WO2020220694A1 - 路由器、网络连接方法及移动终端 - Google Patents

路由器、网络连接方法及移动终端 Download PDF

Info

Publication number
WO2020220694A1
WO2020220694A1 PCT/CN2019/125051 CN2019125051W WO2020220694A1 WO 2020220694 A1 WO2020220694 A1 WO 2020220694A1 CN 2019125051 W CN2019125051 W CN 2019125051W WO 2020220694 A1 WO2020220694 A1 WO 2020220694A1
Authority
WO
WIPO (PCT)
Prior art keywords
router
mobile terminal
random number
dynamic password
temporary key
Prior art date
Application number
PCT/CN2019/125051
Other languages
English (en)
French (fr)
Inventor
赵云华
Original Assignee
惠州Tcl移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 惠州Tcl移动通信有限公司 filed Critical 惠州Tcl移动通信有限公司
Priority to US17/602,818 priority Critical patent/US20220159462A1/en
Priority to EP19927153.7A priority patent/EP3965445A4/en
Publication of WO2020220694A1 publication Critical patent/WO2020220694A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/50—Secure pairing of devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/30—Connection release
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • This application relates to the field of intelligent communication technology, and in particular to a router, a mobile terminal, a network connection method thereof, and a mobile terminal.
  • the inventor of the present application has discovered in long-term research and development that most of the current public WIFI is connected to the router using an unencrypted connection method when the terminal is connected. After browsing the login page or advertisement page provided by the router, the router allows the device to go online. And due to the router’s preset key and master key (Pairwise The Master Key (PMK) is fixed and will cause a large number of idle or not browsing the router login page to still be associated with the router, causing the router to run slowly and have a poor Internet experience.
  • PMK Packewise The Master Key
  • the main technical problem to be solved by this application is to provide a router, a mobile terminal, a network connection method thereof, and a mobile terminal to prevent idle or irrelevant terminals from being excessively associated with the router from resource consumption.
  • a technical solution adopted in this application is to provide a router network connection method, including:
  • the router receives the first dynamic password from the server
  • the router receives the second dynamic password from the mobile terminal and matches the second dynamic password with the first dynamic password
  • the router clears the connection information generated by the connection after the connection is completed.
  • a mobile terminal network connection method including:
  • the mobile terminal recognizes the picture information from the router, and sends a first request signal to the server after the recognition is successful;
  • another technical solution adopted in this application is to provide a mobile terminal, the mobile terminal including a memory and a processor connected to each other, wherein,
  • the memory is used to store program instructions for implementing the following steps;
  • the processor is configured to implement the following steps when executing the program instructions stored in the memory:
  • the mobile terminal recognizes the picture information from the router, and sends a first request signal to the server after successful recognition, where the picture information includes an identification code;
  • a router which includes a memory and a processor connected to each other, wherein,
  • the memory is used to store program instructions for implementing the following steps;
  • the processor is configured to implement the following steps when executing the program instructions stored in the memory:
  • the router receives the first dynamic password from the server
  • the router receives a second dynamic password from a mobile terminal and matches the second dynamic password with the first dynamic password, wherein the second dynamic password is allocated to the mobile terminal by the server;
  • the router clears the connection information generated by the connection after the connection is completed.
  • another technical solution adopted by this application is to provide a storage medium, wherein the storage medium stores program data, and the program data can be executed by the above-mentioned network connection method.
  • the network connection method proposed in this application is to identify the picture information of the router through the mobile terminal and send a first request signal to the server.
  • the router receives the first dynamic password from the server
  • the mobile terminal receives the second dynamic password from the router
  • the mobile terminal sends the first dynamic password to the server.
  • the second dynamic password is sent to the router.
  • the router matches the second dynamic password with the first dynamic password, establishes a connection when the matching is successful, and clears the connection information generated by this connection. To prevent idle terminals from connecting to the router.
  • Fig. 1 is a schematic flowchart of a first embodiment of a router network connection method according to this application;
  • FIG. 2 is a schematic flowchart of a second embodiment of a router network connection method according to the present application.
  • Fig. 3 is a schematic flowchart of a third embodiment of a router network connection method according to the present application.
  • FIG. 5 is a schematic flowchart of a second embodiment of a mobile terminal network connection method according to the present application.
  • Fig. 6 is a schematic flowchart of a third embodiment of a mobile terminal network connection method according to the present application.
  • FIG. 7 is a schematic diagram of the signal transmission structure of the mobile terminal and router network connection method of the present application.
  • FIG. 8 is a schematic diagram of the structure of the mobile terminal/router of the present application.
  • FIG. 9 is a schematic structural diagram of an embodiment of a storage medium of the present application.
  • first”, “second”, and “third” in this application are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined with “first”, “second”, and “third” may explicitly or implicitly include at least one of the features.
  • "a plurality of” means at least two, such as two, three, etc., unless otherwise specifically defined. All the directional indicators (such as up, down, left, right, front, back%) in the embodiments of this application are only used to explain the relative positional relationship between the components in a specific posture (as shown in the figure) If the specific posture changes, the directional indication will change accordingly.
  • FIG. 1 is a schematic flowchart of a first embodiment of a router network connection method according to this application. include:
  • Step S101 The router receives the first dynamic password from the server.
  • the first dynamic password is a password randomly assigned by the server, which can be a digital password, a combination of numbers and letters, such as "128963", "ad5263”, etc.
  • Step S102 The router receives a second dynamic password from the mobile terminal and matches the second dynamic password with the first dynamic password.
  • the second dynamic password is the same as the first dynamic password, which is randomly allocated by the server, and when the server receives the first request signal of the mobile terminal, it will randomly allocate and generate a dynamic password,
  • the dynamic password is sent to the mobile terminal and the router respectively, and the mobile terminal can perform identity authentication with the router through the dynamic password, that is, the second dynamic password obtained by itself is sent to the router for verification by the router.
  • Step S103 when the matching is successful, the connection is established and the first result signal is sent to the mobile terminal.
  • the router After the router receives the second dynamic password sent by the mobile terminal, it compares it with its own first dynamic password. If the results are inconsistent, the verification fails and the connection cannot be established; if the results are consistent, the verification is successful. Allow the connection request of the mobile terminal to establish a connection, and send a first result signal to the mobile terminal to prompt the mobile terminal to establish a network connection.
  • Step S104 The router clears the connection information generated by the connection after the connection is completed.
  • the router After the connection is successful, the router will clear the dynamic password and the information of the mobile terminal connected this time, such as the model and identification code of the mobile terminal, so that the mobile terminal will enter this place next time. Cannot automatically connect when in WIFI area.
  • FIG. 4 is a schematic flowchart of the first embodiment of the mobile terminal network connection method of the present application. include:
  • Step S401 The mobile terminal recognizes the picture information from the router, and sends a first request signal to the server after the recognition is successful.
  • the mobile terminal is an electronic device such as a mobile phone, an ipad, and the image information of the router may be identification code information such as a QR code or a barcode, which identifies the address, factory information, etc. of the router, and the mobile terminal can pass A device such as a camera scans the picture, and sends a first request signal to the server after obtaining the information of the router after the scanning is completed.
  • identification code information such as a QR code or a barcode
  • Step S402 Receive the second dynamic password from the server.
