WO2021134344A1 - 一种控制通信接入的方法、ap及通信设备 - Google Patents

一种控制通信接入的方法、ap及通信设备 Download PDF

Info

Publication number
WO2021134344A1
WO2021134344A1 PCT/CN2019/130176 CN2019130176W WO2021134344A1 WO 2021134344 A1 WO2021134344 A1 WO 2021134344A1 CN 2019130176 W CN2019130176 W CN 2019130176W WO 2021134344 A1 WO2021134344 A1 WO 2021134344A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication device
access
response message
shared key
information
Prior art date
Application number
PCT/CN2019/130176
Other languages
English (en)
French (fr)
Inventor
刘凯
郭湛
艾伟
杨艳江
梁文桥
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201980102414.6A priority Critical patent/CN114731513A/zh
Priority to PCT/CN2019/130176 priority patent/WO2021134344A1/zh
Publication of WO2021134344A1 publication Critical patent/WO2021134344A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication

Definitions

  • This application relates to the field of communication technologies, and in particular to a method, AP, and communication equipment for controlling communication access.
  • Wireless local area network (WLAN) communication technology and wireless-fidelity (wireless-fidelity, WiFi) communication technology have been widely promoted and applied.
  • WLAN/WiFi communication technology With the wide application of WLAN/WiFi communication technology, the security of wireless networks Sex is becoming more and more important.
  • the wireless security protocol enables the establishment of a secure communication channel between a station (STA) and an access point (AP). Since any person or organization can establish or set up a WiFi network, and the WiFi network is open to the STA, when the STA needs to access the WiFi network, it only needs to obtain the service set identifier (SSID) and access of the WiFi network The password is fine.
  • the SSID is broadcast by the AP, and the STA can search for the SSID broadcast by the AP when it is near the AP. That is, the STA can access the AP's WiFi network as long as it obtains the AP's access password.
  • malware STAs may obtain access passwords through brute force cracking, attacks, air interface packet capture analysis, and forgery, etc., so as to access the AP’s WiFi network through the access passwords. In this way, malicious STAs may be Access to other STAs in the WiFi network poses a threat.
  • This application provides a method for controlling communication access, an AP, and a communication device, which are used to improve the security of a communication device that accesses the AP.
  • this application provides a method for controlling communication access.
  • the method includes an AP receiving an authentication request message carrying identity authentication information of the first communication device from a first communication device, and responding to the authentication request message to The server sends the identity authentication information, so that the server authenticates the first communication device according to the identity authentication information of the first communication device, and receives the first response message fed back from the server. If the first response message indicates that the authentication is successful, it will send a message to the second communication device.
  • the communication device sends an authorization request message to request the second communication device to authorize the first communication device to access the AP; receives a second response message fed back by the second communication device in response to the authorization request message, and performs an operation on the first communication device according to the second response message. Access control; where the second communication device is a communication device that has been authorized to access the AP.
  • the server authenticates the identity authentication information of the first communication device, and it can be determined whether the identity authentication information of the first communication device is authentic and effective, thereby helping to ensure the authenticity of the communication device that accesses the AP. .
  • the second communication device that has been authorized to access the AP determines whether to authorize the access of the first communication device, which can further improve the security of the first communication device that accesses the AP. That is, in this application, the AP receives the first response message from the server indicating that the authentication is successful, and the second communication device authorizes the first communication device to access the AP before allowing the first communication device to access the AP. In this way, the security of communication devices that access the AP can be improved.
  • the identity authentication information may include the information of the universal subscriber identity module (USIM) or the identity (identifier, ID) of the first communication device.
  • USIM universal subscriber identity module
  • ID identity of the first communication device.
  • the AP rejects the access of the first communication device.
  • the server fails to authenticate the identity of the first communication device, indicating that the identity authentication information of the first communication device is invalid, that is, the first communication device may be a forged communication device.
  • the AP refuses to access the first communication device. In this way, it helps to improve the security of communication devices that access the AP.
  • the AP allows the first communication device to access; if the second response message includes information indicating that the first communication device is denied access to the AP , The AP refuses the access of the first communication device.
  • the present application provides a method for controlling communication access.
  • the method includes a second communication device receiving an authorization request message from an AP, and the second communication device responds to the received authorization request message and sending a second response message to the AP , Enabling the AP to perform access control on the first communication device according to the second response message; wherein, the second communication device is a communication device that has been authorized to access the AP.
  • the second communication device that has been authorized to access the AP determines whether to authorize the first communication device to access the AP, which can improve the security of the communication device that accesses the AP.
  • the second response message includes information indicating that the first communication device is authorized to access the AP or information that the first communication device is denied access to the AP.
  • the second communication device can be determined according to the blacklist and/or whitelist.
  • the authorization request message may include the ID of the first communication device; if the second communication device determines that the ID of the first communication device belongs to the ID in the preset whitelist, it will send to the AP including the instruction to authorize the first communication device.
  • a second response message for the information that a communication device accesses the AP if the second communication device determines that the ID of the first communication device belongs to the ID in the preset blacklist, it sends to the AP a message including an instruction to deny the first communication device to access the AP The second response message of the information.
  • Implementation manner 2 The second communication device can be determined according to the detected operation instruction.
  • the second communication device detects an operation instruction indicating that the first communication device is authorized to access the AP, it sends a second response message including information indicating that the first communication device is authorized to access the AP to the AP. ; If the second communication device detects an operation instruction that indicates that the first communication device is denied access to the AP, it sends to the AP a second response message that includes information indicating that the first communication device is denied access to the AP.
  • the present application provides a method for controlling communication access.
  • the method includes a server receiving identity authentication information of a first communication device sent by an AP in response to an authentication request, and the server responds to the identity authentication information of the first communication device according to the identity authentication information of the first communication device.
  • the identity authentication information of the first communication device is authenticated, and the first response message is fed back to the AP.
  • the identity authentication information of the first communication device is authenticated by the server, and it can be determined whether the identity authentication information of the first communication device is authentic and effective, that is, it helps to ensure that the first communication device that accesses the AP is valid. Authenticity.
  • the first response message may indicate that the authentication is successful or that the authentication has failed
  • the first communication device is a communication device that requests to access the AP.
  • the identity authentication information may include USIM information
  • the USIM information may include the first token and the international mobile subscriber identification number (IMSI)
  • IMSI international mobile subscriber identification number
  • the server receives the USIM information
  • the key corresponding to the IMSI can be determined, and the second token can be determined according to the key; if it is determined that the second token is consistent with the received first token, the first response message sent to the AP indicates that the authentication is successful; if the second is determined
  • the token is inconsistent with the received first token, and the first response message sent to the AP indicates that the authentication fails.
  • the present application provides a method for controlling communication access.
  • the method includes a second communication device receiving a third response message from a server, the third response message including shared key information for accessing the AP, and the second communication device When it is determined that the first communication device is allowed to access the AP, the shared key information is provided to the first communication device, where the second communication device is a communication device that has been authorized to access the AP.
  • the second communication device can determine whether to allow the first communication device to access the AP, and since the second communication device is a communication device that has been authorized to access the AP, this helps to improve communication access to the AP.
  • the security of the equipment The security of the equipment.
  • the shared key information can be provided in the form of a password or a two-dimensional code. In this way, it is convenient for the first communication device to quickly obtain the shared key information.
  • the shared key information is a password, after the password is used by the first communication device, even if it is leaked, other communication devices can no longer be used. In this way, the security of the communication device that accesses the AP can be further improved.
  • the following exemplarily shows two implementation manners in which the second communication device determines to allow the first communication device to access the AP.
  • the second communication device obtains the identification ID of the first communication device, and if the second communication device determines that the ID of the first communication device belongs to the ID in the preset whitelist, it provides the shared key information to the first communication device.
  • the second communication device If the second communication device detects an operation instruction indicating that the first communication device is authorized to access the AP, it provides the shared key information to the first communication device.
  • the present application provides a method for controlling communication access.
  • the method includes that a first communication device sends a request message for obtaining a shared key to a server through an AP, so as to request the server to generate a shared key for the first communication device to access the AP. Key information, the first communication device obtains the shared key information from the second communication device, and the first communication device accesses the AP through the shared key information, where the second communication device is a communication device that has been authorized to access the AP .
  • the second communication device can determine whether to allow the first communication device to access the AP, and since the second communication device is a communication device that has been authorized to access the AP, this helps to improve communication access to the AP.
  • the security of the equipment The security of the equipment.
  • the first communication device may scan the two-dimensional code provided by the second communication device to obtain the shared key information for accessing the AP.
  • the first communication device may obtain the shared key information for accessing the AP by copying the password provided by the second communication device.
  • the request message for obtaining the shared key includes the ID of the first communication device.
  • the present application provides a method for controlling communication access.
  • the method includes a server receiving a request message for obtaining a shared key from an AP, and the server responding to the request message for obtaining a shared key, generating a shared key for accessing the AP And send a third response message to the second communication device.
  • the third response message includes the shared key information for accessing the AP, and the second communication device is a communication device that has been authorized to access the AP.
  • the server sends the shared key information for accessing the AP to the second communication device, and the second communication device determines whether to allow the first communication device to access the AP, and because the second communication device is authorized to access the AP Communication equipment. In this way, it is helpful to improve the security of the first communication device accessing the AP.
  • the present application provides an AP, which has the function of implementing the AP in the first aspect.
  • This function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above-mentioned functions.
  • the communication device may be an AP, or a module that can be used in the AP, such as a chip or a chip system or a circuit.
  • the beneficial effects can be referred to the description of the first aspect above, which will not be repeated here.
  • the communication device may include a transceiver and a processor.
  • the processor may be configured to support the communication device to perform corresponding functions of the AP shown above, and the transceiver is used to support communication between the communication device and the first communication device, the second communication device, the server, and the like.
  • the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.
  • the communication device may further include a memory, and the memory may be coupled with the processor, which stores program instructions and data necessary for the communication device.
  • the transceiver is used to receive an authentication request message from the first communication device.
  • the authentication request message carries the identity authentication information of the first communication device.
  • the transceiver sends the identity authentication information of the first communication device to the server so that the server The first communication device is authenticated according to the identity authentication information, and the first response message fed back from the server is received; if the first response message indicates that the authentication is successful, an authorization request message is sent to the second communication device to request the second communication device Authorize the first communication device to access the AP, and receive the second response message fed back by the second communication device in response to the authorization request message; the processor is configured to perform access control on the first communication device according to the second response message, and the second communication device is The communication device authorized to access the AP.
  • the identity authentication information includes USIM information or the ID of the first communication device.
  • the processor is further configured to reject the access of the first communication device.
  • the second response message includes information indicating that the first communication device is authorized to access the AP, or information indicating that the first communication device is denied access to the AP. If the second response message includes information indicating that the first communication device is authorized to access the AP, the processor is specifically configured to allow the first communication device to access; if the second response message includes information indicating that the first communication device is denied access to the AP, processing The device is specifically used to deny the access of the first communication device.
  • the present application provides a communication device that has the function of implementing the second communication device in the second aspect or the second communication device in the fourth aspect or the first communication device in the fifth aspect.
  • This function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above-mentioned functions.
  • the communication device may be a second communication device, or a first communication device, or a module that can be used in the second communication device, such as a chip or a chip system or circuit, or may be used in the first communication device. Modules of communication equipment.
  • the communication device may include a transceiver and a processor.
  • the processor may be configured to support the communication device to perform corresponding functions of the second communication device or the first communication device shown above, and the transceiver is used to support communication between the communication device and other communication devices, APs, and the like.
  • the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.
  • the communication device may further include a memory, and the memory may be coupled with the processor, which stores program instructions and data necessary for the communication device.
  • the communication device has the function of realizing the second communication device in the above second aspect, and the beneficial effects can be referred to the description of the above second aspect, which will not be repeated here.
  • the transceiver is used to receive the authorization request message from the access point AP, the communication device is a communication device that has been authorized to access the AP; the processor cooperates with the transceiver to respond to the authorization request message and send a second response message to the AP, so that The AP performs access control on the first communication device according to the second response message.
  • the authorization request message may include the ID of the first communication device.
  • the processor cooperates with the transceiver to be specifically configured to: if the processor determines that the ID of the first communication device belongs to the ID in the preset whitelist, the transceiver sends to the AP an instruction including an instruction to authorize the first communication device.
  • the processor cooperates with the transceiver to be specifically configured to: if the processor detects an operation instruction indicating that the first communication device is authorized to access the AP, the transceiver sends to the AP an instruction including an instruction to authorize the first communication The second response message of the information that the device accesses the AP; if the processor detects the operation instruction indicating that the first communication device is denied access to the AP, the transceiver sends to the AP the second response message including the information indicating that the first communication device is denied access to the AP 2. Response message.
  • the second communication device has the function of realizing the second communication device in the foregoing fourth aspect.
  • the foregoing fourth aspect and details are not described herein again.
  • the transceiver is used to receive a third response message from the server.
  • the third response message includes the shared key information for accessing the AP.
  • the communication device is a communication device that has been authorized to access the AP; the processor is used to determine that the first communication device is allowed to access the AP. When entering the AP, the shared key information for accessing the AP is provided to the first communication device.
  • the processor is specifically configured to generate a two-dimensional code or a password according to the shared key information;
  • the communication device further includes a display, and the display is configured to display the two-dimensional code or the password to the first communication device.
  • the processor is specifically configured to obtain the identification ID of the first communication device; if it is determined that the ID of the first communication device belongs to the ID in the preset whitelist, then provide the shared key to the first communication device information.
  • the processor is specifically configured to provide the shared key information to the first communication device if an operation instruction indicating that the first communication device is authorized to access the AP is detected.
  • the communication device has the function of realizing the first communication device in the above fifth aspect, and the beneficial effects can be referred to the description of the above fifth aspect, which will not be repeated here.
  • the transceiver is used to send a request message for obtaining a shared key to the server through the access point AP, so as to request the server to generate shared key information for the communication device to access the AP; the processor is used to obtain the shared secret key for accessing the AP from the second communication device The key information is used to access the AP through the shared key information of the access AP, and the second communication device is a communication device that has been authorized to access the AP.
  • the processor is specifically configured to scan the two-dimensional code provided by the second communication device to obtain the shared key information for accessing the AP; or it can obtain the access by copying the password provided by the second communication device.
  • the shared key information of the incoming AP is specifically configured to scan the two-dimensional code provided by the second communication device to obtain the shared key information for accessing the AP; or it can obtain the access by copying the password provided by the second communication device.
  • the request message for obtaining the shared key includes the ID of the communication device.
  • the present application provides a server that has the function of realizing the server in the third aspect or the server in the sixth aspect.
  • This function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units or modules corresponding to the above-mentioned functions.
  • the server may include: a transceiver and a processor.
  • the processor may be configured to support the server to perform the corresponding functions of the server shown above, and the transceiver is used to support communication between the server and the AP.
  • the transceiver may be an independent receiver, an independent transmitter, a transceiver with integrated transceiver functions, or an interface circuit.
  • the communication device may further include a memory, and the memory may be coupled with the processor, which stores program instructions and data necessary for the communication device.
  • the server has the function of realizing the server in the above third aspect.
  • the introduction of the above third aspect please refer to the introduction of the above third aspect, which will not be repeated here.
  • the transceiver is used for the identity authentication information of the first communication device from the AP
  • the processor is used for authenticating the identity authentication information of the first communication device according to the identity authentication information of the first communication device
  • the transceiver is also used for sending the first communication device to the AP.
  • a response message indicates that the authentication is successful or that the authentication fails, and the first communication device is a communication device that requests to access the AP.
  • the identity authentication information includes USIM information
  • the USIM information includes a first token and an IMSI.
  • the processor is specifically configured to determine the key corresponding to the IMSI and determine the second token according to the key; If the second token is consistent with the received first token, the first response message sent by the transceiver to the AP indicates that the authentication is successful; if it is determined that the second token is inconsistent with the received first token, the received first token will be sent to the AP through the transceiver The first response message indicates that the authentication failed.
  • the server has the function of realizing the server in the above-mentioned sixth aspect, and the beneficial effects can be referred to the introduction of the above-mentioned sixth aspect, which will not be repeated here.
  • the transceiver is used to receive a request message for obtaining a shared key from the AP, and the processor is used to respond to the request message for obtaining a shared key, generate shared key information for accessing the AP, and send a third response to the second communication device through the transceiver Message, the third response message includes shared key information for accessing the AP, and the second communication device is a communication device that has been authorized to access the AP.
  • the present application provides an AP, which is used to implement the first aspect or any one of the methods in the first aspect, and includes corresponding functional modules, which are respectively used to implement the steps in the above methods.
  • the function can be realized by hardware, or the corresponding software can be executed by hardware.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the AP may include a processing module and a transceiver module, and these modules may perform corresponding functions of the terminal device in the foregoing method example.
