WO2020029498A1 - 一种终端验证方法、ap设备、终端及系统 - Google Patents

一种终端验证方法、ap设备、终端及系统 Download PDF

Info

Publication number
WO2020029498A1
WO2020029498A1 PCT/CN2018/120744 CN2018120744W WO2020029498A1 WO 2020029498 A1 WO2020029498 A1 WO 2020029498A1 CN 2018120744 W CN2018120744 W CN 2018120744W WO 2020029498 A1 WO2020029498 A1 WO 2020029498A1
Authority
WO
WIPO (PCT)
Prior art keywords
terminal
response
positioning
identification information
authorization
Prior art date
Application number
PCT/CN2018/120744
Other languages
English (en)
French (fr)
Inventor
李伟
Original Assignee
西安易朴通讯技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 西安易朴通讯技术有限公司 filed Critical 西安易朴通讯技术有限公司
Priority to US17/043,367 priority Critical patent/US11582606B2/en
Priority to DE112018007211.8T priority patent/DE112018007211T5/de
Publication of WO2020029498A1 publication Critical patent/WO2020029498A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/03—Protecting confidentiality, e.g. by encryption
    • H04W12/037—Protecting confidentiality, e.g. by encryption of the control plane, e.g. signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/047—Key management, e.g. using generic bootstrapping architecture [GBA] without using a trusted network node as an anchor
    • H04W12/0471—Key exchange
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/63—Location-dependent; Proximity-dependent
    • H04W12/64—Location-dependent; Proximity-dependent using geofenced areas
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/02—Services making use of location information
    • H04W4/021—Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the present invention relates to the field of wireless communication technologies, and in particular, to a terminal verification method, an AP device, a terminal, and a system.
  • WLAN wireless local area networks
  • AP access point
  • the terminal in order to improve the security of the WLAN, the terminal usually needs to pass the AP device's identity verification before it can access the wired network through the AP device.
  • the identity verification of the terminal will consume too much operating resources of the AP device and affect the quality of the WLAN network.
  • an end user is often required to enter an authentication key in the terminal, which makes the use of WLAN too cumbersome.
  • the invention provides a terminal verification method, an AP device, a terminal, and a system, so as to improve the convenience of terminal verification in WLAN.
  • an embodiment of the present invention provides a terminal authentication method, which is applied to an access point AP device in a wireless local area network WLAN.
  • the AP device is an encrypted AP device.
  • the method includes:
  • the connection request includes identification information of the first terminal; querying an authorization list according to the identification information of the first terminal; the authorization list includes terminals located within a preset exemption range
  • an authorization response is returned to the first terminal; the authorization response is used to instruct the first terminal to establish a network with the AP device connection.
  • the AP device when the AP device determines that the first terminal is within the preset exemption range according to the authorization list, it can directly return an authorization response to the first terminal without verifying the first terminal within the exemption range, reducing WLAN The number of first terminals in the coverage area that need to be authenticated, thereby reducing the resource consumption of the AP device by the authentication, and at the same time making the use of the WLAN more convenient.
  • the method further includes:
  • the broadcast signal Periodically sending a broadcast signal; the broadcast signal is used to instruct a first terminal to determine a positioning feature of the received broadcast signal and return a positioning response to the AP device; the positioning response includes an identifier of the first terminal Information and the positioning characteristics; the first terminal is any terminal that receives the broadcast signal; receives the positioning response, and determines that the first terminal is located at the location according to the positioning characteristics in the positioning response. If the identification information of the first terminal does not exist in the authorization-free range and the authorization list does not exist, the identification information of the first terminal is added to the authorization list.
  • the method further includes:
  • Sending an authentication response to the first terminal located in the non-secret range allows the first terminal to determine that it has the authority to connect to the AP device.
  • the identification information of the first terminal is not included in the authorization list, confirming that the first terminal fails authentication;
  • the verification instruction is used to instruct the first terminal to return a verification key; and verify the first terminal according to the verification key returned by the first terminal.
  • the first terminal When the first terminal is located outside the exemption range, directly confirming that the first terminal fails the authentication can improve the security of the AP device.
  • verifying the first terminal by using an authentication key can enable legitimate terminals located outside the non-secret range to use the WLAN.
  • Optional also includes:
  • the Internet access signal is sent to the AP device after the first terminal establishes a connection with the AP device; the Internet access signal includes an identifier of the first terminal information;
  • a receiving response is returned to the first terminal.
  • the positioning feature includes a receiving strength and a receiving angle of a signal.
  • the non-secret range is represented by a boundary function;
  • the boundary function is used to characterize a relationship between a reception intensity and a reception angle of the broadcast signal located at a boundary of the non-secret range;
  • the method further includes:
  • the receiving intensity satisfies a positioning response of a preset intensity
  • a boundary function of the unsecured range is determined according to a reception intensity and a reception angle in a positioning response in which the reception intensity satisfies the preset intensity.
  • the non-secret range is represented by a boundary function;
  • the boundary function is used to characterize a relationship between a reception intensity and a reception angle of the broadcast signal located at a boundary of the non-secret range;
  • the method further includes:
  • the multiple sampling devices are located at a preset boundary of the privacy-free range
  • a boundary function of the non-secret range is determined according to a reception intensity and a reception angle in a positioning response returned by the plurality of sampling devices.
  • the AP device determines whether the terminal is located within the security-free range according to a functional relationship between a positioning feature and a boundary function in a positioning response returned by the first terminal.
  • an embodiment of the present invention provides a terminal verification method, which is applied to a terminal in a wireless local area network WLAN.
  • the WLAN further includes an encrypted AP device.
  • the method includes:
  • connection request includes identification information of the terminal
  • the authorization response is returned by the target AP device to the terminal when it is determined that the authorization list includes identification information of the terminal; the authorization list includes Identification information of terminals within a preset exemption range of the AP device;
  • Optional also includes:
  • the positioning response includes the positioning feature and identification information of the terminal.
  • Optional also includes:
  • the authentication response When receiving the authentication response from multiple AP devices at the same time, it is determined that the AP device with the strongest signal strength among the multiple authentication responses is the target AP device; the authentication response is determined by the AP device based on the positioning response.
  • the terminal sends to the terminal after the terminal is located in the preset exemption range;
  • the method further includes:
  • the Internet access signal includes identification information of the terminal
  • the target AP device is determined again.
  • an embodiment of the present invention provides an AP device.
  • the AP device is an encrypted AP device and includes: a transceiver module and a processing module;
  • the transceiver module is configured to receive a connection request sent by a first terminal; the connection request includes identification information of the first terminal;
  • the processing module is configured to query an authorization list according to the identification information of the first terminal; the authorization list includes identification information of terminals located in a preset exemption range; and the authorization list includes the first terminal When the identification information is the same, an authorization response is returned to the first terminal; the authorization response is used to instruct the first terminal to establish a network connection with the AP device.
  • the transceiver module is further configured to:
  • the broadcast signal Periodically sending a broadcast signal; the broadcast signal is used to instruct a first terminal to determine a positioning feature of the received broadcast signal and return a positioning response to the AP device; the positioning response includes an identifier of the first terminal Information and the positioning characteristics; the first terminal is any terminal that receives the broadcast signal;
  • the processing module is further configured to receive the positioning response through the transceiver module, and determine that the first terminal is located in the secret-free range and the authorized list according to a positioning feature in the positioning response. When the identification information of the first terminal does not exist, the identification information of the first terminal is added to the authorization list.
  • processing module is further configured to:
  • processing module is further configured to:
  • the identification information of the first terminal When the identification information of the first terminal is not included in the authorization list, confirm that the first terminal fails verification; or, send a verification instruction to the first terminal through the transceiver module; the verification instruction is used for And instructing the first terminal to return an authentication key; and verifying the first terminal according to the authentication key returned by the first terminal.
  • the transceiver module is further configured to:
  • the Internet access signal is sent to the AP device after the first terminal establishes a network connection with the AP device; the Internet access signal includes the first terminal's Identification information
  • the processing module is further configured to return a receiving response to the first terminal through the transceiver module after determining that the authorization list includes identification information of the first terminal.
  • the positioning characteristics of the broadcast signal include a reception intensity and a reception angle of the broadcast signal.
  • the non-secret range is represented by a boundary function;
  • the boundary function is used to characterize a relationship between a reception intensity and a reception angle of the broadcast signal located at a boundary of the non-secret range;
  • the transceiver module is further configured to:
  • the processing module is further configured to:
  • the receiving intensity satisfies a positioning response with a preset intensity; and the receiving intensity and the receiving angle in the positioning response in which the receiving intensity satisfies the preset intensity are determined, Boundary function of the non-secret range.
  • the non-secret range is represented by a boundary function;
  • the boundary function is used to characterize a relationship between a reception intensity and a reception angle of the broadcast signal located at a boundary of the non-secret range;
  • the transceiver module is further configured to:
  • the processing module is further configured to:
  • a boundary function of the non-secret range is determined according to a reception intensity and a reception angle in a positioning response returned by the plurality of sampling devices.
  • the processing module determines whether the terminal is located within the security-free range according to a functional relationship between a positioning feature and a boundary function in a positioning response returned by the first terminal.
  • an embodiment of the present invention provides a terminal applied to a terminal in a wireless local area network WLAN.
  • the WLAN further includes an encrypted AP device, and the terminal includes a transceiver module and a processing module.
  • the transceiver module is configured to send a connection request to a target AP device; the connection request includes identification information of the terminal; receive an authorization response returned by the target AP device; the authorization response is that the target AP device is determining Returned to the terminal when the authorization list includes identification information of the terminal; the authorization list includes identification information of the terminal located within a preset exemption range of the AP device;
  • the processing module is configured to establish a network connection with the target AP device according to the authorization response.
  • processing module is further configured to:
  • the transceiver module When the transceiver module receives broadcast information sent by any AP device, determine the positioning characteristics of the broadcast information; return a positioning response to the AP device through the transceiver module; the positioning response includes the positioning characteristics and Identification information of the terminal.
  • processing module is further configured to:
  • the transceiver module When the transceiver module receives the authentication response sent by multiple AP devices at the same time, it is determined that the AP device with the strongest signal strength among the multiple authentication responses is the target AP device; the authentication response is based on the AP device according to the authentication response. A positioning response sent to the terminal after determining that the terminal is in the preset exemption range; and sending the connection request to the target AP device through the transceiver module.
  • the transceiver module is further configured to:
  • the Internet access signal includes identification information of the terminal
  • the processing module is further configured to:
  • the target AP device is determined again.
  • an embodiment of the present invention provides an AP device, including: a memory, a transceiver, and a processor;
  • the memory is used to store program instructions
  • the processor is configured to call a program instruction stored in the memory and execute the method according to any one of the first aspects through the transceiver according to the obtained program.
  • an embodiment of the present invention provides a terminal, including: a memory, a transceiver, and a processor;
  • the memory is used to store program instructions
  • the processor is configured to call a program instruction stored in the memory, and execute the method according to any one of the foregoing second aspects through the transceiver according to the obtained program.
  • an embodiment of the present invention provides a system, including the AP device according to any one of the foregoing fifth aspects, and / or the terminal according to any one of the foregoing sixth aspects.
  • an embodiment of the present invention provides a computer program product.
  • the computer program product includes a computing program stored on a non-transitory computer-readable storage medium.