  • the second dynamic password is the same as the first dynamic password, and both are passwords randomly assigned by the server. It can be a digital password, a combination of numbers and letters, such as "128963”, "ad5263”, and so on.
  • Step S403 Send a second dynamic password to the router.
  • the mobile terminal After receiving the second dynamic password sent by the server, the mobile terminal sends the second dynamic password to the router, and the router performs verification.
  • Step S404 Receive the first result signal from the router.
  • the router After receiving the second dynamic password, the router matches the first dynamic password, establishes a connection after the matching is successful, and sends a first result signal to the mobile terminal, and the mobile terminal confirms that the connection is complete when receiving the first signal.
  • the solution proposed in this embodiment is that the mobile terminal recognizes the picture information of the router and sends the first request signal to the server and then receives the second dynamic password from the server, the router receives the first dynamic password from the server, and the mobile terminal sends the second dynamic password to the server.
  • the router matches the second dynamic password with the first dynamic password. After the matching is successful, the connection is established, and the connection information generated by this connection is clear after the connection is completed, so as to prevent the mobile terminal from entering the WIFI area next time Automatic connection affects the running speed of the router.
  • FIG. 2 is a schematic flowchart of a second embodiment of a router network connection method according to this application. include:
  • Step S201 The router receives the first dynamic password from the server.
  • the first dynamic password is a password randomly assigned by the server, and it can be a digital password, a combination of numbers and letters, such as "128963", "ad5263”, and so on.
  • Step S202 The router generates a first master key according to the first dynamic password.
  • PMK is the master key
  • SSID is the router
  • the address of pbkdf2_shal is hash operation.
  • the PMK (Pairwise Master Key) means that the applicant (i.e. mobile terminal) and the authenticator (i.e. router) can share a symmetric key called a paired master key, which is used to control signal access between the two.
  • the PMK comes from a password.
  • the PMK can be dynamically designated.
  • Step S203 The router generates a first random number and sends the first random number to the mobile terminal.
  • the first random number is a number randomly generated by the router, and the router sends the first random number to the mobile terminal after generating the first random number.
  • Step S204 Receive the third random number and the first temporary key from the mobile terminal and generate a fourth random number.
  • the fourth random number is the same as the third random number and both are randomly generated numbers, and the fourth random number is different from the third random number and can only be used once.
  • Step S205 Generate a second temporary key according to the third random number, the fourth random number and the first master key.
  • the mobile terminal when it sends the third random number to the router, it includes the MAC (Media Access Control or Medium) of the mobile terminal.
  • Access Control Media Access Control
  • Physical address hardware address, used to define the location of network equipment, in the open communication system interconnection reference model (Open In System Interconnection, OSI/RM, Open System Interconnection Reference Model)
  • OSI/RM Open System Interconnection Reference Model
  • the third-layer network layer is responsible for the IP address
  • the second-layer data link is responsible for the MAC address. Therefore, a host has a MAC address, and each network location has an IP address dedicated to it.
  • the MAC address is determined by the network card and is fixed.
  • the MAC address is the aforementioned identification address.
  • Step S206 Match the second temporary key with the first temporary key.
  • the router After calculating the second temporary key, the router matches the calculated second temporary key with the first temporary key received from the mobile terminal.
  • Step S207 when the matching is successful, a connection is established and a second result signal is sent to the mobile terminal.
  • the router compares the second temporary key with the first temporary key, and if the results are inconsistent, the verification fails and the connection cannot be established; if the results are consistent, the verification is successful and the connection request of the mobile terminal is allowed to pass, A connection is established, and a second result signal is sent to the mobile terminal to prompt the mobile terminal to establish a network connection.
  • Step S208 The router clears the connection information generated by the connection after the connection is completed.
  • the router will clear the dynamic password of this connection and the information of the mobile terminal connected this time, the master key, temporary key, the device identification address of the mobile terminal, random So that the mobile terminal cannot automatically connect when it enters this WIFI area next time.
  • FIG. 5 is a schematic flowchart of a second embodiment of a mobile terminal network connection method according to this application.
  • step S501 and step S502 are the same as step S401 and step S402 in FIG. 4, and will not be described here.
  • Step S503 The mobile terminal generates a second master key according to the second dynamic password.
  • the mobile terminal sends a first request signal to the server after identifying the picture information of the router, and the server sends a second dynamic password to the mobile terminal when receiving the first request signal, and the mobile terminal
  • the second dynamic password generates the second master key
  • the PMK (Pairwise Master Key) means that the applicant (i.e. mobile terminal) and the authenticator (i.e. router) can share a symmetric key called a paired master key, which is used to control signal access between the two.
  • the PMK comes from a password.
  • the PMK can be dynamically designated.
  • Step S504 Receive the first random number from the router and generate a second random number.
  • the first random number and the second random number are the same as the aforementioned third random number and the fourth random number, and the first random number and the fourth random number are random numbers generated by the router
  • the second random number and the third random number are random numbers generated by the mobile terminal, and the random number can only be used once in the process of calculating and generating a temporary key.
  • Step S505 Generate a first temporary key according to the first random number, the second random number, and the second master key.
  • the router when it sends the first random number to the mobile terminal, it includes the MAC (Media Access Control or Medium) of the router.
  • Access Control Media Access Control
  • Physical address hardware address, used to define the location of network equipment, in the open communication system interconnection reference model (Open In System Interconnection, OSI/RM, Open System Interconnection Reference Model), the third-layer network layer is responsible for the IP address, and the second-layer data link is responsible for the MAC address. Therefore, a host has a MAC address, and each network location has an IP address dedicated to it.
  • the MAC address is determined by the network card and is fixed.
  • the MAC address is the aforementioned identification address.
  • Step S506 Generate a third random number and send the third random number and the first temporary key to the router.
  • the mobile terminal After calculating the first temporary key, the mobile terminal generates a third random number, and sends the third random number to the router, which contains the MAC address of the mobile terminal, that is, the identification address.
  • Step S507 Receive a second result signal from the router.
  • the router calculates a second temporary key after receiving the second random number, matches the second temporary key with the first temporary key, establishes a connection after the matching is successful, and sends the second result
  • the signal is sent to the mobile terminal, and the mobile terminal confirms that the connection is complete when receiving the second signal.
  • the solution proposed in this embodiment is: the mobile terminal recognizes the picture information of the router and sends the first request signal to the server, receives the second dynamic password from the server and generates the second master key according to the second dynamic password, and the router receives the first dynamic password from the server. Password and generate a first master key according to the first dynamic password, so that the router generates a first random number and sends it to the mobile terminal.
  • the mobile terminal generates a second random number after receiving the first random number, and then generates a second random number according to The first random number, the second random number, and the second master key generate a first temporary key, the mobile terminal generates a third random number and sends the third random number and the first temporary key to the router, so The router generates a fourth random number after receiving the third random number, and generates a second temporary key according to the third random number, the fourth random number, and the first master key. After generating the second temporary key, the router generates The second temporary key is matched with the first temporary key. After the matching is successful, the connection is established, and the connection information generated by this connection is clear after the connection is completed, so as to prevent the mobile terminal from automatically entering the WIFI area next time. The connection affects the running speed of the router.