  • these modules may perform corresponding functions of the terminal device in the foregoing method example.
  • processing module and a transceiver module, and these modules may perform corresponding functions of the terminal device in the foregoing method example.
  • transceiver module may perform corresponding functions of the terminal device in the foregoing method example.
  • this application provides a communication device, which is used to implement any one of the foregoing second aspect or the second aspect, or is used to implement any one of the foregoing fourth aspect or the fourth aspect, Or it is used to implement the fifth aspect or any one of the methods in the fifth aspect, including corresponding functional modules, which are respectively used to implement the steps in the above methods.
  • the function can be realized by hardware, or the corresponding software can be executed by hardware.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the communication device may be a first communication device or a second communication device, and the first communication device or the second communication device may include a processing module and a transceiver module, and these modules can perform the above method examples.
  • the first communication device or the second communication device may include a processing module and a transceiver module, and these modules can perform the above method examples.
  • the terminal device For the corresponding functions of the terminal device, refer to the detailed description in the method example for details, which will not be repeated here.
  • the present application provides a server for implementing any one of the foregoing third aspect or the third aspect, or for implementing any one of the foregoing sixth aspect or the sixth aspect, including
  • the corresponding functional modules are respectively used to implement the steps in the above method.
  • the function can be realized by hardware, or the corresponding software can be executed by hardware.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the present application provides a communication system, which includes a first communication device, a second communication device, an AP, and a server.
  • the AP can be used to execute any one of the aforementioned first aspect or the first aspect
  • the second communication device can be used to execute any one of the aforementioned second aspect or the second aspect
  • the server can be used to execute the third aspect or any one of the methods in the third aspect.
  • the second communication device may be used to perform any one of the foregoing fourth aspect or the fourth aspect
  • the first communication device may be used to perform the foregoing fifth aspect or the fifth aspect.
  • the server can be used to execute any method in the sixth aspect or the sixth aspect described above.
  • this application provides a computer-readable storage medium in which a computer program or instruction is stored.
  • the computer program or instruction is executed by an AP, the AP executes the first aspect or the first aspect described above.
  • the method in any possible implementation of the aspect.
  • this application provides a computer-readable storage medium in which a computer program or instruction is stored.
  • the communication device executes the second aspect or The method in any possible implementation manner of the second aspect, or causes the communication device to execute the method in the fourth aspect or any possible implementation manner of the fourth aspect, or causes the communication device to execute the fifth aspect or the fifth aspect Any possible implementation method.
  • this application provides a computer-readable storage medium in which a computer program or instruction is stored.
  • the server executes the third aspect or the third aspect.
  • the method in any possible implementation manner of the aspect, or the communication device is caused to execute the sixth aspect or the method in any possible implementation manner of the sixth aspect.
  • this application provides a computer program product that includes a computer program or instruction, and when the computer program or instruction is executed by an AP, the first aspect or any possible implementation manner of the first aspect is implemented In the method.
  • this application provides a computer program product that includes a computer program or instruction, and when the computer program or instruction is executed by a communication device, it realizes the second aspect or any possible implementation of the second aspect.
  • the method in the manner, or the communication device is caused to execute the method in the fourth aspect or any possible implementation manner of the fourth aspect, or the communication device is caused to execute the method in the fifth aspect or any possible implementation manner of the fifth aspect .
  • this application provides a computer program product that includes a computer program or instruction, and when the computer program or instruction is executed by a server, the third aspect or any possible implementation manner of the third aspect is implemented Or implement the sixth aspect or any possible implementation manner of the sixth aspect.
  • Figure 1 is a schematic diagram of a communication system architecture provided by this application.
  • FIG. 2 is a schematic flowchart of a method for controlling communication access provided by this application
  • FIG. 3 is a schematic flowchart of a method for a communication device to access an AP provided by this application;
  • FIG. 4 is a schematic flowchart of another method for controlling communication access provided by this application.
  • FIG. 5 is a schematic structural diagram of an AP provided by this application.
  • FIG. 6 is a schematic structural diagram of an AP provided by this application.
  • FIG. 7 is a schematic structural diagram of a communication device provided by this application.
  • FIG. 8 is a schematic structural diagram of a communication device provided by this application.
  • FIG. 9 is a schematic structural diagram of a terminal device provided by this application.
  • FIG. 1 is a schematic diagram of the architecture of a communication system applicable to this application.
  • the communication system may include an access point (AP) 101 and at least one station (STA) (FIG. 1 takes STA102 and STA103 as examples).
  • WLAN/WiFi communication can be carried out between AP101 and STA102, and between AP101 and STA103.
  • the STA103 may be a fixed location, or it may be movable. This application does not limit the number of APs and STAs included in the communication system.
  • the communication system can be used for single-user uplink and downlink transmission; if the AP and multiple STAs perform WLAN communication, the communication system can also be used for multi-user uplink and downlink transmission.
  • the communication system may further include a server 104. It should be noted that the server 104 may also be a virtual server, which may be integrated in the AP.
  • APs are also called wireless access points or hotspots. They are the communication bridge between the wireless network and the wired network, and are the core equipment for building a wireless local area network. It is mainly used to provide mutual access between STAs and wired LANs. STAs within the signal coverage area of the AP can communicate with each other through the AP. In other words, the AP is the access point for the STA to enter the wired network.
  • APs can be deployed in homes, buildings, and campuses, with a typical coverage radius of tens of meters to hundreds of meters. Of course, it can also be deployed outdoors.
  • the AP can be a base station (base station), evolved base station (evolved NodeB, eNodeB), transmission reception point (TRP), next generation NodeB (gNB) in 5G communication system, and future communication system
  • the base station or the access point in the Wi-Fi system can also be a module or unit that completes part of the functions of the base station.
  • it can be a centralized unit (CU) or a distributed unit (distributed unit). ,DU); It can also be a router; it can also be a switch; it can also be a bridge; it can also be a wireless gateway; it can also be an STA, etc.
  • This application does not limit the specific technology and specific device form adopted by the AP.
  • the AP may support the 802.11ax protocol; further optionally, the AP may support multiple WLAN protocols such as 802.11ac, 802.11n, 802.11g, 802.11b, and 802.11a.
  • STAs are communication devices connected to the wireless network, such as wireless communication chips, terminal devices, etc.; among them, terminal devices can also be called terminals, user equipment (UE), mobile stations, and mobile terminals Wait.
  • Terminal equipment can be mobile phones, tablet computers, computers with wireless transceiver functions, virtual reality terminal equipment, augmented reality terminal equipment, wireless terminals in industrial control, wireless terminals in unmanned driving, wireless terminals in remote surgery, and smart grids Wireless terminals in the Internet, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, and so on. This application does not limit the specific technology and specific device form adopted by the terminal device.
  • the wireless terminal may be a terminal capable of running a subscriber identity module (SIM) card or a virtual SIM card.
  • SIM subscriber identity module
  • the STA may support the 802.11ax protocol; further optionally, the STA may support multiple WLAN protocols such as 802.11ac, 802.11n, 802.11g, 802.11b, and 802.11a.
  • the AP and the STA can communicate through the 2.4 gigahertz (gigahertz, GHz) frequency spectrum, communicate through the 5 GHz frequency spectrum, or communicate through the 60 GHz frequency spectrum.
  • This application does not limit the spectrum resources used between the AP and the STA.
  • the communication system shown in Figure 1 can be applied to the WiFi network of a smart home.
  • AP 101 can be a router
  • STA 102 and STA 103 can be wireless terminals in a smart home, such as mobile phones, tablets, laptops, smart refrigerators, Smart air conditioners, etc.
  • a new wireless terminal needs to access the WiFi network of the smart home. For example, when a guest visits, the guest's mobile phone may need to access the WiFi network of the smart home.
  • BSS Basic service set
  • BSS is used to describe a group of mobile devices that communicate with each other in an 802.11WLAN.
  • a BSS may include AP (Access Point) or not.
  • AP Access Point
  • IBSS independent BSS
  • workstations can communicate directly with each other, but the distance between the two must be within the range of direct communication.
  • the other is the infrastructure BSS, which includes an AP and several mobile stations.
  • SSID can divide a wireless local area network into several sub-networks that require different authentication. Each sub-network needs independent authentication. Only users who pass the authentication can enter the corresponding sub-network to prevent unauthorized users from entering The internet.
  • IMSI is an identification code that is used to distinguish different users in a cellular network and is not repeated in all cellular networks.
  • the mobile phone can store the IMSI in a 64-bit field and send it to the network.
  • IMSI can be used to query user information in a home location register (HLR) or a visitor location register (VLR).
  • HLR home location register
  • VLR visitor location register
  • the USIM is also called upgraded SIM.
  • the USIM has upgraded the algorithm in the direction of security and added the function of the card to access the network to the AP. This two-way authentication can effectively prevent hackers from attacking the card.
  • QR code is a two-dimensional code that can store information. It can be obtained by encrypting text, uniform resource locator (URL) addresses, and other types of data.
  • URL uniform resource locator
  • each password can only be used once.
  • the shared key is used to verify the Unicode string of the Layer 2 Tunneling Protocol (L2TP)/Internet Protocol Security (IPSec) connection. Users can enter the same pre-configured key to access the network.
  • the key can be 8 to 63 ASCII characters, or 64 16-bit numbers (256 bits).
  • the AP may be AP101 in FIG. 1 and the STA may be STA102 or STA103 in FIG. 1.
  • the first communication device may be a communication device to be connected to the WiFi network of the smart home, for example, to a visitor’s mobile phone; the second communication device may be a smart home’s Any communication device in the WiFi network that has been authorized to access the AP, for example, the host's mobile phone.
  • access to AP refers to the network that accesses the AP or the BSS that accesses the AP.
  • the access of the first communication device to the AP refers to the network where the first communication device accesses the AP or the BSS where the first communication device accesses the AP.
  • the access of the second communication device to the AP means that the second communication device accesses the AP's network or the second communication device accesses the BSS of the AP.
  • the method for controlling communication access includes:
  • Step 200 The second communication device accesses the AP.
  • This step 200 may be an optional step.
  • the second type of communication device can access the AP through multiple permissions.
  • the second communication device can use certificate encryption to access the AP.
  • the second communication device has high authority; for another example, the second communication device can access the AP by using a dedicated password.
  • the second communication device When accessing the AP based on a dedicated password, the second communication device has a medium-level authority.
  • the second communication device accesses the AP through a dedicated password or certificate encryption. On the one hand, it can ensure that the second communication device is a communication device that has been authorized to access the AP; on the other hand, for the AP, the second communication device is safe.
  • Step 201 The first communication device sends an authentication request message to the AP.
  • the AP receives the authentication request message from the first communication device.
  • the authentication request message carries identity authentication information of the first communication device, and the identity authentication information can uniquely identify the first communication device.
  • the identity authentication information of the first communication device may include the SIM information of the first communication device, such as USIM information; or the identity authentication information of the first communication device may include the ID of the first communication device, For example, the ID generated by the first communication device through a specific application, or account information generated based on the Huawei system. It is understandable that which identity authentication information the first communication device chooses may be pre-appointed by the first communication device and the server, or may be determined by the first communication device and notified to the server, or may be stipulated by the agreement. This application does not limit this.
  • Step 202 The AP sends the identity authentication information of the first communication device to the server in response to the authentication request message.
  • the server receives the identity authentication information of the first communication device from the AP.
  • the identity authentication information of the first communication device can be used by the server to authenticate the identity authentication information of the first communication device.
  • the authentication request message may only include the identity authentication information of the first communication device, and the AP may directly forward the authentication request message to the server in response to the authentication request message.
  • the authentication request message may include the identity authentication information and supported encryption mode of the first communication device, etc.
  • the AP responds to the authentication request message, and the first communication device in the authentication request message may be included in the authentication request message.
  • the identity authentication information is sent to the server.
  • Step 203 The server may authenticate the first communication device according to the identity authentication information.
  • the following exemplarily provides two ways for the server to authenticate the first communication device.
  • the identity authentication information of the first communication device is information of the SIM card of the first communication device.
  • the information of the SIM card is the information of the USIM
  • the information of the USIM may include a first token and an IMSI, where the first token is calculated by the USIM through a preset key.
  • the server may be a telecommunication operator server.
  • the relationship between the IMSI of the issued USIM and the key is stored in the telecommunication operator server.
  • the authentication process of the server to the first communication device includes: after the server receives the USIM information of the first communication device (that is, the first token and IMSI), it determines the key corresponding to the IMSI, and determines according to the key For the second token, for example, the determined key can be calculated by the first encryption algorithm to obtain the second token. If it is determined that the received first token is consistent with the calculated second token, the server determines that the authentication of the first communication device is successful, that is, the identity authentication information of the first communication device is true and effective. If it is determined that the received first token is inconsistent with the calculated second token, the server determines that the authentication of the first communication device has failed. That is, the identity authentication information of the first communication device is untrue. It should be understood that the first encryption algorithm may be agreed upon by the server and the first communication device, or the server may notify the first communication device after determining, which is not limited in this application.
  • the identity authentication information of the first communication device is the ID of the first communication device. Further, optionally, the identity authentication information of the first communication device may further include first verification information.
  • the server may be a Huawei server.
  • the first verification information may be determined by the first communication device according to the ID (ie account information) of the first communication device.
  • the first communication device may use the second encryption algorithm to verify the first verification information.
  • the first verification information calculated from the ID (namely account information) of the communication device.
  • the second encryption algorithm may be pre-appointed by the Huawei server and the first communication device, or the Huawei server may notify the first communication device after determining the second encryption algorithm, which is not limited in this application.
  • the authentication process of the server to the first communication device includes: after the server receives the ID (account information) of the first communication device, it calculates the ID of the first communication device through a second encryption algorithm to obtain the second Verification information; if it is determined that the received first verification information is consistent with the calculated second verification information, the server determines that the authentication of the first communication device is successful. If it is determined that the received first verification information is inconsistent with the calculated second verification information, the server determines that the authentication of the first communication device fails.
  • the server may be a server that supports authentication services.
  • the ID of the first communication device is an ID generated by a specific application, for example, an ID generated based on information such as the MAC address and time of the first communication device; the server may also be a server that supports authentication services.
  • the authentication process of the first communication device by the server supporting the authentication service please refer to the authentication process of the first communication device by the Huawei server, which will not be repeated here.
  • the first encryption algorithm may be hash message authentication code (HMAC)-message-digest algorithm (MD)5, HMAC-secure hash algorithm (SHA) 1. HMAC-SHA256, HMAC-SHA512, etc.
  • HMAC hash message authentication code
  • MD hash message authentication code
  • SHA HMAC-secure hash algorithm
  • HMAC-SHA256 HMAC-SHA512, etc.
  • the above-mentioned second encryption algorithm may be the same as or different from the first encryption algorithm, which is not limited in this application.
  • the authentication of the first communication device by the server can ensure that the identity authentication information of the first communication device is authentic and effective, thereby effectively preventing illegal communication devices from accessing the AP.
  • Step 204 The server feeds back the first response message to the AP.
  • the AP receives the first response message fed back from the server.
  • the first response message indicates that the authentication fails or indicates that the authentication succeeds. It can also be understood that if the server successfully authenticates the first communication device based on the above step 203, the first response message indicates that the authentication is successful; if the server fails to authenticate the first communication device based on the above step 203, the first response message Indicates that authentication failed.
  • the first response message may be 1 bit, for example, "0" indicates authentication failure, and "1" indicates authentication success.
  • the first response message can also indicate the authentication success or authentication failure in other ways, which is not limited in this application.
  • step 204 if the first response message indicates that the authentication is successful, step 205 is executed; if the first response message indicates that the authentication failed, step 206 is executed.
  • Step 205 The AP sends an authorization request message to the second communication device.
  • the second communication device receives the authorization request message from the AP.
  • Step 207 is executed after step 205.
  • the authorization request message is used to request the second communication device to authorize the first communication device to access the AP.
  • the authorization request message may include the ID of the first communication device, for example, the MAC address of the first communication device, or for example, the identity certificate information of the first communication device.
  • Step 206 The AP rejects the access of the first communication device.
  • the AP may send an authentication failure message to the first communication device to notify the first communication device that the authentication has failed. In other words, the AP does not allow the first communication device to access.
  • Step 207 In response to the authorization request message, the second communication device feeds back the second response message to the AP. Correspondingly, the AP receives the second response message fed back from the second communication device.
  • the second response message includes information indicating that the first communication device is authorized to access the AP, or information indicating that the first communication device is denied access to the AP. It can also be understood that if the second communication device authorizes the first communication device to access the AP, the second response message includes information indicating that the first communication device is authorized to access the AP; if the second communication device denies the first communication device to access the AP Corresponding network, the second response message includes information indicating that the first communication device is denied access to the AP.
  • the information indicating that the first communication device is authorized to access the AP may be 2 bits.
  • “11” indicates that the information indicating that the first communication device is denied access to the AP may be 2 bits, such as "00". This is not limited.
  • a preset blacklist and whitelist may be stored in the second communication device.
  • the authorization request message includes the ID of the first communication device, and if the second communication device determines that the standard ID of the first communication device included in the authorization request message is on the whitelist, it sends to the AP a message including instructions to authorize the first communication device to access the AP.
  • the second response message of the information if the second communication device determines that the ID of the first communication device included in the authorization request message is on the blacklist, it sends a second response including information indicating that the first communication device is denied access to the AP to the AP news.
  • the whitelist can be set to identify the smart home in the home, which can be the MAC address of the smart home, etc. In this way, it helps to avoid the need for the owner to determine whether to authorize each time the smart home accesses the WiFi network in the smart home.
  • the second communication device may display the ID of the first communication device on the interface, and the user using the second communication device may display the ID of the first communication device based on the ID of the first communication device displayed on the second communication device.
  • the interface can display "authorize” and "reject” prompt information buttons; if the second communication device detects an operation instruction indicating that the first communication device is authorized to access the AP, then Send a second response message to the AP that includes the information indicating that the first communication device is authorized to access the AP; if the second communication device detects an operation instruction that indicates that the first communication device is denied access to the AP, it will send to the AP including the instruction to deny the first communication device. The second response message for the information that the communication device accesses the AP.
  • Step 208 The AP performs access control on the first communication device according to the second response message.
  • the AP if the second response message includes information indicating that the first communication device is authorized to access the AP, the AP allows the first communication device to access the AP; if the second response message includes information indicating that the first communication device is denied access to the AP, The AP refuses the first communication device to access the AP.