  • the computer program includes the computer-executable instructions. When the computer-executable instructions are executed by a computer, the computer is caused to execute the terminal verification method provided by the embodiment of the present invention.
  • FIG. 1 is a schematic diagram of a WLAN system architecture according to an embodiment of the present invention
  • FIG. 2 is a schematic flowchart of a terminal verification method according to an embodiment of the present invention.
  • FIG. 3 is a schematic flowchart of a method for maintaining an authorization list according to an embodiment of the present invention
  • FIG. 4 is a schematic flowchart of a specific terminal verification process according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of a multi-AP coverage area according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of a security-free range provided by an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a security-free range provided by an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of a security-free range provided by an embodiment of the present invention.
  • FIG. 9 is a schematic diagram of a security-free range provided by an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of an AP device according to an embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 12 is a schematic structural diagram of an AP device according to an embodiment of the present invention.
  • FIG. 13 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • FIG. 1 is a schematic diagram of a WLAN system architecture according to an embodiment of the present invention.
  • the system includes an AP device, which is an encrypted AP device, and can perform identity verification on a terminal requesting access to a WLAN.
  • the signal coverage range (S0) of the AP device includes a preset secret-free range (S1), which is determined in advance according to the positioning characteristics of the sampling signal of the sampling device received by the AP device. .
  • FIG. 2 is a schematic flowchart of a terminal verification method provided by an embodiment of the present invention. As shown in Figure 2, it mainly includes the following steps:
  • S201 Receive a connection request sent by a terminal; the connection request includes identification information of the terminal.
  • S202 Query the authorization list according to the identification information of the terminal; the authorization list includes identification information of the terminal located within a preset exemption range.
  • the terminal is a terminal that can request network services from the AP device during the operation of the AP device, such as a mobile phone, a tablet computer, and a wearable smart device used by the user.
  • the AP device may query the authorization list according to the terminal's identification information to determine whether the terminal is within a preset exemption range.
  • the identification information of the terminal may be a network protocol (IP) address of the terminal, or a medium access control (MAC) address of the terminal.
  • IP network protocol
  • MAC medium access control
  • the AP device When the AP device determines that the terminal is within the preset exemption range according to the authorization list, it can directly return an authorization response to the terminal without verifying the terminal within the exemption range, reducing the number of terminals that need to be authenticated in the WLAN coverage Quantity, thereby reducing the resource consumption of AP devices by authentication, and making the use of WLAN more convenient.
  • an embodiment of the present invention provides a method for maintaining an authorization list by an AP device.
  • the specific process is shown in FIG. 3, which is a schematic flowchart of an authorization list maintenance method according to an embodiment of the present invention. :
  • S301 The AP device sends a broadcast signal periodically.
  • the first terminal receives the broadcast signal and determines the positioning characteristics of the broadcast signal; the first terminal is any terminal that receives the broadcast signal sent by the AP device.
  • the first terminal returns a positioning response to the AP device; the positioning response includes positioning characteristics and identification information of the first terminal.
  • the AP device receives a positioning response, and determines whether the first terminal is within a preset privacy-free range according to the positioning characteristics in the positioning response; if yes, execute S305; if not, execute S306.
  • S305 Determine whether the identification information of the first terminal device already exists in the authorization list; if yes, execute S306; if not, execute S307.
  • the positioning characteristics of the broadcast signal are determined by the positioning method adopted by the AP device.
  • the AP device may adopt an Angle of Arrival (AOA) positioning scheme.
  • AOA Angle of Arrival
  • the positioning characteristic of the broadcast signal is the reception angle at which the first terminal receives the broadcast signal.
  • the AP device may also adopt a Time Difference of Arrival (TDOA) positioning scheme.
  • TDOA Time Difference of Arrival
  • the positioning characteristic of the broadcast signal is the reception time difference between the first terminal receiving the broadcast signal.
  • the AP device may also adopt a Time of Arrival (TOA) positioning scheme.
  • the positioning characteristic of the broadcast signal is the reception time when the first terminal receives the broadcast signal.
  • the AP device may adopt a received signal strength (Received Signal Strength Indication, RSSI) positioning scheme.
  • RSSI received Signal Strength Indication
  • the RSSI positioning scheme is derived from the signal's fading model, and its basic calculation formula is shown in Formula 1:
  • PL is the attenuation of wireless signal strength in space
  • Gr is the gain of the receiving antenna
  • Gt is the gain of the transmitting antenna
  • R is the distance between the AP device and the terminal
  • ⁇ is the wavelength of the signal.
  • the AP device can determine the amount of attenuation of the broadcast signal according to the relationship between the amount of attenuation of the wireless signal strength and the distance shown in Equation 1, and the reception strength of the broadcast signal in the positioning response returned by the first terminal.
  • the distance of the first terminal from the AP device can also determine the direction of the first terminal relative to the AP device according to the receiving angle of the broadcast signal in the positioning response, and the position of the first terminal relative to the AP device can be determined by the polar coordinate positioning method.
  • Polar coordinate positioning has no requirements on the shape of the positioning area.
  • Positioning For three-dimensional space, the position of the terminal can also be obtained based on spherical coordinate positioning. The process is similar to polar coordinate positioning, and can be implemented on the basis of polar coordinate positioning methods, which are not described in detail in this application.
  • the AP device When the AP device locates the terminal according to the reception strength of the terminal signal, the strength of the broadcast signal may fluctuate, resulting in an error in the positioning result.
  • the AP device fits multiple reception intensities according to a Gaussian distribution probability model according to the reception strength of broadcast signals in the positioning responses returned by multiple first terminals that are continuously received within a certain sampling time. The average value and standard deviation of the reception intensity of the broadcast signal during the sampling time are determined according to the fitting result, and then the average value, standard deviation, and formula of the reception intensity of the broadcast signal are used to locate the first terminal.
  • the reception intensity of the received broadcast signal also theoretically obeys the Gaussian distribution.
  • the Gaussian distribution probability model the same The multiple received intensities of the same broadcast signal determined by a terminal are fitted, so that the determined average value and standard deviation can better reflect the true situation of the received intensity of the broadcast signal, so that a more accurate positioning result can be obtained.
  • RSSI positioning method is suitable for microwave signals. Since most terminals use microwave communication, RSSI positioning is more suitable for positioning terminals.
  • the AP device further determines whether the identification information of the first terminal is included in the authorization list. If the identification information of the first terminal does not exist in the authorization list, the identification information of the first terminal is added to the authorization list.
  • the authorization list may only include identification information of the first terminal located within the exemption range. Therefore, in S305, if the AP device determines that the first terminal is outside the exemption range, directly execute S306, End the authentication of the first terminal.
  • the authorization list further includes a first terminal located outside the exemption range and identification information of each first terminal.
  • the authorization list can be shown in Table 1 below:
  • the authorization list includes the terminal ID, location confidentiality, and authorization status.
  • the location confidentiality is 1, it indicates that the terminal is in the confidentiality range, and when the location confidentiality is 0, it indicates that the terminal is in the confidentiality range.
  • the authorization status is 1, the terminal has the authority to establish a network connection with the AP device, and when the authorization status is 0, it means that the terminal does not have the permission to establish a network connection with the AP device.
  • the terminal identifier of the terminal a is MAC, which is within the security-free range, and therefore has the authority to establish a network connection with the AP device.
  • the terminal identity of terminal b is MAC, which is outside the exemption range and does not have permission to establish a network connection with the AP device, but will still be added to the authorization list.
  • the AP device can process the terminal in at least the following two ways:
  • Method 1 Directly confirm that the terminal verification fails. In this way, the AP device directly refuses access to the WLAN from terminals outside the security-free range, which can improve the security of the WLAN.
  • Method 2 Send a verification instruction to the terminal; after the terminal receives the verification instruction, it returns a verification key to the AP device; the AP device then verifies the terminal based on the verification key returned by the terminal.
  • the terminal c corresponding to the MAC c is outside the exemption range, it still has the right to establish a network connection with the AP device.
  • FIG. 4 is a schematic diagram of a specific terminal verification process according to an embodiment of the present invention. As shown in FIG. 4, it mainly includes the following steps:
  • the terminal sends a connection request to the AP device, and the connection request includes identification information of the terminal.
  • the connection request also includes the MAC address of the terminal b.
  • S402 The AP device determines whether the terminal is within the exemption range according to the authorization list. If yes, execute S403; if not, execute S404.
  • the AP device can determine that the terminal b is outside the exemption range according to the authorization list shown in Table 1. Therefore, S404 is performed next. After the AP device receives the connection request sent by the terminal a, according to the authorization list shown in Table 1, it can be determined that the terminal a is located in the non-secret range, so S403 will be performed next.
  • the verification key can be a pre-registered account password, or a dynamic password such as a mobile phone verification code.
  • S406 The terminal sends the authentication key to the AP device.
  • S407 The AP device verifies the terminal according to the verification key. If the verification succeeds, S408 is performed; if the verification fails, S410 is performed.
  • the original authorization status of terminal b in the authorization list shown in Table 1 is "0" (unauthorized).
  • the authorization status of terminal b in the authorization list is updated to "1" (Authorization).
  • the terminals located in the non-secret range can be not verified, so as to reduce the resource consumption of the AP device and improve the WLAN experience, but also can be used for conventional key authentication for the terminals located outside the non-secret range. Verification method, so that legal terminals located outside the exemption range can also establish a connection with the AP device to access the WLAN.
  • the AP device after determining that the first terminal is located in a non-secret range, the AP device also returns an authentication response to the first terminal, as shown in S308 in FIG. 3.
  • the first terminal may determine a target AP device with which to establish a network connection according to the received authentication response, and send a connection request to the target AP device.
  • the terminal may be located within the privacy-free range of multiple AP devices at the same time.
  • FIG. 5 it is a schematic diagram of a multi-AP coverage area provided by an embodiment of the present invention.
  • UE3 is located at both AP1 and AP1.
  • AP2 and AP3 are within the exemption range. Therefore, UE3 will receive broadcast signals from AP1, AP2, and AP3 at the same time and return positioning responses to these three AP devices. After that, UE3 will receive AP1, AP2, and AP3 at the same time Authentication response.
  • the terminal when the terminal receives the authentication response sent by multiple AP devices at the same time, it can also determine that the AP device corresponding to the authentication response with the strongest signal strength among the multiple authentication responses is the target AP device, and Send a connection request to the target AP device. For example, in FIG. 5, the signal strength of the authentication response returned by AP1 is the strongest, then UE3 can determine that AP1 is the target AP device, and send a connection request to AP1 to establish a network connection with AP1.
  • UE3 after establishing a connection with AP1, UE3 will always maintain a connection with AP1 and will not switch APs due to the weakening of the signal strength sent by AP1 to improve network stability and reduce power consumption of the terminal system. For example, in FIG. 5, after the connection between UE3 and AP1 is established in the position in the figure, the connection between UE3 and AP1 will be maintained until it moves out of AP1 in the process of moving to point A.
  • the terminal After the terminal establishes a network connection with the AP device, it can access the wired network through the AP device. After the terminal accesses the WLAN, it sends an Internet access signal to the AP device, and the AP device forwards the information contained in the Internet access signal to the wired network.
  • the AP device may be that the AP device moves out of the privacy-free range of the AP device after the AP device is connected. Therefore, the AP device will continue to locate the terminal with which the network connection is established. If the terminal moves out of the exemption range, it will update the authorization status of the terminal in the authorization list.
  • the AP device can also query the authorization list according to the identification information of the terminal included in the Internet access signal. When it is determined according to the authorization list that the terminal still has permissions, it returns a reception response to the terminal. To enable the terminal to determine that the AP device has received the Internet access signal sent by the terminal. When it is determined according to the authorization list that the terminal no longer has permission, the AP device can stop forwarding the information contained in the Internet signal to the wired network and send a reception response to the terminal. In a feasible implementation manner, it can also send a verification instruction to the terminal To initiate key verification on the terminal and so on.