  • FIG. 3 is a schematic flowchart of a third embodiment of a router network connection method according to this application. Compared with the second embodiment shown in FIG. 2, the difference is that this embodiment further includes after step S206: matching the second temporary key with the first temporary key:
  • Step S307 If the matching is successful, the router sends a second temporary key to the mobile terminal.
  • the second temporary key is sent to the mobile terminal, so that the mobile terminal performs matching again.
  • Step S308 The router receives the authentication confirmation message from the mobile terminal, establishes a connection, and sends a third result signal to the mobile terminal.
  • the mobile terminal After the mobile terminal receives the second temporary key, it matches the second temporary key with the first temporary key again. If the match fails, the connection fails, and if the match succeeds, it sends an authentication to the router. A confirmation message, the router completes the connection after receiving the authentication confirmation message and sends a third result signal to the mobile terminal to prompt the mobile terminal of the connection result.
  • Step S309 The router clears the connection information generated by the connection after the connection is completed.
  • the router will clear the dynamic password of this connection and the information of the mobile terminal connected this time, etc., the master key, temporary key, device identification address of the mobile terminal, Random numbers, etc., so that the mobile terminal cannot automatically connect when it enters this WIFI area next time.
  • FIG. 6 is a schematic flowchart of a third embodiment of a mobile terminal network connection method according to this application. Compared with the second embodiment shown in FIG. 5, the difference is that in this embodiment, in step S506: generate a third random number and send the third random number and the first temporary key to the router It also includes:
  • Step S607 Receive the second temporary key from the router.
  • the router After successfully matching the second temporary key with the first temporary key, the router sends the second temporary key to the mobile terminal.
  • Step S608 Match the second temporary key with the first temporary key.
  • the mobile terminal After receiving the second temporary key from the router, the mobile terminal matches the second temporary key with the first temporary key, and when the matching fails, the connection fails.
  • Step S609 Send an authentication confirmation message to the router when the matching is successful.
  • the mobile terminal matches the second temporary key with the first temporary key, and sends an authentication confirmation message to the router when the matching is successful, so as to prompt the router to pass the verification.
  • Step S610 Receive the third result signal from the router.
  • the router establishes a connection after receiving the authentication confirmation message sent by the mobile terminal, and sends a third result signal to the mobile terminal to prompt the mobile terminal to connect successfully.
  • the solution proposed in this embodiment differs in that: the router matches the second temporary key, and after the matching succeeds, the second temporary key
  • the key is sent to the mobile terminal, and the mobile terminal performs a match between the second temporary key and the first temporary key, and sends an authentication confirmation message to the router after the match is successful.
  • the mobile terminal is allowed to connect, and after the connection is established, a third result signal is sent to the mobile terminal to prompt the mobile terminal to complete the connection.
  • two matches are performed to further improve the security of the network connection.
  • the router clears the connection information generated by this connection after the connection is completed, so as to avoid the next time the mobile terminal automatically connects when entering the WIFI area and affects the running speed of the router.
  • Figure 7 is a schematic diagram of the signal transmission structure of the mobile terminal and router of this application.
  • the mobile terminal 11 recognizes the picture information of the router 12 and sends a first request signal to the server 13, and the server 13 sends the first dynamic password to the router 12 after receiving the first request signal, Send a second dynamic password to the mobile terminal 11, the mobile terminal 11 generates a second master key according to the second dynamic password, the router 12 generates a first master key according to the first dynamic password, the router 12 Generate a first random number and send the first random number to the mobile terminal 11.
  • the mobile terminal 11 generates a second random number after receiving the first random number, and generates a second random number according to the first random number ,
  • the second random number and the second master key generate a first temporary key
  • the mobile terminal 11 generates a third random number and sends the third random number and the first temporary key to the router 12
  • the router 12 generates a fourth random number after receiving the third random number and the first temporary key, and generates a second temporary key according to the third random number, the fourth random number and the first master key
  • the second temporary key is matched with the first temporary key, and after the matching is successful, the second temporary key is sent to the mobile terminal 11, and the mobile terminal 11 then matches the second temporary key
  • the temporary key will be matched with the first temporary key.
  • an authentication confirmation message will be sent to the router 12, and the router 12 will establish a connection after receiving the authentication confirmation message, and send to the mobile
  • the terminal 11 sends a result signal to remind the mobile terminal 11 that the network connection is successful.
  • FIG 8 is a schematic diagram of the structure of the mobile terminal or router of this application.
  • the mobile terminal or router includes a processor 51 and a memory 52 coupled to the processor.
  • the memory 52 stores program instructions for implementing any of the above-mentioned network connections.
  • the processor 51 is configured to execute the program instructions stored in the memory 52.
  • the processor 51 may also be referred to as a CPU (Central Processing Unit, central processing unit).
  • the processor 51 may be an integrated circuit chip with signal processing capability.
  • the processor 51 may also be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component .
  • the general-purpose processor may be a microprocessor or the processor may also be any conventional processor or the like.
  • the memory 52 can be a memory stick, a TF card, etc., and can store all the information in the mobile terminal, including input original data, computer programs, intermediate running results, and final running results, all stored in the memory. It stores and retrieves information according to the location specified by the controller. With the memory, the mobile terminal has the memory function to ensure normal operation.
  • the storage in the mobile terminal can be divided into main storage (memory) and auxiliary storage (external storage) according to usage, and there are also classification methods into external storage and internal storage. External storage is usually magnetic media or optical discs, etc., which can store information for a long time.
  • Memory refers to the storage components on the motherboard, which are used to store the currently executing data and programs, but only to temporarily store the programs and data. The data will be lost if the power is turned off or power off.
  • the mobile terminal or router also includes other devices, which are the same as other devices and functions in the mobile terminal or router in the prior art, and will not be repeated here.
  • FIG. 9 is a schematic structural diagram of an embodiment of a storage medium of this application.
  • the storage medium of the present application stores program data 61 that can implement all the above methods.
  • the program data 61 can be stored in the above storage medium in the form of a software product, and includes several instructions to enable a computer device (which can be a personal computer).
  • a computer, a server, or a network device, etc.) or a processor (processor) executes all or part of the steps of the methods described in each embodiment of the present application.
  • the aforementioned storage devices include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks or optical disks and other media that can store program codes, or terminal devices such as computers, servers, mobile phones, and tablets.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are merely illustrative, for example, the division of units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components can be combined or integrated. To another system, or some features can be ignored, or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • each unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明提供一种路由器、网络连接方法及移动终端。包括：路由器接收来自服务器的第一动态密码；所述路由器接收来自移动终端的第二动态密码并将所述第二动态密码与所述第一动态密码进行匹配；在匹配成功时建立连接并向移动终端发送第一结果信号；所述路由器在连接完成之后清除所述连接所产生的连接信息。以此防止没有通过鉴权的终端连接路由器，提高路由器连接的安全性。