  • step 201 to step 208 above it can be seen that by authenticating the identity authentication information of the first communication device through the server, it can be determined whether the identity authentication information of the first communication device is authentic and effective, which is helpful to ensure access The authenticity of AP's communication equipment. Further, determining whether to authorize the first communication device to access the AP through the second communication device that has been authorized to access the AP can further improve the security of the communication device that accesses the AP. In other words, the AP only allows the first communication device to access the AP after receiving the first response message fed back by the server indicating that the authentication is successful, and receiving the second communication device authorizing the first communication device to access the AP. In this way, the security of communication devices that access the AP can be improved.
  • the first communication device can access the AP based on a four-way handshake.
  • WiFi protected access WiFi protected acces, WPA
  • WPA2-pre-sharing A pre-shared key (PSK) is taken as an example, and is a schematic flowchart of a method for a communication device to access an AP provided in this application. The method includes the following steps:
  • Step 301 The AP sends a first random number (ANonce) to the first communication device.
  • the first communication device receives the first random number (ANonce) from the AP.
  • the first communication device may generate a pairwise transient key (PTK) according to the ANonce.
  • PTK pairwise transient key
  • Step 302 The first communication device sends a second random number (SNonce) and a key confirmation key (key confirmation key, MIC) to the AP.
  • the AP receives SNonce and MIC from the first communication device.
  • the AP performs integrity verification on the received MIC and the generated MIC. If the verification fails, the handshake fails; if the verification succeeds, the AP can generate a PTK and a group transient key (GTK) according to SNonce.
  • GTK group transient key
  • Step 303 The AP sends GTK and MIC to the first communication device.
  • the AP will encrypt the GTK with a key encryption key (KEK).
  • KEK key encryption key
  • Step 304 The first communication device sends an acknowledge character (acknowledge character, ACK) to the AP for confirmation.
  • acknowledge character acknowledge character
  • the four-way handshake is completed, and the first communication device accesses the AP.
  • the flow of the method for the communication device to access the AP shown in FIG. 3 is only an exemplary description, and the first communication device may also access the AP in other ways, which is not limited in this application.
  • FIG. 4 it is a schematic flowchart of another method for controlling communication access provided by this application.
  • the method includes the following steps:
  • Step 400 The second communication device accesses the AP.
  • This step 400 is an optional step.
  • Step 401 The first communication device sends a request message for obtaining a shared key to the server through the AP.
  • the server receives a request message for obtaining the shared key from the AP.
  • the request message for acquiring the shared key is used to request the server to generate shared key information for the first communication device to access the AP.
  • This step 401 can also be understood as that the first communication device sends a request message for obtaining the shared key to the AP, and the AP may forward the request message for obtaining the shared key to the server.
  • the request message for obtaining the shared key includes the ID of the first communication device, such as the MAC address of the first communication device, or the ID generated by the first communication device through a specific application, such as Based on account information generated by the Huawei system, or other ID that can uniquely identify the first communication device.
  • ID the first communication device may be pre-arranged by the first communication device and the server, or it may be determined by the first communication device and notified to the server, or it may be a protocol As stipulated, this application does not limit this.
  • Step 402 In response to the request message for obtaining the shared key, the server generates shared key information for accessing the AP.
  • This step 402 is an optional step.
  • the server may generate shared key information for accessing the AP according to the ID of the first communication device included in the request message for obtaining the shared key, and the shared key information includes the access password for accessing the AP. .
  • the server may use a key generation algorithm, such as the HMAC-SHA 256 algorithm, to calculate the ID of the first communication device to generate shared key information for the first communication device to access the AP.
  • a key generation algorithm such as the HMAC-SHA 256 algorithm
  • Step 403 The server sends a third response message to the second communication device.
  • the second communication device receives the third response message from the server.
  • the third response message includes shared key information for accessing the AP.
  • Step 404 When the second communication device determines that the first communication device is allowed to access the AP, it provides the first communication device with shared key information for accessing the AP.
  • the second communication device obtains the identification ID of the first communication device, and if the second communication device determines that the ID of the first communication device belongs to the ID in the preset whitelist, it provides the shared key information to the first communication device.
  • the second communication device If the second communication device detects an operation instruction indicating that the first communication device is authorized to access the AP, it provides the shared key information to the first communication device.
  • the second communication device can authorize or deny operations on the interface.
  • the interface can display "authorize” and "reject” prompt information buttons.
  • Preset legal tokens in the first communication device and the second communication device are preset legal tokens in the first communication device and the second communication device.
  • the second communication device determines that the locally preset token and the token received from the first communication device have been received, it is determined to allow the first communication
  • the device is connected to the AP.
  • the second communication device may generate a two-dimensional code or a password according to the shared key information for accessing the AP, where the two-dimensional code may be a QR code, and the password may be a string password.
  • the second communication device may display a two-dimensional code or a character string password on the interface of the second communication device.
  • the shared key information is a password
  • the password is used by the first communication device, even if it is leaked, other communication devices can no longer be used. In this way, the security of the communication device that accesses the AP can be further improved.
  • Step 405 The first communication device obtains shared key information for accessing the AP from the second communication device.
  • the first communication device can scan the two-dimensional code displayed by the second communication device to obtain the shared key information for accessing the AP. If the second communication device displays the string password, the first communication device can obtain the shared key information for accessing the AP by copying the string password.
  • Step 406 The first communication device accesses the AP through the shared key information of the access AP.
  • the AP can obtain the shared key information from the server. For example, after determining the shared key information between the first communication device and the AP, the server sends the shared key information to the AP. After the AP and the first communication device both obtain the shared key information, the first communication device can access the AP through the shared key information. It should be noted that the shared key information for the first communication device to access the AP is also determined by the server.
  • the second communication device can determine whether to allow the first communication device to access the AP, and because the second communication device is a communication device that has been authorized to access the AP, this helps to improve The security of the communication equipment that accesses the AP.
  • the second communication device may send the authentication strategy supported by the second communication device to the server, and the server may determine one of the authentication strategies supported by the second communication device as the first authentication strategy.
  • the authentication strategy between the communication device and the AP facilitates the first communication device to access the AP.
  • the authentication strategy includes WPA, WPA2, WPA3 or other private encryption authentication protocols.
  • the authentication strategy between the AP and the first communication device may also be pre-appointed, which is not limited in this application.
  • the communication device and the server include corresponding hardware structures and/or software modules that perform each function.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application scenarios and design constraints of the technical solution.
  • Figures 5 and 6 are schematic diagrams of the structure of possible APs provided by this application. These APs can be used to implement the APs in the foregoing method embodiments, and therefore can also achieve the beneficial effects of the foregoing method embodiments.
  • the communication device may be AP101 as shown in FIG. 1, or a module (module such as a chip) applied to the communication device or AP.
  • the communication device 500 includes a processing module 501 and a transceiver module 502.
  • the communication device 500 is configured to implement the function of the AP in the method embodiment shown in FIG. 2, FIG. 3, or FIG. 4 above.
  • the transceiver module 502 is used to receive an authentication request message from the first communication device, and the authentication request message carries the identity of the first communication device Authentication information; in response to the authentication request message, send the identity authentication information of the first communication device to the server, so that the server can authenticate the identity authentication information of the first communication device; receive the first response message fed back from the server, if the first response If the message indicates that the authentication is successful, an authorization request message is sent to the second communication device to request the second communication device to authorize the first communication device to access the AP, and to receive a second response message fed back from the second communication device in response to the authorization request message.
  • the second communication device is a communication device that has been authorized to access the AP; the processing module 501 is configured to perform access control on the first communication device according to the second response message.
  • processing module 501 and the transceiver module 502 can be obtained directly with reference to the relevant description in the method embodiment shown in FIG. 2, and will not be repeated here.
  • processing module 501 in the embodiment of the present application may be implemented by a processor or a processor-related circuit component
  • transceiver module 502 may be implemented by a transceiver or a transceiver-related circuit component.
  • the present application also provides an AP600.
  • the AP600 may include a processor 601 and a transceiver 602.
  • the processor 601 and the transceiver 602 are coupled to each other.
  • the transceiver 602 may be an interface circuit or an input/output interface.
  • the communication device 600 may further include a memory 603 for storing instructions executed by the processor 601 or storing input data required by the processor 601 to run the instructions or storing data generated after the processor 601 runs the instructions.
  • the processor 601 is used to perform the functions of the above-mentioned processing module 501
  • the transceiver 602 is used to perform the functions of the above-mentioned transceiving module 502, which will not be repeated here.
  • FIG. 7 and FIG. 8 are schematic diagrams of the structure of possible communication devices provided by this application. These communication devices can be used to implement the functions of the first communication device or the second communication device in the foregoing method embodiments, and therefore, can also achieve the beneficial effects of the foregoing method embodiments.
  • the communication device may be STA102 or STA103 as shown in FIG. 1, and may also be a module (module such as a chip) applied to the communication device.
  • the communication device 700 includes a processing module 701 and a transceiver module 702. Further, optionally, the communication device may further include a display module 703.
  • the communication device 700 is configured to implement the function of the first communication device or the second communication device in the method embodiment shown in FIG. 2, FIG. 3, or FIG. 4.
  • the transceiver module 702 is used to receive the authorization request message from the access point AP, and the communication device is authorized to access the AP.
  • Communication device; the processing module 701 cooperates with the transceiver module 702 to respond to the authorization request message and send a second response message to the AP, so that the AP performs access control on the first communication device according to the second response message.
  • processing module 701 and the transceiver module 702 can be obtained directly with reference to the relevant description in the method embodiment shown in FIG. 2, and will not be repeated here.
  • processing module 701 in the embodiment of the present application may be implemented by a processor or processor-related circuit components
  • transceiver module 702 may be implemented by a transceiver or transceiver-related circuit components.
  • the transceiver module 702 is used to receive a third response message from the server, and the third response message includes the shared key for accessing the AP Information, the communication device is a communication device that has been authorized to access the AP; the processing module 701 is configured to provide the first communication device with shared key information for accessing the AP when determining that the first communication device is allowed to access the AP.
  • the transceiver module 702 is used to send a request message for obtaining a shared key to the server through the access point AP, so as to request the server for communication.
  • the device generates shared key information for accessing the AP;
  • the processing module 701 is configured to obtain the shared key information for accessing the AP from the second communication device, and access the AP through the shared key information for accessing the AP, and the second communication device is the AP Authorized communication equipment.
  • processing module 701 and the transceiver module 702 can be obtained directly with reference to the related description in the method embodiment shown in FIG. 3, and will not be repeated here.
  • the present application also provides a communication device 800.
  • the communication device 800 may include a processor 801 and a transceiver 802.
  • the processor 801 and the transceiver 802 are coupled to each other.
  • the transceiver 802 may be an interface circuit or an input/output interface.
  • the communication device 800 may further include a memory 803 for storing instructions executed by the processor 801 or storing input data required by the processor 801 to run the instructions or storing data generated after the processor 801 executes the instructions.
  • the communication device may further include a display 804.
  • the processor 801 is used to perform the functions of the above-mentioned processing module 701
  • the transceiver 802 is used to perform the functions of the above-mentioned transceiving module 702, which will not be repeated here.
  • FIG. 9 shows a simplified schematic diagram of the structure of the terminal device. It is easy to understand and easy to illustrate.
  • the terminal device is a mobile phone as an example.
  • the terminal device 900 includes a processor, a memory, a radio frequency circuit, an antenna, and an input and output device.
  • the processor is mainly used to process the communication protocol and communication data, and to control the entire terminal device, execute the software program, and process the data of the software program. For example, it is used to support the terminal device 900 to execute any of the above-mentioned embodiments by the terminal device.
  • the memory is mainly used to store software programs and data.
  • the radio frequency circuit is mainly used for the conversion of baseband signals and radio frequency signals and the processing of radio frequency signals.
  • the antenna is mainly used to send and receive radio frequency signals in the form of electromagnetic waves.
  • Input and output devices such as touch screens, display screens, keyboards, etc., are mainly used to receive data input by users and output data to users. It should be noted that some types of terminal devices may not have input and output devices.
  • the processor can read the software program in the memory, interpret and execute the instructions of the software program, and process the data of the software program.
  • the processor performs baseband processing on the data to be sent and outputs the baseband signal to the radio frequency circuit.
  • the radio frequency circuit performs radio frequency processing on the baseband signal and then sends the radio frequency signal to the outside in the form of electromagnetic waves through the antenna.
  • the radio frequency circuit receives the radio frequency signal through the antenna, converts the radio frequency signal into a baseband signal, and outputs the baseband signal to the processor, and the processor converts the baseband signal into data and processes the data .
  • the processor may include a baseband processor and a central processing unit.
  • the baseband processor is mainly used to process communication protocols and communication data
  • the central processing unit is mainly used to control the entire terminal device 900. Execute the software program and process the data of the software program.
  • the processor in FIG. 9 integrates the functions of the baseband processor and the central processing unit. It should be noted that the baseband processor and the central processing unit may also be independent processors, which are interconnected by technologies such as a bus.
  • the terminal device may include multiple baseband processors to adapt to different network standards, the terminal device 900 may include multiple central processors to enhance its processing capabilities, and the various components of the terminal device 900 may be connected through various buses.
  • the baseband processor can also be expressed as a baseband processing circuit or a baseband processing chip.
  • the central processing unit can also be expressed as a central processing circuit or a central processing chip.
  • the function of processing the communication protocol and the communication data can be built in the processor, or can be stored in the storage unit in the form of a software program, and the processor executes the software program to realize the baseband processing function.
  • the antenna and radio frequency circuit with the transceiver function can be regarded as the transceiver unit of the terminal device
  • the processor with the processing function can be regarded as the processing unit of the terminal device.
  • the terminal device includes a processing unit 901 and a transceiver unit 902.
  • the transceiving unit may also be called a transceiver, a transceiver, a transceiving device, etc.
  • the processing unit may also be called a processor, a processing board, a processing unit, a processing device, and the like.
  • the device used to implement the receiving function in the transceiver unit can be regarded as the receiving unit
  • the device used to implement the transmitting function in the transceiver unit can be regarded as the transmitting unit, that is, the transceiver unit includes the receiving unit and the transmitting unit.
  • the receiving unit may also be called a receiver, a receiver, a receiving circuit, etc.
  • the sending unit may be called a transmitter, a transmitter, or a transmitting circuit, etc.
  • the antenna On the downlink, the antenna receives the downlink signal (including data and/or control information) sent by the network device, and on the uplink, the antenna sends the uplink signal (including data) to the network device or other terminal equipment. And/or control information).
  • service data and signaling messages are processed. These units are based on the radio access technology adopted by the radio access network (for example, LTE, NR and other evolved system access technologies) To deal with it.
  • the processor is also used to control and manage the actions of the terminal device, and is used to execute the processing performed by the terminal device in the foregoing embodiment.
  • the processor is also used to support the terminal device to perform the execution method of the first communication device or the second communication device involved in FIG. 2; or is also used to support the terminal device to perform the execution of the first communication device or the second communication device involved in FIG. 3 method.
  • FIG. 9 only shows one memory, one processor and one antenna.
  • the terminal equipment may include any number of antennas, memories, processors, etc.
  • the memory may also be referred to as a storage medium or a storage device.
  • the memory may be set independently of the processor, or may be integrated with the processor, which is not limited in the embodiment of the present application.
  • the transceiving unit 902 is used to perform the sending operation and receiving operation on the first communication device or the second communication device side in the method embodiment shown in FIG. 2, and the processing unit 901 is used to perform the method implementation shown in FIG.
  • the first communication device side or the second communication device side performs other operations other than the transceiving operation.
  • the transceiving unit 902 is used to perform the transceiving steps on the second communication device side in the embodiment shown in FIG. 2, such as step 205 and step 209; or used to perform the transceiving steps on the first communication device side, such as step 201, Step 206.
  • the processing unit 901 is configured to perform other operations of the first communication device or the second communication device in the embodiment shown in FIG. 2 except for the receiving and sending operations.
  • the transceiving unit 902 is used to perform the transceiving steps on the second communication device side in the embodiment shown in FIG. 4, such as step 404; or used to perform the transceiving steps on the first communication device side, such as step 405.
  • the processing unit 901 is configured to perform other operations on the side of the first communication device or the second communication device in the embodiment shown in FIG. 4 except for the receiving and sending operations.
  • the communication device may include a transceiver module and a processing module.
  • the transceiver module may be an input/output circuit and/or an interface circuit
  • the processing module may be a processor, a microprocessor, or an integrated circuit integrated on the chip.
  • the processor in the embodiments of the present application may be a central processing unit (Central Processing Unit, CPU), or other general-purpose processors, digital signal processors (Digital Signal Processors, DSPs), and application specific integrated circuits. (Application Specific Integrated Circuit, ASIC), Field Programmable Gate Array (Field Programmable Gate Array, FPGA) or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof.
  • the general-purpose processor may be a microprocessor or any conventional processor.
  • the method steps in the embodiments of the present application can be implemented by hardware, and can also be implemented by a processor executing software instructions.
  • Software instructions can be composed of corresponding software modules, which can be stored in random access memory (Random Access Memory, RAM), flash memory, read-only memory (Read-Only Memory, ROM), and programmable read-only memory (Programmable ROM) , PROM), erasable programmable read-only memory (Erasable PROM, EPROM), electrically erasable programmable read-only memory (Electrically EPROM, EEPROM), register, hard disk, mobile hard disk, CD-ROM or well-known in the art Any other form of storage medium.
  • RAM Random Access Memory
  • ROM read-only memory
  • PROM programmable read-only memory
  • Erasable PROM Erasable PROM
  • EPROM electrically erasable programmable read-only memory
  • register hard disk, mobile hard disk, CD-ROM or well-known in the art Any other form of storage medium.
  • An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and write information to the storage medium.
  • the storage medium may also be an integral part of the processor.
  • the processor and the storage medium may be located in the ASIC.
  • the ASIC can be located in a network device or a terminal device.
  • the processor and the storage medium may also exist as discrete components in the network device or the terminal device.
  • the computer program product includes one or more computer programs or instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, network equipment, user equipment, or other programmable devices.
  • Computer programs or instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, a computer program or instruction can be downloaded from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that integrates one or more available media.
  • the usable medium can be a magnetic medium, such as a floppy disk, a hard disk, and a magnetic tape; it can also be an optical medium, such as a digital video disc (DVD); it can also be a semiconductor medium, such as a solid state drive (SSD). ).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种控制通信接入的方法、AP及通信设备，以解决现有技术中恶意通信设备接入AP的问题。本申请中，AP接收第一通信设备的鉴权请求消息，响应该鉴权请求消息向服务器发送身份认证信息，使服务器对身份认证信息进行鉴权；若AP收到的第一响应消息指示鉴权成功，向已被授权接入AP的第二通信设备发授权请求消息，以请求第二通信设备授权第一通信设备；AP接收第二通信设备响应授权请求消息反馈的第二响应消息，并根据第二响应消息对第一通信设备进行接入控制。通过对身份认真信息的鉴权，可确保第一通信设备的真实有效。而且通过已被授权接入AP的第二通信设备确定是否授权第一通信设备，可进一步提高接入AP的通信设备的安全性。