  • the terminal After the terminal sends an Internet access signal to the AP device, it can also determine whether it has received a reception response returned by the AP device within a preset waiting time. It is determined that the AP device no longer provides Internet access services for the terminal. At this time, the terminal may re-determine the target AP device and send a connection request to it according to the authentication response returned by other AP devices.
  • the non-secret range is identified by a boundary function
  • the boundary function may be determined according to a positioning feature in a positioning response returned by the sampling device received by the AP device.
  • the boundary function is used to characterize the relationship between the reception strength and the reception angle of the broadcast signal located at the boundary of the non-secret range.
  • the sampling device may be a terminal of one or several common brands currently on the market. In order to avoid the difference in positioning features between the sampling device and the terminal in actual use, a certain error range can also be set for the boundary function to adapt to the differences between the terminals of different brands and the sampling device.
  • the embodiments of the present invention provide the following two feasible methods for determining the exemption range to describe the exemption range.
  • the AP device periodically sends broadcast signals; receives positioning responses returned by multiple sampling devices according to the broadcast signals; and determines, according to a preset strength, among the positioning responses returned by the multiple sampling devices, the received strength of the broadcast signals meets the positioning responses of the preset strength;
  • the boundary function of the non-secret range is determined according to the reception intensity and the reception angle in the positioning response where the reception intensity of the broadcast signal meets the preset intensity.
  • the receiving strength of the broadcast signal received by the sampling device is the same.
  • FIG. 6 it is a schematic diagram of a non-secret range provided by an embodiment of the present invention.
  • the non-density range determined by the above method is a circular area. Therefore, the sampling device 1, the sampling device 2, and Sampling equipment 3 Three sampling equipments can both determine the exemption range. In actual use, because the signal attenuation in each direction may be inconsistent, the determined non-secret range may not be a regular circular area.
  • the reception strength of the broadcast signal in the positioning response sent by the sampling device at the boundary received by the AP device Still the same.
  • the AP device After the AP device determines the boundaries of the exemption range, it can save the polar coordinates of the sampling device at each boundary. Generally, it can be saved in the form of an array (STA-num, AP-num, MAC, RSSI_avg, Theta ( ⁇ ), RSSI_dev, Add_info, ). The meaning of each element in the array can be shown in Table 1 below.
  • the AP device may further determine the boundary function of the confidentiality-free range according to the reception intensity and the reception angle in the positioning response returned by the sampling device at the boundary of the confidentiality-free range.
  • the boundary function is used to characterize the relationship between the reception strength and the reception angle of the broadcast signal received by the sampling device located at the boundary of the non-secret range, so that it can be used to determine the first position according to the positioning characteristics in the positioning response returned by the first terminal. Whether a terminal is within the security-free range.
  • the above-mentioned receiving intensity may also be an average value or a standard deviation determined according to a Gaussian distribution, which is not repeated in this application.
  • the AP device sends a broadcast signal; after that, it receives the positioning response returned by multiple sampling devices, where the sampling device is set at a preset boundary of the non-secret range; according to the receiving intensity and receiving angle in the positioning response of the multiple sampling device Fan Lake To determine the boundary function of the non-secret range; the boundary function is used to characterize the relationship between the reception intensity and the reception angle of the broadcast signal received by the sampling device located at the boundary of the non-secret range.
  • the shape of the non-secret range surrounded by the boundary line of the non-secret range can be any shape, for example, it can be an oval non-secret area as shown in FIG. 7 or a rectangular non-secret area as shown in FIG. It may be an irregular area as shown in FIG. 9.
  • the second method is more flexible and more universal than the first method.
  • method two requires more sampling equipment to improve the accuracy of the non-density range.
  • two methods for determining the exemption range can be flexibly used in combination with actual application situations.
  • the AP device can use the data shown in Table 1 in Method 1, or the boundary function saves the relationship between the receiving strength and the receiving angle in the positioning response of the sampling device on the boundary line of the non-secret range. For specific implementation, refer to Method 1. More details.
  • a boundary function for characterizing the relationship between the reception intensity and the reception angle of a broadcast signal in a positioning response sent by a sampling device located at the boundary of a non-secret range can be obtained.
  • the AP device determines whether any terminal is within the security-free range, it can directly determine whether the terminal is within the security-free range based on the functional relationship between the positioning feature and the boundary function in the positioning response returned by the terminal, thereby saving The process of calculating the specific location of the terminal is eliminated, and the response speed of the AP device is accelerated.
  • FIG. 10 is a schematic structural diagram of an AP device according to an embodiment of the present invention.
  • the AP device can implement the terminal authentication method provided by any of the foregoing embodiments.
  • the AP device 1000 includes a transceiver module 1001 and a processing module 1002, where:
  • the transceiver module 1001 is configured to receive a connection request sent by a first terminal; the connection request includes identification information of the first terminal;
  • the processing module 1002 is configured to query an authorization list according to the identification information of the first terminal; the authorization list includes identification information of terminals located within a preset exemption range; and the authorization list includes the first When the terminal has the identification information, an authorization response is returned to the first terminal; the authorization response is used to instruct the first terminal to establish a network connection with the AP device.
  • the transceiver module 1001 is further configured to:
  • the broadcast signal Periodically sending a broadcast signal; the broadcast signal is used to instruct a first terminal to determine a positioning feature of the received broadcast signal and return a positioning response to the AP device; the positioning response includes an identifier of the first terminal Information and the positioning characteristics; the first terminal is any terminal that receives the broadcast signal;
  • the processing module 1002 is further configured to receive the positioning response through the transceiver module 1001, and determine that the first terminal is located within the non-secreted range and that the first terminal is located according to a positioning characteristic in the positioning response. When the identification information of the first terminal does not exist in the authorization list, the identification information of the first terminal is added to the authorization list.
  • processing module 1002 is further configured to:
  • processing module 1002 is further configured to:
  • the identification information of the first terminal When the identification information of the first terminal is not included in the authorization list, confirm that the verification of the first terminal fails; or, send a verification instruction to the first terminal through the transceiver module 1001; the verification instruction It is used to instruct the first terminal to return an authentication key; and verify the first terminal according to the authentication key returned by the first terminal.
  • the transceiver module 1001 is further configured to:
  • the Internet access signal is sent to the AP device after the first terminal establishes a network connection with the AP device; the Internet access signal includes the first terminal's Identification information
  • the processing module 1002 is further configured to return a receiving response to the first terminal through the transceiver module 1001 after determining that the authorization list includes identification information of the first terminal.
  • the positioning characteristics of the broadcast signal include a reception intensity and a reception angle of the broadcast signal.
  • the non-secret range is represented by a boundary function;
  • the boundary function is used to characterize a relationship between a reception intensity and a reception angle of the broadcast signal located at a boundary of the non-secret range;
  • the transceiver module 1001 is further configured to:
  • the processing module 1002 is further configured to:
  • the receiving intensity satisfies a positioning response with a preset intensity; and the receiving intensity and the receiving angle in the positioning response in which the receiving intensity satisfies the preset intensity are determined, Boundary function of the non-secret range.
  • the non-secret range is represented by a boundary function;
  • the boundary function is used to characterize a relationship between a reception intensity and a reception angle of the broadcast signal located at a boundary of the non-secret range;
  • the transceiver module 1001 is further configured to:
  • the processing module 1002 is further configured to:
  • a boundary function of the non-secret range is determined according to a reception intensity and a reception angle in a positioning response returned by the plurality of sampling devices.
  • the processing module 1002 determines whether the terminal is located within the privacy-free range according to a functional relationship between a positioning feature and a boundary function in a positioning response returned by the first terminal.
  • FIG. 11 is a schematic structural diagram of a terminal according to an embodiment of the present invention.
  • the terminal can implement the terminal verification method provided by any of the foregoing embodiments.
  • the terminal 1100 includes a transceiver module 1101 and a processing module 1102, where:
  • the transceiver module 1101 is configured to send a connection request to a target AP device; the connection request includes identification information of the terminal; receive an authorization response returned by the target AP device; the authorization response is that the target AP device is in Returned to the terminal when it is determined that the authorization list includes identification information of the terminal; the authorization list includes identification information of the terminal located within a preset exemption range of the AP device;
  • the processing module 1102 is configured to establish a network connection with the target AP device according to the authorization response.
  • processing module 1102 is further configured to:
  • the transceiver module 1101 When the transceiver module 1101 receives broadcast information sent by any AP device, determine the positioning characteristics of the broadcast information; return a positioning response to the AP device through the transceiver module 1101; the positioning response includes the positioning Characteristics and identification information of the terminal.
  • processing module 1102 is further configured to:
  • the transceiver module 1101 When the transceiver module 1101 receives authentication responses sent by multiple AP devices simultaneously, it is determined that the AP device with the strongest signal strength among the multiple authentication responses is the target AP device; the authentication response is that the AP device The positioning response sends to the terminal after determining that the terminal is located in the preset exemption range; and sends the connection request to the target AP device through the transceiver module 1101.
  • the transceiver module 1101 is further configured to:
  • the Internet access signal includes identification information of the terminal
  • the processing module 1102 is further configured to:
  • the target AP device is determined again.
  • FIG. 12 is a schematic structural diagram of an AP device according to an embodiment of the present invention.
  • the AP device in FIG. 12 includes a processor 1200 for reading a program in the memory 1220 and executing a terminal verification method provided by any one of the foregoing embodiments.
  • the bus interface may include any number of interconnected buses and bridges, and one or more processors specifically represented by the processor 1200 and various circuits of the memory represented by the memory 1220 are linked together.
  • the bus interface can also link various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art, so they are not described further herein.
  • the bus interface provides an interface.
  • the transceiver 1210 may be a plurality of elements, including a transmitter and a receiver, providing a unit for communicating with various other devices on a transmission medium.
  • the processor 1200 is responsible for managing a bus interface and general processing, and the memory 1220 may store data used by the processor 1200 when performing operations.
  • the processor 1200 may be a CPU (central embedded device), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a CPLD (Complex Programmable Logic Device) , Complex programmable logic device).
  • CPU central embedded device
  • ASIC Application Specific Integrated Circuit
  • FPGA Field-Programmable Gate Array
  • CPLD Complex Programmable Logic Device
  • Complex programmable logic device Complex programmable logic device
  • FIG. 13 is a schematic structural diagram of a terminal provided by an embodiment of the present invention.
  • the terminal in FIG. 13 includes a processor 1300 for reading a program in the memory 1320 and executing the terminal authentication method provided by any of the foregoing embodiments through the transceiver 1310 according to the obtained program.
  • an embodiment of the present invention provides a WLAN system, including an AP device provided in any one of the foregoing embodiments, and / or a terminal provided in any one of the foregoing embodiments.
  • an embodiment of the present invention provides a computer program product.
  • the computer program product includes a computing program stored on a non-transitory computer-readable storage medium.
  • the computer program includes the computer-executable instructions. When the execution instruction is executed by the computer, the computer is caused to execute the terminal verification method provided by any one of the foregoing embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明公开了一种终端验证方法、AP设备、终端及系统，其中AP设备为加密式AP设备，该方法包括：接收第一终端发送的连接请求；连接请求包括第一终端的标识信息；根据第一终端的标识信息查询授权列表；所述授权列表包括位于预设免密范围内的终端的标识信息；在授权列表中包括第一终端的标识信息时，向第一终端返回授权应答；授权应答用于指示第一终端与AP设备建立网络连接。AP设备可以不验证位于免密范围之内的第一终端减少了WLAN覆盖范围内需要进行身份验证的第一终端的数量，从而降低了身份验证对AP设备的资源消耗，同时使WLAN的使用更加便捷。