Description

路由器、网络连接方法及移动终端
本申请要求于2019年04月29日提交中国专利局、申请号为201910355810.1、发明名称为“路由器、移动终端及其网络连接方法及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及智能通讯技术领域，尤其涉及一种路由器、移动终端及其网络连接方法及移动终端。
 背景技术
本申请发明人在长期研发中发现，目前公共WIFI大多在用终端进行连接时，使用不加密的连接方式直接连接到路由器，浏览路由器提供的登录页面或广告页面后，路由器放行此设备进行上网，且由于路由器的预置密钥和主密钥（Pairwise Master Key，PMK）是固定不变的，会使大量空闲或没有浏览路由器登录页面的终端仍然关联着路由器，导致路由器运行缓慢，上网体验不佳。
 技术问题
本申请主要解决的技术问题是提供一种路由器、移动终端及其网络连接方法及移动终端，以防止空闲或无关终端过度关联路由器导致的资源消耗。
 技术解决方案
为解决上述技术问题，本申请采用的一个技术方案是：提供一种路由器网络连接方法，包括：
路由器接收来自服务器的第一动态密码；
所述路由器接收来自移动终端的第二动态密码并将所述第二动态密码与所述第一动态密码进行匹配；
在匹配成功时建立连接并向移动终端发送第一结果信号；
所述路由器在连接完成之后清除所述连接所产生的连接信息。
为解决上述技术问题，本申请采用的另一个技术方案是：提供一种移动终端网络连接方法，包括：
所述移动终端识别来自所述路由器的图片信息，在识别成功后向服务器发送第一请求信号；
接收来自服务器的第二动态密码；
向所述路由器发送第二动态密码；
接收来自所述路由器的第一结果信号。
为解决上述技术问题，本申请采用的另一个技术方案是：提供一种移动终端，所述移动终端包括相互连接的存储器和处理器，其中，
所述存储器用于存储实现如下步骤的程序指令；
所述处理器用于执行所述存储器存储的所述程序指令时实现以下步骤：
所述移动终端识别来自所述路由器的图片信息，在识别成功后向服务器发送第一请求信号，其中，所述图片信息包括识别码；
接收来自服务器的第二动态密码；
向所述路由器发送第二动态密码；
接收来自所述路由器的第一结果信号。
为解决上述技术问题，本申请采用的又一个技术方案是：提供一种路由器，所述路由器包括相互连接的存储器和处理器，其中，
所述存储器用于存储实现如下步骤的程序指令；
所述处理器用于执行所述存储器存储的所述程序指令时实现以下步骤：
路由器接收来自服务器的第一动态密码；
所述路由器接收来自移动终端的第二动态密码并将所述第二动态密码与所述第一动态密码进行匹配，其中，所述第二动态密码由所述服务器分配至所述移动终端；
在匹配成功时建立连接并向移动终端发送第一结果信号；
所述路由器在连接完成之后清除所述连接所产生的连接信息。
为解决上述技术问题，本申请采用的再一个技术方案是：提供一种存储介质，其中，所述存储介质存储有程序数据，所述程序数据能够被执行上述所述网络连接方法。
 有益效果
本申请提出的网络连接方法是通过移动终端识别路由器的图片信息并向服务器发送第一请求信号，路由器接受来自服务器的第一动态密码，移动终端接收来自路由器的第二动态密码，移动终端将第二动态密码发送给路由器，路由器接收到第二动态密码后将第二动态密码与第一动态密码进行匹配，在匹配成功时建立连接并清除此次连接产生的连接信息。以防止空闲终端连接路由器。
 附图说明
图1是本申请路由器网络连接方法的第一实施例的流程示意图；
图2是本申请路由器网络连接方法的第二实施例的流程示意图；
图3是本申请路由器网络连接方法的第三实施例的流程示意图；
图4是本申请移动终端网络连接方法的第一实施例的流程示意图；
图5是本申请移动终端网络连接方法的第二实施例的流程示意图；
图6是本申请移动终端网络连接方法的第三实施例的流程示意图；
图7是本申请移动终端及路由器网络连接方法信号传输的结构示意图；
图8是本申请移动终端/路由器的结构示意图；
图9是本申请存储介质实施例的结构示意图。
 本发明的实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅是本申请的一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请中的术语“第一”、“第二”、“第三”仅用于描述目的，而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此，限定有“第一”、“第二”、“第三”的特征可以明示或者隐含地包括至少一个该特征。本申请的描述中，“多个”的含义是至少两个，例如两个，三个等，除非另有明确具体的限定。本申请实施例中所有方向性指示（诸如上、下、左、右、前、后……）仅用于解释在某一特定姿态（如附图所示）下各部件之间的相对位置关系、运动情况等，如果该特定姿态发生改变时，则该方向性指示也相应地随之改变。此外，术语“包括”和“具有”以及它们任何变形，意图在于覆盖不排他的包含。例如包含了一系列步骤或单元的过程、方法、系统、产品或设备没有限定于已列出的步骤或单元，而是可选地还包括没有列出的步骤或单元，或可选地还包括对于这些过程、方法、产品或设备固有的其它步骤或单元。
在本文中提及“实施例”意味着，结合实施例描述的特定特征、结构或特性可以包含在本申请的至少一个实施例中。在说明书中的各个位置出现该短语并不一定均是指相同的实施例，也不是与其它实施例互斥的独立的或备选的实施例。本领域技术人员显式地和隐式地理解的是，本文所描述的实施例可以与其它实施例相结合。
下面结合附图和实施例对本申请进行详细的说明。
请参阅图1，为本申请路由器网络连接方法的第一实施例的流程示意图。包括：
步骤S101：路由器接收来自服务器的第一动态密码。
其中，所述第一动态密码为服务器随机分配的密码，其可以是数字密码、数字与字母组合的密码，如：“128963”、 “ad5263”等。
步骤S102：所述路由器接收来自移动终端的第二动态密码并将所述第二动态密码与所述第一动态密码进行匹配。
其中，所述第二动态密码与所述第一动态密码相同，都是由服务器随机分配的，且当服务器接收到移动终端的第一请求信号之后，将会随机分配生成一动态密码，将所述动态密码分别发送给所述移动终端及所述路由器，所述移动终端可通过动态密码与所述路由器进行身份认证，即将自身得到的第二动态密码发送给路由器，由所述路由器进行验证。
步骤S103：在匹配成功时建立连接并向移动终端发送第一结果信号。
其中，当所述路由器接收到所述移动终端发送的第二动态密码之后，与自身的第一动态密码进行比较，若结果不一致，则验证失败，无法建立连接；若结果一致，则验证成功，允许所述移动终端的连接请求通过建立连接，并向移动终端发送第一结果信号以提示所述移动终端建立网络连接。
步骤S104：所述路由器在连接完成之后清除所述连接所产生的连接信息。
在此次连接成功之后，路由器会清除此次连接时的动态密码及此次连接的移动终端的信息等，如所述移动终端的型号、标识码等，以使所述移动终端在下次进入此WIFI区域中时不能自动连接。
请参见图4，是本申请移动终端网络连接方法的第一实施例的流程示意图。包括：
步骤S401：所述移动终端识别来自所述路由器的图片信息，在识别成功后向服务器发送第一请求信号。
其中，所述移动终端为手机、ipad等电子设备，所述路由器的图片信息可以为二维码或条形码等识别码信息，其标识所述路由器的地址、出厂信息等，所述移动终端可通过摄像头等装置对图片进行扫描，在扫描完成后得到所述路由器的信息之后向服务器发送第一请求信号。
步骤S402：接收来自服务器的第二动态密码。
