域确定方法及装置
CN107922050B (zh) 计算机可读介质、无人驾驶飞行器及其控制方法
US9336356B2 (en) Restricting network and device access based on presence detection
KR102157661B1 (ko) 무선 침입 방지 시스템, 이를 포함하는 무선 네트워크 시스템 및 무선 네트워크 시스템의 작동 방법
KR20200003099A (ko) 업링크 캐리어 어그리게이션을 위한 사용자 장비 승인 절차
JP2017046338A (ja) 身元確認方法、同方法を用いるＩｏＴゲートウェイ装置、及び検証ゲートウェイ装置
US10148676B2 (en) Method and device for defending DHCP attack
US20200036886A1 (en) Method for photographing an unmanned aerial robot and a device for supporting the same in an unmanned aerial vehicle system
US9912606B2 (en) Apparatus and method to secure acquisition and contention burst activity in a communication network
US20240031349A1 (en) Enhanced multi-factor authentication based on physical and logical proximity to trusted devices and users
CN116158019A (zh) 用于扩展现实辅助无线电资源管理的方法、架构、装置和系统
JP6172350B2 (ja) エリア制限アクセスに用いるシステム及び方法
EP3318103B1 (en) Data transmissions without connections
US10608769B2 (en) Selective directional mitigation of wireless signal interference
CN103906226A (zh) 邻近终端发现方法、装置、终端和服务器
JP2017168909A (ja) 無線通信プログラム、方法及び装置
US9357395B1 (en) Protecting non-informing incumbent spectrum operations
US11726173B2 (en) Attack detection and mitigation for fine timing measurement
US11956637B2 (en) Management of an adaptive relay method for lost-device bluetooth low energy signaling
KR101624135B1 (ko) 사물인터넷 기능을 이용한 미아방지 장치
KR20150012154A (ko) 비인가 액세스 포인트 검출 장치 및 그 방법
US9337951B2 (en) Device and method for limiting an extent of a wireless network service
KR101575341B1 (ko) 무선침입방지시스템 센서 및 채널 모니터링 방법
KR101395835B1 (ko) 단말장치 및 인증관리장치와, 그 장치의 동작 방법
US11552960B2 (en) Technique for processing messages sent by a communicating device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18820664

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018820664

Country of ref document: EP

Effective date: 20200120