Description

一种终端验证方法、AP设备、终端及系统
本申请要求在2018年08月07日提交中国专利局、申请号为201810889475.9、发明名称为“一种终端验证方法、AP设备、终端及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及无线通信技术领域，尤其涉及一种终端验证方法、AP设备、终端及系统。
背景技术
随着通信技术的发展，无线局域网(wireless local area networks，WLAN)的使用越来越普遍。WLAN的实现需要接入点(access point，AP)设备的参与，AP设备与有线网络连接，使得在AP设备无线信号覆盖范围内的终端可以通过AP设备接入有线网络，从而使终端实现了无线上网。
然而，为了提高WLAN的安全性，终端通常需要通过AP设备的身份验证之后，才可以通过AP设备接入有线网络。在AP设备的无线信号覆盖范围内存在较多终端时，对终端的身份验证会过多消耗AP设备的运行资源，影响WLAN网络的质量。同时，对终端进行身份验证时，多需要终端用户在终端中输入验证密钥，使得WLAN的使用过于繁琐。
因此，现有WLAN中终端验证方法过于繁琐，便捷性还有待进一步提高。
发明内容
本发明提供一种终端验证方法、AP设备、终端及系统，用以提高WLAN中终端验证的便捷性。
第一方面，本发明实施例提供一种终端验证方法，应用于无线局域网WLAN中的接入点AP设备，所述AP设备为加密式AP设备，所述方法包括：
接收第一终端发送的连接请求；所述连接请求包括所述第一终端的标识信息；根据所述第一终端的标识信息查询授权列表；所述授权列表包括位于预设免密范围内的终端的标识信息；在所述授权列表中包括所述第一终端的标识信息时，向所述第一终端返回授权应答；所述授权应答用于指示所述第一终端与所述AP设备建立网络连接。
采用上述方案，AP设备在根据授权列表确定第一终端位于预设免密范围之内时，可以不验证位于免密范围之内的第一终端而直接向第一终端返回授权应答，减少了WLAN覆盖范围内需要进行身份验证的第一终端的数量，从而降低了身份验证对AP设备的资源消耗，同时使WLAN的使用更加便捷。
可选的，所述方法还包括：
周期性发送广播信号；所述广播信号用于指示第一终端确定接收到的所述广播信号的定位特征，并向所述AP设备返回定位应答；所述定位应答包括所述第一终端的标识信息及所述定位特征；所述第一终端为任一接收到所述广播信号的终端；接收所述定位应答，并在根据所述定位应答中的定位特征，确定所述第一终端位于所述免密范围之内且所述授权列表中不存在所述第一终端的标识信息时，在所述授权列表中添加所述第一终端的标识信息。
可选的，在所述授权列表中添加所述第一终端的标识信息之后，还包括：
向所述第一终端发送认证应答。
向位于免密范围内的第一终端发送认证应答，可以使第一终端确定自身具有连接AP设备的权限。
可选的，在所述授权列表中未包括所述第一终端的标识信息时，确认所述第一终端验证未通过；
或，向所述第一终端发送验证指令；所述验证指令用于指示所述第一终端返回验证密钥；根据所述第一终端返回的验证密钥对所述第一终端进行验证。
在第一终端位于免密范围之外时，直接确认第一终端验证未通过可以提高AP设备的安全性。而在第一终端位于免密范围之外时，通过验证密钥对第 一终端进行验证可以使位于免密范围外的合法终端也能够使用WLAN。
可选的，还包括：
接收所述第一终端发送的上网信号；所述上网信号是所述第一终端与所述AP设备建立连接后向所述AP设备发送的；所述上网信号中包括所述第一终端的标识信息；
在确定所述授权列表中包括所述第一终端的标识信息后，向所述第一终端返回接收应答。
可选的，所述定位特征包括信号的接收强度和接收角度。
可选的，所述免密范围是通过边界函数表示的；所述边界函数用于表征位于所述免密范围的边界处所述广播信号的接收强度与接收角度之间的关系；
所述方法还包括：
发送所述广播信号；
接收多个采样设备根据所述广播信号返回的定位应答；
确定所述多个采样设备返回的定位应答中，所述接收强度满足预设强度的定位应答；
根据所述接收强度满足所述预设强度的定位应答中的接收强度和接收角度，确定所述免密范围的边界函数。
可选的，所述免密范围是通过边界函数表示的；所述边界函数用于表征位于所述免密范围的边界处所述广播信号的接收强度与接收角度之间的关系；
所述方法还包括：
发送所述广播信号；
接收多个采样设备根据所述广播信号返回的定位应答；所述多个采样设备位于所述免密范围的预设边界；
根据所述多个采样设备返回的定位应答中的接收强度和接收角度，确定所述免密范围的边界函数。
可选的，所述AP设备是根据所述第一终端所返回的定位应答中的定位特征与所述边界函数之间的函数关系确定所述终端是否位于所述免密范围之内 的。
第二方面，本发明实施例提供一种终端验证方法，应用于无线局域网WLAN中的终端，所述WLAN还包括加密式AP设备，所述方法包括：
向目标AP设备发送连接请求；所述连接请求包括所述终端的标识信息；
接收所述目标AP设备返回的授权应答；所述授权应答是所述目标AP设备在确定授权列表中包括所述终端的标识信息时，向所述终端返回的；所述授权列表包括位于所述AP设备的预设免密范围内的终端的标识信息；
根据所述授权应答，与所述目标AP设备建立网络连接。
可选的，还包括：
在接收到任一AP设备发送的广播信息时，确定所述广播信息的定位特征；
向所述AP设备返回定位应答；所述定位应答包括所述定位特征和所述终端的标识信息。
可选的，还包括：
在同时收到多个AP设备发送的认证应答时，确定多个认证应答中信号强度最强的AP设备为所述目标AP设备；所述认证应答是所述AP设备根据所述定位应答确定所述终端位于所述预设免密范围后，向所述终端发送的；
向所述目标AP设备发送所述连接请求。
可选的，根据所述授权应答，与所述目标AP设备建立网络连接之后，还包括：
向所述目标AP设备发送上网信号；所述上网信号包括所述终端的标识信息；
在预设等待时间之后未收到所述目标AP设备返回的接收应答时，重新确定目标AP设备。
第三方面，本发明实施例提供一种AP设备，所述AP设备为加密式AP设备，包括：收发模块和处理模块；
所述收发模块，用于接收第一终端发送的连接请求；所述连接请求包括所述第一终端的标识信息；
所述处理模块，用于根据所述第一终端的标识信息查询授权列表；所述授权列表包括位于预设免密范围内的终端的标识信息；在所述授权列表中包括所述第一终端的标识信息时，向所述第一终端返回授权应答；所述授权应答用于指示所述第一终端与所述AP设备建立网络连接。
可选的，所述收发模块还用于：
周期性发送广播信号；所述广播信号用于指示第一终端确定接收到的所述广播信号的定位特征，并向所述AP设备返回定位应答；所述定位应答包括所述第一终端的标识信息及所述定位特征；所述第一终端为任一接收到所述广播信号的终端；
所述处理模块，还用于通过所述收发模块接收所述定位应答，并在根据所述定位应答中的定位特征，确定所述第一终端位于所述免密范围之内且所述授权列表中不存在所述第一终端的标识信息时，在所述授权列表中添加所述第一终端的标识信息。
可选的，所述处理模块还用于：
通过所述收发模块向所述第一终端发送认证应答。
可选的，所述处理模块还用于：
在所述授权列表中未包括所述第一终端的标识信息时，确认所述第一终端验证未通过；或，通过所述收发模块向所述第一终端发送验证指令；所述验证指令用于指示所述第一终端返回验证密钥；根据所述第一终端返回的验证密钥对所述第一终端进行验证。
可选的，所述收发模块还用于：
接收所述第一终端发送的上网信号；所述上网信号是所述第一终端与所述AP设备建立网络连接后向所述AP设备发送的；所述上网信号中包括所述第一终端的标识信息；
所述处理模块，还用于在确定所述授权列表中包括所述第一终端的标识信息后，通过所述收发模块向所述第一终端返回接收应答。
可选的，所述广播信号的定位特征包括所述广播信号的接收强度和接收 角度。
可选的，所述免密范围是通过边界函数表示的；所述边界函数用于表征位于所述免密范围的边界处所述广播信号的接收强度与接收角度之间的关系；
所述收发模块还用于：
发送所述广播信号；接收多个采样设备根据所述广播信号返回的定位应答；
所述处理模块还用于：
确定所述多个采样设备返回的定位应答中，所述接收强度满足预设强度的定位应答；根据所述接收强度满足所述预设强度的定位应答中的接收强度和接收角度，确定所述免密范围的边界函数。
可选的，所述免密范围是通过边界函数表示的；所述边界函数用于表征位于所述免密范围的边界处所述广播信号的接收强度与接收角度之间的关系；
所述收发模块还用于：
发送所述广播信号；接收多个采样设备根据所述广播信号返回的定位应答；所述多个采样设备位于所述免密范围的预设边界；
所述处理模块还用于：
根据所述多个采样设备返回的定位应答中的接收强度和接收角度，确定所述免密范围的边界函数。
可选的，所述处理模块是根据所述第一终端所返回的定位应答中的定位特征与所述边界函数之间的函数关系确定所述终端是否位于所述免密范围之内的。
第四方面，本发明实施例提供一种终端，应用于无线局域网WLAN中的终端，所述WLAN还包括加密式AP设备，所述终端包括：收发模块和处理模块；
所述收发模块，用于向目标AP设备发送连接请求；所述连接请求包括所述终端的标识信息；接收所述目标AP设备返回的授权应答；所述授权应答是所述目标AP设备在确定授权列表中包括所述终端的标识信息时，向所述终端 返回的；所述授权列表包括位于所述AP设备的预设免密范围内的终端的标识信息；
所述处理模块，用于根据所述授权应答，与所述目标AP设备建立网络连接。
可选的，所述处理模块还用于：
在所述收发模块接收到任一AP设备发送的广播信息时，确定所述广播信息的定位特征；通过所述收发模块向所述AP设备返回定位应答；所述定位应答包括所述定位特征和所述终端的标识信息。
可选的，所述处理模块还用于：
在所述收发模块同时收到多个AP设备发送的认证应答时，确定多个认证应答中信号强度最强的AP设备为所述目标AP设备；所述认证应答是所述AP设备根据所述定位应答确定所述终端位于所述预设免密范围后，向所述终端发送的；通过所述收发模块向所述目标AP设备发送所述连接请求。
可选的，所述收发模块还用于：
向所述目标AP设备发送上网信号；所述上网信号包括所述终端的标识信息；
所述处理模块还用于：
在预设等待时间之后未收到所述目标AP设备返回的接收应答时，重新确定目标AP设备。
第五方面，本发明实施例提供一种AP设备，包括：存储器、收发器和处理器；
所述存储器，用于存储程序指令；
所述处理器，用于调用所述存储器中存储的程序指令，按照获得的程序通过所述收发器执行如上述第一方面中任一项所述的方法。
第六方面，本发明实施例提供一种终端，包括：存储器、收发器和处理器；
所述存储器，用于存储程序指令；
所述处理器，用于调用所述存储器中存储的程序指令，按照获得的程序通过所述收发器执行如上述第二方面中任一项所述的方法。
第七方面，本发明实施例提供一种系统，包括如上述第五方面中任一项所述的AP设备，和/或，如上述第六方面中任一项所述的终端。
第八方面，本发明实施例提供一种计算机程序产品，所述计算机程序产品包括存储在非暂态计算机可读存储介质上的计算程序，所述计算机程序包括所述计算机可执行指令，当所述计算机可执行指令被计算机执行时，使所述计算机执行本发明实施例所提供的终端验证方法。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种WLAN系统架构示意图；
图2为本发明实施例提供的一种终端验证方法流程示意图；
图3为本发明实施例提供的一种授权列表维护方法流程示意图；