其中，所述第二动态密码与所述第一动态密码相同，且都是服务器随机分配的密码，其可以是数字密码、数字与字母组合的密码，如：“128963”、 “ad5263”等。
步骤S403：向所述路由器发送第二动态密码。
所述移动终端在接收到服务器发送的第二动态密码之后将所述第二动态密码发送给所述路由器，有所述路由器进行验证。
步骤S404：接收来自所述路由器的第一结果信号。
所述路由器接收到第二动态密码后与第一动态密码进行匹配，在匹配成功之后建立连接，并发送第一结果信号给移动终端，移动终端在接收到第一信号时确认连接完成。
本实施例提出的方案为：移动终端识别路由器的图片信息向服务器发送第一请求信号后从服务器接收第二动态密码，路由器从服务器接收第一动态密码，移动终端将第二动态密码发送给所述路由器，路由器将第二动态密码与第一动态密码进行匹配，匹配成功后则建立连接，且在连接完成后清楚此次连接所产生的连接信息，避免下次移动终端在进入此WIFI区域内自动连接而影响路由器的运行速度。
请参见图2，为本申请路由器网络连接方法的第二实施例的流程示意图。包括：
步骤S201：路由器接收来自服务器的第一动态密码。
与上一实施例相同，第一动态密码为服务器随机分配的密码，其可以是数字密码、数字与字母组合的密码，如：“128963”、 “ad5263”等。
步骤S202：所述路由器根据所述第一动态密码生成第一主密钥。
其中，所述路由器根据所述第一动态密码生成第一主密钥的方式为： PMK=pbkdf2_shal（第一动态密码，SSID，SSID长度，4096），其中，PMK为主密钥，SSID为路由器的地址，pbkdf2_shal为哈希运算。
其中，所述PMK（Pairwise Master Key）为申请者（即移动终端）及认证者（即路由器）可以共享称之为成对主密钥的对称密钥，用于控制两者之间的信号访问，根据本申请的实施例，所述PMK来自密码，在其他实施例中，所述PMK可以动态的被指定。
步骤S203：所述路由器生成第一随机数并向移动终端发送所述第一随机数。
其中，所述第一随机数为所述路由器随机产生的数，所述路由器在产生第一随机数之后将第一随机数发送给所述移动终端。
步骤S204：接收来自移动终端的第三随机数及第一临时密钥并生成第四随机数。
其中，所述第四随机数与所述第三随机数相同，都是随机产生的数，所述第四随机数与所述第三随机数不同，且只能使用一次。
步骤S205：根据所述第三随机数、第四随机数及第一主密钥生成第二临时密钥。
其中，根据所述第三随机数、第四随机数及第一主密钥生成第二临时密钥的方式为：PTK=PRF-X（PMK，“Pairwise key expansion”,Min（AA，SA）||Max（AA，SA）|| Min（ANonce，SNonce）||Max（ANonce，SNonce）），PTK为临时密钥，ANonce为所述路由器产生的随机数，SNonce为所述移动终端产生的随机数，AA为路由器的标识地址，SA为移动终端的标识地址，PRF-X为伪随机函数，Pairwise key expansion为常量字符串。
需要说明的是，所述移动终端在向所述路由器发送第三随机数时，其中包括了所述移动终端的MAC（Media Access Control或Medium Access Control）地址，意译为媒体访问控制，或物理地址、硬件地址，用来定义网络设备的位置，在开放式通信系统互联参考模型（Open System Interconnection，OSI/RM，Open System Interconnection Reference Model）中，第三层网络层负责IP地址，第二层数据链路则负责MAC地址。因此一个主机会有一个MAC地址，而每个网络位置会有一个专属于它的IP地址，所述MAC地址是由网卡决定的，是固定的。所述MAC地址即为上述所述的标识地址。
步骤S206：将所述第二临时密钥与所述第一临时密钥进行匹配。
所述路由器在计算出第二临时密钥之后，将计算得出的第二临时密钥与接收的来自移动终端的第一临时密钥进行匹配。
步骤S207：在匹配成功时建立连接并向所述移动终端发送第二结果信号。
其中，所述路由器将第二临时密钥与第一临时密钥进行比较，若结果不一致，则验证失败，无法建立连接；若结果一致，则验证成功，允许所述移动终端的连接请求通过，建立连接，并向移动终端发送第二结果信号以提示所述移动终端建立网络连接。
步骤S208：所述路由器在连接完成之后清除所述连接所产生的连接信息。
在此次连接成功之后，路由器会清除此次连接时的动态密码及此次连接的移动终端的信息，如此次连接产生的主密钥、临时密钥、所述移动终端的设备标识地址、随机数等，以使所述移动终端在下次进入此WIFI区域中时不能自动连接。
请参见图5，为本申请移动终端网络连接方法的第二实施例的流程示意图。其中，步骤S501与步骤S502与图4中的步骤S401及步骤S402相同，在此不再说明。
步骤S503：所述移动终端根据所述第二动态密码生成第二主密钥。
其中，所述移动终端在识别出所述路由器的图片信息之后向服务器发送第一请求信号，服务器在接受到第一请求信号时向所述移动终端发送第二动态密码，所述移动终端根据所述第二动态密码生成第二主密钥，其方式为：PMK=pbkdf2_shal（第一动态密码，SSID，SSID长度，4096），其中，PMK为主密钥，SSID为路由器的地址，pbkdf2_shal为哈希运算。
其中，所述PMK（Pairwise Master Key）为申请者（即移动终端）及认证者（即路由器）可以共享称之为成对主密钥的对称密钥，用于控制两者之间的信号访问，根据本申请的实施例，所述PMK来自密码，在其他实施例中，所述PMK可以动态的被指定。
步骤S504：接收来自所述路由器的第一随机数并生成第二随机数。
其中，所述第一随机数及第二随机数与上述所述的第三随机数及第四随机数相同，所述第一随机数及所述第四随机数为所述路由器产生的随机数，所述第二随机数及第三随机数为所述移动终端产生的随机数，且所述随机数在计算生成临时密钥过程中只能使用一次。
步骤S505：根据所述第一随机数、第二随机数及第二主密钥生成第一临时密钥。
其中，根据所述第一随机数、第二随机数及第二主密钥生成第一临时密钥的方式为：PTK=PRF-X（PMK，“Pairwise key expansion”,Min（AA，SA）||Max（AA，SA）|| Min（ANonce，SNonce）||Max（ANonce，SNonce）），PTK为临时密钥，ANonce为所述路由器产生的随机数，SNonce为所述移动终端产生的随机数，AA为路由器的标识地址，SA为移动终端的标识地址，PRF-X为伪随机函数，Pairwise key expansion为常量字符串。
需要说明的是，所述路由器在向所述移动终端发送第一随机数时，其中包括了所述路由器的MAC（Media Access Control或Medium Access Control）地址，意译为媒体访问控制，或物理地址、硬件地址，用来定义网络设备的位置，在开放式通信系统互联参考模型（Open System Interconnection，OSI/RM，Open System Interconnection Reference Model）中，第三层网络层负责IP地址，第二层数据链路则负责MAC地址。因此一个主机会有一个MAC地址，而每个网络位置会有一个专属于它的IP地址，所述MAC地址是由网卡决定的，是固定的。所述MAC地址即为上述所述的标识地址。
步骤S506：生成第三随机数并将所述第三随机数及所述第一临时密钥发送给所述路由器。
所述移动终端在计算出第一临时密钥之后，生成第三随机数，将第三随机数发送给所述路由器，其中包含了所述移动终端的MAC地址，即所述标识地址。
步骤S507：接收来自所述路由器的第二结果信号。