Description

一种控制通信接入的方法、AP及通信设备 技术领域
本申请涉及通信技术领域，尤其涉及一种控制通信接入的方法、AP及通信设备。
背景技术
无线局域网(wireless local area network，WLAN)通信技术和无线保真(wireless-fidelity，WiFi)通信技术目前得到了大规模的推广和应用，随着WLAN/WiFi通信技术的广泛应用，无线网络的安全性也就显得越来越重要。
无线安全协议的发展经历了WEP–>WPA–>WPA2–>WPA3的过程，无线安全协议使得站(station，STA)与接入点(access point，AP)两者之间建立安全通信的通道。由于任何人或机构均可以建立或者设置WiFi网络，而且WiFi网络对STA是开放的，STA需要接入WiFi网络时，仅需要获取到WiFi网络的服务集标识(service set identifier，SSID)和接入密码即可。SSID是AP广播的，STA在AP附近就可以搜索到该AP广播的SSID，也就是说，STA只要获取到AP的接入密码即可接入该AP的WiFi网络。因此，可能会有一些恶意的STA通过暴力破解、攻击、空口抓包分析并伪造等方式获取到接入密码，从而通过接入密码接入该AP的WiFi网络，如此，恶意的STA可能会对接入该WiFi网络中的其它STA造成威胁。
发明内容
本申请提供一种控制通信接入的方法、AP及通信设备，用于提高接入AP的通信设备的安全性。
第一方面，本申请提供一种控制通信接入的方法，该方法包括AP接收来自第一通信设备的携带有第一通信设备的身份认证信息的鉴权请求消息，响应鉴权请求消息，向服务器发送身份认证信息，使服务器根据第一通信设备的身份认证信息对第一通信设备进行鉴权，接收来自服务器反馈的第一响应消息，若第一响应消息指示鉴权成功，则向第二通信设备发送授权请求消息，以请求第二通信设备授权第一通信设备接入AP；接收第二通信设备响应授权请求消息反馈的第二响应消息，并根据第二响应消息对第一通信设备进行接入控制；其中，第二通信设备为已被授权接入AP的通信设备。
基于该方案，通过服务器对第一通信设备的身份认证信息进行鉴权，可确定出第一通信设备的身份认证信息是否是真实有效的，从而有助于保证接入AP的通信设备的真实性。进一步，通过已被授权接入AP的第二通信设备确定是否授权第一通信设备接入，可进一步提高接入该AP的第一通信设备的安全性。即本申请中，AP是在接收到服务器反馈的第一响应消息指示鉴权成功、且收到第二通信设备授权第一通信设备接入该AP后，才允许第一通信设备接入该AP，如此，可提高接入该AP的通信设备的安全性。
在一种可能的实现方式中，身份认证信息可包括全球用户识别卡(universal subscriber identity module，USIM)的信息或第一通信设备的标识(identifier，ID)。当身份认证信息包括USIM的信息，可以通过运营商服务器鉴权第一通信设备的身份认证信息，从而可进一步提高第一通信设备的真实性。
在一种可能的实现方式中，若第一响应消息指示鉴权失败，则AP拒绝第一通信设备接入。服务器对第一通信设备的身份认真信息鉴权失败，说明第一通信设备的身份认证信息是无效的，即第一通信设备可能是伪造的通信设备，此时，AP拒绝该第一通信设备接入，从而有助于提高接入AP的通信设备的安全性。
进一步，可选地，若第二响应消息包括指示授权第一通信设备接入AP的信息，AP允许第一通信设备接入；若第二响应消息包括指示拒绝第一通信设备接入AP的信息，AP拒绝第一通信设备接入。
第二方面，本申请提供一种控制通信接入的方法，该方法包括第二通信设备接收来自AP的授权请求消息，第二通信设备响应接收到的授权请求消息，向AP发送第二响应消息，使AP根据第二响应消息对第一通信设备进行接入控制；其中，第二通信设备为已被授权接入AP的通信设备。
基于该方案，通过已被授权接入AP的第二通信设备确定是否授权第一通信设备接入AP，可提高接入该AP的通信设备的安全性。
在一种可能的实现方式中第二响应消息包括指示授权第一通信设备接入AP的信息或拒绝第一通信设备接入AP的信息。
如下，示例性地的给出了两种第二通信设备确定是否授权第一通信设备接入AP的实现方式。
实现方式一，第二通信设备可根据黑名单和/或白名单确定。
在一种可能的实现方式中，授权请求消息可包括第一通信设备的ID；若第二通信设备确定第一通信设备的ID属于预设白名单中的ID，则向AP发送包括指示授权第一通信设备接入AP的信息的第二响应消息；若第二通信设备确定第一通信设备的ID属于预设黑名单中的ID，则向AP发送包括指示拒绝第一通信设备接入AP的信息的第二响应消息。
实现方式二，第二通信设备可根据检测到的操作指令确定。
在一种可能的实现方式中，若第二通信设备检测到指示授权第一通信设备接入AP的操作指令，则向AP发送包括指示授权第一通信设备接入AP的信息的第二响应消息；若第二通信设备检测到指示拒绝第一通信设备接入AP的操作指令，则向AP发送包括指示拒绝第一通信设备接入AP的信息的第二响应消息。
第三方面，本申请提供一种控制通信接入的方法，该方法包括服务器接收来自AP响应鉴权请求发送的第一通信设备的身份认证信息，服务器根据第一通信设备的身份认证信息，对第一通信设备的身份认证信息进行鉴权，并向AP反馈第一响应消息。
基于该方案，通过服务器对第一通信设备的身份认证信息进行鉴权，可确定出第一通信设备的身份认证信息是否为真实有效的，即有助于保证接入AP的第一通信设备的真实性。
在一种可能的实现方式中，第一响应消息可指示鉴权成功或指示鉴权失败，第一通信设备为请求接入AP的通信设备。
在一种可能的实现方式中，身份认证信息可包括USIM的信息，USIM的信息可包括第一令牌token以及国际移动用户识别码(nternational mobile subscriber identification number，IMSI)，服务器接收到USIM的信息后，可确定IMSI对应的密钥，根据密钥确定第二token；若确定第二token与接收到的第一token一致，则向AP发送的第一响应消息指示鉴权成功；若确定第二token与接收到的第一token不一致，则向AP发送的第一响应 消息指示鉴权失败。
第四方面，本申请提供一种控制通信接入的方法，该方法包括第二通信设备接收来自服务器的第三响应消息，第三响应消息包括接入AP的共享密钥信息，第二通信设备确定允许第一通信设备接入AP时，向第一通信设备提供共享密钥信息，其中，第二通信设备为已被授权接入AP的通信设备。
基于该方案，可由第二通信设备确定是否允许第一通信设备接入AP，又由于第二通信设备是已被授权接入AP的通信设备，如此，有助于提高接入该AP中的通信设备的安全性。
在一种可能的实现方式中，共享密钥信息可以以口令或二维码的形式提供。如此，可以便于第一通信设备快速获取到共享密钥信息。另外，若共享密钥信息为口令，当该口令被第一通信设备使用后，即便泄露，其它的通信设备也不能再使用，如此，可进一步提高接入AP的通信设备的安全性。
如下，示例性地的示出两种第二通信设备确定允许第一通信设备接入AP的实现方式。
实现方式1
第二通信设备获取第一通信设备的标识ID，若第二通信设备确定第一通信设备的ID属于预设白名单中的ID，则向第一通信设备提供共享密钥信息。
实现方式2
若第二通信设备检测到指示授权第一通信设备接入AP的操作指令，则向第一通信设备提供共享密钥信息。
第五方面，本申请提供一种控制通信接入的方法，该方法包括第一通信设备通过AP向服务器发送获取共享密钥的请求消息，以请求服务器为第一通信设备生成接入AP的共享密钥信息，第一通信设备从第二通信设备获取该共享密钥信息，第一通信设备通过该共享密钥信息接入AP，其中，第二通信设备为已被授权接入AP的通信设备。
基于该方案，可由第二通信设备确定是否允许第一通信设备接入AP，又由于第二通信设备是已被授权接入AP的通信设备，如此，有助于提高接入该AP中的通信设备的安全性。
在一种可能的实现方式中，第一通信设备可通过扫描第二通信设备提供的二维码，获取接入AP的共享密钥信息。在另一种可能的实现方式中，第一通信设备可通过复制第二通信设备提供的口令，获取接入AP的共享密钥信息。
在一种可能的实现方式中，获取共享密钥的请求消息包括第一通信设备的ID。
第六方面，本申请提供一种控制通信接入的方法，该方法包括服务器接收来自AP的获取共享密钥的请求消息，服务器响应获取共享密钥的请求消息，生成接入AP的共享密钥信息，并向第二通信设备发送第三响应消息，第三响应消息包括接入AP的共享密钥信息，第二通信设备为已被授权接入AP的通信设备。
基于该方案，服务器将接入AP的共享密钥信息发送至第二通信设备，由第二通信设备确定是否允许第一通信设备接入AP，又由于第二通信设备是已被授权接入AP的通信设备。如此，有助于提高接入该AP中的第一通信设备的安全性。
第七方面，本申请提供一种AP，该AP具有实现上述第一方面中的AP的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种可能的实现方式中，该通信设备可以是AP，或者是可用于AP中的模块，例如芯片或芯片系统或者电路。有益效果可参见上述第一方面的描述，此处不再赘述。该通信设备可以包括：收发器和处理器。该处理器可被配置为支持该通信设备执行以上所示AP的相应功能，该收发器用于支持该通信设备与第一通信设备、第二通信设备和服务器等之间的通信。其中，收发器可以为独立的接收器、独立的发射器、集成收发功能的收发器、或者是接口电路。可选地，该通信设备还可以包括存储器，该存储器可以与处理器耦合，其保存该通信设备必要的程序指令和数据。
收发器用于接收来自第一通信设备的鉴权请求消息，鉴权请求消息携带有第一通信设备的身份认证信息，响应鉴权请求消息，向服务器发送第一通信设备的身份认证信息，使服务器根据身份认证信息对第一通信设备进行鉴权，接收来自服务器反馈的第一响应消息；若第一响应消息指示鉴权成功，则向第二通信设备发送授权请求消息，以请求第二通信设备授权第一通信设备接入AP，接收第二通信设备响应授权请求消息反馈的第二响应消息；处理器用于根据第二响应消息对第一通信设备进行接入控制，第二通信设备为已被授权接入AP的通信设备。
在一种可能的实现方式中，身份认证信息包括USIM的信息或第一通信设备的ID。
在一种可能的实现方式中，若第一响应消息指示鉴权失败，处理器还用于拒绝第一通信设备接入。
在一种可能的实现方式中，第二响应消息包括指示授权第一通信设备接入AP的信息、或指示拒绝第一通信设备接入AP的信息。若第二响应消息包括指示授权第一通信设备接入AP的信息，处理器具体用于允许第一通信设备接入；若第二响应消息包括指示拒绝第一通信设备接入AP的信息，处理器具体用于拒绝第一通信设备接入。
第八方面，本申请提供一种通信设备，该通信设备具有实现上述第二方面中的第二通信设备或第四方面中的第二通信设备或第五方面第一通信设备的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种可能的实现方式中，该通信设备可以是第二通信设备，或第一通信设备，或者是可用于第二通信设备的模块，例如芯片或芯片系统或者电路，或者是可用于第一通信设备的模块。该通信设备可以包括：收发器和处理器。该处理器可被配置为支持该通信设备执行以上所示第二通信设备或第一通信设备的相应功能，该收发器用于支持该通信设备与其它通信设备和AP等之间的通信。其中，收发器可以为独立的接收器、独立的发射器、集成收发功能的收发器、或者是接口电路。可选地，该通信设备还可以包括存储器，该存储器可以与处理器耦合，其保存该通信设备必要的程序指令和数据。
一种可能的情形下，该通信设备具有实现上述第二方面中的第二通信设备的功能，有益效果可参见上述第二方面的描述，此处不再赘述。
收发器用于接收来自接入点AP的授权请求消息，通信设备为已被授权接入AP的通信设备；处理器与收发器协作，用于响应授权请求消息，向AP发送第二响应消息，使AP根据第二响应消息对第一通信设备进行接入控制。
在一种可能的实现方式中，授权请求消息可包括第一通信设备的ID。
在一种可能的实现方式中，处理器与收发器协作，具体用于：若处理器确定第一通信设备的ID属于预设白名单中的ID，则收发器向AP发送包括指示授权第一通信设备接入 AP的信息的第二响应消息；若处理器确定第一通信设备的ID属于预设黑名单中的ID，则收发器向AP发送包括指示拒绝第一通信设备接入AP的信息的第二响应消息。
在一种可能的实现方式中，处理器与收发器协作，具体用于：若处理器检测到指示授权第一通信设备接入AP的操作指令，则收发器向AP发送包括指示授权第一通信设备接入AP的信息的第二响应消息；若处理器检测到指示拒绝第一通信设备接入AP的操作指令，则收发器向AP发送包括指示拒绝第一通信设备接入AP的信息的第二响应消息。
另一种可能的情形下，该第二通信设备具有实现上述第四方面中的第二通信设备的功能，有益效果可参见上述第四方面的描述，此处不再赘述。
收发器用于接收来自服务器的第三响应消息，第三响应消息包括接入AP的共享密钥信息，通信设备为已被授权接入AP的通信设备；处理器用于在确定允许第一通信设备接入AP时，向第一通信设备提供接入AP的共享密钥信息。
在一种可能的实现方式中，处理器具体用于根据共享密钥信息生成二维码或者口令；通信设备还包括显示器，显示器用于向第一通信设备显示二维码或者口令。
在一种可能的实现方式中，处理器具体用于获取第一通信设备的标识ID；若确定第一通信设备的ID属于预设白名单中的ID，则向第一通信设备提供共享密钥信息。
在一种可能的实现方式中，处理器具体用于若检测到指示授权第一通信设备接入AP的操作指令，则向第一通信设备提供共享密钥信息。
再一种可能的情形下，该通信设备具有实现上述第五方面中的第一通信设备的功能，有益效果可参见上述第五方面的描述，此处不再赘述。
收发器用于通过接入点AP向服务器发送获取共享密钥的请求消息，以请求服务器为通信设备生成接入AP的共享密钥信息；处理器用于从第二通信设备获取接入AP的共享密钥信息，通过接入AP的共享密钥信息接入AP，第二通信设备为已被授权接入AP的通信设备。
在一种可能的实现方式中，处理器具体用于通过扫描第二通信设备提供的二维码，获取接入AP的共享密钥信息；或者可通过复制第二通信设备提供的口令，获取接入AP的共享密钥信息。
在一种可能的实现方式中，获取共享密钥的请求消息包括通信设备的ID。
第九方面，本申请提供一种服务器，该服务器具有实现上述第三方面中的服务器或第六方面中的服务器的功能。该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元或模块。
在一种可能的实现方式中，该服务器可以包括：收发器和处理器。该处理器可被配置为支持该服务器执行以上所示服务器的相应功能，该收发器用于支持该服务器与AP等之间的通信。其中，收发器可以为独立的接收器、独立的发射器、集成收发功能的收发器、或者是接口电路。可选地，该通信设备还可以包括存储器，该存储器可以与处理器耦合，其保存该通信设备必要的程序指令和数据。
在一种情形下，该服务器具有实现上述第三方面中的服务器的功能，有益效果可参见上述第三方面的介绍，此处不再赘述。
收发器用于来自AP的第一通信设备的身份认证信息，处理器用于根据第一通信设备的身份认证信息，对第一通信设备的身份认证信息进行鉴权，收发器还用于向AP发送第一响应消息，第一响应消息指示鉴权成功或指示鉴权失败，其中，第一通信设备为请求接 入AP的通信设备。
在一种可能的实现方式中，身份认证信息包括USIM的信息，USIM的信息包括第一token以及IMSI，处理器具体用于确定IMSI对应的密钥，根据密钥确定第二token；若确定第二token与接收到的第一token一致，则通过收发器向AP发送的第一响应消息指示鉴权成功；若确定第二token与接收到的第一token不一致，则通过收发器向AP发送的第一响应消息指示鉴权失败。
在另一种情形下，服务器具有实现上述第六方面中的服务器的功能，有益效果可参见上述第六方面的介绍，此处不再赘述。
收发器用于接收来自AP的获取共享密钥的请求消息，处理器用于响应获取共享密钥的请求消息，生成接入AP的共享密钥信息，并通过收发器向第二通信设备发送第三响应消息，第三响应消息包括接入AP的共享密钥信息，第二通信设备为已被授权接入AP的通信设备。
第十方面，本申请提供一种AP，用于实现上述第一方面或第一方面中的任意一种方法包括相应的功能模块，分别用于实现以上方法中的步骤。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的实施方式中，该AP可以括处理模块和收发模块，这些模块可以执行上述方法示例中终端设备的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
第十一方面，本申请提供一种通信设备，用于实现上述第二方面或第二方面中的任意一种方法，或者用于实现上述第四方面或第四方面中的任意一种方法，或者用于实现上述第五方面或第五方面中的任意一种方法，包括相应的功能模块，分别用于实现以上方法中的步骤。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的模块。
在一种可能的实施方式中，该通信设备可为第一通信设备或第二通信设备，该第一通信设备或第二通信设备可以括处理模块和收发模块，这些模块可以执行上述方法示例中终端设备的相应功能，具体参见方法示例中的详细描述，此处不做赘述。
第十二方面，本申请提供一种服务器，用于实现上述第三方面或第三方面中的任意一种方法，或者用于实现上述第六方面或第六方面中的任意一种方法，包括相应的功能模块，分别用于实现以上方法中的步骤。功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。硬件或软件包括一个或多个与上述功能相对应的模块。
第十三方面，本申请提供一种通信系统，该通信系统包括第一通信设备、第二通信设备、AP和服务器。在一种可能的实现方式中，AP可以用于执行上述第一方面或第一方面中的任意一种方法，第二通信设备可以用于执行上述第二方面或第二方面中的任意一种方法，服务器可以用于执行上述第三方面或第三方面中的任意一种方法。在另一种可能的实现方式中，第二通信设备可以用于执行上述第四方面或第四方面中的任意一种方法，第一通信设备可以用于执行上述第五方面或第五方面中的任意一种方法，服务器可以用于执行上述第六方面或第六方面中的任意一种方法。
第十四方面，本申请提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序或指令，当计算机程序或指令被AP执行时，使得该AP执行上述第一方面或第一方面的任意可能的实现方式中的方法。
第十五方面，本申请提供一种计算机可读存储介质，计算机可读存储介质中存储有计 算机程序或指令，当计算机程序或指令被通信设备执行时，使得该通信设备执行上述第二方面或第二方面的任意可能的实现方式中的方法、或者使得该通信设备执行第四方面或第四方面的任意可能的实现方式中的方法、或者使得该通信设备执行第五方面或第五方面的任意可能的实现方式中的方法。