图4为本发明实施例提供的一种具体的终端验证流程示意图；
图5为本发明实施例提供的一种多AP覆盖区域示意图；
图6为本发明实施例提供的一种免密范围示意图；
图7为本发明实施例提供的一种免密范围示意图；
图8为本发明实施例提供的一种免密范围示意图；
图9为本发明实施例提供的一种免密范围示意图；
图10为本发明实施例提供的一种AP设备结构示意图；
图11为本发明实施例提供的一种终端结构示意图；
图12为本发明实施例提供的一种AP设备结构示意图；
图13为本发明实施例提供的一种终端结构示意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
图1为本发明实施例提供的一种WLAN系统架构示意图，如图1所示，该系统包括AP设备，该AP设备为加密式AP设备，可以对请求接入WLAN的终端进行身份验证。在本发明实施例中，AP设备的信号覆盖范围(S0)内包括预设的免密范围(S1)，该免密范围是根据AP设备接收到的采样设备的采样信号的定位特征预先确定的。
基于图1所示的系统架构，本发明实施例提供一种终端验证方法，图2为本发明实施例提供的一种终端验证方法流程示意图。如图2所示，主要包括以下步骤：
S201：接收终端发送的连接请求；连接请求包括终端的标识信息。
S202：根据终端的标识信息查询授权列表；授权列表包括位于预设免密范围内的终端的标识信息。
S203：在授权列表中包括终端的标识信息时，向终端返回授权应答；授权应答用于指示终端与AP设备建立网络连接。
其中，终端为AP设备运行过程中，能够向AP设备请求网络服务的终端，如被用户所使用的手机、平板电脑、可穿戴智能设备等。AP设备在接收到终端发送的连接请求后，可以根据终端的标识信息查询授权列表，以确定终端是否位于预设的免密范围内。其中，终端的标识信息可以是终端的网络协议(Internet Protocol，IP)地址，也可以是终端的媒体接入控制(Medium Access Control，MAC)地址等。AP设备在根据授权列表确定终端位于预设免密范围之内时，可以不验证位于免密范围之内的终端而直接向终端返回授权应答，减少了WLAN覆盖范围内需要进行身份验证的终端的数量，从而降低了身份 验证对AP设备的资源消耗，同时使WLAN的使用更加便捷。
基于上述实施例，本发明实施例提供了一种AP设备维护授权列表的方法，其具体过程如图3所示，为本发明实施例提供的一种授权列表维护方法流程示意图，主要包括以下步骤：
S301：AP设备周期性发送广播信号。
S302：第一终端接收广播信号，并确定广播信号的定位特征；第一终端为任一收到AP设备所发送的广播信号的终端。
S303：第一终端向AP设备返回定位应答；定位应答中包括定位特征和第一终端的标识信息。
S304：AP设备接收定位应答，并根据定位应答中的定位特征确定第一终端是否位于预设的免密范围之内；若是，则执行S305；若否，则执行S306。
S305：判断授权列表中是否已存在第一终端设备的标识信息；若是，则执行S306；若否，则执行S307。
S306：结束。
S307：在授权列表中增加第一终端的标识信息。
在上述实施例中，广播信号的定位特征是由AP设备所采用的定位方法确定的。例如，AP设备可以采用到达角度测距(AngleofArrival，AOA)定位方案，此时广播信号的定位特征为第一终端接收广播信号的接收角度。又例如，AP设备也可以采用到达时间差(Time Difference of Arrival，TDOA)定位方案，此时广播信号的定位特征为第一终端接收广播信号的接收时间差。还例如，AP设备也可以采用到达时间(Time of Arrival，TOA)定位方案，此时广播信号的定位特征为第一终端接收广播信号的接收时间。在一种可行的实现方式中，AP设备可以采用接收信号强度(Received Signal Strength Indication，RSSI)定位方案，在此情况下，广播信号的定位特征为第一终端接收广播信号的接收强度和接收角度。
RSSI定位方案根据信号的衰落模型推算而来，其基本的计算公式如公式一所示：
PL＝-Gr-Gt+20Log(4*PI*R/λ)  (公式一)
其中，PL为空间的无线信号强度衰减量，Gr为接收天线的增益，Gt为发射天线的增益，R为AP设备与终端之间的距离，λ为信号的波长。
在S304中，AP设备根据公式一所示的无线信号强度衰减量与距离的关系，以及第一终端所返回的定位应答中广播信号的接收强度，便可以确定广播信号的强度衰减量，进而确定第一终端距离AP设备的距离。同时，AP设备还可以根据定位应答中广播信号的接收角度，从而确定第一终端相对于AP设备的方向，通过极坐标定位的方法便可以确定出第一终端相对于AP设备的位置。极坐标定位对定位区域的形状没有要求，其可以用于椭圆形区域、矩形区域、不规则区域等等不同形状的定位区域中各个点的定位，因此非常适用于本申请中免密范围内终端的定位。对于三维空间，同样可以基于球坐标定位获取终端的位置，其过程与极坐标定位类似，可在极坐标定位方法的基础上实现，本申请不再一一赘述。
在AP设备根据终端信号的接收强度对终端进行定位时，由于广播信号的强度可能会出现波动，从而导致定位结果出现误差。在一种可行的实现方式中，AP设备根据一定采样时间内连续接收的多个第一终端所返回的定位应答中广播信号的接收强度，根据高斯分布概率模型对多个接收强度进行拟合，并根据拟合结果确定广播信号的接收强度在采样时间内的平均值和标准差，进而利用广播信号的接收强度的平均值、标准差和公式一对第一终端进行定位。由于任一通信信号的强度分布一般服从高斯分布概率模型，因此，对于同一环境下的同一个第一终端，其接收广播信号的接收强度理论上也服从高斯分布，根据高斯分布概率模型对同一第一终端所确定的同一广播信号的多个接收强度进行拟合，从而确定的平均值和标准差更能反映广播信号的接收强度的真实情况，从而可以获得更精确的定位结果。
RSSI定位方法，适用于微波信号，由于大多数终端采用微波通信，因此RSSI定位更适用于对终端的定位。
在S305中，AP设备在确定第一终端位于免密范围之后，还会进一步确定授权列表中是否已包括第一终端的标识信息。若授权列表中不存在该第一终端的标识信息，则在授权列表中添加该第一终端的标识信息。
在具体实施过程中，授权列表可以只包括位于免密范围之内的第一终端的标识信息，因此，在S305中，若AP设备确定第一终端位于免密范围之外，则直接执行S306，结束对第一终端的认证。
在另一种可行的实现方式中，授权列表还包括位于免密范围之外的第一终端，以及各第一终端的标识信息。此时，授权列表可以如下表一所示：
表一
终端标识 位置免密 授权状态
MAC a 1 1
MAC b 0 0
MAC c 0 1
……   ……
如表一所示，授权列表包括终端标识、位置免密及授权状态，其中，位置免密为1时，表示终端位于免密范围内，位置免密为0时，表示终端位于免密范围之外；授权状态为1时，表示终端具有与AP设备建立网络连接的权限，授权状态为0时，表示终端没有与AP设备建立网络连接的权限。
具体的，如上表一，终端a的终端标识为MAC a，其位于免密范围之内，因此具有与AP设备建立网络连接的权限。终端b的终端标识为MAC b，其位于免密范围之外，且不具有与AP设备建立网络连接的权限，但仍会被加入授权列表中。
可选的，AP设备在根据授权列表确定终端位于免密范围以外时，如图1中UE2，AP设备至少可以采用以下两种方式对终端进行处理：
方式一：直接确认终端验证未通过。采用这种方式，AP设备直接拒绝免密范围以外的终端接入WLAN，可以提高WLAN的安全性。
方式二：向终端发送验证指令；终端收到验证指令后，会向AP设备返回验证密钥；AP设备进而根据终端返回的验证密钥对终端进行验证。如表一中，MAC c所对应的终端c，虽然位于免密范围之外，但仍具有与AP设备建立网络连接的权限。
基于方式二，本发明实施例提供一种具体的终端验证流程以供说明。图4为本发明实施例提供的一种具体的终端验证流程示意图，如图4所示，主要包括以下步骤：
S401：终端向AP设备发送连接请求，连接请求中包括该终端的标识信息。
例如，该终端为终端b，则连接请求中还包括终端b的MAC地址MAC b。
S402：AP设备根据授权列表确定终端是否位于免密范围之内，若是，则执行S403；若否，则执行S404。
例如，AP设备在收到终端b发送的连接请求后，根据表一所示的授权列表，可以确定终端b位于免密范围之外，因此接下来将执行S404。而AP设备在收到终端a发送的连接请求后，根据表一所示的授权列表，可以确定终端a位于免密范围之内，因此接下来将执行S403。
S403：向终端返回授权应答。
S404：向终端返回验证指令。
S405：终端收到验证指令后，生成验证密钥。
例如，验证密钥可以是预先注册的账号密码，也可以是如手机验证码之类的动态密码等。
S406：终端将验证密钥发送给AP设备。
S407：AP设备根据验证密钥对终端进行验证，若验证通过，则执行S408；若验证未通过，则执行S410。
S408：向终端返回授权应答。
S409：更新授权列表中终端的授权状态。
例如，表一所示的授权列表中终端b原始的授权状态为“0”(未授权)，在终端b通过验证密钥验证通过后，将授权列表中终端b的授权状态更新为 “1”(授权)。
S410：结束。
通过上述方式二，不仅可以对位于免密范围之内的终端不进行验证，以降低AP设备的资源消耗，提高WLAN的使用体验，还可以对位于免密范围以外的终端采用常规的密钥验证方式进行验证，使位于免密范围以外的合法终端也可以与AP设备建立连接，从而接入WLAN。
在一种可行的实现方式中，AP设备在确定第一终端位于免密范围之后，还会向第一终端返回认证应答，如图3中S308所示。第一终端可以根据所接收到的认证应答，确定与之建立网络连接的目标AP设备，并向该目标AP设备发送连接请求。
具体实施过程中，终端可能同时位于多个AP设备的免密范围之内，如图5所示，为本发明实施例提供的一种多AP覆盖区域示意图，图5中，UE3同时位于AP1、AP2和AP3的免密范围之内，因此，UE3会同时收到AP1、AP2和AP3的广播信号并分别向这三个AP设备返回定位应答，之后，UE3将会同时收到AP1、AP2和AP3的认证应答。在一种可行的实现方式中，终端在同时收到多个AP设备发送的认证应答时，还可以确定多个认证应答中信号强度最强的认证应答所对应的AP设备为目标AP设备，并向目标AP设备发送连接请求。例如，图5中AP1所返回的认证应答的信号强度最强，则UE3便可以确定AP1为目标AP设备，并向AP1发送连接请求，从而与AP1建立网络连接。可选的，UE3在与AP1建立连接后，将会一直保持与AP1的连接，并不会因为AP1所发送的信号强度减弱而切换AP，以提高网络稳定性并降低终端系统的功耗。例如图5中，UE3在图中位置与AP1建立连接后，将会一直保持与AP1之间的连接，直到其向点A移动的过程中移动出AP1的免密范围。
终端在与AP设备建立网络连接后，便可以通过AP设备访问有线网络。终端在接入WLAN后，向AP设备发送上网信号，由AP设备将上网信号中包含的信息转发至有线网络。在具体实施过程中，对于移动终端而言，其有 可能在于AP设备连接之后又移动出了AP设备的免密范围。因此，AP设备将持续对与其建立网络连接的终端进行定位，若终端移动出了免密范围，便会更新授权列表中该终端的授权状态。同时，AP设备在收到任一终端发送的上网信号后，还可以根据上网信号中所包括的终端的标识信息查询授权列表，在根据授权列表确定该终端仍具有权限时，向终端返回接收应答，以使终端能够确定AP设备接收到了终端发送的上网信号。在根据授权列表确定该终端不再具有权限时，AP设备可以停止向有线网络转发上网信号中包含的信息以及向终端发送接收应答，在一种可行的实现方式中，还可以向终端发送验证指令，以对终端发起密钥验证等等。