所述路由器接收到第二随机数之后计算得出第二临时密钥，将所述第二临时密钥与所述第一临时密钥进行匹配，在匹配成功之后建立连接，并发送第二结果信号给移动终端，移动终端在接收到第二信号时确认连接完成。
本实施例提出的方案为：移动终端识别路由器的图片信息向服务器发送第一请求信号后从服务器接收第二动态密码并根据第二动态密码生成第二主密钥，路由器从服务器接收第一动态密码并根据第一动态密码生成第一主密钥，使所述路由器生成第一随机数并发送给所述移动终端，所述移动终端接收到第一随机数后生成第二随机数，并根据第一随机数、第二随机数及第二主密钥生成第一临时密钥，所述移动终端生成第三随机数并将第三随机数及第一临时密钥发送给所述路由器，所述路由器接收到第三随机数后生成第四随机数，并根据第三随机数、第四随机数及第一主密钥生成第二临时密钥，在生成第二临时密钥之后将所述第二临时密钥与所述第一临时密钥进行匹配，匹配成功后则建立连接，且在连接完成后清楚此次连接所产生的连接信息，避免下次移动终端在进入此WIFI区域内自动连接而影响路由器的运行速度。
请参见图3，为本申请路由器网络连接方法的第三实施例的流程示意图。相较于图2所示的第二实施例而言，区别在于本实施例在步骤S206：将所述第二临时密钥与所述第一临时密钥进行匹配之后还包括：
步骤S307：若匹配成功，所述路由器向所述移动终端发送第二临时密钥。
在所述路由器将第一临时密钥及第二临时密钥匹配成功之后再将所述第二临时密钥发送给所述移动终端，使所述移动终端再进行匹配一次。
步骤S308：所述路由器接收来自移动终端的认证确认消息，建立连接并向移动终端发送第三结果信号。
在所述移动终端接收到第二临时密钥之后，将第二临时密钥与第一临时密钥再进行一次匹配，若匹配失败，则连接失败，若匹配成功，则向所述路由器发送认证确认消息，所述路由器在接收到认证确认消息后完成连接并向所述移动终端发送第三结果信号，以提示移动终端连接结果。
步骤S309：所述路由器在连接完成之后清除所述连接所产生的连接信息。
在此次连接成功之后，路由器会清除此次连接时的动态密码及此次连接的移动终端的信息等，如此次连接产生的主密钥、临时密钥、所述移动终端的设备标识地址、随机数等，以使所述移动终端在下次进入此WIFI区域中时不能自动连接。
请参见图6，为本申请移动终端网络连接方法的第三实施例的流程示意图。相较于图5所示的第二实施例而言，区别在于本实施例在步骤S506：生成第三随机数并将所述第三随机数及所述第一临时密钥发送给所述路由器之后还包括：
步骤S607：接收来自路由器的所述第二临时密钥。
所述路由器在将所述第二临时密钥与所述第一临时密钥进行匹配成功之后，将所述第二临时密钥发送给所述移动终端。
步骤S608：将所述第二临时密钥与所述第一临时密钥进行匹配。
所述移动终端在接收到来自所述路由器的第二临时密钥之后，将所述第二临时密钥与所述第一临时密钥进行匹配，在匹配失败时，连接失败。
步骤S609：在匹配成功时向所述路由器发送认证确认消息。
所述移动终端将所述第二临时密钥与所述第一临时密钥进行匹配，在匹配成功时向所述路由器发送认证确认消息，以提示所述路由器验证通过。
步骤S610：接收来自路由器的第三结果信号。
所述路由器在接收到所述移动终端发送的认证确认消息之后建立连接，并发送第三结果信号给所述移动终端，以提示所述移动终端连接成功。
本实施例提出的方案与第二实施例（图2及图5）相比，区别在于：所述路由器在将所述第二临时密钥进行匹配，且在匹配成功之后将所述第二临时密钥发送给所述移动终端，所述移动终端再将所述第二临时密钥与所述第一临时密钥进行一次匹配，在匹配成功后向所述路由器发送认证确认消息，所述路由器在接收到所述认证确认消息之后允许所述移动终端进行连接，并在建立连接之后发送第三结果信号给所述移动终端，以提示所述移动终端完成连接。本实施例进行两次匹配，进一步提高网络连接的安全性。所述路由器在连接完成之后清除此次连接所产生的连接信息，避免下次移动终端在进入此WIFI区域内自动连接而影响路由器的运行速度。
请参见图7，为本申请移动终端及路由器信号传输的结构示意图。具体地，所述移动终端11识别所述路由器12的图片信息向所述服务器13发送第一请求信号，所述服务器13在接收到第一请求信号后向所述路由器12发送第一动态密码，向所述移动终端11发送第二动态密码，所述移动终端11根据第二动态密码生成第二主密钥，所述路由器12根据所述第一动态密码生成第一主密钥，所述路由器12生成第一随机数并将所述第一随机数发送给所述移动终端11，所述移动终端11接收到所述第一随机数后生成第二随机数，并根据所述第一随机数、第二随机数及第二主密钥生成第一临时密钥，所述移动终端11生成第三随机数并将所述第三随机数及所述第一临时密钥发送给所述路由器12，所述路由器12接收到所述第三随机数及所述第一临时密钥后生成第四随机数，根据第三随机数、第四随机数及第一主密钥生成第二临时密钥，将所述第二临时密钥与所述第一临时密钥进行匹配，在匹配成功后向所述移动终端11发送所述第二临时密钥，所述移动终端11再将所述第二临时密钥与所述第一临时密钥将进行匹配，在匹配成功后向所述路由器12发送认证确认消息，所述路由器12在接收到所述认证确认消息后建立连接，并向所述移动终端11发送结果信号，以提示所述移动终端11网络连接成功。
请参阅图8，是本申请移动终端或路由器的结构示意图。所述移动终端或路由器包括处理器51及和处理器藕接的存储器52。
所述存储器52存储有用于实现上述任一项的网络连接的程序指令。
所述处理器51用于执行存储器52存储的所述程序指令。
其中，处理器51还可以称为CPU（Central Processing Unit，中央处理单元）。处理器51可能是一种集成电路芯片，具有信号的处理能力。处理器51还可以是通用处理器、数字信号处理器（DSP）、专用集成电路（ASIC）、现成可编程门阵列（FPGA）或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
存储器52可以为内存条、TF卡等，可以存储移动终端中全部信息，包括输入的原始数据、计算机程序、中间运行结果和最终运行结果都保存在存储器中。它根据控制器指定的位置存入和取出信息。有了存储器，移动终端才有记忆功能，才能保证正常工作。移动终端中的存储器按用途存储器可分为主存储器(内存)和辅助存储器(外存),也有分为外部存储器和内部存储器的分类方法。外存通常是磁性介质或光盘等，能长期保存信息。内存指主板上的存储部件，用来存放当前正在执行的数据和程序，但仅用于暂时存放程序和数据，关闭电源或断电，数据会丢失。
所述移动终端或路由器还包括其他的器件，其与现有技术中的移动终端或路由器中的其他器件及功能相同，在此不再赘述。
参阅图9，为本申请存储介质实施例的结构示意图。本申请的存储介质存储有能够实现上述所有方法的程序数据61，其中，该程序数据61可以以软件产品的形式存储在上述存储介质中，包括若干指令用以使得一台计算机设备（可以是个人计算机，服务器，或者网络设备等）或处理器（processor）执行本申请各个实施方式所述方法的全部或部分步骤。而前述的存储装置包括：U盘、移动硬盘、只读存储器（ROM，Read-Only Memory）、随机存取存储器（RAM，Random Access Memory）、磁碟或者光盘等各种可以存储程序代码的介质，或者是计算机、服务器、手机、平板等终端设备。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
以上所述仅为本申请的实施方式，并非因此限制本申请的专利范围，凡是利用本申请说明书及附图内容所作的等效结构或等效流程变换，或直接或间接运用在其他相关的技术领域，均同理包括在本申请的专利保护范围内。