第十六方面，本申请提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机程序或指令，当计算机程序或指令被服务器执行时，使得该服务器执行上述第三方面或第三方面的任意可能的实现方式中的方法、或者使得该通信设备执行第六方面或第六方面的任意可能的实现方式中的方法。
第十七方面，本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序或指令，当该计算机程序或指令被AP执行时，实现上述第一方面或第一方面的任意可能的实现方式中的方法。
第十八方面，本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序或指令，当该计算机程序或指令被通信设备执行时，实现上述第二方面或第二方面的任意可能的实现方式中的方法、或者使得该通信设备执行第四方面或第四方面的任意可能的实现方式中的方法、或者使得该通信设备执行第五方面或第五方面的任意可能的实现方式中的方法。
第十九方面，本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序或指令，当该计算机程序或指令被服务器执行时，实现上述第三方面或第三方面的任意可能的实现方式中的方法、或者实现上述第六方面或第六方面的任意可能的实现方式中的方法。
附图说明
图1为本申请提供的一种通信系统架构示意图；
图2为本申请提供的一种控制通信接入方法的方法流程示意图；
图3为本申请提供的一种通信设备接入AP的方法流程示意图；
图4为本申请提供的另一种控制通信接入方法的方法流程示意图；
图5为本申请提供的一种AP的结构示意图；
图6为本申请提供的一种AP的结构示意图；
图7为本申请提供的一种通信设备的结构示意图；
图8为本申请提供的一种通信设备的结构示意图；
图9为本申请提供的一种终端设备的结构示意图。
具体实施方式
下面将结合附图，对本申请实施例进行详细描述。
图1是本申请的可应用的一种通信系统的架构示意图。如图1所示，该通信系统可包括接入点(access point，AP)101和至少一个站(station，STA)(图1以STA102和STA103为例)。AP101与STA102之间、AP101与STA103之间均可进行WLAN/WiFi通信。其中，STA103可以是固定位置的，也可以是可移动的。本申请对该通信系统中包括的AP和STA的数量不做限定。若AP与单个STA之间进行WLAN通信，即该通信系统可以用于单用户上下行传输；若AP与多个STA之间进行WLAN通信，即该通信系统也可以用于多用 户上下行传输。进一步，可选地，该通信系统还可包括服务器104。需要说明的是，服务器104也可以是虚拟服务器，可集成于AP内。
AP(如AP101)也称为无线接入点或热点等，是无线网和有线网之间沟通的桥梁，是组建无线局域网的核心设备。主要用于提供STA和有线局域网之间的互相访问，在AP信号覆盖范围内的STA可以通过AP进行相互通信。也就是说，AP是STA进入有线网络的接入点。AP可部署于家庭、大楼内部以及园区内部，典型覆盖半径为几十米至上百米。当然，也可以部署于户外。AP可以为基站(base station)、演进型基站(evolved NodeB，eNodeB)、发送接收点(transmission reception point，TRP)、5G通信系统中的下一代基站(next generation NodeB，gNB)、未来通信系统中的基站或无线保真WiFi系统中的接入点等；也可以是完成基站部分功能的模块或单元，例如，可以是集中式单元(central unit，CU)，也可以是分布式单元(distributed unit，DU)；也可以是路由器；也可以是交换机；也可以是网桥；也可以是无线网关；也可以是STA等。本申请对AP所采用的具体技术和具体设备形态不做限定。可选地，AP可以支持802.11ax协议；进一步可选地，AP可以支持802.11ac、802.11n、802.11g、802.11b及802.11a等多种WLAN协议。
STA(如STA102和STA103)是连接到无线网络中的通信设备，例如无线通讯芯片、终端设备等；其中，终端设备也可以称为终端、用户设备(user equipment，UE)、移动台、移动终端等。终端设备可以是手机、平板电脑、带无线收发功能的电脑、虚拟现实终端设备、增强现实终端设备、工业控制中的无线终端、无人驾驶中的无线终端、远程手术中的无线终端、智能电网中的无线终端、运输安全中的无线终端、智慧城市中的无线终端、智慧家庭中的无线终端等等。本申请对终端设备所采用的具体技术和具体设备形态不做限定。在一种可能的实现方式中，无线终端可为能够运行实体客户识别模块(subscriber identity module，SIM)卡或虚拟SIM卡的终端。可选地，STA可以支持802.11ax协议；进一步可选地，STA可支持802.11ac、802.11n、802.11g、802.11b及802.11a等多种WLAN协议。
AP与STA之间可以通过2.4千兆赫(gigahertz，GHz)的频谱进行通信，也可以通过5GHz的频谱进行通信，还可以通过60GHz的频谱进行通信。本申请对AP和STA之间所使用的频谱资源不做限定。
图1所示的通信系统可应用于智能家庭的WiFi网络。当图1所示的通信系统应用于智能家庭的WiFi网络中时，AP 101可为路由器、STA 102和STA 103可为智慧家庭中的无线终端，例如手机、平板电脑、笔记本电脑、智能冰箱、智能空调等。一种可能的情况下，有新的无线终端需要接入该智能家庭的WiFi网络，例如，客人到访，客人的手机可能需要接入智能家庭的WiFi网络。
需要说明的是，本申请所描述的系统架构以及应用场景是为了更加清楚的说明本申请的技术方案，并不构成对本申请提供的技术方案的限定，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本申请提供的技术方案对于类似的技术问题，同样适用。
以下，对本申请中的部分用语进行解释说明，以便于本领域技术人员理解。
1)基本服务集(basic service set，BSS)
BSS用于描述在一个802.11WLAN中的一组相互通信的移动设备。一个BSS可以包含AP(接入点)，也可以不包含AP。基本服务集有两种类型：一种是独立基本服务集 (independent BSS，IBSS)，由少数几个工作站为了特定目的而组成的暂时性网络，因为持续时间不长，规模甚小且目的特殊，有时也被称为特设BSS或特设网络，在IBSS中，工作站相互之间可以直接通信，但两者的距离必须在可以直接通信的范围内。另一种是基础结构型基本服务集(infrastructure BSS)，包含一个AP和若干个移动台。
2)服务集标识(service set identifier，SSID)
SSID可以将一个无线局域网分为几个需要不同身份验证的子网络，每一个子网络都需要独立的身份验证，只有通过身份验证的用户才可以进入相应的子网络，防止未被授权的用户进入网络。
3)IMSI
IMSI是用于区分蜂窝网络中不同用户的、在所有蜂窝网络中不重复的识别码。手机可将IMSI存储于一个64比特的字段发送给网络。IMSI可以用来在归属位置寄存器(home location register，HLR)或拜访位置寄存器(visitor location register，VLR)中查询用户的信息。
4)USIM
USIM也称为升级SIM，USIM在安全性方向对算法进行了升级，并增加了卡对网络接入AP的功能。这种双向认证可以有效防止黑客对卡的攻击。
5)快速反应(quick response，QR)码
QR码是一种能够存储信息的二维码，可通过对文字、统一资源定位符(uniform resource locator，URL)地址和其它类型的数据加密得到的。
6)口令
根据专门的算法生成的不可预测的随机数字和/或字母的组合，每个口令只能被使用一次。
7)共享密钥
共享密钥，用于验证第二层隧道协议(layer 2 tunneling protocol，L2TP)/互联网安全协议(internet protocol security，IPSec)连接的统一码(Unicode)字符串。使用者可以输入预先配置好的相同密钥来接入网络，密钥可以是8到63个ASCII字符、或是64个16位数字(256比特)。
下面对本申请提供的用于解决背景技术中的技术问题的控制通信接入的方法进行详细说明。在下文的介绍中，AP可以是上述图1中的AP101，STA可以是上述图1中的STA102或STA103。若图1所示的通信系统应用于智能家庭的WiFi网络，第一通信设备可以是待接入智能家庭的WiFi网络的通信设备，例如，到访客人的手机；第二通信设备可以智能家庭的WiFi网络中已被授权接入AP的任一通信设备，例如，主人手机。
下面参考图2，为本申请提供的控制通信接入的方法的流程示意图。在下文介绍中，接入AP是指接入AP的网络或接入AP的BSS。例如，第一通信设备接入AP是指第一通信设备接入AP的网络或第一通信设备接入AP的BSS。再比如，第二通信设备接入AP是指第二通信设备接入AP的网络或第二通信设备接入AP的BSS。该控制通信接入的方法包括：
步骤200，第二通信设备接入AP。
该步骤200可为可选步骤。
此处，第二类通信设备可以通过多种权限接入AP。比如第二通信设备可采用证书加密的方式接入AP，基于证书加密的方式接入时，第二通信设备具有高的权限；再比如，第二通信设备可采用专用密码的方式接入AP，基于专用密码的方式接入AP时，第二通信设备具有中等级别的权限。第二通信设备通过专用密码或者证书加密等方式接入AP，一方面，可确保第二通信设备为已被授权接入AP的通信设备；另一方面，对于AP来说，第二通信设备是安全的。
步骤201，第一通信设备向AP发送鉴权请求消息。相应地，AP接收来自第一通信设备的鉴权请求消息。
此处，鉴权请求消息携带有第一通信设备的身份认证信息，该身份认证信息可以唯一的标识出第一通信设备。
在一种可能的实现方式中，第一通信设备的身份认证信息可包括第一通信设备的SIM的信息，比如USIM的信息；或者第一通信设备的身份认证信息包括第一通信设备的ID，比如，第一通信设备通过特定的应用生成的ID，再比如，基于华为系统生成的账号信息等。可以理解的是，第一通信设备选择哪种作为身份认证信息，可以是第一通信设备与服务器预先约定的，也可以是第一通信设备确定后通知服务器的，或者也可以是协议规定的，本申请对此不做限定。
步骤202，AP响应鉴权请求消息，向服务器发送第一通信设备的身份认证信息。相应地，服务器接收来自AP的第一通信设备的身份认证信息。
其中，第一通信设备的身份认证信息可用于服务器对第一通信设备身份认证信息进行鉴权。
在一种可能的实现方式中，鉴权请求消息可以仅包括第一通信设备的身份认证信息，AP响应鉴权请求消息，可直接将该鉴权请求消息转发至服务器。在另一种可能的实现方式中，鉴权请求消息可以包括第一通信设备的身份认证信息和支持的加密模式等，AP响应鉴权请求消息，可将鉴权请求消息中的第一通信设备的身份认证信息发送至服务器。
步骤203，服务器可根据身份认证信息，对第一通信设备进行鉴权。
此处，基于第一通信设备的身份认证信息，如下示例性地的给出了两种服务器对第一通信设备的进行鉴权方式。
方式一，第一通信设备的身份认证信息为第一通信设备的SIM卡的信息。
如下以SIM卡的信息为USIM的信息为例，USIM的信息可包括第一token和IMSI，其中，第一token是USIM通过预置的密钥计算得到的。
在该方式一，服务器可为电信运营商服务器。在一种可能的实现方式中，电信运营商服务器中存储有发放的USIM的IMSI与密钥的关系。
基于该方式一，服务器对第一通信设备的鉴权过程包括：服务器接收到第一通信设备的USIM的信息(即第一token和IMSI)后，确定IMSI对应的密钥，根据该密钥确定第二token，例如，可通过第一加密算法对确定出的密钥进行计算，得到第二token。若确定接收到的第一token与计算出的第二token一致，则服务器确定对该第一通信设备的鉴权成功，即该第一通信设备的身份认证信息为真实有效的。若确定接收到的第一token与计算出的第二token不一致，则服务器确定对该第一通信设备的鉴权失败。即第一通信设备的身份认证信息是不真实的。应理解，第一加密算法可以是服务器与第一通信设备约定的，也可以是服务器确定后通知第一通信设备，本申请对此不做限定。
方式二，第一通信设备的身份认证信息为第一通信设备的ID。进一步，可选地，第一通信设备的身份认证信息还可包括第一校验信息。
基于该方式二，若第一通信设备的ID是基于华为系统生成的账号信息，则服务器可为华为服务器。在一种可能的实现方式中，第一校验信息可以是第一通信设备根据第一通信设备的ID(即账号信息)确定的，例如，第一通信设备可通过第二加密算法对第一通信设备的ID(即账号信息)计算得到的第一校验信息。需要说明的是，第二加密算法可以是华为服务器和第一通信设备预先约定的，也可以是华为服务器确定第二加密算法后，通知第一通信设备，本申请对此不做限定。
基于该方式二，服务器对第一通信设备的鉴权过程包括：服务器接收到第一通信设备的ID(账号信息)后，通过第二加密算法对第一通信设备的ID进行计算，得到第二校验信息；若确定接收到的第一校验信息与计算出的第二校验信息一致，则服务器确定对该第一通信设备鉴权成功。若确定接收到的第一校验信息与计算出的第二校验信息不一致，则服务器确定对该第一通信设备鉴权失败。
基于上述方式二，若第一通信设备的ID是某类特定设备的ID，例如该类特定设备的媒体访问控制(medium access control，MAC)地址，服务器可为支持鉴权服务的服务器。若第一通信设备的ID为通过特定应用生成的ID，例如根据第一通信设备的MAC地址和时间等信息生成的ID；服务器也可为支持鉴权服务的服务器。支持鉴权服务的服务器对第一通信设备的鉴权过程可参见上述华为服务器对第一通信设备的鉴权过程，此处不再一一赘述。
需要说明的是，第一加密算法可以是哈希消息认证码(hash message authentication code，HMAC)-信息摘要(message-digest algorithm，MD)5，HMAC-安全散列算法(secure hash algorithm，SHA)1、HMAC-SHA256、HMAC-SHA512等，上述第二加密算法可以与第一加密算法相同，也可以不相同，本申请对此不做限定。
本申请中，通过服务器对第一通信设备的鉴权，可确保第一通信设备的身份认证信息是真实有效的，从而可有效防止非法的通信设备接入该AP。
步骤204，服务器向AP反馈第一响应消息。相应地，AP接收来自服务器反馈的第一响应消息。
此处，第一响应消息指示鉴权失败或指示鉴权成功。也可以理解为，若服务器基于上述步骤203对第一通信设备鉴权成功，则第一响应消息指示鉴权成功；若服务器基于上述步骤203对第一通信设备鉴权失败，则第一响应消息指示鉴权失败。
示例性地，第一响应消息可以是1个比特，例如“0”指示鉴权失败，“1”指示鉴权成功。第一响应信息还可用其它方式指示鉴权成功或鉴权失败，本申请对此不做限定。
需要说明的是，在上述步骤204之后，若第一响应消息指示鉴权成功，则执行步骤205；若第一响应消息指示鉴权失败，则执行步骤206。
步骤205，AP向第二通信设备发送授权请求消息。相应地，第二通信设备接收来自AP的授权请求消息。在步骤205后执行步骤207。
此处，授权请求消息用于请求第二通信设备授权第一通信设备接入AP。
在一种可能的实现方式中，授权请求消息可包括第一通信设备的ID，例如，第一通信设备的MAC地址，再比如，第一通信设备的身份证书信息。
步骤206，AP拒绝第一通信设备接入。
示例性地，AP接收到来自服务器的第一响应信息指示鉴权失败后，可向第一通信设备发送认证失败的消息，以通知第一通信设备鉴权失败。也就是说，AP不允许第一通信设备接入。
步骤207，第二通信设备响应授权请求消息，向AP反馈第二响应消息。相应地，AP接收来自第二通信设备反馈的第二响应消息。
此处，第二响应消息包括指示授权第一通信设备接入AP的信息、或指示拒绝第一通信设备接入AP的信息。也可以理解为，第二通信设备若授权第一通信设备接入AP，则第二响应消息包括指示授权第一通信设备接入AP的信息；第二通信设备若拒绝第一通信设备接入AP的对应的网络，则第二响应消息包括指示拒绝第一通信设备接入AP的信息。
示例性地，指示授权第一通信设备接入AP的信息可以是2个比特，例如“11”指示拒绝第一通信设备接入AP的信息可以是2个比特，例如“00”，本申请对此不做限定。
在一种可能的实现方式中，第二通信设备中可存储有预设的黑名单和白名单。授权请求消息包括第一通信设备的ID，第二通信设备若确定授权请求消息中包括的第一通信设备的标ID在白名单上，则向AP发送包括指示授权第一通信设备接入AP的信息的第二响应消息；第二通信设备若确定授权请求消息中包括的第一通信设备的ID在黑名单上，则向AP发送包括指示拒绝第一通信设备接入AP的信息的第二响应消息。
结合上述场景，若该AP为智能家庭中的WiFi网络中的路由器，则白名单可以设置家庭中的智能家居的标识，可以是智能家居的MAC地址等。如此，有助于避免智能家居每次接入智能家庭中的WiFi网络时，都需要主人逐一确定是否授权。
在另一种可能的实现方式中，第二通信设备可在界面上显示第一通信设备的ID，使用第二通信设备的用户可基于第二通信设备显示的第一通信设备的ID，在第二通信设备的所显示的界面进行操作，例如，界面上可显示“授权”和“拒绝”的提示信息按钮；若第二通信设备检测到指示授权第一通信设备接入AP的操作指令，则向AP发送包括指示授权第一通信设备接入AP的信息的第二响应消息；若第二通信设备检测到指示拒绝第一通信设备接入AP的操作指令，则向AP发送包括指示拒绝第一通信设备接入AP的信息的第二响应消息。
步骤208，AP根据第二响应消息对第一通信设备进行接入控制。
此处，若第二响应消息包括指示授权第一通信设备接入AP的信息，AP允许第一通信设备接入该AP；若第二响应消息包括指示拒绝第一通信设备接入AP的信息，AP拒绝第一通信设备接入该AP。
从上述步骤201至步骤208可以看出，通过服务器对第一通信设备的身份认证信息进行鉴权，可确定出第一通信设备的身份认证信息是否为真实有效的，即有助于保证接入AP的通信设备的真实性。进一步，通过已被授权接入AP的第二通信设备确定是否授权第一通信设备接入AP，可进一步提高接入该AP的通信设备的安全性。也就是说，AP是在接收到服务器反馈的第一响应消息指示鉴权成功、且收到第二通信设备授权第一通信设备接入该AP后，才允许第一通信设备接入该AP，如此，可提高接入该AP的通信设备的安全性。
本申请中，AP允许第一通信设备接入AP后，第一通信设备可基于四次握手的方式接入AP，参考图3，以WiFi保护访问(WiFi protected acces，WPA)/WPA2-预共享密钥 (pre-shared key，PSK)为例，为本申请提供的一种通信设备接入AP的方法流程示意图。该方法包括如下步骤：