基于此，终端在向AP设备发送了上网信号之后，还可以判断在预设等待时间内是否有收到AP设备返回的接收应答，若没有收到或收到了AP设备返回的验证指令，则可以确定该AP设备不再为终端提供上网服务。此时，终端可以根据其它AP设备返回的认证应答，重新确定目标AP设备并向其发送连接请求。
在本发明实施例中，免密范围是通过边界函数标识的，而边界函数可以根据AP设备接收到的采样设备返回的定位应答中的定位特征确定。其中，边界函数用于表征位于免密范围的边界处的广播信号的接收强度与接收角度之间的关系。在具体实施过程中，采样设备可以是目前市场上的一种或几种常见品牌的终端。为了避免采样设备与实际使用时的终端之间确定定位特征的差异，还可以为边界函数设定一定的误差范围，以适应不同品牌终端与采样设备之间的差异。
通常情况下，在确定免密范围的边界函数时，采样设备的数量越多，后续判断终端是否位于免密范围的判断结果便越准确。本发明实施例提供以下两种可行的确定免密范围的方法以对免密范围进行说明。
方法一：基于强度
AP设备周期性发送广播信号；接收多个采样设备根据广播信号返回的定位应答；根据预设强度，确定多个采样设备返回的定位应答中，广播信号的 接收强度满足预设强度的定位应答；根据广播信号的接收强度满足预设强度的定位应答中接收强度和接收角度，确定免密范围的边界函数。
采用上述方法所确定的免密范围的边界处，采样设备所接收的广播信号的接收强度相同。如图6所示，为本发明实施例提供的一种免密范围示意图，理想情况下，采用上述方法所确定的免密范围为一圆形区域，因此，利用采样设备1、采样设备2和采样设备3三个采样设备既可以确定免密范围。在实际使用过程中，由于各个方向的信号衰减可能不一致，所确定的免密范围也可能不是一个规则的圆形区域，AP设备接收的边界处采样设备所发送的定位应答中广播信号的接收强度仍旧相同。
AP设备在确定了免密范围的边界后，可以分别保存各个边界处的采样设备的极坐标。一般可采用数组(STA-num，AP-num，MAC，RSSI_avg，Theta(θ)，RSSI_dev，Add_info，……)的形式保存，其中，数组中各个元素的含义可以如下表一所示。
表一
Figure PCTCN2018120744-appb-000001
在一种可行的实现方式中，AP设备还可以根据免密范围边界处采样设备所返回的定位应答中的接收强度和接收角度，确定免密范围的边界函数。边界函数用于表征位于免密范围的边界处的采样设备所接收的广播信号的接收强度与接收角度之间的关系，从而可以用来根据第一终端所返回的定位应答 中的定位特征判断第一终端是否位于免密范围之内。当然，上述接收强度也可以是根据高斯分布确定的平均值或标准差，本申请对此不再赘述。
方法二：基于预设边界线
AP设备发送广播信号；之后，接收多个采样设备返回的定位应答，其中，采样设备被设置于免密范围的预设边界；根据多个采样设备范湖的定位应答中的接收强度和接收角度，确定免密范围的边界函数；边界函数用于表征位于免密范围的边界处的采样设备所接收的广播信号的接收强度与接收角度之间的关系。
免密范围的边界线所围成的免密范围的形状可以为任意形状，如，其可以为图7所示的椭圆形免密区域，也可以为图8所示的矩形免密区域，还可以为图9所示的不规则区域。例如，用户想要设置某一商场内部为免密范围时，便可以按着商场的区域形状为免密范围的预设边界线。在实际应用中，方法二相较于方法一的应用方式更加灵活，普适性更高。但是，方法二由于其不规则性，需要更多的采样设备提高免密范围的精确度。在具体实施时，可以结合实际应用情况灵活使用两种确定免密范围的方法。
AP设备可以采用如方法一中表一所示的数据，或者，边界函数保存免密范围边界线上采样设备的定位应答中接收强度和接收角度之间的关系，具体实施可参考方法一，不再赘述。
采用上述方法一或者方法二，可获得用于表征位于免密范围的边界处的采样设备所发送的定位应答中广播信号的接收强度与接收角度之间的关系的边界函数。AP设备在确定任一终端是否位于免密范围之内时，可以直接根据该终端所返回的定位应答中的定位特征与边界函数之间的函数关系确定终端是否位于免密范围之内，从而省去了计算终端具体位置的过程，加快了AP设备的响应速度。
基于相同的技术构思，本发明实施例提供一种AP设备，该AP设备为加密式AP设备。图10为本发明实施例提供的一种AP设备结构示意图，该AP设备可以实现上述任一实施例提供的终端验证方法。如图10所示，AP设备 1000包括：收发模块1001和处理模块1002，其中：
所述收发模块1001，用于接收第一终端发送的连接请求；所述连接请求包括所述第一终端的标识信息；
所述处理模块1002，用于根据所述第一终端的标识信息查询授权列表；所述授权列表包括位于预设免密范围内的终端的标识信息；在所述授权列表中包括所述第一终端的标识信息时，向所述第一终端返回授权应答；所述授权应答用于指示所述第一终端与所述AP设备建立网络连接。
可选的，所述收发模块1001还用于：
周期性发送广播信号；所述广播信号用于指示第一终端确定接收到的所述广播信号的定位特征，并向所述AP设备返回定位应答；所述定位应答包括所述第一终端的标识信息及所述定位特征；所述第一终端为任一接收到所述广播信号的终端；
所述处理模块1002，还用于通过所述收发模块1001接收所述定位应答，并在根据所述定位应答中的定位特征，确定所述第一终端位于所述免密范围之内且所述授权列表中不存在所述第一终端的标识信息时，在所述授权列表中添加所述第一终端的标识信息。
可选的，所述处理模块1002还用于：
通过所述收发模块1001向所述第一终端发送认证应答。
可选的，所述处理模块1002还用于：
在所述授权列表中未包括所述第一终端的标识信息时，确认所述第一终端验证未通过；或，通过所述收发模块1001向所述第一终端发送验证指令；所述验证指令用于指示所述第一终端返回验证密钥；根据所述第一终端返回的验证密钥对所述第一终端进行验证。
可选的，所述收发模块1001还用于：
接收所述第一终端发送的上网信号；所述上网信号是所述第一终端与所述AP设备建立网络连接后向所述AP设备发送的；所述上网信号中包括所述第一终端的标识信息；
所述处理模块1002，还用于在确定所述授权列表中包括所述第一终端的标识信息后，通过所述收发模块1001向所述第一终端返回接收应答。
可选的，所述广播信号的定位特征包括所述广播信号的接收强度和接收角度。
可选的，所述免密范围是通过边界函数表示的；所述边界函数用于表征位于所述免密范围的边界处所述广播信号的接收强度与接收角度之间的关系；
所述收发模块1001还用于：
发送所述广播信号；接收多个采样设备根据所述广播信号返回的定位应答；
所述处理模块1002还用于：
确定所述多个采样设备返回的定位应答中，所述接收强度满足预设强度的定位应答；根据所述接收强度满足所述预设强度的定位应答中的接收强度和接收角度，确定所述免密范围的边界函数。
可选的，所述免密范围是通过边界函数表示的；所述边界函数用于表征位于所述免密范围的边界处所述广播信号的接收强度与接收角度之间的关系；
所述收发模块1001还用于：
发送所述广播信号；接收多个采样设备根据所述广播信号返回的定位应答；所述多个采样设备位于所述免密范围的预设边界；
所述处理模块1002还用于：
根据所述多个采样设备返回的定位应答中的接收强度和接收角度，确定所述免密范围的边界函数。
可选的，所述处理模块1002是根据所述第一终端所返回的定位应答中的定位特征与所述边界函数之间的函数关系确定所述终端是否位于所述免密范围之内的。
基于相同的技术构思，本发明实施例提供一种终端，该终端应用于无线局域网WLAN中，该WLAN还包括加密式AP设备。图11为本发明实施例提供的一种终端结构示意图，该终端可以实现上述任一实施例提供的终端验 证方法。如图11所示，终端1100包括：收发模块1101和处理模块1102，其中：
所述收发模块1101，用于向目标AP设备发送连接请求；所述连接请求包括所述终端的标识信息；接收所述目标AP设备返回的授权应答；所述授权应答是所述目标AP设备在确定授权列表中包括所述终端的标识信息时，向所述终端返回的；所述授权列表包括位于所述AP设备的预设免密范围内的终端的标识信息；
所述处理模块1102，用于根据所述授权应答，与所述目标AP设备建立网络连接。
可选的，所述处理模块1102还用于：
在所述收发模块1101接收到任一AP设备发送的广播信息时，确定所述广播信息的定位特征；通过所述收发模块1101向所述AP设备返回定位应答；所述定位应答包括所述定位特征和所述终端的标识信息。
可选的，所述处理模块1102还用于：
在所述收发模块1101同时收到多个AP设备发送的认证应答时，确定多个认证应答中信号强度最强的AP设备为所述目标AP设备；所述认证应答是所述AP设备根据所述定位应答确定所述终端位于所述预设免密范围后，向所述终端发送的；通过所述收发模块1101向所述目标AP设备发送所述连接请求。
可选的，所述收发模块1101还用于：
向所述目标AP设备发送上网信号；所述上网信号包括所述终端的标识信息；
所述处理模块1102还用于：
在预设等待时间之后未收到所述目标AP设备返回的接收应答时，重新确定目标AP设备。
基于相同的技术构思，本发明实施例还提供一种AP设备。图12为本发明实施例提供的一种AP设备结构示意图。图12中AP设备包括处理器1200， 用于读取存储器1220中的程序，执行上述任一实施例提供的终端验证方法。
在图12中，总线接口可以包括任意数量的互联的总线和桥，具体由处理器1200代表的一个或多个处理器和存储器1220代表的存储器的各种电路链接在一起。总线接口还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路链接在一起，这些都是本领域所公知的，因此，本文不再对其进行进一步描述。总线接口提供接口。收发器1210可以是多个元件，即包括发送器和接收器，提供用于在传输介质上与各种其他装置通信的单元。
处理器1200负责管理总线接口和通常的处理，存储器1220可以存储处理器1200在执行操作时所使用的数据。
可选的，处理器1200可以是CPU(中央处埋器)、ASIC(Application Specific Integrated Circuit，专用集成电路)、FPGA(Field－Programmable Gate Array，现场可编程门阵列)或CPLD(Complex Programmable Logic Device，复杂可编程逻辑器件)。
基于相同的技术构思，本发明实施例提供一种终端，图13为本发明实施例提供的一种终端结构示意图。图13中终端包括处理器1300，用于读取存储器1320中的程序，按照获得的程序通过收发器1310执行上述任一实施例提供的终端认证方法。
基于相同的技术构思，本发明实施例提供一种WLAN系统，包括如上述任一实施例提供的AP设备，和/或，如上述任一项实施例提供的终端。
基于相同的技术构思，本发明实施例提供一种计算机程序产品，该计算机程序产品包括存储在非暂态计算机可读存储介质上的计算程序，计算机程序包括所述计算机可执行指令，当计算机可执行指令被计算机执行时，使计算机执行上述任一实施例提供的终端验证方法。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本 发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (22)