Claims (20)

  1. 一种网络连接方法，应用于路由器，其中，所述方法包括：
    路由器接收来自服务器的第一动态密码；
    所述路由器接收来自移动终端的第二动态密码并将所述第二动态密码与所述第一动态密码进行匹配；
    在匹配成功时建立连接并向移动终端发送第一结果信号；
    所述路由器在连接完成之后清除所述连接所产生的连接信息。
  2. 根据权利要求1所述的网络连接方法，其中，所述路由器接收来自服务器的第一动态密码之后，还包括：
    所述路由器根据所述第一动态密码生成第一主密钥；
    所述路由器生成第一随机数并向移动终端发送所述第一随机数；
    接收来自移动终端的第三随机数及第一临时密钥并生成第四随机数；
    根据所述第三随机数、第四随机数及第一主密钥生成第二临时密钥；
    将所述第二临时密钥与所述第一临时密钥进行匹配；
    在匹配成功时建立连接并向移动终端发送第二结果信号。
  3. 根据权利要求2所述的网络连接方法，其中，所述将所述第二临时密钥与所述第一临时密钥进行匹配之后，还包括：
    当匹配成功时，所述路由器向所述移动终端发送所述第二临时密钥；
    所述路由器接收来自移动终端的认证确认消息，建立连接并向移动终端发送第三结果信号。
  4. 根据权利要求2所述的网络连接方法，其中，所述路由器根据所述第一动态密码生成第一主密钥的方式为：
    PMK=pbkdf2_shal（第一动态密码，SSID，SSID长度，4096）；
    其中，PMK为主密钥，SSID为路由器的地址；
    所述根据所述第三随机数、第四随机数及第一主密钥生成第二临时密钥的方式为：
    PTK=PRF-X（PMK，“Pairwise key expansion”,Min（AA，SA）||Max（AA，SA）|| Min（ANonce，SNonce）||Max（ANonce，SNonce））；
    其中，PTK为临时密钥，ANonce为所述路由器产生的随机数，SNonce为所述移动终端产生的随机数，AA为路由器的标识地址，SA为移动终端的标识地址，PRF-X为伪随机函数，Pairwise key expansion为常量字符串。
  5. 根据权利要求1所述的网络连接方法，其中，所述第一动态密码为数字密码、或者数字与字母组合的密码。
  6. 根据权利要求1所述的网络连接方法，其中，所述第二动态密码由所述服务器分配至所述移动终端。
  7. 一种网络连接方法，应用于移动终端，其中，所述方法包括：
    所述移动终端识别来自所述路由器的图片信息，在识别成功后向服务器发送第一请求信号；
    接收来自服务器的第二动态密码；
    向所述路由器发送第二动态密码；
    接收来自所述路由器的第一结果信号。
  8. 根据权利要求7所述的网络连接方法，其中，所述接收来自服务器的第二动态密码之后，还包括：
    所述移动终端根据所述第二动态密码生成第二主密钥；
    接收来自所述路由器的第一随机数并生成第二随机数；
    根据所述第一随机数、第二随机数及第二主密钥生成第一临时密钥；
    生成第三随机数并将所述第三随机数及所述第一临时密钥发送给所述路由器；
    接收来自所述路由器的第二结果信号。
  9. 根据权利要求8所述的网络连接方法，其中，所述生成第三随机数并将所述第三随机数及所述第一临时密钥发送给所述路由器之后，还包括：
    接收来自路由器的所述第二临时密钥；
    将所述第二临时密钥与所述第一临时密钥进行匹配；
    在比较匹配成功时向所述路由器发送认证确认消息；
    接受来自路由器的第三结果信号。
  10. 根据权利要7所述的网络连接方法，其中，所述图片信息包括识别码。
  11. 根据权利要求7所述的网络连接方法，其中，所述第一动态密码为数字密码、或者数字与字母组合的密码。
  12. 一种移动终端，其中，包括相互连接的存储器和处理器，其中，
    所述存储器用于存储实现如下步骤的程序指令；
    所述处理器用于执行所述存储器存储的所述程序指令时实现以下步骤：
    所述移动终端识别来自所述路由器的图片信息，在识别成功后向服务器发送第一请求信号，其中，所述图片信息包括识别码；
    接收来自服务器的第二动态密码；
    向所述路由器发送第二动态密码；
    接收来自所述路由器的第一结果信号。
  13. 根据权利要求12所述的移动终端，其中，所述接收来自服务器的第二动态密码之后，还包括：
    所述移动终端根据所述第二动态密码生成第二主密钥；
    接收来自所述路由器的第一随机数并生成第二随机数；
    根据所述第一随机数、第二随机数及第二主密钥生成第一临时密钥；
    生成第三随机数并将所述第三随机数及所述第一临时密钥发送给所述路由器；
    接收来自所述路由器的第二结果信号。
  14. 根据权利要求13所述的移动终端，其中，所述生成第三随机数并将所述第三随机数及所述第一临时密钥发送给所述路由器之后，还包括：
    接收来自路由器的所述第二临时密钥；
    将所述第二临时密钥与所述第一临时密钥进行匹配；
    在比较匹配成功时向所述路由器发送认证确认消息；
    接受来自路由器的第三结果信号。
  15. 根据权利要求12所述的移动终端，其中，所述第一动态密码为数字密码、或者数字与字母组合的密码。
  16. 一种路由器，其中，包括相互连接的存储器和处理器，其中，
    所述存储器用于存储实现如下步骤的程序指令；
    所述处理器用于执行所述存储器存储的所述程序指令时实现以下步骤：
    路由器接收来自服务器的第一动态密码；
    所述路由器接收来自移动终端的第二动态密码并将所述第二动态密码与所述第一动态密码进行匹配，其中，所述第二动态密码由所述服务器分配至所述移动终端；
    在匹配成功时建立连接并向移动终端发送第一结果信号；
    所述路由器在连接完成之后清除所述连接所产生的连接信息。
  17. 根据权利要求16所述的路由器，其中，所述路由器接收来自服务器的第一动态密码之后，还包括：
    所述路由器根据所述第一动态密码生成第一主密钥；
    所述路由器生成第一随机数并向移动终端发送所述第一随机数；
    接收来自移动终端的第三随机数及第一临时密钥并生成第四随机数；
    根据所述第三随机数、第四随机数及第一主密钥生成第二临时密钥；
    将所述第二临时密钥与所述第一临时密钥进行匹配；
    在匹配成功时建立连接并向移动终端发送第二结果信号。
  18. 根据权利要求17所述的路由器，其中，所述将所述第二临时密钥与所述第一临时密钥进行匹配之后，还包括：
    当匹配成功时，所述路由器向所述移动终端发送所述第二临时密钥；
    所述路由器接收来自移动终端的认证确认消息，建立连接并向移动终端发送第三结果信号。
  19. 根据权利要求17所述的路由器，其中，所述路由器根据所述第一动态密码生成第一主密钥的方式为：
    PMK=pbkdf2_shal（第一动态密码，SSID，SSID长度，4096）；
    其中，PMK为主密钥，SSID为路由器的地址；
    所述根据所述第三随机数、第四随机数及第一主密钥生成第二临时密钥的方式为：
    PTK=PRF-X（PMK，“Pairwise key expansion”,Min（AA，SA）||Max（AA，SA）|| Min（ANonce，SNonce）||Max（ANonce，SNonce））；
    其中，PTK为临时密钥，ANonce为所述路由器产生的随机数，SNonce为所述移动终端产生的随机数，AA为路由器的标识地址，SA为移动终端的标识地址，PRF-X为伪随机函数，Pairwise key expansion为常量字符串。
  20. 根据权利要求16所述的路由器，其中，所述第一动态密码为数字密码、或者数字与字母组合的密码。
PCT/CN2019/125051 2019-04-29 2019-12-13 路由器、网络连接方法及移动终端 WO2020220694A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US17/602,818 US20220159462A1 (en) 2019-04-29 2019-12-13 Router, network connection method and mobile terminal
EP19927153.7A EP3965445A4 (en) 2019-04-29 2019-12-13 ROUTER, NETWORK CONNECTION METHOD AND MOBILE TERMINAL

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910355810.1 2019-04-29
CN201910355810.1A CN110213760B (zh) 2019-04-29 2019-04-29 路由器、移动终端及其网路连接方法及存储介质

Publications (1)

Publication Number Publication Date
WO2020220694A1 true WO2020220694A1 (zh) 2020-11-05

Family

ID=67786714

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/125051 WO2020220694A1 (zh) 2019-04-29 2019-12-13 路由器、网络连接方法及移动终端

Country Status (4)

Country Link
US (1) US20220159462A1 (zh)
EP (1) EP3965445A4 (zh)
CN (1) CN110213760B (zh)
WO (1) WO2020220694A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110213760B (zh) * 2019-04-29 2022-02-11 惠州Tcl移动通信有限公司 路由器、移动终端及其网路连接方法及存储介质
US20230032967A1 (en) * 2021-07-29 2023-02-02 Red Hat, Inc. Establishing process connections utilizing an intermediary broker
CN113873485B (zh) * 2021-09-22 2024-04-23 联想(北京)有限公司 通信方法及通信系统
CN114500032B (zh) * 2022-01-24 2024-03-29 北京华云安信息技术有限公司 一种路由器调试模式的开启方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104394533A (zh) * 2014-11-24 2015-03-04 中国联合网络通信集团有限公司 无线保真WiFi连接方法、服务器及终端
WO2015089324A1 (en) * 2013-12-11 2015-06-18 Nantmobile, Llc Recognition-based authentication, systems and methods
CN106412897A (zh) * 2016-10-08 2017-02-15 西安瀚炬网络科技有限公司 基于服务器的WiFi认证方法
CN108111522A (zh) * 2017-12-28 2018-06-01 武汉长光科技有限公司 一种在onu上实现稳定安全普遍服务协议框架的方法
CN110213760A (zh) * 2019-04-29 2019-09-06 惠州Tcl移动通信有限公司 路由器、移动终端及其网路连接方法及存储介质