步骤301，AP向第一通信设备发送第一随机数(ANonce)。相应地，第一通信设备接收来自AP的第一随机数(ANonce)。
此处，第一通信设备收到ANonce后，可以根据ANonce生成临时密钥(pairwise transient key，PTK)。
步骤302，第一通信设备向AP发送第二随机数(SNonce)和秘钥确认秘钥(key confirmation key，MIC)。相应地，AP接收来自第一通信设备的SNonce和MIC。
此处，AP将接收到的MIC和生成的MIC进行完整性校验。若校验失败，则握手失败；若校验成功，AP可根据SNonce生成PTK和组临时密钥(group transient key，GTK)。
步骤303，AP向第一通信设备发送GTK和MIC。
此处，由于AP和第一通信设备均已经得到了PTK，因此，AP会对GTK进行密钥加密密钥(key encryption key，KEK)加密。
步骤304，第一通信设备向AP发送确认字符(acknowledge character，ACK)进行确认。
基于上述步骤301至步骤304，四次握手完成，第一通信设备接入了AP。
需要说明的是，图3所示的通信设备接入AP的方法流程仅是示例性的说明，第一通信设备也可以通过其他的方式接入AP，本申请对此不做限定。
如图4所示，为本申请提供的另一种控制通信接入方法的方法流程示意图。该方法包括以下步骤：
步骤400，第二通信设备接入AP。
该步骤400为可选步骤，详细介绍可参见上述步骤200的介绍，此处不再一一赘述。
步骤401，第一通信设备通过AP向服务器发送获取共享密钥的请求消息。相应地，服务器接收来自AP的获取共享密钥的请求消息。
此处，获取共享密钥的请求消息用于请求服务器为第一通信设备生成接入AP的共享密钥信息。该步骤401也可理解为，第一通信设备向AP发送获取共享密钥的请求消息，AP可将该获取共享密钥的请求消息转发至服务器。
在一种可能的实现方式中，获取共享密钥的请求消息包括第一通信设备的ID，比如第一通信设备的MAC地址，再比如，第一通信设备通过特定的应用生成的ID，再比如基于华为系统生成的账号信息，或者其他可以唯一的标识第一通信设备的ID。可以理解的是，第一通信设备选择哪种作为第一通信设备的ID，可以是第一通信设备与服务器预先约定的，也可以是第一通信设备确定后通知服务器的，或者也可以是协议规定的，本申请对此不做限定。
步骤402，服务器响应获取共享密钥的请求消息，生成接入AP的共享密钥信息。
该步骤402为可选步骤。
在一种可能的实现方式中，服务器可根据获取共享密钥的请求消息中包括的第一通信设备的ID生成接入AP的共享密钥信息，共享密钥信息包括接入AP的接入密码。
示例性地，服务器可以采用密钥生成算法，如HMAC-SHA 256算法，对第一通信设备的ID进行计算，生成第一通信设备接入AP的共享密钥信息。
步骤403，服务器向第二通信设备发送第三响应消息。相应地，第二通信设备接收来 自服务器的第三响应消息。
其中，第三响应消息包括接入AP的共享密钥信息。
步骤404，第二通信设备确定允许第一通信设备接入AP时，向第一通信设备提供接入AP的共享密钥信息。
如下，示例性地的提供三种第二通信设备确定是否允许第一通信设备接入AP的实现方式。
实现方式1
第二通信设备获取第一通信设备的标识ID，若第二通信设备确定第一通信设备的ID属于预设白名单中的ID，则向第一通信设备提供共享密钥信息。
实现方式2
若第二通信设备检测到指示授权第一通信设备接入AP的操作指令，则向第一通信设备提供共享密钥信息。示例性地，第二通信设备可在界面授权或拒绝的操作，例如，界面上可显示“授权”和“拒绝”的提示信息按钮。
实现方式3
在第一通信设备和第二通信设备中预置合法的token，在一定时限内，若第二通信设备确定本地预置的token和接收来自第一通信设备的token一直，则确定允许第一通信设备接入AP。
本申请中，第二通信设备可根据接入AP的共享密钥信息，生成二维码或口令，其中，二维码可以是QR码，口令可以是字符串口令。
在一种可能的实现方式中，第二通信设备可以在第二通信设备的界面上显示二维码或者字符串口令。如此，可以便于第一通信设备快速获取到共享密钥信息。另外，若共享密钥信息为口令，当该口令被第一通信设备使用后，即便泄露，其它的通信设备也不能再使用，如此，可进一步提高接入AP的通信设备的安全性。
步骤405，第一通信设备从第二通信设备获取接入AP的共享密钥信息。
若第二通信设备显示的是二维码，第一通信设备可扫描第二通信设备显示的二维码，获得接入AP的共享密钥信息。若第二通信设备显示的是字符串口令，第一通信设备可通过复制字符串口令，获得接入AP的共享密钥信息。
步骤406，第一通信设备通过接入AP的共享密钥信息，接入AP。
此处，AP可从服务器获取到该共享密钥信息。例如，服务器确定出第一通信设备与AP之间的共享密钥信息后，向AP发送该共享密钥信息。当AP和第一通信设备均获取到该共享密钥信息后，第一通信设备可通过该共享密钥信息接入AP。需要说明的是，第一通信设备接入AP的共享密钥信息也是由服务器确定的。
通过上述步骤401至步骤406可以看出，可由第二通信设备确定是否允许第一通信设备接入AP，又由于第二通信设备是已被授权接入AP的通信设备，如此，有助于提高接入该AP中的通信设备的安全性。
需要说明的是，在上述步骤406之前，第二通信设备可向服务器发送第二通信设备所支持的认证策略，服务器可从第二通信设备所支持的认证策略中确定一个为认证策略为第一通信设备和AP之间的认证策略，便于第一通信设备接入AP。其中，认证策略包括WPA，WPA2，WPA3或者其他私有加密认证协议。当然，AP与第一通信设备在之间的认证策略也可以预先约定好的，本申请对此不做限定。
可以理解的是，为了实现上述实施例中功能，通信设备和服务器包括了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该很容易意识到，结合本申请中所公开的实施例描述的各示例的单元及方法步骤，本申请能够以硬件或硬件和计算机软件相结合的形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用场景和设计约束条件。
图5和图6为本申请的提供的可能的AP的结构示意图。这些AP可以用于实现上述方法实施例中AP，因此也能实现上述方法实施例所具备的有益效果。在本申请中，该通信设备可以是如图1所示的AP101，还可以是应用于通信设备或AP的模块(模块如芯片)。
如图5所示，该通信设备500包括处理模块501和收发模块502。通信设备500用于实现上述图2、图3或图4中所示的方法实施例中AP的功能。
当通信设备500用于实现图2所示的方法实施例的AP的功能时：收发模块502用于接收来自第一通信设备的鉴权请求消息，鉴权请求消息携带有第一通信设备的身份认证信息；响应鉴权请求消息，向服务器发送第一通信设备的身份认证信息，使服务器对第一通信设备的身份认证信息进行鉴权；接收来自服务器反馈的第一响应消息，若第一响应消息指示鉴权成功，则向第二通信设备发送授权请求消息，以请求第二通信设备授权第一通信设备接入AP，接收来自第二通信设备响应授权请求消息反馈的第二响应消息，第二通信设备为已被授权接入AP的通信设备；处理模块501用于根据第二响应消息对第一通信设备进行接入控制。
有关上述处理模块501和收发模块502更详细的描述可以参考图2所示的方法实施例中相关描述直接得到，此处不再一一赘述。
应理解，本申请实施例中的处理模块501可以由处理器或处理器相关电路组件实现，收发模块502可以由收发器或收发器相关电路组件实现。
基于上述内容和相同构思，如图6所示，本申请还提供一种AP600。该AP600可包括处理器601和收发器602。处理器601和收发器602之间相互耦合。可以理解的是，收发器602可以为接口电路或输入输出接口。可选地，通信设备600还可包括存储器603，用于存储处理器601执行的指令或存储处理器601运行指令所需要的输入数据或存储处理器601运行指令后产生的数据。
当通信设备600用于实现图2所示的方法时，处理器601用于执行上述处理模块501的功能，收发器602用于执行上述收发模块502的功能，此处不再一一赘述。
图7和图8为本申请的提供的可能的通信设备的结构示意图。这些通信设备可以用于实现上述方法实施例中第一通信设备或第二通信设备的功能，因此也能实现上述方法实施例所具备的有益效果。在本申请中，该通信设备可以是如图1所示的STA102或STA103，还可以是应用于通信设备的模块(模块如芯片)。
如图7所示，该通信设备700包括处理模块701和收发模块702。进一步，可选地，通信设备还可包括显示模块703。通信设备700用于实现上述图2、图3或图4中所示的方法实施例中第一通信设备或第二通信设备的功能。
当通信设备700用于实现图2所示的方法实施例的第二通信设备的功能时：收发模块702用于接收来自接入点AP的授权请求消息，通信设备为已被授权接入AP的通信设备；处理模块701与收发模块702协作，用于响应授权请求消息，向AP发送第二响应消息， 使AP根据第二响应消息对第一通信设备进行接入控制。
有关上述处理模块701和收发模块702更详细的描述可以参考图2所示的方法实施例中相关描述直接得到，此处不再一一赘述。
应理解，本申请实施例中的处理模块701可以由处理器或处理器相关电路组件实现，收发模块702可以由收发器或收发器相关电路组件实现。
当通信设备700用于实现图3所示的方法实施例的第二通信设备的功能时：收发模块702用于接收来自服务器的第三响应消息，第三响应消息包括接入AP的共享密钥信息，通信设备为已被授权接入AP的通信设备；处理模块701用于确定允许第一通信设备接入AP时，向第一通信设备提供接入AP的共享密钥信息。
当通信设备700用于实现图3所示的方法实施例的第一通信设备的功能时：收发模块702用于通过接入点AP向服务器发送获取共享密钥的请求消息，以请求服务器为通信设备生成接入AP的共享密钥信息；处理模块701用于从第二通信设备获取接入AP的共享密钥信息，通过接入AP的共享密钥信息接入AP，第二通信设备为AP已被授权的通信设备。
有关上述处理模块701和收发模块702更详细的描述可以参考图3所示的方法实施例中相关描述直接得到，此处不再一一赘述。
基于上述内容和相同构思，如图8所示，本申请还提供一种通信设备800。该通信设备800可包括处理器801和收发器802。处理器801和收发器802之间相互耦合。可以理解的是，收发器802可以为接口电路或输入输出接口。可选地，通信设备800还可包括存储器803，用于存储处理器801执行的指令或存储处理器801运行指令所需要的输入数据或存储处理器801运行指令后产生的数据。进一步，可选地，通信设备还可包括显示器804。
当通信设备800用于实现图2所示的方法时，处理器801用于执行上述处理模块701的功能，收发器802用于执行上述收发模块702的功能，此处不再一一赘述。
当通信设备为终端设备时，图9示出了一种简化的终端设备的结构示意图。便于理解和图示方便，图9中，终端设备以手机为例。如图9所示，终端设备900包括处理器、存储器、射频电路、天线以及输入输出装置。处理器主要用于对通信协议以及通信数据进行处理，以及对整个终端设备进行控制，执行软件程序，处理软件程序的数据，例如用于支持终端设备900执行上述任一实施例中由终端设备执行的方法。存储器主要用于存储软件程序和数据。射频电路主要用于基带信号与射频信号的转换以及对射频信号的处理。天线主要用于收发电磁波形式的射频信号。输入输出装置，例如触摸屏、显示屏，键盘等主要用于接收用户输入的数据以及对用户输出数据。需要说明的是，有些种类的终端设备可以不具有输入输出装置。
当终端设备开机后，处理器可以读取存储器中的软件程序，解释并执行软件程序的指令，处理软件程序的数据。当需要通过发送数据时，处理器对待发送的数据进行基带处理后，输出基带信号至射频电路，射频电路将基带信号进行射频处理后将射频信号通过天线以电磁波的形式向外发送。当有数据发送到终端设备900时，射频电路通过天线接收到射频信号，将射频信号转换为基带信号，并将基带信号输出至处理器，处理器将基带信号转换为数据并对该数据进行处理。
作为一种可选的实现方式，处理器可以包括基带处理器和中央处理器，基带处理器主 要用于对通信协议以及通信数据进行处理，中央处理器主要用于对整个终端设备900进行控制，执行软件程序，处理软件程序的数据。图9中的处理器集成了基带处理器和中央处理器的功能，需要说明的是，基带处理器和中央处理器也可以是各自独立的处理器，通过总线等技术互联。另外，终端设备可以包括多个基带处理器以适应不同的网络制式，终端设备900可以包括多个中央处理器以增强其处理能力，终端设备900的各个部件可以通过各种总线连接。基带处理器也可以表述为基带处理电路或者基带处理芯片。中央处理器也可以表述为中央处理电路或者中央处理芯片。对通信协议以及通信数据进行处理的功能可以内置在处理器中，也可以以软件程序的形式存储在存储单元中，由处理器执行软件程序以实现基带处理功能。
本申请中，可以将具有收发功能的天线和射频电路视为终端设备的收发单元，将具有处理功能的处理器视为终端设备的处理单元。如图9所示，终端设备包括处理单元901和收发单元902。收发单元也可以称为收发器、收发机、收发装置等，处理单元也可以称为处理器，处理单板，处理单元、处理装置等。可选地，可以将收发单元中用于实现接收功能的器件视为接收单元，将收发单元中用于实现发送功能的器件视为发送单元，即收发单元包括接收单元和发送单元示例性的，接收单元也可以称为接收机、接收器、接收电路等，发送单元可以称为发射机、发射器或者发射电路等。
在下行链路上，通过天线接收网络设备发送的下行链路信号(包括数据和/或控制信息)，在上行链路上，通过天线向网络设备或其它终端设备发送上行链路信号(包括数据和/或控制信息)，在处理器中，对业务数据和信令消息进行处理，这些单元根据无线接入网采用的无线接入技术(例如，LTE、NR及其他演进系统的接入技术)来进行处理。处理器还用于对终端设备的动作进行控制管理，用于执行上述实施例中由终端设备进行的处理。处理器还用于支持终端设备执行图2中涉及的第一通信设备或第二通信设备的执行方法；或者还用于支持终端设备执行图3涉及的第一通信设备或第二通信设备的执行方法。
需要说明的是，图9仅示出了一个存储器、一个处理器和一个天线。在实际的终端设备中，终端设备可以包含任意数量的天线，存储器，处理器等。其中，存储器也可以称为存储介质或者存储设备等。另外，存储器可以是独立于处理器设置，也可以是与处理器集成在一起，本申请实施例对此不做限制。
应理解，收发单元902用于执行上述图2所示的方法实施例中第一通信设备或第二通信设备侧的发送操作和接收操作，处理单元901用于执行上述图2所示的方法实施例中第一通信设备侧或第二通信设备侧除了收发操作之外的其他操作。例如，收发单元902用于执行图2所示的实施例中的第二通信设备侧的收发步骤，例如步骤205、步骤209；或者用于执行第一通信设备侧的收发步骤，例如步骤201、步骤206。处理单元901，用于执行图2所示的实施例中的第一通信设备或第二通信设备除了收发操作之外的其他操作。
再比如，收发单元902用于执行图4所示的实施例中的第二通信设备侧的收发步骤，例如步骤404；或者用于执行第一通信设备侧的收发步骤，例如步骤405。处理单元901，用于执行图4所示的实施例中的第一通信设备或第二通信设备侧除了收发操作之外的其他操作。
当该通信设备为芯片类的装置或者电路时，该通信设备可包括收发模块和处理模块。其中，收发模块可以是输入输出电路和/或接口电路；处理模块可为该芯片上集成的处理器或者微处理器或者集成电路。
可以理解的是，本申请的实施例中的处理器可以是中央处理单元(Central Processing Unit，CPU)，还可以是其它通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列(Field Programmable Gate Array，FPGA)或者其它可编程逻辑器件、晶体管逻辑器件，硬件部件或者其任意组合。通用处理器可以是微处理器，也可以是任何常规的处理器。
本申请的实施例中的方法步骤可以通过硬件的方式来实现，也可以由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于随机存取存储器(Random Access Memory，RAM)、闪存、只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)、寄存器、硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于网络设备或终端设备中。当然，处理器和存储介质也可以作为分立组件存在于网络设备或终端设备中。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。计算机程序产品包括一个或多个计算机程序或指令。在计算机上加载和执行计算机程序或指令时，全部或部分地执行本申请实施例的流程或功能。计算机可以是通用计算机、专用计算机、计算机网络、网络设备、用户设备或者其它可编程装置。计算机程序或指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，计算机程序或指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。计算机可读存储介质可以是计算机能够存取的任何可用介质或者是集成一个或多个可用介质的服务器、数据中心等数据存储设备。可用介质可以是磁性介质，例如，软盘、硬盘、磁带；也可以是光介质，例如，数字视频光盘(digital video disc，DVD)；还可以是半导体介质，例如，固态硬盘(solid state drive，SSD)。
在本申请的各个实施例中，如果没有特殊说明以及逻辑冲突，不同的实施例之间的术语和/或描述具有一致性、且可以相互引用，不同的实施例中的技术特征根据其内在的逻辑关系可以组合形成新的实施例。
本申请中，“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况，其中A，B可以是单数或者复数。在本申请的文字描述中，字符“/”，一般表示前后关联对象是一种“或”的关系。
可以理解的是，在本申请的实施例中涉及的各种数字编号仅为描述方便进行的区分，并不用来限制本申请的实施例的范围。上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定。术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。此外，术语“包括”和“具有”以 及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元。方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的保护范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (34)