  1. 一种终端验证方法，其特征在于，应用于无线局域网WLAN中的接入点AP设备，所述AP设备为加密式AP设备，所述方法包括：
    接收终端发送的连接请求；所述连接请求包括所述终端的标识信息；
    根据所述终端的标识信息查询授权列表；所述授权列表包括位于预设免密范围内的终端的标识信息；
    在所述授权列表中包括所述终端的标识信息时，向所述终端返回授权应答；所述授权应答用于指示所述终端与所述AP设备建立网络连接。
  2. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    周期性发送广播信号；所述广播信号用于指示第一终端确定接收到的所述广播信号的定位特征，并向所述AP设备返回定位应答；所述定位应答包括所述第一终端的标识信息及所述定位特征；所述第一终端为任一接收到所述广播信号的终端；
    接收所述定位应答，并在根据所述定位应答中的定位特征，确定所述第一终端位于所述免密范围之内且所述授权列表中不存在所述第一终端的标识信息时，在所述授权列表中添加所述第一终端的标识信息。
  3. 如权利要求2所述的方法，其特征在于，在所述授权列表中添加所述第一终端的标识信息之后，还包括：
    向所述第一终端发送认证应答。
  4. 如权利要求1所述的方法，其特征在于，所述方法还包括：
    在所述授权列表中未包括所述第一终端的标识信息时，确认所述第一终端验证未通过；
    或，向所述第一终端发送验证指令；所述验证指令用于指示所述第一终端返回验证密钥；根据所述第一终端返回的验证密钥对所述第一终端进行验证。
  5. 如权利要求1所述的方法，其特征在于，还包括：
    接收所述第一终端发送的上网信号；所述上网信号是所述第一终端与所述AP设备建立网络连接后向所述AP设备发送的；所述上网信号中包括所述第一终端的标识信息；
    在确定所述授权列表中包括所述第一终端的标识信息后，向所述第一终端返回接收应答。
  6. 如权利要求2至5任一项所述的方法，其特征在于，所述广播信号的定位特征包括所述广播信号的接收强度和接收角度。
  7. 如权利要求6所述的方法，其特征在于，所述免密范围是通过边界函数表示的；所述边界函数用于表征位于所述免密范围的边界处所述广播信号的接收强度与接收角度之间的关系；
    所述方法还包括：
    发送所述广播信号；
    接收多个采样设备根据所述广播信号返回的定位应答；
    确定所述多个采样设备返回的定位应答中，所述接收强度满足预设强度的定位应答；
    根据所述接收强度满足所述预设强度的定位应答中的接收强度和接收角度，确定所述免密范围的边界函数。
  8. 如权利要求6所述的方法，其特征在于，所述免密范围是通过边界函数表示的；所述边界函数用于表征位于所述免密范围的边界处所述广播信号的接收强度与接收角度之间的关系；
    所述方法还包括：
    发送所述广播信号；
    接收多个采样设备根据所述广播信号返回的定位应答；所述多个采样设备位于所述免密范围的预设边界；
    根据所述多个采样设备返回的定位应答中的接收强度和接收角度，确定所述免密范围的边界函数。
  9. 如权利要求7或8所述的方法，其特征在于，所述AP设备是根据所 述第一终端所返回的定位应答中的定位特征与所述边界函数之间的函数关系确定所述终端是否位于所述免密范围之内的。
  10. 一种终端验证方法，其特征在于，应用于无线局域网WLAN中的终端，所述WLAN还包括加密式AP设备，所述方法包括：
    向目标AP设备发送连接请求；所述连接请求包括所述终端的标识信息；
    接收所述目标AP设备返回的授权应答；所述授权应答是所述目标AP设备在确定授权列表中包括所述终端的标识信息时，向所述终端返回的；所述授权列表包括位于所述AP设备的预设免密范围内的终端的标识信息；
    根据所述授权应答，与所述目标AP设备建立网络连接。
  11. 如权利要求10所述的方法，其特征在于，还包括：
    在接收到任一AP设备发送的广播信息时，确定所述广播信息的定位特征；
    向所述AP设备返回定位应答；所述定位应答包括所述定位特征和所述终端的标识信息。
  12. 如权利要求11所述的方法，其特征在于，还包括：
    在同时收到多个AP设备发送的认证应答时，确定多个认证应答中信号强度最强的AP设备为所述目标AP设备；所述认证应答是所述AP设备根据所述定位应答确定所述终端位于所述预设免密范围后，向所述终端发送的；
    向所述目标AP设备发送所述连接请求。
  13. 如权利要求12所述的方法，其特征在于，根据所述授权应答，与所述目标AP设备建立网络连接之后，还包括：
    向所述目标AP设备发送上网信号；所述上网信号包括所述终端的标识信息；
    在预设等待时间之后未收到所述目标AP设备返回的接收应答时，重新确定目标AP设备。
  14. 一种AP设备，其特征在于，所述AP设备为加密式AP设备，包括：收发模块和处理模块；
    所述收发模块，用于接收第一终端发送的连接请求；所述连接请求包括 所述第一终端的标识信息；
    所述处理模块，用于根据所述第一终端的标识信息查询授权列表；所述授权列表包括位于预设免密范围内的终端的标识信息；在所述授权列表中包括所述第一终端的标识信息时，向所述第一终端返回授权应答；所述授权应答用于指示所述第一终端与所述AP设备建立网络连接。
  15. 一种终端，其特征在于，应用于无线局域网WLAN中的终端，所述WLAN还包括加密式AP设备，所述终端包括：收发模块和处理模块；
    所述收发模块，用于向目标AP设备发送连接请求；所述连接请求包括所述终端的标识信息；接收所述目标AP设备返回的授权应答；所述授权应答是所述目标AP设备在确定授权列表中包括所述终端的标识信息时，向所述终端返回的；所述授权列表包括位于所述AP设备的预设免密范围内的终端的标识信息；
    所述处理模块，用于根据所述授权应答，与所述目标AP设备建立网络连接。
  16. 如权利要求15所述的终端，其特征在于，所述处理模块还用于：
    在所述收发模块接收到任一AP设备发送的广播信息时，确定所述广播信息的定位特征；通过所述收发模块向所述AP设备返回定位应答；所述定位应答包括所述定位特征和所述终端的标识信息。
  17. 如权利要求16所述的终端，其特征在于，所述处理模块还用于：
    在所述收发模块同时收到多个AP设备发送的认证应答时，确定多个认证应答中信号强度最强的AP设备为所述目标AP设备；所述认证应答是所述AP设备根据所述定位应答确定所述终端位于所述预设免密范围后，向所述终端发送的；通过所述收发模块向所述目标AP设备发送所述连接请求。
  18. 如权利要求17所述的终端，其特征在于，所述收发模块还用于：
    向所述目标AP设备发送上网信号；所述上网信号包括所述终端的标识信息；
    所述处理模块还用于：
    在预设等待时间之后未收到所述目标AP设备返回的接收应答时，重新确定目标AP设备。
  19. 一种AP设备，其特征在于，包括：存储器、收发器和处理器；
    所述存储器，用于存储程序指令；
    所述处理器，用于调用所述存储器中存储的程序指令，按照获得的程序通过所述收发器执行如权利要求1至9中任一项所述的方法。
  20. 一种终端，其特征在于，包括：存储器、收发器和处理器；
    所述存储器，用于存储程序指令；
    所述处理器，用于调用所述存储器中存储的程序指令，按照获得的程序通过所述收发器执行如权利要求10至13中任一项所述的方法。
  21. 一种系统，其特征在于，包括如权利要求14所述的AP设备，和/或，如权利要求15至18中任一项所述的终端。
  22. 一种计算机程序产品，其特征在于，所述计算机程序产品包括存储在非暂态计算机可读存储介质上的计算程序，所述计算机程序包括所述计算机可执行指令，当所述计算机可执行指令被计算机执行时，使所述计算机执行权利要求1至9中任一权利要求所述的终端验证方法，和/或，如权利要求10至13中任一项所述的终端验证方法。
PCT/CN2018/120744 2018-08-07 2018-12-12 一种终端验证方法、ap设备、终端及系统 WO2020029498A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US17/043,367 US11582606B2 (en) 2018-08-07 2018-12-12 Terminal verification method, and AP device, terminal and system
DE112018007211.8T DE112018007211T5 (de) 2018-08-07 2018-12-12 Verfahren zum Authentifizieren eines Terminals, AP-Anlage, Terminal und System