Family Cites Families (30)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1615380A1 (en) * 2004-07-07 2006-01-11 Thomson Multimedia Broadband Belgium Device and process for wireless local area network association
GB0507988D0 (en) * 2005-04-20 2005-05-25 Connect Spot Ltd Wireless access system
US8295851B2 (en) * 2005-08-03 2012-10-23 Michael Edward Finnegan Realtime, interactive and geographically defined computerized personal matching systems and methods
US20140355592A1 (en) * 2012-11-01 2014-12-04 Datavalet Technologies System and method for wireless device detection, recognition and visit profiling
US8898474B2 (en) * 2008-11-04 2014-11-25 Microsoft Corporation Support of multiple pre-shared keys in access point
US8331567B2 (en) * 2009-03-30 2012-12-11 Intel Corporation Methods and apparatuses for generating dynamic pairwise master keys using an image
WO2012035203A1 (en) * 2010-09-16 2012-03-22 Nokia Corporation Dynamic account creation with secured hotspot network
US20120284785A1 (en) * 2011-05-05 2012-11-08 Motorola Mobility, Inc. Method for facilitating access to a first access nework of a wireless communication system, wireless communication device, and wireless communication system
CN103249047B (zh) * 2012-02-10 2018-11-23 南京中兴新软件有限责任公司 无线局域网热点的接入认证方法及装置
US9161219B2 (en) * 2012-06-22 2015-10-13 Guest Tek Interactive Entertainment Ltd. Authorizing secured wireless access at hotspot having open wireless network and secure wireless network
US8977856B2 (en) * 2012-08-31 2015-03-10 Blackberry Limited Methods and apparatus for use in sharing credentials amongst a plurality of mobile communication devices
US20150229475A1 (en) * 2014-02-10 2015-08-13 Qualcomm Incorporated Assisted device provisioning in a network
US10057813B1 (en) * 2014-05-09 2018-08-21 Plume Design, Inc. Onboarding and configuring Wi-Fi enabled devices
CN104967997B (zh) * 2015-05-28 2019-02-01 Oppo广东移动通信有限公司 一种无线网路接入方法、Wi-Fi设备、终端设备及系统
CN106559814B (zh) * 2015-09-28 2020-02-18 腾讯科技（深圳）有限公司 连接无线接入点的方法和装置
CN104994118A (zh) * 2015-08-11 2015-10-21 吴培希 一种基于动态密码的WiFi认证系统及方法
US9853968B2 (en) * 2015-08-19 2017-12-26 Winifred Shen Systems and methods for authenticating users accessing a secure network with one-session-only, on-demand login credentials
US10034237B2 (en) * 2016-02-08 2018-07-24 Cisco Technology, Inc. System and method to facilitate hotspot onboarding for user equipment in a network environment
CN107040922B (zh) * 2016-05-05 2019-11-26 腾讯科技（深圳）有限公司 无线网络连接方法、装置及系统
US10334438B2 (en) * 2016-06-21 2019-06-25 ANI Technologies Private Limited System and method for creating and managing wireless networks
CN107659936A (zh) * 2016-07-25 2018-02-02 中兴通讯股份有限公司 一种控制WiFi接入设备的接入方法及装置
US11044240B2 (en) * 2016-08-01 2021-06-22 At&T Intellectual Property I, L.P. Method and system to manage access to a wireless local area network
CN106375999A (zh) * 2016-08-30 2017-02-01 福建联迪商用设备有限公司 一种WiFi快速连接的方法和装置
US11832100B2 (en) * 2017-05-16 2023-11-28 Apple Inc. Secure password sharing for wireless networks
US11689925B2 (en) * 2017-09-29 2023-06-27 Plume Design, Inc. Controlled guest access to Wi-Fi networks
CN107864475B (zh) * 2017-12-20 2021-05-28 中电福富信息科技有限公司 基于Portal+动态密码的WiFi快捷认证方法
CN108990062B (zh) * 2018-07-13 2022-03-08 全讯汇聚网络科技（北京）有限公司 智能安全Wi-Fi管理方法和系统
CN109548018B (zh) * 2019-01-11 2021-11-23 腾讯科技（深圳）有限公司 无线网络接入方法、装置、设备及系统
US11405789B1 (en) * 2019-02-12 2022-08-02 Amazon Technologies, Inc. Cloud-based secure wireless local area network (WLAN) group self-forming technologies
US11368994B1 (en) * 2020-03-02 2022-06-21 Amazon Technologies, Inc. Process for managing reconnections of devices in a network

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2015089324A1 (en) * 2013-12-11 2015-06-18 Nantmobile, Llc Recognition-based authentication, systems and methods
CN104394533A (zh) * 2014-11-24 2015-03-04 中国联合网络通信集团有限公司 无线保真WiFi连接方法、服务器及终端
CN106412897A (zh) * 2016-10-08 2017-02-15 西安瀚炬网络科技有限公司 基于服务器的WiFi认证方法
CN108111522A (zh) * 2017-12-28 2018-06-01 武汉长光科技有限公司 一种在onu上实现稳定安全普遍服务协议框架的方法
CN110213760A (zh) * 2019-04-29 2019-09-06 惠州Tcl移动通信有限公司 路由器、移动终端及其网路连接方法及存储介质

Also Published As

Publication number Publication date
US20220159462A1 (en) 2022-05-19
CN110213760B (zh) 2022-02-11
EP3965445A1 (en) 2022-03-09
CN110213760A (zh) 2019-09-06
EP3965445A4 (en) 2023-01-25

Similar Documents

Publication Publication Date Title
TWI672648B (zh) 業務處理方法、裝置、資料共享系統及儲存介質
US10798081B2 (en) Method, apparatus, and system for providing a security check
WO2022262078A1 (zh) 基于零信任安全的访问控制方法、设备及存储介质
WO2020220694A1 (zh) 路由器、网络连接方法及移动终端
WO2019184135A1 (zh) 一种应用登录方法、装置、计算机设备及存储介质
US11764966B2 (en) Systems and methods for single-step out-of-band authentication
US10944574B2 (en) Method for providing virtual asset service based on decentralized identifier and virtual asset service providing server using them
WO2016155497A1 (zh) 认证用户的方法及装置、注册可穿戴设备的方法及装置
US20160080157A1 (en) Network authentication method for secure electronic transactions
US10659226B2 (en) Data encryption method, decryption method, apparatus, and system
TW201805846A (zh) 身份認證方法、裝置和系統
US9154483B1 (en) Secure device configuration
JP2017532837A (ja) プレアソシエーションサービスディスカバリのためのシステムおよび方法
TW202134913A (zh) 判定認證能力之查詢系統、方法及非暫態機器可讀媒體
WO2019140790A1 (zh) 业务跟踪方法、装置、终端设备及存储介质
TWI522841B (zh) 多重伺服器環境下的匿名認證方法
US11409861B2 (en) Passwordless authentication
WO2018196686A1 (zh) 一种服务响应方法及其中间件
US11222099B2 (en) Methods, systems, and media for authenticating users using blockchains
TW201635177A (zh) 點對點連線及建立方法及其通訊系統
EP3794485B1 (en) Method and network node for managing access to a blockchain
CN114500082A (zh) 接入认证方法及装置、设备、服务器、存储介质和系统
US9985947B1 (en) Method and system for communication of devices using dynamic routes encoded in security tokens and a dynamic optical label
WO2024060696A1 (zh) 一种基于tee的智能家居远程控制方法及相关装置
WO2023241331A1 (zh) 物联网系统及其认证与通信方法、相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19927153

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019927153

Country of ref document: EP

Effective date: 20211129

ENP Entry into the national phase

Ref document number: 2019927153

Country of ref document: EP

Effective date: 20211129