  1. 一种控制通信接入的方法，其特征在于，包括：
    接入点AP接收来自第一通信设备的鉴权请求消息，所述鉴权请求消息携带有所述第一通信设备的身份认证信息；
    所述AP响应所述鉴权请求消息，向服务器发送所述身份认证信息，使所述服务器根据所述身份认证信息对所述第一通信设备进行鉴权；
    所述AP接收所述服务器反馈的第一响应消息；
    若所述第一响应消息指示鉴权成功，则向第二通信设备发送授权请求消息，以请求所述第二通信设备授权所述第一通信设备接入所述AP，所述第二通信设备为已被授权接入所述AP的通信设备；
    所述AP接收所述第二通信设备响应所述授权请求消息反馈的第二响应消息，并根据所述第二响应消息对所述第一通信设备进行接入控制。
  2. 如权利要求1所述的方法，其特征在于，所述身份认证信息包括全球用户识别卡USIM的信息或第一通信设备的标识ID。
  3. 如权利要求1或2所述的方法，其特征在于，所述方法还包括：
    若所述第一响应消息指示鉴权失败，则所述AP拒绝所述第一通信设备接入。
  4. 如权利要求1或2所述的方法，其特征在于，所述第二响应消息包括指示授权所述第一通信设备接入所述AP的信息、或指示拒绝所述第一通信设备接入所述AP的信息；
    所述AP根据所述第二响应消息对所述第一通信设备进行接入控制，包括：
    若所述第二响应消息包括指示授权所述第一通信设备接入所述AP的信息，所述AP允许所述第一通信设备接入；
    若所述第二响应消息包括指示拒绝所述第一通信设备接入所述AP的信息，所述AP拒绝所述第一通信设备接入。
  5. 一种控制通信接入的方法，其特征在于，包括：
    第二通信设备接收来自接入点AP的授权请求消息，所述第二通信设备为已被授权接入所述AP的通信设备；
    所述第二通信设备响应所述授权请求消息，向所述AP发送第二响应消息，使所述AP根据所述第二响应消息对所述第一通信设备进行接入控制。
  6. 如权利要求5所述的方法，其特征在于，所述授权请求消息包括所述第一通信设备的标识ID；
    所述第二通信设备响应所述授权请求消息，向所述AP发送第二响应消息，包括：
    若所述第二通信设备确定所述第一通信设备的ID属于预设白名单中的ID，则向所述AP发送包括指示授权所述第一通信设备接入所述AP的信息的第二响应消息；
    若所述第二通信设备确定所述第一通信设备的ID属于预设黑名单中的ID，则向所述AP发送包括指示拒绝所述第一通信设备接入所述AP的信息的第二响应消息。
  7. 如权利要求5所述的方法，其特征在于，所述第二通信设备响应所述授权请求消息，向所述AP发送第二响应消息，包括：
    若所述第二通信设备检测到指示授权所述第一通信设备接入所述AP的操作指令，则向所述AP发送包括指示授权所述第一通信设备接入所述AP的信息的第二响应消息；
    若所述第二通信设备检测到指示拒绝所述第一通信设备接入所述AP的操作指令，则向所述AP发送包括指示拒绝所述第一通信设备接入所述AP的信息的第二响应消息。
  8. 一种控制通信接入的方法，其特征在于，包括：
    第二通信设备接收来自服务器的第三响应消息，所述第三响应消息包括接入接入点AP的共享密钥信息，所述第二通信设备为已被授权接入所述AP的通信设备；
    所述第二通信设备确定允许第一通信设备接入所述AP时，向所述第一通信设备提供所述共享密钥信息。
  9. 如权利要求8所述的方法，其特征在于，所述第二通信设备向所述第一通信设备提供所述共享密钥信息，包括：
    所述第二通信设备根据所述共享密钥信息生成二维码或者口令；
    所述第二通信设备向所述第一通信设备显示所述二维码或者所述口令。
  10. 如权利要求8或9所述的方法，其特征在于，所述第二通信设备确定允许第一通信设备接入所述AP，包括：
    所述第二通信设备获取所述第一通信设备的标识ID；
    若所述第二通信设备确定所述第一通信设备的ID属于预设白名单中的ID，则向所述第一通信设备提供所述共享密钥信息。
  11. 如权利要求8或9所述的方法，其特征在于，所述第二通信设备确定允许第一通信设备接入所述AP，包括：
    若所述第二通信设备检测到指示授权所述第一通信设备接入所述AP的操作指令，则向所述第一通信设备提供所述共享密钥信息。
  12. 一种控制通信接入的方法，其特征在于，包括：
    第一通信设备通过接入点AP向服务器发送获取共享密钥的请求消息，以请求所述服务器为所述第一通信设备生成接入所述AP的共享密钥信息；
    所述第一通信设备从第二通信设备获取所述共享密钥信息，所述第二通信设备为已被授权接入所述AP的通信设备；
    所述第一通信设备通过所述共享密钥信息，接入所述AP。
  13. 如权利要求12所述的方法，其特征在于，所述第一通信设备从第二通信设备获取共享密钥信息，包括：
    所述第一通信设备通过扫描所述第二通信设备提供的二维码，获取所述共享密钥信息；或者，
    所述第一通信设备通过复制所述第二通信设备提供的口令，获取所述共享密钥信息。
  14. 如权利要求12或13所述的方法，其特征在于，所述获取共享密钥的请求消息包括所述第一通信设备的标识ID。
  15. 一种接入点AP，其特征在于，包括收发模块和处理模块：
    所述收发模块，用于接收来自第一通信设备的鉴权请求消息，所述鉴权请求消息携带有所述第一通信设备的身份认证信息；响应所述鉴权请求消息，向服务器发送所述身份认证信息，使所述服务器根据所述身份认证信息对所述第一通信设备进行鉴权；接收所述服务器反馈的第一响应消息；若所述第一响应消息指示鉴权成功，则向第二通信设备发送授权请求消息，以请求所述第二通信设备授权所述第一通信设备接入所述AP，所述第二通信设备为已被授权接入所述AP的通信设备；接收来自所述第二通信设备响应所述授权请 求消息反馈的第二响应消息；
    所述处理模块，用于根据所述第二响应消息对所述第一通信设备进行接入控制。
  16. 如权利要求15所述的AP，其特征在于，所述身份认证信息包括全球用户识别卡USIM的信息或第一通信设备的标识ID。
  17. 如权利要求15或16所述的AP，其特征在于，若所述第一响应消息指示鉴权失败，所述处理模块还用于拒绝所述第一通信设备接入。
  18. 如权利要求15或16所述的AP，其特征在于，所述第二响应消息包括指示授权所述第一通信设备接入所述AP的信息、或指示拒绝所述第一通信设备接入所述AP的信息；
    若所述第二响应消息包括指示授权所述第一通信设备接入所述AP的信息，所述处理模块，具体用于：允许所述第一通信设备接入；
    若所述第二响应消息包括指示拒绝所述第一通信设备接入所述AP的信息，所述处理模块，具体用于：拒绝所述第一通信设备接入。
  19. 一种通信设备，其特征在于，包括收发模块和处理模块：
    所述收发模块，用于接收来自接入点AP的授权请求消息，所述通信设备为已被授权接入所述AP的通信设备；
    所述收发模块与所述处理模块协作，用于响应所述授权请求消息，向所述AP发送第二响应消息，使所述AP根据所述第二响应消息对所述第一通信设备进行接入控制。
  20. 如权利要求19所述的通信设备，其特征在于，所述授权请求消息包括第一通信设备的标识ID；
    所述处理模块与所述收发模块协作，具体用于：
    若所述处理模块确定所述第一通信设备的ID属于预设白名单中的ID，则所述收发模块向所述AP发送包括指示授权所述第一通信设备接入所述AP的信息的第二响应消息；
    若所述处理模块确定所述第一通信设备的ID属于预设黑名单中的ID，则所述收发模块向所述AP发送包括指示拒绝所述第一通信设备接入所述AP的信息的第二响应消息。
  21. 如权利要求19所述的通信设备，其特征在于，
    所述处理模块与所述收发模块协作，具体用于：
    若所述处理模块检测到指示授权所述第一通信设备接入所述AP的操作指令，则所述收发模块向所述AP发送包括指示授权所述第一通信设备接入所述AP的信息的第二响应消息；
    若所述处理模块检测到指示拒绝所述第一通信设备接入所述AP的操作指令，则所述收发模块向所述AP发送包括指示拒绝所述第一通信设备接入所述AP的信息的第二响应消息。
  22. 一种通信设备，其特征在于，包括收发模块和处理模块：
    所述收发模块，用于接收来自服务器的第三响应消息，所述第三响应消息包括接入接入点AP的共享密钥信息，所述通信设备为已被授权接入所述AP的通信设备；
    所述处理模块，用于在确定允许第一通信设备接入所述AP时，向所述第一通信设备提供所述共享密钥信息。
  23. 如权利要求22所述的通信设备，其特征在于，所述处理模块，具体用于：
    根据所述共享密钥信息生成二维码或者口令；
    所述通信设备还包括显示模块，所述显示模块用于：
    向所述第一通信设备显示所述二维码或者所述口令。
  24. 如权利要求22或23所述的通信设备，其特征在于，所述处理模块，具体用于：
    获取所述第一通信设备的标识ID；
    若确定所述第一通信设备的ID属于预设白名单中的ID，则向所述第一通信设备提供所述共享密钥信息。
  25. 如权利要求22或23所述的通信设备，其特征在于，所述处理模块，具体用于：
    若检测到指示授权所述第一通信设备接入所述AP的操作指令，则向所述第一通信设备提供所述共享密钥信息。
  26. 一种通信设备，其特征在于，包括收发模块和处理模块：
    所述收发模块，用于通过接入点AP向服务器发送获取共享密钥的请求消息，以请求所述服务器为所述通信设备生成接入所述AP的共享密钥信息；
    所述处理模块，用于从第二通信设备获取所述共享密钥信息，通过所述共享密钥信息，接入所述AP，所述第二通信设备为已被授权接入所述AP的通信设备。
  27. 如权利要求26所述的通信设备，其特征在于，所述处理模块，具体用于：
    通过扫描所述第二通信设备提供的二维码，获取所述共享密钥信息；或者，
    通过复制所述第二通信设备提供的口令，获取所述共享密钥信息。
  28. 如权利要求26或27所述的通信设备，其特征在于，所述获取共享密钥的请求消息包括所述通信设备的标识ID。
  29. 一种接入点AP，其特征在于，包括处理器和收发器，所述收发器用于接收来自所述通信装置之外的其它通信装置的信号并传输至所述处理器或将来自所述处理器的信号发送给所述通信装置之外的其它通信装置，所述处理器通过逻辑电路或执行代码指令用于实现如权利要求1至4中任一项所述的方法。
  30. 一种通信设备，其特征在于，包括处理器和收发器，所述收发器用于接收来自所述通信装置之外的其它通信装置的信号并传输至所述处理器或将来自所述处理器的信号发送给所述通信装置之外的其它通信装置，所述处理器通过逻辑电路或执行代码指令用于实现如权利要求5至7中任一项、或8至11中任一项、或12至14中任一项所述的方法。
  31. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序或指令，当所述计算机程序或指令被接入点AP执行时，实现如权利要求1至4中任一项所述的方法。
  32. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序或指令，当所述计算机程序或指令被通信设备执行时，实现如权利要求5至7中任一项、或8至11中任一项、或12至14任一项所述的方法。
  33. 一种计算机程序产品，其特征在于，所述计算机程序产品包括计算机程序或指令，当所述计算机程序或指令被接入点AP执行时，实现如权利要求1至4中任一项所述的方法。
  34. 一种计算机程序产品，其特征在于，所述计算机程序产品包括计算机程序或指令，当所述计算机程序或指令被通信设备执行时，实现如权利要求5至7中任一项、或8至11中任一项、或12至14中任一项所述的方法。
PCT/CN2019/130176 2019-12-30 2019-12-30 一种控制通信接入的方法、ap及通信设备 WO2021134344A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN201980102414.6A CN114731513A (zh) 2019-12-30 2019-12-30 一种控制通信接入的方法、ap及通信设备
PCT/CN2019/130176 WO2021134344A1 (zh) 2019-12-30 2019-12-30 一种控制通信接入的方法、ap及通信设备