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810889475.9A CN109151818B (zh) 2018-08-07 2018-08-07 一种终端验证方法、ap设备、终端及系统
CN201810889475.9 2018-08-07

Publications (1)

Publication Number Publication Date
WO2020029498A1 true WO2020029498A1 (zh) 2020-02-13

Family

ID=64792146

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/120744 WO2020029498A1 (zh) 2018-08-07 2018-12-12 一种终端验证方法、ap设备、终端及系统

Country Status (4)

Country Link
US (1) US11582606B2 (zh)
CN (1) CN109151818B (zh)
DE (1) DE112018007211T5 (zh)
WO (1) WO2020029498A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FR3089744B1 (fr) * 2018-12-05 2020-12-04 Sagemcom Broadband Sas Procede de configuration automatique par canal audio d’un dispositif sans fil
CN110022556A (zh) * 2019-03-08 2019-07-16 佛山市云米电器科技有限公司 一种通过识别编号实现家电组网的方法及系统
CN111867146B (zh) * 2019-04-30 2022-07-22 大唐移动通信设备有限公司 一种标识信息发送、接收方法、设备及装置
US11140165B2 (en) * 2019-07-22 2021-10-05 Bank Of America Corporation System for selective mapping of distributed resources across network edge framework for authorized user access
CN111741463B (zh) * 2020-07-08 2022-12-13 Oppo广东移动通信有限公司 一种通信连接方法、相关设备以及存储介质
CN117044256A (zh) * 2021-04-01 2023-11-10 三星电子株式会社 封闭wi-fi热点网络的方法、接入点设备及站设备
CN114205748B (zh) * 2021-12-08 2023-03-10 珠海格力电器股份有限公司 网络配置方法和装置、电子设备和存储介质
CN114802102B (zh) * 2022-05-27 2023-11-14 支付宝(杭州)信息技术有限公司 基于超宽带uwb的无感入车方法和系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102791016A (zh) * 2012-07-04 2012-11-21 大唐移动通信设备有限公司 一种接入处理方法及装置
US20150172926A1 (en) * 2008-09-23 2015-06-18 Telefonaktiebolaget Lm Ericsson (Publ) Access Control for Terminals in UTRAN FEMTO System
CN105406961A (zh) * 2015-11-02 2016-03-16 珠海格力电器股份有限公司 密钥协商方法、终端及服务器
CN107146294A (zh) * 2017-04-13 2017-09-08 腾讯科技（深圳）有限公司 签到方法、装置及系统

Family Cites Families (29)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7039392B2 (en) * 2000-10-10 2006-05-02 Freescale Semiconductor System and method for providing device authentication in a wireless network
US7042867B2 (en) * 2002-07-29 2006-05-09 Meshnetworks, Inc. System and method for determining physical location of a node in a wireless network during an authentication check of the node
US7813733B2 (en) * 2004-07-27 2010-10-12 Lenovo (Singapore) Pte. Ltd. Forced roaming to avoid interference
US7864732B2 (en) * 2006-01-27 2011-01-04 Mediatek Inc. Systems and methods for handoff in wireless network
CN101192916A (zh) * 2006-11-23 2008-06-04 华为技术有限公司 无线接入方法及无线接入设备
KR20100131211A (ko) * 2009-06-05 2010-12-15 삼성전자주식회사 무선 랜 환경에서의 인증 시스템 및 방법
KR101645461B1 (ko) * 2010-01-12 2016-08-12 삼성전자주식회사 휴대용 단말기에서 근거리 무선 네트워크 자동 연결 방법 및 장치
US8732801B2 (en) * 2011-12-09 2014-05-20 Verizon Patent And Licensing Inc. Wireless connection method and device
JP5812910B2 (ja) * 2012-03-22 2015-11-17 富士通エフ・アイ・ピー株式会社 認証装置及び認証方法
US8625796B1 (en) * 2012-11-30 2014-01-07 Mourad Ben Ayed Method for facilitating authentication using proximity
US10652242B2 (en) * 2013-03-15 2020-05-12 Airwatch, Llc Incremental compliance remediation
CN104754761A (zh) * 2013-12-27 2015-07-01 中兴通讯股份有限公司 无线局域网连接处理方法及装置
US20150215762A1 (en) * 2014-01-24 2015-07-30 Qualcomm Incorporated Method and apparatus for verifying the identity of a wireless device
EP2928245A1 (en) * 2014-04-01 2015-10-07 Alcatel Lucent A wireless access point, a transmitter-implemented method, a mobile user device and a user-implemented method for localization
US9455964B2 (en) * 2015-01-30 2016-09-27 Aruba Networks, Inc. Guest WiFi authentication based on physical proximity
KR101538503B1 (ko) * 2015-02-04 2015-07-24 주식회사 지란지교 신호세기를 이용한 무선랜 접속 방법
FR3037751A1 (fr) * 2015-06-18 2016-12-23 Orange Composant materiel et procede d'acces d'un terminal distant a un reseau local, passerelle de service, procede d'autorisation d'acces et programme d'ordinateur correspondants
US10122685B2 (en) * 2015-08-26 2018-11-06 Tatung Company Method for automatically establishing wireless connection, gateway device and client device for internet of things using the same
CN105245539A (zh) * 2015-10-27 2016-01-13 上海斐讯数据通信技术有限公司 一种路由器访客验证方法及系统、路由器
US9787869B1 (en) * 2016-04-05 2017-10-10 Hewlett-Packard Development Company, L.P. Print job access provision
US10009951B2 (en) * 2016-05-10 2018-06-26 Kodacloud Inc. Executing a corrective action based on behavior detected during a connection stage
FR3060929A1 (fr) * 2016-12-16 2018-06-22 Orange Mise en oeuvre conditionnelle d' un service
US20180191689A1 (en) * 2016-12-30 2018-07-05 Wipro Limited Method and system for providing a communication device access to a wireless local area network
CN106658672B (zh) * 2017-02-20 2019-08-20 Oppo广东移动通信有限公司 一种无线保真Wi-Fi连接方法及移动终端
CN107396303B (zh) * 2017-06-20 2022-03-29 中兴通讯股份有限公司 接入控制方法及系统、安全区域确定方法及装置
US20190053124A1 (en) * 2017-08-11 2019-02-14 Qualcomm Incorporated Method and apparatus for enabling wireless connection based on rtt and aoa
US10965672B2 (en) * 2018-04-13 2021-03-30 At&T Intellectual Property I, L.P. Network service control for access to wireless radio networks
KR20210008474A (ko) * 2018-05-18 2021-01-22 소니 주식회사 무선 통신 장치 및 무선 통신 방법
CN111132137A (zh) * 2019-09-16 2020-05-08 华为技术有限公司 一种Wi-Fi连接方法及设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150172926A1 (en) * 2008-09-23 2015-06-18 Telefonaktiebolaget Lm Ericsson (Publ) Access Control for Terminals in UTRAN FEMTO System
CN102791016A (zh) * 2012-07-04 2012-11-21 大唐移动通信设备有限公司 一种接入处理方法及装置
CN105406961A (zh) * 2015-11-02 2016-03-16 珠海格力电器股份有限公司 密钥协商方法、终端及服务器
CN107146294A (zh) * 2017-04-13 2017-09-08 腾讯科技（深圳）有限公司 签到方法、装置及系统

Also Published As

Publication number Publication date
CN109151818A (zh) 2019-01-04
DE112018007211T5 (de) 2020-11-26
US11582606B2 (en) 2023-02-14
US20210021996A1 (en) 2021-01-21
CN109151818B (zh) 2021-08-17

Similar Documents

Publication Publication Date Title
WO2020029498A1 (zh) 一种终端验证方法、ap设备、终端及系统
KR101783662B1 (ko) 인증된 ToF 실내 포지셔닝 시스템 및 방법
US11399018B2 (en) Network device proximity-based authentication
US9319835B2 (en) Securely managed location-and-tracking service access
EP2915372B1 (en) Systems and methods for utilizing hidden access points
EP3732917B1 (en) Controlling access to networks in a heterogeneous network environment
CN101322331B (zh) 位置信息系统及基于位置执行通知的方法
US11997491B2 (en) Data transmission system and method, and apparatus thereof
CN113132908B (zh) 一种业务管理方法及装置
CN110678770A (zh) 定位信息验证
US10615844B2 (en) System and method for relaying data over a communication network
CN112438056B (zh) 基于设备的接入点关联和物理地址跟踪
CN109618392B (zh) 网络共享的方法、装置、设备及计算机可读存储介质
WO2018120553A1 (zh) 一种网络共享方法及终端
GB2393073A (en) Certification scheme for hotspot services
KR101460766B1 (ko) 무선 네트워크 시스템에서 클러스터 기능을 이용한 보안설정 시스템 및 그 제어방법
WO2017211198A1 (zh) 无线局域网接入控制方法及装置
CN112637757A (zh) 近距离离线共乘预订系统
US10009347B2 (en) Communication device, communication method, and communication system
CN114786121A (zh) 一种定位方法、装置、系统及存储介质
WO2021052276A1 (zh) 获取目标标识的方法、服务实体、应用实体、电子装置及存储介质
TWI767202B (zh) 用於將無線存取點登記到多ａｐ無線網路的裝置及方法
WO2019014928A1 (zh) 一种控制可操控设备接入网络的方法及装置
CN109743237B (zh) 一种app的鉴权方法及网关
CN108848066B (zh) 一种终端的通信方法、终端及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18929753

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 18929753

Country of ref document: EP

Kind code of ref document: A1