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2019/130176 WO2021134344A1 (zh) 2019-12-30 2019-12-30 一种控制通信接入的方法、ap及通信设备

Publications (1)

Publication Number Publication Date
WO2021134344A1 true WO2021134344A1 (zh) 2021-07-08

Family

ID=76686168

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/130176 WO2021134344A1 (zh) 2019-12-30 2019-12-30 一种控制通信接入的方法、ap及通信设备

Country Status (2)

Country Link
CN (1) CN114731513A (zh)
WO (1) WO2021134344A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024007239A1 (en) * 2022-07-07 2024-01-11 Qualcomm Incorporated Preventing attacks in a mixed wpa2 and wpa3 environment

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100153710A1 (en) * 2008-12-16 2010-06-17 Jeong Young Ho Method of preventing unauthenticated viewing using unique information of secure micro
CN103929748A (zh) * 2014-04-30 2014-07-16 普联技术有限公司 一种物联网无线终端及其配置方法和无线网络接入点
CN105307169A (zh) * 2015-09-18 2016-02-03 腾讯科技（深圳）有限公司 访客网络的接入方法、装置和系统
CN109756915A (zh) * 2017-11-03 2019-05-14 阿里巴巴集团控股有限公司 一种无线网络管理方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100153710A1 (en) * 2008-12-16 2010-06-17 Jeong Young Ho Method of preventing unauthenticated viewing using unique information of secure micro
CN103929748A (zh) * 2014-04-30 2014-07-16 普联技术有限公司 一种物联网无线终端及其配置方法和无线网络接入点
CN105307169A (zh) * 2015-09-18 2016-02-03 腾讯科技（深圳）有限公司 访客网络的接入方法、装置和系统
CN109756915A (zh) * 2017-11-03 2019-05-14 阿里巴巴集团控股有限公司 一种无线网络管理方法及系统

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2024007239A1 (en) * 2022-07-07 2024-01-11 Qualcomm Incorporated Preventing attacks in a mixed wpa2 and wpa3 environment

Also Published As

Publication number Publication date
CN114731513A (zh) 2022-07-08

Similar Documents

Publication Publication Date Title
US10412083B2 (en) Dynamically generated SSID
EP2900006B1 (en) Method and system for securely accessing portable hotspot of smart phones
US9451460B2 (en) Method and apparatus for associating station (STA) with access point (AP)
CN107425961B (zh) 执行链路建立和认证的系统和方法
TWI388180B (zh) 通信系統中之金鑰產生
WO2021155758A1 (zh) 密钥获取方法及装置
WO2017049461A1 (zh) 用户设备ue的接入方法、设备及系统
US20170339626A1 (en) Method, apparatus and system
CN103139768A (zh) 融合无线网络中的认证方法以及认证装置
US10645572B2 (en) Method for generating a common identifier for a wireless device in at least two different types of networks
US9693332B2 (en) Identification of a wireless device in a wireless communication environment
WO2022028259A1 (zh) 用户签约数据的获取方法及装置
CN103096307A (zh) 密钥验证方法及装置
JP6651613B2 (ja) ワイヤレス通信
KILINÇER et al. Automated fake access point attack detection and prevention system with IoT devices
WO2021134344A1 (zh) 一种控制通信接入的方法、ap及通信设备
US11343244B2 (en) Method and apparatus for multi-factor verification of a computing device location within a preset geographic area
CN111526514B (zh) 多频段通信的方法和装置
CN111465007B (zh) 一种认证方法、装置和系统
WO2022253298A1 (zh) 传输系统消息的方法和装置
WO2023155721A1 (zh) 检测伪基站的方法和装置
US20240073690A1 (en) Transmission of network access information for wireless device
CN117242811A (zh) 无线通信的方法、站点设备和接入点设备
Sun A Study of Wireless Network Security

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19958508

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19958508

Country of ref document: EP

Kind code of ref document: A1